Legal

Privacy Policy

Last updated 29 Aug 2026

The short version

The Cinema Chair is a personal publication, not a business with a customer database. There is no newsletter, no advertising, and nothing is sold through this website. The only personal information collected is what you type into the contact form or a shop enquiry, and it is used to reply to you.

You do not need an account to read anything, to browse the shop, or to put something in a basket. An account exists so you do not have to retype your address, and so the shop owner can manage the shop.

Analytics run only if you accept cookies, and they are anonymous.

Who runs this site

This site is operated by The Cinema Chair, whose registered address is No. 26, behind Gutte Anjaneya Swamy Temple, Sunkalpalya, Bengaluru, Karnataka 560060, India.

Rohan is the person responsible for how your data is handled here, and the person a grievance goes to.

For anything in this policy, including a request to see or delete your data, write to contact@thecinemachair.in or use the contact form.

What is collected

When you send a message. The form asks for your name, your email address, a topic, and your message. You must tick a consent box before it will send. All four fields, and the fact that you consented, are emailed to the site owner. Nothing is written to a database.

When you send a shop enquiry. Asking about a product sends your name, email, the product, quantity, any size chosen, any coupon code and your note. It is emailed, exactly like the contact form. No order record is created, because there is no checkout: the shop is a catalogue and nothing is paid for on this site.

If you create an account. You can sign in with Google or with an email address and password. With Google, Google tells this site your name, email address and profile picture, and nothing else: not your contacts, your other Google data, or your password. With an email address, the password is handled and stored by Supabase and is never seen by this site.

Your session is held in your own browser's local storage, not in a cookie, and signing out clears it.

Choosing a password. If you sign up with an email address, the password you choose is checked against HaveIBeenPwned's public list of passwords found in known data breaches. Your password never leaves your browser and neither does its full fingerprint: only the first five characters of a hash are sent, which match hundreds of thousands of entries, so the service cannot work out which password was being asked about. Nothing about you is sent with it.

What an account stores. Only what you type into it: your name, your phone number, and any delivery addresses you save. These are visible to you and to the shop owner, and to nobody else. Database rules restrict every row to the account that created it, so one customer cannot read another's address book. You can edit or delete any of it from your account page at any time, and deleting an address deletes it outright.

Your basket is kept in your own browser, not on a server. Clearing your browser data clears it, and it is never linked to you until you send it.

Advertising. This site has applied to Google AdSense. No advert is shown today. If and when ads do appear, Google and its partners may use cookies to choose and measure them, and those cookies load only if you accept on the banner. Declining means no advertising cookie is ever set. You can also review and change Google's own ad settings at google.com/settings/ads, and read how Google uses data from sites that show its ads at policies.google.com/technologies/partner-sites.

When you accept cookies. One cookie named tcc_consent records your choice so the banner does not reappear. Accepting also enables Vercel Web Analytics, which counts page views and referrers without cookies and without building a profile of you. Declining means it never loads.

Automatically, by the host. Vercel keeps short-lived server logs that include IP addresses, as any web host does. The contact endpoint also holds your IP in memory for sixty seconds to stop the form being flooded. That value is never written to disk, never included in the email, and disappears when the window closes.

What is not collected

  • No password is ever created, stored or seen by this site: sign-in is handled entirely by Google
  • No shopper accounts. Browsing and enquiring need no account at all
  • No card numbers, UPI IDs, CVVs or bank details. Those go to Razorpay and never touch this site
  • No cross-site tracking of you between websites
  • No social media pixels or embedded trackers
  • No location data beyond whatever a routine server log implies
  • No sensitive personal data, and none is asked for

Your information is never sold, rented, or handed to anyone for marketing.

Who else handles it

To run the site at all, a few processors necessarily see data in transit:

  • Vercel Inc. hosts the site and runs the contact endpoint. Primary region is Mumbai, but Vercel is a US company and traffic may route through infrastructure outside India.
  • Resend delivers the contact email.
  • Google receives your message once it lands in the owner's Gmail inbox, and handles the sign-in if you use it.
  • Supabase stores the shop's products, coupons, product images, your account, and any addresses you save, and issues the sign-in session.
  • Razorpay handles payments. Your card, UPI or bank details are entered on Razorpay's systems and are never seen by or stored on this site. Razorpay tells us only whether a payment succeeded, and a reference for it.
  • Google Fonts serves the typefaces. Your browser requests them from Google's servers, which means Google receives your IP address on every page load. This happens whether or not you accept cookies, because it is not a cookie. See the cookie policy.

Each of these has its own privacy terms, and this site cannot control them.

How long it is kept

Messages stay in the owner's email account for as long as they are useful, and are deleted on request. The consent cookie lasts a year, or until you clear it. Host logs follow the host's own retention. Analytics data is aggregate and not tied to you.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask what personal data is held about you, ask for it to be corrected, ask for it to be erased, and complain about how it is handled. If you are in the UK or the EU, the UK GDPR and GDPR give you comparable rights, including data portability and the right to object.

The lawful basis here is straightforward: you chose to send a message, and you ticked a box saying so. You can withdraw that at any time by asking for the message to be deleted. Withdrawing does not undo a reply already sent.

To exercise any of this, write to contact@thecinemachair.in. Expect a reply within thirty days.

Children

This site is not aimed at children and does not knowingly collect information from anyone under 18. If you believe a child has sent a message through the form, write in and it will be deleted.

Changes

If this policy changes, the date at the top changes with it. Material changes will be obvious on the page rather than buried.