Privacy policy


Effective Date: September 15, 2026

Last Updated: September 15, 2026

Deshla Herbs ("Deshla Herbs", "we", "us", or "our") respects your privacy and is committed to protecting the personal information and data that we collect, use, store, and process through our website, online store, applications, services, communications, and connected third-party platforms.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, when it may be shared, how we handle information obtained through third-party platforms and APIs, and the choices available to you.

By using our website, purchasing our products, communicating with us, or using services that interact with our website, you acknowledge the practices described in this Privacy Policy.

1. About Deshla Herbs

Deshla Herbs operates an online business through which we provide products, information, educational material, marketing content, customer support, and related services.

Our website may use third-party services and application programming interfaces ("APIs") to provide functionality such as e-commerce, payment processing, analytics, customer communication, content generation, social-media publishing, advertising, and account integrations.

Third-party services are used only for legitimate business and service purposes and are subject to the applicable terms and privacy policies of those providers.

2. Information We Collect

Depending on how you interact with us, we may collect the following categories of information.

2.1 Information You Provide

This may include:

  • Name

  • Email address

  • Telephone/mobile number

  • Billing and shipping information

  • Delivery address

  • Account information

  • Order and transaction information

  • Customer-service communications

  • Product enquiries

  • Reviews and feedback

  • Information voluntarily submitted through forms

  • Information provided when subscribing to communications or newsletters

  • Information you provide when contacting us through social-media platforms

2.2 Transaction Information

When you purchase products or services, we may receive information relating to:

  • Products purchased

  • Order number

  • Order status

  • Transaction amount

  • Shipping information

  • Payment status

  • Refund or cancellation information

Payment-card and banking information may be processed directly by our payment-service providers. We do not intentionally store complete payment-card numbers or payment authentication credentials on our own servers unless expressly stated otherwise.

2.3 Automatically Collected Information

When you visit our website, certain technical information may be collected automatically, including:

  • IP address

  • Browser type

  • Device type

  • Operating system

  • Approximate location derived from IP address

  • Referring and exit pages

  • Pages viewed

  • Date and time of visits

  • Website interactions

  • Cookies and similar technologies

  • Security and diagnostic information

We use this information for website operation, security, analytics, performance, and improvement.

3. Cookies and Similar Technologies

We may use cookies, pixels, local storage, tags, SDKs, and similar technologies to:

  • Operate the website

  • Maintain sessions

  • Remember preferences

  • Maintain shopping-cart functionality

  • Understand website usage

  • Improve website performance

  • Measure marketing effectiveness

  • Prevent fraud and abuse

  • Provide relevant advertising where permitted

Third-party services may also place their own cookies or similar technologies in accordance with their respective policies.

You may be able to control cookies through your browser settings. Disabling certain cookies may affect website functionality.

4. How We Use Information

We may use information for legitimate business and service purposes, including to:

  • Process and fulfill orders

  • Provide products and services

  • Process payments and refunds

  • Deliver products

  • Provide customer support

  • Respond to enquiries

  • Maintain customer accounts

  • Communicate about orders and services

  • Send marketing communications where permitted

  • Improve our website and services

  • Develop and manage content

  • Manage our social-media presence

  • Publish authorized content to connected platforms

  • Generate and manage marketing material

  • Analyze business performance

  • Prevent fraud, abuse, unauthorized access, and security incidents

  • Maintain technical infrastructure

  • Comply with applicable law

  • Enforce our terms and policies

  • Protect our rights, property, users, and business

We do not use third-party platform data for purposes that are inconsistent with the permissions granted by the relevant platform or applicable platform policies.

5. Third-Party Platforms and API Integrations

We may connect our systems to third-party platforms through APIs, OAuth, SDKs, webhooks, or other authorized integrations.

