![Products from six of the eight D2C brands read for this page, in their own listing photographs on a colour-block banner]()
Every D2C order leaves a trail - name, phone number, address, order history, and whatever you typed into a feedback box. How long does the brand keep it?
We read eight Indian D2C privacy policies on 23 October 2026 to find out. Not one publishes a retention period. Three give a principle, four say nothing at all, and the only concrete sentence in the entire set is Libas telling you what it doesn't keep.
📅 Update log:
23 Oct 2026: first published. Retention language read from each brand's own /policies/privacy-policy on 23 October 2026, from India, logged out, with /policies/terms-of-service and /policies/refund-policy read alongside as a cross-check. Where we report that nothing was found, that is a statement about those pages on that date and not an allegation of non-compliance. Nothing was purchased and no brand was contacted.
The question none of these pages answers
You order a face wash. The brand now has your name, phone number, address, order history and whatever you typed into a feedback box. How long does it keep them?
On 23 October 2026 we read the published privacy policies of eight well-known Indian D2C brands to find out, from India, logged out. Not one of them publishes a retention period. Three state a principle, one makes a single negative statement about card data, and four say nothing about retention at all.
What eight privacy policies say about keeping your data
| Brand | Retention language? | What it says | Period stated |
|---|
| Mamaearth | Yes — a principle | "We will retain your Personal Information only as long as it is reasonably required or otherwise permitted or required by applicable law or regulatory requirements." | None |
| Plum | Yes — its own headed section | "How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies." | None |
| mCaffeine | Partly — for one data type | Retains message-board and feedback content "as necessary to resolve disputes, provide customer support and troubleshoot problems as permitted by law". | None |
| Libas | Only a negative statement | "We do not record or retain your card information at all as it is directly passed over to the payment gateway for processing." | N/A — says it keeps nothing |
| Beardo | Nothing found | — | — |
| Dot & Key | Nothing found | — | — |
| Minimalist | Nothing found | — | — |
| Bombay Shaving Company | Nothing found | — | — |
The pattern is purpose-based retention. Data is kept "as long as reasonably required", or for as long as a listed purpose or a legal requirement lasts. That is ordinary, widely used drafting and we are not suggesting otherwise. It simply means the honest answer to "how long?" on all eight of these brands is "it depends, and we have not said on what timescale".
The one concrete line in eight policies
Across all eight documents there is exactly one sentence that tells a customer something specific is not kept. It belongs to Libas:
"We do not record or retain your card information at all as it is directly passed over to the payment gateway for processing."
That is how online card payments are generally handled in India — the details go to a PCI-DSS compliant gateway rather than sitting on the shop's own servers — and several of the other brands describe using exactly such intermediaries. Libas is simply the only one that spells out the consequence for the reader.
Four things worth doing
- Treat deletion as a request, not a switch. Closing an account does not necessarily remove the record — Bewakoof's terms, read the same day, say a backup of registration information may be kept for as long as the law requires.
- Put data requests in writing, and date them. A written record is what any later escalation rests on.
- Escalate to the grievance officer where one is published. Mamaearth and Plum both name an individual with an email address.
- Separate marketing consent from account data. Unsubscribing is not a deletion request, and these policies handle the two under different headings.
What this page does not tell you
This is a reading of published pages, and it is not legal advice. Every quotation was read from each brand's own published privacy policy on 23 October 2026, from India, as a logged-out visitor, with the terms and refund pages read alongside for cross-checking. Nothing was purchased, no data request was filed and no brand was contacted. We are not lawyers.
"Nothing found" means nothing found on the page we read. It is not a claim that a brand has no retention policy, keeps data forever, or is in breach of anything. A brand may set retention internally, describe it in a document we did not read, or answer the question on request. We make no allegation of non-compliance against any brand named here.
And purpose-based retention is normal. Tying retention to a purpose or a legal requirement rather than to a fixed number of days is standard drafting worldwide, for the good reason that different categories of data have genuinely different lifespans and some are fixed by tax and company-law record-keeping rules. The point of this page is not that the drafting is wrong - it is that a shopper who wants a number cannot get one from any of these eight pages. Policies change without notice; read the live document before relying on it.
Frequently Asked Questions
How long do Indian D2C brands keep your personal data?
