Privacy Policy - Stumpage

Last updated: 12 October 2026

This Privacy Policy explains how STUMPAGE (“STUMPAGE”, “we”, “us”) collects, uses, shares and looks after personal data when you visit stumpage.in (the “website”), place an order, contact us, message us on WhatsApp or subscribe to our newsletter. We have tried to write it in plain language. If anything is unclear, write to us at hello@stumpage.in.

1. Who We Are

STUMPAGE is a brand of wooden essentials for everyday living. For the purposes of this Privacy Policy, Stumpage (OPC) Pvt Ltd. is the party that decides why and how the personal data described below is used.

Registered address: New Ram Vihar Colony, Pinto Park, Morar, near Mahakal Oil Mill, Morar, Gwalior, 474006.

You can reach us about anything in this policy at hello@stumpage.in.

2. What Personal Data We Collect

Depending on how you use the website, we may collect the following.

When you place an order. WooCommerce, the software that runs our shop, stores this customer and order information so that we can operate the website, process your order and fulfil it:

Your first and last name, and your company name if you provide one
Your email address and telephone or mobile number
Your billing address and shipping address, including city, state, PIN code and country
The products you order, order totals and the payment method you chose
Any notes you add to your order
Technical information recorded with the order, such as your IP address, browser and device (user-agent) details
Order source information, such as the website or campaign link you arrived from, the page you first visited and the number of pages viewed in that visit, where this is captured by the website

When you contact us through the website’s contact form:

The details you enter, such as your name, email address, subject and message
Technical information recorded with the submission, such as your IP address, browser and device details and the page you submitted the form from

When you message us on WhatsApp:

Your WhatsApp phone number and profile information, such as the profile name shown on your account
The messages you send us, and any attachments you send, such as photos, documents, voice notes, videos or your location
Information about whether messages we send you were delivered and read

We may provide a WhatsApp contact option on our website so that you can start a conversation with STUMPAGE. If we introduce automated or AI-assisted replies, we will explain the relevant processing and provide any notices or choices required by applicable law.

When you subscribe to our newsletter:

Your email address
Your choice to receive the newsletter (you tick a box to agree). We keep a record of that agreement, including the version of the wording you agreed to.
Technical information used to check that the sign-up comes from a person and not an automated program (see Cloudflare Turnstile in section 6)
After you subscribe, information about whether newsletter emails are delivered, opened and clicked, which our email provider records.

In our customer records (STUMPAGE CRM). We keep a customer records system, STUMPAGE CRM, to manage contacts, enquiries and conversations, and to track sales or enquiries. It can hold your contact details, notes we add about you or your enquiry, your WhatsApp conversations, and records of any enquiry or sale we are tracking.

Relevant customer details may be imported or copied into STUMPAGE CRM from the order records held in WooCommerce. The website and STUMPAGE CRM are not automatically connected, so the information held in the two systems may differ. Importing or copying a contact into STUMPAGE CRM does not delete the original WooCommerce record.

When you simply browse the website:

Technical information that your browser sends automatically, such as your IP address and browser details, which our hosting and website services process in order to deliver pages to you

We do not ask for, and you should not send us through the website, payment card numbers or banking passwords. Payment details are entered on our payment provider’s secure payment screen (see section 6).

3. How We Collect Personal Data

Directly from you, when you fill in the checkout form, the contact form or the newsletter form
Directly from you, when you send us a message on WhatsApp
Automatically, through the website and the services it relies on, when you visit or place an order (for example, IP address, browser details and order source information)
From our payment provider, which tells us whether your payment succeeded and gives us a reference for it
By importing or copying relevant customer details from WooCommerce into STUMPAGE CRM, as described in section 2

4. Why We Use Personal Data

We use personal data only for the purposes below.

Processing and fulfilling your order: confirming your order, preparing it, and arranging delivery to you
Payment processing: allowing you to pay for your order and recording that payment
Shipping and delivery: sharing the details needed to deliver your order and to let you know about its progress
Customer support and enquiries: responding to messages, questions, delivery issues, return and refund requests, and complaints, including messages you send us on WhatsApp
Customer records and sales tracking: managing contact details, keeping a record of enquiries and conversations, and tracking sales or enquiries in STUMPAGE CRM
Order and transaction records: keeping a record of orders, payments, refunds and cancellations
Security, fraud and abuse prevention: protecting the website, our customers and ourselves from misuse, fraudulent orders and technical attacks
Operating the website: keeping the website working, reliable and secure
Legal, accounting and tax obligations: keeping records we are required to keep and responding to lawful requests
Newsletter and other optional marketing communications: only where you have chosen to receive them (see section 7)

5. Order, Payment and Delivery Communications

When you place an order, we will contact you about that order, for example to confirm it, to tell you about payment, shipping, delivery, cancellation, return or refund, or to answer a question you asked. These are transactional messages. They are necessary to provide the service you requested and are separate from promotional messages.