These integrations may include, depending on which services are enabled:

  • Pinterest

  • Facebook

  • Instagram

  • Threads

  • X

  • YouTube

  • Snapchat

  • Shopify

  • OpenAI

  • Google services

  • Meta services

  • Payment providers

  • Shipping and logistics providers

  • Analytics providers

  • Advertising platforms

  • Other business, marketing, communication, or technology providers

Not every integration is necessarily active at all times.

6. Pinterest API and Pinterest Data

Our applications may use the Pinterest API to connect an authorized Pinterest Business account and to create, manage, schedule, or publish Pins to authorized Pinterest Boards.

When a Pinterest account owner authorizes our application through Pinterest OAuth, we may receive information necessary to provide the integration, which may include:

  • Pinterest account identifiers

  • Account-related information

  • Board identifiers

  • Pin-related information

  • Authorization information

  • Access tokens

  • Refresh tokens

  • API permission/scopes granted to the application

Pinterest data is used only for authorized business functionality, including:

  • Connecting the authorized Pinterest account

  • Identifying authorized Boards

  • Creating and publishing our business's Pins

  • Managing authorized Pinterest content

  • Maintaining the Pinterest integration

  • Diagnosing API or integration problems

We do not intentionally access or collect Pinterest information belonging to unrelated users except where such access is expressly authorized and necessary for a specific feature.

We do not sell Pinterest API data.

Pinterest access tokens, refresh tokens, client secrets, and other authentication credentials are treated as confidential credentials and are stored using reasonable security measures.

Pinterest currently requires API applications to use authenticated and authorized access, and its documentation recommends secure handling of access and refresh tokens.

If you revoke Pinterest authorization or request that we disconnect the integration, we will take reasonable steps to deactivate the connection and delete applicable authentication credentials, subject to legitimate legal, security, accounting, or operational requirements.

7. Facebook and Instagram Data

Where enabled, we may use Meta APIs to connect authorized Facebook Pages, Instagram professional accounts, and related business assets.

Information obtained through authorized Meta integrations may include:

  • Page identifiers

  • Instagram account identifiers

  • Account names or usernames

  • Authorized publishing permissions

  • Access tokens

  • Content and media information necessary for publishing

  • Publishing status and API response information

We use this information to provide authorized business functions such as:

  • Publishing posts

  • Publishing images or other supported content

  • Managing authorized social-media publishing

  • Checking publishing status

  • Maintaining the connection with the authorized account

We do not sell or rent Meta platform data for unrelated purposes.

Meta access tokens and application credentials are treated as confidential credentials and are not intentionally made publicly available.

Users can revoke the application's access through the relevant Meta platform or by contacting us.

8. Threads Data

Where enabled, we may use the Threads API to connect an authorized Threads account and publish authorized content.

Information may include:

  • Threads account identifier

  • Threads username

  • Authorization information

  • Access tokens

  • Token expiration information

  • Content submitted for publication

  • Publishing status

  • API response information

Threads data is used to:

  • Authenticate the authorized account

  • Publish authorized text and media

  • Maintain the Threads integration

  • Check publishing status

  • Manage authorized content

We do not sell Threads API data or intentionally use it for unrelated profiling.

If the Threads connection is revoked or the application is uninstalled, applicable stored authentication information will be removed or deactivated in accordance with our data-retention procedures.

9. X Data

Where enabled, our application may use the X API to connect an authorized X account and perform authorized publishing or account-management functions.

Information may include:

  • X account identifiers

  • Username or account information

  • Access tokens

  • Authorization information

  • Content submitted for publication

  • Publishing status

  • API response information

We use X data only to provide the authorized integration and related business functions.

We do not sell X API data.

Users may revoke the application's authorization through X or contact us to request disconnection.

10. YouTube Data

Where enabled, we may use YouTube APIs to connect an authorized YouTube account or channel.

Information may include:

  • YouTube channel identifiers

  • Channel information

  • Video metadata

  • Upload or publishing information

  • OAuth authorization information

  • Access and refresh tokens

  • API status information

YouTube API data is used only to provide authorized functionality, such as managing or publishing content to an authorized channel.

