mCaffeine Privacy Policy 2026: What It Says About Selling Your Data

Most privacy policies have a paragraph about what happens if the company is sold. They usually say the data "may be transferred". mCaffeine's says something more definite, and uses a word most do not:

"We and our affiliates will share / sell some or all of your personal information with another business entity should we (or our assets) plan to undergo any merger or acquisition activity with that business entity, or re-organization, amalgamation, restructuring of business."

Two things are worth noticing in that sentence, and neither is an accusation. The first is "will" rather than "may". The second is "share / sell": the policy contemplates the information being sold as part of a corporate transaction, which is an ordinary feature of how businesses change hands, and says so in plain terms rather than burying it.

The policy does attach a condition: "Should such a transaction occur that other business entity (or the new combined entity) will be required to follow this privacy policy with respect to your personal information." That is a meaningful protection as drafted. It is also worth reading next to the clause higher up the page saying the policy itself can change without notice, because a promise to follow "this privacy policy" is only as fixed as the policy is.

Transferring customer data in a merger or acquisition is normal and lawful, and nothing here suggests otherwise. It is set down because it is the kind of term nobody reads and everybody is bound by.

Near the top of the document: "Our privacy policy is subject to change at any time without notice. To make sure you are aware of any changes, please review this policy periodically." That puts the duty on the reader to keep checking.

Near the bottom of the same document: "If we decide to change our privacy policy, we will post those changes on this page so that you are always aware of what information we collect, how we use it, and under what circumstances we disclose it." That promises the reader will always be aware.

The two can be reconciled — posting a change on the page is arguably both "without notice" and a way of making it available — but as written they pull in opposite directions, and a reader looking for the answer to "will you tell me if this changes?" gets two of them. We report both sentences verbatim and draw no conclusion about which governs. The practical response is the same either way: if the terms of a purchase matter to you, keep your own dated copy.

There is no "last updated" date anywhere on the page we read, which is the detail that makes the question live. A policy that can change at any time and does not say when it last did gives a reader no way to tell whether what they are reading is what they agreed to.

The collection section is unusually specific, which is to the brand's credit. In its own words:

On browsing: "On usage of our website whether by logging in or simply surfing, we may collect behavioral information." The policy is explicit that anonymity ends at the point of identification: "You can browse the Website anonymously without revealing your identity or any personal information about yourself. Once you give us your personal information, you are not anonymous to us."

On payment details: "If you transact with us, we collect some additional information, such as a billing address, a credit / debit card number and a credit / debit card expiration date and/ or other payment instrument details and tracking information from cheques or money orders."

On surveys: "We will occasionally ask you to complete optional online surveys. These surveys may ask you for contact information and demographic information (like pincode, age, education, or income)." The policy calls these optional and says the data is used to tailor content.

On things you write: "If you choose to post messages on our message boards, chat rooms or other message areas or leave feedback, we will collect that information you provide to us. We retain this information as necessary to resolve disputes, provide customer support and troubleshoot problems as permitted by law." Correspondence you send, and correspondence others send about you, may also be collected into a file.

Three separate sharing routes are described, and they are worth keeping apart because they work differently.

Within the corporate group. "We may share personal information with our other corporate entities and affiliates to help detect and prevent identity theft, fraud and other potentially illegal acts; correlate related or multiple accounts to prevent abuse of our services; and to facilitate joint or co-branded services that you request." Crucially, the policy limits what those affiliates may then do: "Those entities and affiliates may not market to you as a result of such sharing unless you explicitly opt-in." That is a genuine restriction and a better term than many comparable pages carry.

On legal process. Personal information may be disclosed "if required to do so by law or in the good faith belief that such disclosure is reasonably necessary to respond to subpoenas, court orders, or other legal process", and to law enforcement or third-party rights owners where reasonably necessary to enforce the terms, respond to infringement claims or protect safety.

On a corporate transaction. The share/sell clause above.

On third parties generally the policy disclaims control rather than responsibility for choosing them well: it says it takes "effort in selecting and facilitiating access to service providers with high privacy and securitystandards" — the spelling and spacing are the page's own — but that it "cannot take responsiblity for third party service providers" and urges readers to review their policies. On cookies placed by others: "We do not control the use of cookies by third parties."

The URL does not match the document. The page we read sits at mcaffeine.com/policies/terms-of-service, and it is not a terms-of-service document. It opens as a privacy policy, describes collection, use, sharing and cookies, and closes with a Grievance Officer block. A shopper clicking a "Terms of Service" link lands on a privacy policy. We report the URL and its contents as found; mapping policy pages to URLs is a site-build decision and nothing improper is alleged.

Two company addresses appear on the same page. The body names PEP Technologies at a Powai address; the Grievance Officer block names an Andheri (East) address. Both are reproduced as published and we draw no inference from the difference — companies move, and a page can lag. It is noted only because the Grievance Officer block is the part of the page a reader with an actual complaint will use, and it is the one to go by.

That block is the most useful thing on the document. It is published "In accordance with Information Technology Act 2000 and rules made there under" and carries a named officer, a phone number, an email address and stated hours, Monday to Friday, 9:00 to 18:00.

Four practical points, none of them legal advice. One: browse before you identify yourself. The policy itself says you can use the site anonymously and that anonymity ends when you hand over personal information, so there is no reason to create an account before you intend to buy. Two: the surveys are optional. The policy says so, and they ask for income, education and age — which is more than a shampoo order requires. Three: if you have a complaint, use the Grievance Officer block, which is published precisely so that complaints have a named destination, and is faster than any argument about clauses. Four: save a dated copy if it matters. The policy can change at any time, carries no last-updated date, and the version that governs a dispute is not necessarily the one on the screen today. Everything above is mCaffeine's published text as it stood on 7 October 2026. This page describes a document and does not assess whether it complies with any law; nothing here is legal advice.