None of the eight we read publishes a figure. On 23 October 2026 we read the privacy policies of Mamaearth, Plum, mCaffeine, Minimalist, Beardo, Dot & Key, Libas and Bombay Shaving Company, and not one states a retention period in days, months or years. Three state a principle instead. Mamaearth keeps data "only as long as it is reasonably required or otherwise permitted or required by applicable law". Plum says the period "depends on different factors" and lists them. mCaffeine addresses only feedback and message-board content. The other five say nothing about retention at all on the page we read - which is a statement about those pages, not a claim that no policy exists internally.
Does any D2C brand say it does NOT keep your data?
One does, and it is the most concrete sentence in the whole set. Libas's privacy policy says: "We do not record or retain your card information at all as it is directly passed over to the payment gateway for processing." That is the only line across eight privacy policies that tells a customer a specific category of data is not kept. It is also, usefully, the normal way online payments work in India - card details go to a PCI-DSS compliant gateway rather than sitting on the merchant's own systems, and the RBI's card-on-file tokenisation regime pushes in the same direction. Several other brands describe using third-party PCI-DSS compliant payment intermediaries without drawing the same explicit conclusion for the reader.
What happens to my data if I delete my account?
Deletion and erasure are not the same thing, on the wording these brands use. The clearest example we read the same day is Bewakoof's: "You may delete your account at any time. However, we may maintain backup of your registration information for such time as may be required under applicable laws." The D2C privacy policies here are consistent with that shape - retention is tied to a purpose or a legal requirement rather than to a date, so closing an account does not by itself start a clock you can point to. If you want data deleted, the route is a written request to the brand - and on four of these eight, a published grievance officer is the escalation point if nothing happens.
Is it normal for a privacy policy not to give a retention period?
Yes - and we want to be fair about that. Purpose-based retention language ("as long as necessary for the purposes for which it was collected, or as required by law") is standard drafting internationally, including in policies written for GDPR, because different data types genuinely have different lifespans and some are pinned by tax or company-law record-keeping rules. Mamaearth even gives that example directly: it is "required to retain business records for fixed periods of time in order to comply with local legal requirements". Nothing on this page says any of these brands is non-compliant or doing anything improper. The observation is narrower: a shopper who wants to know how long their address, order history and phone number will exist cannot find out from any of these eight pages.
What can I actually do about my data at a D2C brand?
Four practical things. First, ask in writing - a specific request naming the data you want deleted is harder to ignore than a general complaint. Second, send it to the published grievance officer where one exists: Mamaearth and Plum both name an individual with an email address. Third, keep card storage to a minimum - tokenised card-on-file and UPI reduce how much of your payment data any one merchant touches, and Libas states outright that it retains none. Fourth, remember marketing consent is separate from account data: unsubscribing from emails is not a deletion request, and these policies treat the two differently. We have not filed a request with any of these brands, so we cannot tell you how any of them responds in practice.
Prices & codes last verified: October 23, 2026
Every quotation on this page was read from each brand's own published privacy policy on 23 October 2026, from India, as a logged-out visitor, with their terms of service and refund policy pages read alongside as a cross-check. Nothing was purchased, no data deletion or access request was filed and no brand was contacted, so nothing here describes how any of these brands behaves in practice. This page is not legal advice and we are not lawyers. Where we report that no retention language was found, that is a statement about the pages we read on that date - it is not a claim that a brand has no retention policy, that it keeps data indefinitely, or that it is in breach of any law, and no allegation of non-compliance is made against any brand named here. Purpose-based retention language, tying the period to the purpose of collection or to a legal requirement rather than to a fixed number of days, is standard drafting internationally and is used for sound reasons including statutory record-keeping obligations. Privacy policies are revised without notice - read the live document before relying on anything here. Zoutons may earn a commission on purchases made through links on this page, which never affects what we report.
Flipkart Big Billion Days 2026 Is Live: General Access Open October 9 
Nykaa Sale Calendar 2026: Diwali Dhamaka & Pink Friday Dates, Next Sale 
Amazon Upcoming Sale Calendar 2026: Next Sale Dates India, GIF & More 
Udemy Upcoming Sale 2026: Next Sale Dates, Black Friday & Coupons 
Myntra Sale Calendar 2026: Big Fashion Festival Live Now, Winter EORS Dates 
Amazon Great Indian Festival 2026: Reloaded Deals Live Oct 21, Dates Official 
Booking com 
Hostinger 
Dell 
Udemy 
Agoda 
Nykaa 
Myntra 
Ajio