LAUNCH PRICING · REV 01
/
ENDS IN 71:59:23
/
FREE SHIPPING OVER ₹499 · COD · 7-DAY RETURNS
This policy explains what we collect when you buy from mtheory.in, why we collect it, who we share it with, and what you can ask us to do about it. We have tried to write it in plain language rather than boilerplate.
mtheory.in is operated by M Theory Personal Care Pvt. Ltd., registered at [STREET ADDRESS], Andheri East, Mumbai 400069, Maharashtra, India. CIN [CIN]. GSTIN [GSTIN].
In the language of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below — meaning we decide why and how it is processed, and we are answerable for it.
Only what an order actually needs, plus what your browser tells us.
We do not collect your card number, CVV, UPI PIN or bank credentials. Those go straight to the payment gateway and never touch our servers. See section 5.
We do not ask for health information. If you volunteer something about your skin in a message to us, we use it only to answer you.
Each purpose is separate, and we do not quietly reuse data collected for one thing to do another:
We process your personal data on the basis of the consent you give when you place an order, create an account or opt in to marketing. That consent has to be a positive action on your part — a box you tick yourself, a button you press. We do not use pre-ticked boxes.
You can withdraw consent at any time by writing to the address in section 13. Withdrawing it is as easy as giving it. Note that we may still need to keep certain records to meet legal obligations — see section 8 — and withdrawing consent does not undo processing we already carried out lawfully.
Payments are handled by a licensed third-party payment gateway. When you pay, you are passed to their secure environment. They collect and process your card, UPI or net banking details under their own privacy policy and their PCI-DSS obligations.
All we receive back is whether the payment succeeded, a transaction reference, and the method used. We never see or store your full card number, CVV or UPI PIN.
If you choose cash on delivery, no payment details reach us at all — you pay the courier.
We do not sell your personal data. We share it only where an order cannot happen without it:
Some of these providers may process data on servers outside India. Where they do, we transfer it only in line with what Indian law permits.
Cookies are small files a site stores in your browser. We use two kinds.
Necessary cookies keep your cart and your session working. The site cannot function without them, so they are always on.
Analytics cookies tell us which pages people read and where they leave. These only run if you accept them. You can change your mind at any time through the cookie settings on the site, and you can clear or block cookies in your browser — though blocking the necessary ones will break checkout.
We keep personal data only as long as the purpose it was collected for requires:
When a retention period ends, we delete the data or irreversibly anonymise it.
The site runs over HTTPS. Access to order data is restricted to the people who need it to do their job. We keep our platform and plugins patched, and we work with payment and logistics providers who carry their own security obligations.
No system is perfectly secure, and we will not pretend otherwise. If a personal data breach affects you, we will notify you and the Data Protection Board of India within the timeframe the law requires — currently 72 hours of becoming aware of it.
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
Write to us at the address in section 13 and we will respond within the period the law allows. We may need to verify who you are first. If you are not satisfied with how we handle it, you can escalate to the Data Protection Board of India.
Our products and this site are meant for adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or guardian, and we do not track children or serve them advertising.
If you believe a child has given us personal data, write to us and we will delete it.
We update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you directly rather than relying on you to re-read this page.
If you have a question about this policy, want to exercise a right, or want to complain about how we have handled your data, contact our Grievance Officer. We acknowledge every complaint within 48 hours and aim to resolve it within one month.
The starter kit is the whole routine in travel sizes — and the ₹599 comes back as credit on your first full-size order.