We do not use YouTube API data to:

  • Surveil users

  • Harvest personal information without authorization

  • Sell user information

  • Access unauthorized accounts

  • Store user data indefinitely

We provide appropriate mechanisms for users to request deletion of applicable data.

YouTube's developer policies require API clients to maintain a published privacy policy accurately describing API data access, collection, storage, use, and sharing, and require reasonable privacy and security controls.

11. Snapchat Data

Where enabled, we may use authorized Snapchat/Snap developer services to provide supported business or content-management functionality.

Depending on the specific integration, information may include:

  • Account or application identifiers

  • Authorization information

  • Content or media submitted through the integration

  • Technical/API information

  • Access tokens or other authorization credentials

We use Snapchat-related information only for the specific authorized functionality for which access has been granted.

We do not intentionally use Snapchat data for unauthorized surveillance, profiling, or unrelated purposes.

Snap developer integrations are subject to Snap's developer requirements, privacy requirements, and review processes.

12. Shopify and E-Commerce Data

Our online store may use Shopify or related e-commerce services.

Shopify-related information may include:

  • Customer information

  • Order information

  • Product information

  • Shipping information

  • Store information

  • Inventory information

  • Blog or article information

  • API authentication information

We use this information to operate our store, process orders, manage products and content, provide customer service, and perform authorized administrative functions.

Shopify's own privacy and data practices may also apply to information processed through Shopify services.

13. OpenAI and AI Services

We may use OpenAI or other artificial-intelligence services to assist with:

  • Content generation

  • Marketing copy

  • Product descriptions

  • Social-media captions

  • Blog content

  • Content editing or humanization

  • Image generation

  • Other authorized business-content workflows

Information submitted to an AI service may include text, product information, instructions, images, or other content necessary to provide the requested functionality.

We do not intentionally submit passwords, payment-card information, access tokens, client secrets, or other unnecessary authentication credentials to AI services.

Where personal information is included in content submitted to an AI service, we take reasonable steps to limit the information to what is necessary for the requested functionality.

14. Social-Media Publishing

Our content-management tools may allow authorized users to prepare and publish content to multiple social platforms.

Published content may include:

  • Text

  • Images

  • Videos

  • Product information

  • Website links

  • Hashtags

  • Marketing information

  • Branding elements such as logos

Publishing occurs only when authorized credentials and permissions have been provided.

The availability of a particular social platform depends on its API, account type, permissions, technical requirements, and applicable policies.

15. Access Tokens, API Keys and Secrets

Certain integrations require authentication credentials such as:

  • OAuth access tokens

  • OAuth refresh tokens

  • Client IDs

  • Client secrets

  • API keys

  • Webhook secrets

  • Application credentials

These credentials are treated as confidential information.

We use reasonable technical and organizational safeguards to prevent unauthorized access, disclosure, modification, or misuse.

Credentials should not be intentionally exposed in public source code, public repositories, browser interfaces, URLs, screenshots, or other publicly accessible locations.

Where an integration is disconnected, credentials may be revoked, deleted, disabled, or replaced as appropriate.

16. Sharing of Information

We may share information with service providers and technology partners where necessary to operate our business and provide requested services.

These may include:

  • E-commerce providers

  • Payment processors

  • Shipping providers

  • Hosting providers

  • Cloud-service providers

  • Analytics providers

  • Marketing providers

  • Social-media platforms

  • API providers

  • AI service providers

  • Customer-support providers

  • Security providers

  • Professional advisers

  • Government authorities where legally required

We do not sell personal information merely because it is processed by a service provider.

Third-party providers may process information according to their own terms and privacy policies.

17. International Data Transfers

Some of our service providers and technology partners may process information outside India.

Where information is transferred internationally, we take reasonable steps to use appropriate contractual, technical, and organizational safeguards consistent with applicable law.

18. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

  • Providing services

  • Processing orders

  • Maintaining business records

  • Maintaining authorized integrations

  • Security and fraud prevention

  • Customer support

  • Legal and regulatory obligations

  • Dispute resolution

  • Accounting and tax requirements

API credentials and platform-specific data are not intended to be retained indefinitely.

When information is no longer required, we may delete, anonymize, aggregate, or securely dispose of it, subject to legal and legitimate business requirements.

For APIs subject to specific platform retention requirements, we follow the applicable platform's requirements.

For example, YouTube's developer policies require developers to provide users with control over their data and address valid deletion requests within the applicable policy period.

19. Data Security

We use reasonable technical, administrative, and organizational safeguards designed to protect information against:

  • Unauthorized access

  • Unauthorized disclosure

  • Loss

  • Misuse

  • Alteration

  • Destruction

  • Security attacks

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

20. Data Deletion and Account Disconnection

You may request deletion of personal information or disconnection of an authorized third-party integration by contacting us.

Depending on the service involved, you may also revoke authorization directly through the relevant platform.

For platform-specific API integrations, we may need to retain limited information where required for:

  • Legal compliance

  • Fraud prevention

  • Security

  • Accounting

  • Transaction records

  • Dispute resolution

Where deletion is requested and no valid retention requirement applies, we will take reasonable steps to delete or anonymize applicable information.

For social-media integrations, disconnecting an account may prevent future publishing but may not automatically delete content that has already been published directly on that platform.

21. Third-Party Privacy Policies

Our services may contain links to or integrations with third-party websites and services.

Examples include Pinterest, Facebook, Instagram, Threads, X, YouTube, Snapchat, Shopify, Google, OpenAI, payment providers, shipping providers, and other services.

Those services operate independently and have their own privacy policies and terms.

We encourage users to review the privacy policies of third-party services before using their services.

22. Children's Privacy

Our services are intended for general audiences and are not knowingly directed toward children where prohibited by applicable law.

We do not knowingly collect personal information from children in circumstances where such collection is prohibited.

If you believe a child has provided personal information to us improperly, please contact us so that we can investigate and take appropriate action.

23. Marketing Communications

Where permitted by law, we may send promotional communications about our products, services, offers, or content.

You may unsubscribe from marketing communications by:

  • Using the unsubscribe mechanism provided in the communication

  • Contacting us

  • Using applicable account or communication preferences

Transactional and service-related communications may continue where necessary to fulfill an order or provide a requested service.

24. Your Rights and Choices

Depending on applicable law, you may have rights concerning your personal information, including rights to:

  • Request access to information we hold about you

  • Request correction of inaccurate information

  • Request deletion where legally applicable

  • Request restriction of certain processing

  • Object to certain processing

  • Withdraw consent where processing is based on consent

  • Request information about how data is processed

  • Disconnect authorized third-party integrations

We may need to verify your identity before completing certain requests.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes to our services

  • Changes to our technology

  • Changes to third-party integrations

  • Changes to applicable laws

  • Changes to platform/API requirements

  • Changes to our business practices

When we make material changes, we may update the "Last Updated" date and provide additional notice where appropriate.

We encourage you to periodically review this Privacy Policy.

26. Contact Us

If you have questions about this Privacy Policy, your personal information, data deletion, or any connected social-media/API integration, please contact us through the contact information provided on our website.

Website:
https://www.deshlaherbs.com/

Privacy Policy:
https://www.deshlaherbs.com/policies/privacy-policy

Business:
Deshla Herbs

27. Platform-Specific Compliance

Our use of third-party APIs and platform data is subject to the applicable terms, developer policies, API policies, and privacy requirements of the relevant platform.

These may include requirements imposed by Pinterest, Meta, Instagram, Threads, Facebook, X, YouTube/Google, Snapchat/Snap, Shopify, OpenAI, and other providers whose APIs or services we use.

Where a platform imposes stricter requirements concerning data access, storage, deletion, security, or user control, we will follow the applicable platform requirements in addition to this Privacy Policy.

This Privacy Policy does not replace the privacy policy or terms of any third-party platform.