Placing an order does not mean you have agreed to receive promotional messages from us.

6. Service Providers and Third Parties

We do not sell your personal data. We use the following service providers to run the website and fulfil orders. They receive personal data only to the extent needed to provide their service to us or to you, and they handle it under their own terms and privacy policies, which we encourage you to read.

Hostinger: hosts the website and the data stored on it, including orders and form submissions. Our basket, checkout and account pages also load a script from Hostinger Reach, Hostinger’s email marketing tool. When these pages load, Hostinger’s servers may receive technical information such as your IP address and browser details. We have not confirmed whether this script performs additional tracking.
WordPress and WooCommerce: the software on which the website and our order management run. Customer and order details are stored in the website’s database.
Razorpay: processes payments (such as UPI, cards and net banking). You enter your payment details on Razorpay’s payment screen, and Razorpay processes them under its own privacy policy. We receive the outcome of the payment and a payment reference, not your full card details.
Shiprocket: our shipping and logistics platform. For delivery and fulfilment, we share the personal data necessary to fulfil your order with our logistics and shipping service providers, including Shiprocket. For prepaid orders, fulfilment information is transmitted to Shiprocket when the order reaches the applicable fulfilment stage after successful payment. Shiprocket may share the details needed for delivery with the courier partners it uses.
Fluent Forms: the software that powers our contact form. Contact form submissions are stored on our website.
WhatsApp (Meta): if you message us on WhatsApp, your messages travel through Meta’s WhatsApp Business platform, which processes them under Meta’s own terms and privacy policy. This applies to conversations you start through any WhatsApp contact option we provide on our website.
Supabase and Vercel: STUMPAGE CRM’s database and stored files are kept with Supabase, and the application runs on Vercel. They process the customer records described in section 2 on our behalf.
Brevo: powers the newsletter sign-up form in the footer of the website and sends our newsletter. If you subscribe, your email address and subscription choice are processed through Brevo’s service, and Brevo sends you the confirmation email.
Cloudflare Turnstile: helps protect the newsletter form from automated sign-ups. When the form loads, your browser connects to Cloudflare, which receives technical information such as your IP address and browser details, under Cloudflare’s own privacy policy.
Google Fonts and similar technical services: the website may load fonts and similar resources from third-party servers. When this happens, your browser connects to those servers, which can see technical information such as your IP address and browser details.

We may also share personal data where we are required to by law, to respond to lawful requests from authorities, or to protect our rights, our customers or the security of the website.

7. Marketing and Promotional Communications

Promotional communications are separate from the order-related messages described in section 5.

You can subscribe to our newsletter by entering your email address in the sign-up form in the website footer and ticking the box to agree. The box is not ticked for you. We then send you an email asking you to confirm. You are added to our newsletter only after you confirm. If you subscribe, we may send you occasional emails such as essays, stories from our workshop and updates about our products.
We do not treat the placing of an order as permission to send you promotional emails, WhatsApp messages or other marketing messages.
STUMPAGE CRM is currently used to manage customer enquiries and order-related support, including questions about orders, shipping, delivery tracking and related matters. Adding a customer’s details to our CRM for these purposes does not, by itself, mean that the customer has agreed to receive promotional communications.
Customers may contact us through WhatsApp or other contact options we make available on our website. We may introduce additional features to support these conversations in the future. Any use of personal data for promotional communications will be handled separately from order-related and customer-support communications, in accordance with applicable law and any consent or permission required.
You can ask us to stop sending you newsletters or other promotional messages at any time by writing to hello@stumpage.in. You can also use the unsubscribe link in our newsletter emails. Stopping promotional messages will not affect the order-related messages we need to send you about an order you have placed.

If you believe you have received a promotional message you did not agree to, please tell us at hello@stumpage.in and we will look into it.

8. Cookies and Technical Information

The website uses cookies and similar technologies, as described below.

