Privacy Policy

The short version

The Cinema Chair is a personal publication, not a business with a customer database. There is no newsletter, no advertising, and nothing is sold through this website. The only personal information collected is what you type into the contact form or a shop enquiry, and it is used to reply to you.

You do not need an account to read anything or to buy anything. The sign-in exists only so the shop owner can manage the shop.

Analytics run only if you accept cookies, and they are anonymous.

Who runs this site

This site is operated by Rohan Mehindrakar, an individual based in India, publishing at thecinemachair.in.

For anything in this policy, including a request to see or delete your data, write to contact@thecinemachair.in or use the contact form.

What is collected

When you send a message. The form asks for your name, your email address, a topic, and your message. You must tick a consent box before it will send. All four fields, and the fact that you consented, are emailed to the site owner. Nothing is written to a database.

When you send a shop enquiry. Asking about a product sends your name, email, the product, quantity, any size chosen, any coupon code and your note. It is emailed, exactly like the contact form. No order record is created, because there is no checkout: the shop is a catalogue and nothing is paid for on this site.

If you sign in. Signing in with Google is only for administering the shop. Google tells this site your name, email address and profile picture, and nothing else: not your contacts, your other Google data, or your password. Your session is held in your own browser's local storage, not in a cookie, and signing out clears it. If you are not the shop's administrator there is no reason to sign in and nothing behind it for you.

When you accept cookies. One cookie named tcc_consent records your choice so the banner does not reappear. Accepting also enables Vercel Web Analytics, which counts page views and referrers without cookies and without building a profile of you. Declining means it never loads.

Automatically, by the host. Vercel keeps short-lived server logs that include IP addresses, as any web host does. The contact endpoint also holds your IP in memory for sixty seconds to stop the form being flooded. That value is never written to disk, never included in the email, and disappears when the window closes.

What is not collected

• No password is ever created, stored or seen by this site: sign-in is handled entirely by Google
• No shopper accounts. Browsing and enquiring need no account at all
• No payment or financial information
• No advertising or cross-site tracking cookies
• No social media pixels or embedded trackers
• No location data beyond whatever a routine server log implies
• No sensitive personal data, and none is asked for

Your information is never sold, rented, or handed to anyone for marketing.

Who else handles it

To run the site at all, a few processors necessarily see data in transit:

• Vercel Inc. hosts the site and runs the contact endpoint. Primary region is Mumbai, but Vercel is a US company and traffic may route through infrastructure outside India.
• Resend delivers the contact email.
• Google receives your message once it lands in the owner's Gmail inbox, and handles the sign-in if you use it.
• Supabase stores the shop's products, coupons and product images, and issues the sign-in session. Shop enquiries are not stored there.
• Google Fonts serves the typefaces. Your browser requests them from Google's servers, which means Google receives your IP address on every page load. This happens whether or not you accept cookies, because it is not a cookie. See the cookie policy.

Each of these has its own privacy terms, and this site cannot control them.

How long it is kept

Messages stay in the owner's email account for as long as they are useful, and are deleted on request. The consent cookie lasts a year, or until you clear it. Host logs follow the host's own retention. Analytics data is aggregate and not tied to you.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask what personal data is held about you, ask for it to be corrected, ask for it to be erased, and complain about how it is handled. If you are in the UK or the EU, the UK GDPR and GDPR give you comparable rights, including data portability and the right to object.

The lawful basis here is straightforward: you chose to send a message, and you ticked a box saying so. You can withdraw that at any time by asking for the message to be deleted. Withdrawing does not undo a reply already sent.

To exercise any of this, write to contact@thecinemachair.in. Expect a reply within thirty days.

Children

This site is not aimed at children and does not knowingly collect information from anyone under 18. If you believe a child has sent a message through the form, write in and it will be deleted.

Changes

If this policy changes, the date at the top changes with it. Material changes will be obvious on the page rather than buried.