Privacy Policy

HugFab, at hugfab.com, is operated by tapashub Pvt Ltd, a private limited company incorporated in India. Its registered office is at Manikonda, Hyderabad, Telangana, India.

In the language of the Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data described here, and you are the data principal.

This policy applies to this website and nothing else. Once you leave for a retailer’s site, that retailer’s policy governs what happens there.

Customer care and privacy questions both go to contact@hugfab.com.

• Nothing, if you only browseSearching, viewing a product and comparing prices require no account and create no record tied to you.
• Account details, only if you create an accountYour email address, and a password that is handled by our authentication provider — we never receive or store it in readable form. If you sign in with Google instead, we receive the name, email address and profile picture Google releases to us. We store a display name, a profile picture address, and your language and currency preference.
• What you saveItems you add to a wishlist, any note you attach, and any price you ask to be alerted below.
• A record of clicks out to retailersWhen you follow a link to a retailer we record which product and retailer, the time, the page you came from, and — if you are signed in — your account. This is how a commission is attributed to us and how we detect fraudulent clicking. See section 4 for what we do not record here.
• Ordinary server logsOur hosting provider keeps standard web server logs, which include IP addresses, for security and diagnostics.

To give you an account and keep you signed in; to show you the things you saved; to attribute commissions and detect click fraud; to keep the service running and secure; and to answer you when you contact us.

Account details and wishlists are processed on the consent you give when you sign up and save things. Click records and server logs are processed for the legitimate operation of the service — attribution of the commission that funds it, fraud prevention, and security.

We do not build advertising profiles and we have no advertising business. We do not sell your personal data, and we do not share it with advertisers or data brokers.

This section is specific on purpose, because “we may use analytics partners” is how most policies avoid answering it.

• No advertising or tracking pixelsThere is no Google Analytics, no Google Tag Manager, no Meta or Facebook pixel, and no advertising, retargeting or session-recording script anywhere on this site.
• No product analytics currently runningThe site can be configured to use PostHog for product analytics. It is not configured here: with no key set, the browser never downloads it and nothing is sent. The same is true of Sentry, which the site can use for error reports and which is likewise switched off.
• No IP address stored against your clicksThe click record described in section 2 has a field for a hashed IP address. The secret needed to produce that hash is deliberately not configured, and without it nothing at all is written to that field — not the address, not a hash of it.

If we ever switch any of these on, we will update this page and the date at the top before it goes live, not after.

We use strictly necessary cookies only. They are set by our authentication provider to keep you signed in and to protect the sign-in process. If you never create an account, they are never set.

There is no consent banner because there is nothing to consent to: no analytics, advertising or third-party tracking cookie is set by this site. If that changes, a consent mechanism will arrive in the same change.

Some links from HugFab to a retailer are affiliate links. If you buy something after following one, the retailer may pay us a commission. It costs you nothing, it does not change the price you pay, and it does not affect the order offers are shown in — offers are sorted by price and availability, never by what they pay us.

Following such a link may route you through an affiliate network’s redirect. That network and the retailer may set cookies or identifiers of their own in order to credit the sale. We do not control those and cannot see them; their privacy policies apply from the moment you leave this site.

On our side, all that is recorded is the click described in section 2.

• SupabaseDatabase and authentication — account records, wishlists and click records.
• HostingerWebsite hosting, and the server logs mentioned in section 2.
• ZohoEmail, if you write to us.
• GoogleOnly if you choose to sign in with Google, and only for that sign-in.

Each is used for the purpose named and nothing else. Some of them operate servers outside India, which means your personal data may be processed outside India.

Account details and wishlists are kept for as long as your account exists, and are deleted when you ask us to close it. Click records are kept as a commercial and anti-fraud record; where one is linked to an account, that link is severed when the account is deleted, leaving a record that identifies nobody.

We do not keep personal data for longer than the purpose it was collected for requires, except where a law obliges us to retain it.

Under the Digital Personal Data Protection Act, 2023 you may:

• Ask what we holdA summary of the personal data we process about you, what we do with it, and who we have shared it with.
• Correct or complete itHave inaccurate or incomplete data corrected, completed or updated.
• Have it erasedAsk us to delete personal data we no longer need for the purpose it was collected for.
• Withdraw consentWithdraw a consent you gave, as easily as you gave it. Doing so does not undo processing already carried out.
• Nominate someoneName a person to exercise these rights on your behalf if you die or become incapable of exercising them.
• ComplainRaise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it.

How to make a request. Email contact@hugfab.com from the address on your account — that address is what we use to identify you, and a request from another one cannot be honoured without it. Say which of the above you want. We will respond within the timeframe in section 10.

There is no self-service delete button in your account settings yet. Until there is, the mailbox above is the route, and we would rather say so plainly than point you at a button that does not exist.

If you are unhappy with how we have handled your personal data or your request, write to our Grievance Officer at contact@hugfab.com, with “Grievance” in the subject line.

We will acknowledge your complaint within 48 hours and resolve it within 30 days of receipt, as required by the Consumer Protection (E-Commerce) Rules, 2020.

If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India.

HugFab is not directed at children, and we do not knowingly collect personal data from anyone under 18. We do not carry out any tracking, behavioural monitoring or targeted advertising — of children or of anyone else. If you believe a child has given us personal data, write to us and we will delete it.

Access to stored data is governed by row-level security rules in the database, so one account cannot read another’s wishlist. The site is served over HTTPS only. No system is perfectly secure, and we do not claim otherwise.

When this policy changes, the date at the top changes with it. Changes that affect what we collect will be made before the collection starts, not afterwards.