Shopping and checkout cookies: WooCommerce, the software that runs our shop, uses cookies to remember the contents of your basket and to keep your shopping session working. These are used when you add items to your basket or go through checkout.
Order source information: WooCommerce can record where an order came from (for example, a direct visit or a link from another site) and attach this to the order. This may use cookies or similar browser storage.
Payment and embedded services: when you pay, or where the website loads content from a service such as Razorpay, Brevo, Cloudflare Turnstile, Hostinger Reach or Google Fonts, those services may set their own cookies or receive technical information from your browser, under their own policies.

We do not currently use third-party advertising or remarketing pixels, or third-party website analytics services, on this website. We may introduce tools of this kind in the future, such as Google Tag Manager and analytics or advertising tags. Google Tag Manager is a tool for managing tags on a website; what data is collected, and for what purpose, depends on the particular analytics or advertising tags used through it. You can control or delete cookies through your browser settings, although parts of the shop, such as the basket and checkout, may not work properly without them.

9. How Long We Keep Personal Data

We keep personal data only for as long as is reasonably necessary for the purposes described in this policy. This includes fulfilling and supporting your order, handling returns, refunds and complaints, keeping accounting, tax and legal records, resolving disputes, preventing fraud and keeping the website secure. Retention periods depend on the type of data and the purpose, and are subject to applicable law. When we no longer need personal data, we intend to delete it or anonymise it.

Third-party services that we use keep personal data under their own retention practices. If you would like to know more about how long we hold your information, please contact us at hello@stumpage.in.

10. Data Security

We use reasonable technical and organisational measures that are appropriate to the nature of the personal data we handle. These include limiting access to the website’s administration and relying on established hosting and payment providers. However, no website, internet transmission or electronic storage system can be guaranteed to be completely secure, and we cannot promise absolute security.

11. Your Privacy Rights

Subject to applicable law, you may ask us to:

Tell you what personal data we hold about you and how we are using it
Correct or update personal data that is inaccurate or incomplete
Delete personal data that we no longer need to keep, or are not legally required to keep
Stop using your personal data for a purpose for which you gave consent, by withdrawing that consent (see section 12)
Look into a complaint or grievance about how we handle your personal data

Where the law gives you additional rights, such as the right to nominate another person to exercise your rights if you are unable to, you may exercise those too.

We do not currently offer an online privacy dashboard or account area for managing your data. To make a request, please write to us at hello@stumpage.in from the email address linked to your order or subscription, and tell us what you would like us to do. We may need to verify your identity before acting on a request, and in some cases we may be unable to delete data that we are required by law to keep (for example, certain order and accounting records). We will handle your request in accordance with applicable law and any timelines that apply.

If you are not satisfied with our response, you may also have the right to approach the Data Protection Board of India, as provided by law.

12. Withdrawal of Consent

Where we use your personal data because you agreed to it, such as subscribing to the newsletter, you can withdraw that consent at any time by writing to hello@stumpage.in. You can also use the unsubscribe link in our newsletter emails. Withdrawing consent does not affect the lawfulness of what we did before you withdrew it, and does not stop us from using personal data we need to complete an order, meet legal obligations or deal with a dispute.

13. Children

Our website and services are intended for a general audience and are not directed at children. We do not knowingly collect personal data from children in circumstances where applicable law requires parental or guardian involvement. If you believe a child has provided us with personal data in such circumstances, please contact us at hello@stumpage.in and we will take appropriate steps.

14. Automated Decisions

Our payment provider may run its own fraud and security checks on payments under its own policies.

We do not currently use an AI assistant within STUMPAGE CRM to read or generate replies to customer conversations.

15. Processing Outside India

Some of the service providers described in section 6 may store or process personal data on servers or systems located outside India. We have not independently confirmed the locations used by each provider. Where personal data is handled by these providers, it is handled under their own terms and privacy policies and in line with the law that applies to them and to us.

16. Data Breaches and Security Incidents

If we become aware of a security incident affecting personal data, we will look into it, take steps to address it and limit its effects, and take the steps required by applicable law, which may include informing affected people and the relevant authority.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example if our practices or the services we use change, or if the law requires it. The date at the top shows when it was last updated. We encourage you to check it from time to time.

18. Contact, Privacy Requests and Grievances

For any question about this Privacy Policy, to make a privacy request, or to raise a privacy-related grievance, please email us at hello@stumpage.in. Please include your name, the email address or order number connected to your query, and a short description of what you need, so that we can help you promptly.