Privacy Policy

Who We Are

Bucklayer is an international handcrafted leather goods brand, operated from Calcutta Leather Complex, Bantalla, Kolkata, West Bengal 700150, India. Bucklayer is the data controller for the information described below. This policy explains what personal information the Bucklayer website (bucklayer.com) collects, why we collect it, who we share it with, how we protect it, how long we keep it, and how you can have it deleted.

For any privacy question or request, contact us at info@bucklayer.com or +91 9123767366.

What Information We Collect

When you browse bucklayer.com, create an account, or place an order, we may collect:

• •Identity and contact details — your name, email address, and phone number
• •Delivery details — your full shipping address, and billing address where it differs
• •Order data — the items you buy, sizes, order history, and your correspondence with our team
• •Payment data — handled entirely by our payment providers. We receive a confirmation, an amount, and a transaction reference; we never see or store your full card number, CVV, or bank credentials
• •Account data — your email address and a salted hash of your password, or, if you use Sign in with Google, the basic Google profile described in the next section
• •Technical data — IP address, browser and device type, and pages viewed, collected through cookies and analytics

Signing In With Google (Google User Data)

Sign in with Google is an optional way to create and access your Bucklayer account. If you choose it, Google shares a limited profile with us. We request only the basic sign-in scopes and nothing more:

• •Your name — from the Google 'profile' scope
• •Your email address — from the Google 'email' scope
• •Your Google profile picture and Google account identifier — from the Google 'profile' scope

We use this data for one purpose only: to create your Bucklayer account, sign you in securely, and display your name and email in your account area, your order confirmations, and your shipping notifications. We do not request, read, store, or process your Gmail messages, Google Contacts, Google Calendar, Google Drive files, or any other Google service data, and we never ask for those permissions.

You can disconnect Bucklayer from your Google Account at any time at myaccount.google.com/permissions. Doing so stops future Google sign-ins; to also delete the profile data we already hold, email info@bucklayer.com.

Limited Use of Google User Data

Bucklayer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• •We never sell Google user data, and we never transfer it to data brokers or information resellers
• •We never use Google user data for advertising, retargeting, or personalised or targeted ads of any kind
• •We never use Google user data to develop, train, improve, or fine-tune generalised artificial intelligence or machine learning models
• •We never use Google user data to determine creditworthiness or for lending, insurance, or similar decisions
• •We never transfer Google user data to third parties except as strictly necessary to operate the sign-in feature itself (our authentication provider, Supabase), to comply with applicable law, or as part of a merger or acquisition, in which case we would notify affected users first
• •No human at Bucklayer reads your Google user data, except with your explicit permission when you ask us for support, where it is necessary for security purposes such as investigating abuse, or where we are legally required to do so

How We Use Your Information

We use your personal data only for the purposes below, each with a lawful basis:

• •To produce, pack, and deliver the order you placed — necessary to perform our contract with you
• •To send order confirmations, production updates, shipping notifications, and tracking links — necessary to perform our contract with you
• •To create and secure your account and sign you in — necessary to perform our contract with you
• •To respond to your enquiries and provide customer support — our legitimate interest in serving our customers
• •To prevent fraud, handle chargebacks, and keep accounting and tax records — our legitimate interest and our legal obligations
• •To measure and improve the performance of our website — our legitimate interest, using aggregated and anonymised data wherever possible
• •To send marketing emails — only where you have opted in, and you can unsubscribe from every message we send

Who We Share Your Data With

We do not sell your personal data, and we do not share it for advertising. We share the minimum necessary with service providers who process it on our behalf under contract:

• •Payment providers — PayPal and Wise, to collect and verify payment for your order
• •Shipping carriers and customs brokers — who receive your name, delivery address, and phone number solely in order to deliver your parcel and clear it through customs
• •Authentication and database hosting — Supabase, which stores your account record and processes your sign-in, including Google sign-in
• •Website hosting and image delivery — Vercel, which hosts bucklayer.com, and ImageKit, which serves product imagery
• •Email delivery — Resend, which sends your order, shipping, and account emails on our behalf

We may also disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise, or defend legal claims.

How We Protect Your Information

All traffic to and from bucklayer.com is encrypted in transit using HTTPS/TLS. Account and order data is held in an encrypted, access-controlled database, and passwords are stored only as salted hashes, which means we cannot read them. Full payment card numbers never reach our servers — they are captured and processed directly by our PCI-compliant payment providers. Inside Bucklayer, access to customer data is restricted to the small number of staff who need it to fulfil orders and provide support, and administrative access requires authentication.

How Long We Keep Your Data

We keep personal data only as long as we need it for the purpose it was collected:

• •Account data, including any Google sign-in profile — kept while your account is open, and deleted within 30 days of you closing it or asking us to delete it
• •Order, invoice, and delivery records — retained for as long as applicable tax, customs, and accounting law requires, generally up to 8 years, after which they are deleted
• •Customer support correspondence — kept for up to 24 months from your last message to us
• •Marketing contact details — kept until you unsubscribe, after which your address is suppressed so we do not contact you again
• •Cookie and analytics data — retained in aggregated form for up to 14 months

Your Rights and How to Delete Your Data

You can ask us at any time to access a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict or object to how we process it, withdraw a consent you previously gave, or receive your data in a portable machine-readable format.

To make a request, email info@bucklayer.com from the address on your account with the subject line 'Data Request'. We acknowledge every request within 5 business days and complete it within 30 days, free of charge. If you signed in with Google, deletion removes the Google profile data we hold alongside the rest of your account; you can additionally revoke Bucklayer's access from your Google Account at myaccount.google.com/permissions.

Cookies and Analytics

We use strictly necessary cookies to keep you signed in and to remember the contents of your cart, and analytics cookies to understand how the site is used so we can improve it. You can block or clear cookies at any time through your browser settings, though doing so may prevent checkout and sign-in from working. We do not use Google user data, or any data obtained through Sign in with Google, for advertising or profiling.

International Transfers

Bucklayer operates from India and ships worldwide, so your personal data may be processed in India, the European Union, and the United States by the service providers listed above. Where data leaves your region, we rely on appropriate safeguards, including standard contractual clauses with our providers, to keep it protected to the standard described in this policy.

Children's Privacy

Bucklayer is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email info@bucklayer.com and we will delete it.

Changes to This Policy

We may update this policy from time to time. The current version is always published on this page, with the effective date shown at the top. If we make a material change to how we handle your data, including any change to how we use Google user data, we will notify account holders by email before it takes effect.

Contact Us

Bucklayer, Calcutta Leather Complex, Bantalla, Kolkata, West Bengal 700150, India. Email info@bucklayer.com or call +91 9123767366. We respond to privacy enquiries within 5 business days.