Privacy Policy

Welcome to CarXen (“CarXen”, “we”, “us”, or “our”), operated under VedaHub. This Privacy Policy applies to all services, websites, mobile interfaces, and digital platforms operated by CarXen (collectively, the “Platform”).

By visiting our Platform, creating a customer account, ordering engineered automotive accessories (including seat covers, floor mats, and steering accessories), or authenticating via third-party identity providers such as Google Sign-In, you acknowledge that you have read, understood, and agreed to the practices outlined in this policy.

If you do not agree with this policy, please discontinue use of our Platform. We reserve the right to modify this policy periodically to reflect evolving legal, technical, or operational standards.

To design, manufacture, and deliver precision-fitted automotive gear, we collect information directly from you, automatically through your device interactions, and via secure authentication providers:

Note on Payment Card Security: All electronic financial payments are processed directly by certified Payment Card Industry Data Security Standard (PCI-DSS) compliant payment gateways (such as Razorpay or Stripe). CarXen never stores your full credit/debit card numbers or CVV on our servers.

CarXen provides an optional, highly secure Google Sign-In integration enabling drivers to register, log in, and manage their orders without manually maintaining another password.

CarXen is fully committed to upholding Google's rigorous standards for user privacy and data protection. In compliance with the Google API Services User Data Policy:

• No Data Brokerage or Sale: We strictly prohibit selling, renting, licensing, or leasing any Google user data to data brokers, ad networks, or external commercial entities under any circumstances.
• No Advertising Profiling: Information obtained through Google APIs is never utilized to build advertising profiles, serve retargeted third-party advertisements, or conduct surveillance analytics.
• No AI/ML Training: Google user data is not used to train generalized artificial intelligence or machine learning models.
• Human Access Restrictions: No human employee or contractor is permitted to read or inspect your personal Google user data unless required to resolve an explicit customer service ticket initiated by you, necessary for security incident investigations, or compelled by applicable law.

We utilize personal and vehicle data strictly for legitimate operational purposes directly associated with our automotive storefront:

• Order Fulfillment & Manufacturing: Custom-cutting seat upholstery, laser-tailoring floor mats, and dispatching orders to your specified delivery address.
• Customer Support: Resolving fitment questions, warranty validations, and addressing technical support inquiries.
• Account Management: Maintaining your personal virtual garage, tracking accumulated Apex reward points, and saving order receipts.
• Operational Communications: Providing critical transactional notices, such as shipping dispatch alerts, OTPs, password resets, and changes to our terms.
• Platform Integrity: Protecting against fraudulent checkout attempts, unauthorized account takeover, and DDoS threats.

CarXen shares data solely with vetted, contractually bound service providers necessary to operate our e-commerce platform. All providers are bound by strict data processing and confidentiality agreements:

• Cloud Infrastructure & Database: Supabase (PostgreSQL hosting with SSL encryption and row-level security) for reliable, encrypted data storage.
• Payment Processors: PCI-DSS certified gateways (Razorpay, Stripe) to securely process payments and issue refunds.
• Logistics & Couriers: Verified courier partners (such as Delhivery, Blue Dart, Shiprocket) receiving solely the recipient's name, phone number, and physical shipping address required to hand-deliver packages.
• Transactional Email & SMS: Enterprise delivery networks for dispatching one-time passwords, order confirmations, and tracking links.
• Legal Compliance: If mandated by statutory law, court summons, or governmental agency with lawful jurisdiction.

We retain personal data only for as long as necessary to maintain your customer account, support your product warranty, and comply with statutory accounting and tax retention regulations (typically 7 years for financial transaction records).

We implement multi-layered physical, technical, and organizational security measures to protect against unauthorized access, loss, alteration, or disclosure:

• Cryptographic Encryption: 256-bit Advanced Encryption Standard (AES-256) for data stored at rest; Transport Layer Security (TLS 1.3) with HSTS for all web traffic in transit.
• Row-Level Security (RLS): Granular PostgreSQL authorization policies ensuring users can only read and modify their own customer records.
• Credential Security: We never store plaintext passwords; authentication utilizes salted Bcrypt hashes and cryptographically signed JWT sessions.
• Continuous Vulnerability Monitoring: Regular automated security scanning, dependency vulnerability audits, and rate-limiting protections.

Regardless of your geographical location, CarXen honors fundamental data subject rights:

• Right to Access: You can view all saved profile details, garage entries, addresses, and orders directly within your authenticated Customer Portal.
• Right to Rectification: You may update or correct your phone number, default shipping addresses, and vehicle selections at any time.
• Right to Erasure (Right to be Forgotten): Request deletion of your personal account and records as detailed in Section 07.
• Right to Restrict or Object: Opt-out of non-essential promotional newsletters anytime via the one-click “Unsubscribe” link in emails.
• Children's Privacy: Our platform is intended for licensed motor vehicle drivers and adults aged 18 and older. We do not knowingly solicit or collect data from children under 16.

If you have inquiries, concerns, or requests regarding this Privacy Policy, your personal information, or our Google OAuth practices, please reach out directly to our dedicated Data Protection Officer: