Privacy, explained
without small print.

This policy applies to visitors, registered buyers, applicant and approved sellers, administrators and people who contact Curio. In Indian data-protection terminology, Curio acts as the data fiduciary for personal data it determines how and why to process.

Where another country's mandatory privacy law gives you additional rights, those rights are preserved. This policy does not reduce rights that cannot lawfully be waived.

Information you provide

• Account and profile details, including name, email, password hash, phone, locale, preferences and currency.
• Delivery addresses, recipient details and order support information.
• Seller applications, business details, identity-verification documents, public store information and listing media.
• Private seller inquiries, replies, contact-form information, cancellation or return requests, and other support communications.
• Order details and payment-safe metadata such as payment status, provider reference, card brand and last four digits.

Information collected automatically

• Session identifiers, IP address, user agent, sign-in activity and security records.
• Essential browser storage, including the guest cart held in local storage before sign-in.
• Technical request, error and audit information needed to secure and operate the service.

• Create and secure accounts, authenticate sessions and provide buyer, seller and administrator workspaces.
• Review seller identity and applications, moderate listings and maintain marketplace integrity.
• Calculate cart quotes, process orders, coordinate seller fulfilment, delivery, returns, refunds and support.
• Enable private buyer-seller inquiry threads and essential order or account notifications.
• Prevent fraud, misuse and security incidents; keep legally required records; establish or defend claims.
• Improve usability and reliability using appropriately limited operational information.

We rely on consent where applicable, performance of requested services or contracts, compliance with law, and legitimate operational interests that do not override applicable rights. You may withdraw consent where processing depends on it, without affecting processing already lawfully completed.

Curio uses an essential session cookie to keep signed-in users authenticated. A guest cart is stored locally in the browser and merged into a buyer cart after sign-in. These mechanisms are necessary for requested service functionality.

If analytics, advertising or non-essential cookies are introduced, Curio will update this policy and provide any consent controls required by applicable law before using them.

• With the relevant seller or buyer to fulfil an order, answer a private inquiry or resolve a transaction issue.
• With delivery, hosting, communications, security, professional-adviser and future payment-processing providers under appropriate obligations.
• With regulators, courts, law-enforcement or other authorities where disclosure is legally required or necessary to protect rights and safety.
• With a successor in a merger, restructuring or sale, subject to lawful notice and safeguards.

Curio does not sell personal data. Seller identity documents are private and available only to authorised administrators for review; they are not public catalogue assets.

Buyers, sellers and technical providers may be located in different countries. Information may therefore be processed outside your country. Curio will use contractual, organisational and technical safeguards required by applicable law and will assess transfer restrictions before appointing production providers.

We keep personal data only as long as needed for the purpose collected, legal obligations, fraud prevention, tax or accounting records, dispute handling and enforcement. Account records generally remain while an account is active; order and transaction records may be retained for applicable statutory periods; unsuccessful seller identity material should be removed when no longer needed for review or legal defence.

Curio uses password hashing, session expiry, role-based access, private upload storage, transaction boundaries, audit records and limited payment metadata. No service can promise absolute security; suspected incidents should be reported promptly to [email protected].

• Request information about personal data and processing activities, subject to applicable law.
• Request correction, completion or updating of inaccurate data.
• Request erasure where retention is no longer lawful or necessary.
• Withdraw consent where consent is the basis for processing.
• Manage communication preferences and essential account information in your account.
• Raise a grievance, nominate another person where Indian law provides that right, and complain to the competent data-protection or consumer authority.

We may verify identity before acting and may retain information where law, security, a transaction, dispute or another person's rights require it. Requests may be sent to [email protected].

Curio is intended for adults able to enter binding transactions. We do not knowingly invite children to create marketplace accounts. If child data is identified, contact us so it can be reviewed under applicable Indian and local requirements.

Links to sellers, carriers or other websites are governed by their own policies. Curio is not responsible for independent third-party privacy practices.

Questions and privacy requests: [email protected]. General support: [email protected]. Order support: [email protected].

Material changes will be dated and, where required, notified through the service or email. The final production policy must identify Curio's registered Indian operator, address and grievance officer.