Jyoti Refractories is a manufacturer and supplier of ceramic foundry filters, operating as a sole proprietorship of KAILASHBHAI RUPSINGBHAI UGHAREJA. We run the website https://www.jyotirefractories.com and we are the party responsible for the personal data this website collects.

This policy explains what we collect from visitors and customers of this website, why we collect it, who it is shared with, how long it is kept, and the choices you have. It applies to the public website, the customer account portal, the transactional messages we send by email and WhatsApp, and conversations with our WhatsApp business number.

We only collect what is needed to answer an enquiry, prepare a quotation, deliver an order or run your account. Everything below is data you give us through a form on this website or in a message to our WhatsApp business number, or data the website generates when you use it.

• One account per email address. Your normalised email is the identity key for your orders, quotations, invoices and saved products.
• Your password is stored only as a bcrypt hash. We cannot read it, and it is never shown to anyone.
• You can sign in with your password or with a one-time code emailed to you. The code is stored only as an HMAC hash, expires after 10 minutes, and allows a maximum of 5 attempts.
• After signing in, the browser receives a session cookie named “jr_customer”. It is httpOnly, SameSite=Lax, marked Secure over HTTPS, and expires after 14 days or when you sign out.
• We record the last successful sign-in time. Changing your password invalidates older sessions, so a previous device is signed out.
• Sign-in attempts and password changes are written to an internal audit log with a one-way hash of the requesting IP address and a shortened browser description. The raw IP address is not stored, and neither are passwords or codes.

Order data is the most detailed information we hold, because it is also our statutory tax record. For each order we keep the customer and address details, the ordered items, the GST breakup and totals, and the documents issued — proforma invoice and tax invoice, with their numbers and dates.

• Every status change (pending, confirmed, processing, ready, dispatched, completed, cancelled) is appended to an order history trail along with who made the change and when.
• Dispatch details recorded against an order include the transporter, the LR / consignment number and the dispatch date, so you can follow the consignment from the portal.
• Payment status and payment date are recorded. Payments themselves are made off the website by bank transfer, UPI, cheque or advance against proforma — this website never handles your payment credentials.
• Your GSTIN and place of supply decide whether CGST + SGST or IGST applies, and they appear on the tax invoice as required by law.
• Quotations are kept with their reference number, line items, totals and how you asked to receive them. The quotation validity printed on the document is 15 days from the date of issue.

Contact-page messages, product enquiries, bulk enquiries, “email me this product” requests and sample requests all land in the same internal enquiries list. Only our own staff see them in the admin panel.

• The purpose of an enquiry is to reply to you, so your contact details are used to send that reply by phone, email or WhatsApp.
• Internal notes, approval decisions and rejection reasons added by our staff are never shown on the public website or returned to you in an automated response.
• Reviews are published only after approval. A review you submit stays unpublished until it is approved, and you can ask us to remove it at any time.
• Sample requests also record the page you came from and any campaign tags present in the link, which tells us which of our pages generated the request.
• Public forms are rate limited and payload-capped to stop spam and abuse. This is applied to the request, not used to build a profile of you.

The public application code in this repository contains no Google Analytics, Meta Pixel or other third-party advertising / analytics tag. Its own product-view and homepage-slide counters are first-party. The public customer area uses a sign-in session cookie; the separate /admin area uses its own operator session, short-lived verification and display-preference cookies, and the staff-only WhatsApp inbox uses its own session cookie. Everything else listed below is stored in your browser's local storage and remains there unless a feature explicitly sends the associated data.

We cannot inspect scripts injected separately by the hosting platform or deployment configuration, outside this application code. If a separate provider is added there, its collection should be disclosed here and in that provider's own policy.

Our on-site analytics are first-party. A product view is stored against the browser's random visitor id, the product and the action; a homepage slider interaction is stored as the slide, the event and the device type. Those event fields do not include your name, email, phone number or IP address, but the random id groups events from the same browser and is also used for the chat transcript. The chat messages themselves may contain identifying details you type, so they are described separately above. Product-view logging can be switched off from the admin panel, in which case no browse event is written.

Our WhatsApp business number is +91 99098 99496. We use it through Meta's WhatsApp Business Cloud API in three ways:

• Conversations — when you message our business number, our staff read and reply to your messages from our internal WhatsApp inbox.
• Transactional notifications — when this feature is enabled and configured, we send pre-approved template messages about your own business with us: order status changes, dispatch with the transport reference, order completion, a quotation being ready, a proforma or tax invoice being issued, and sample request updates.
• Marketing messages — we may send product or offer updates using templates approved by Meta, but only to numbers for which we have recorded your explicit opt-in, including when and how you gave it. Messaging us about an enquiry or an order is not treated as consent to marketing.

When you exchange messages with our business number, we store the following in our own database:

• Contact record — your WhatsApp number and the profile name your WhatsApp account shows. Our staff may add details you have given us, such as your name, company, email address, city, state, country, customer type and product interest, together with tags and internal notes.
• Messages — the text of each message you send us (up to 4,000 characters), including the text of any button you tap, and of each reply we send, with the date and time and which member of our team sent each reply.
• Delivery information — for messages we send, the status WhatsApp reports (sent, delivered, read or failed), the message identifier issued by Meta and any error code.
• Attachments — for a photo, document, audio, video or sticker you send, its file name, file type, caption and Meta's media identifier. We do not currently download or keep a copy of the file itself; it remains with WhatsApp under Meta's terms. If you share a location, we record only that a location was shared.
• Conversation management — the conversation's status, labels, the team member it is assigned to, the unread count and a short preview of the latest message, plus any follow-up tasks and notes our team creates.
• Your choices — whether you have agreed to receive marketing messages (and when and how), whether you have opted out, and whether you have asked us not to contact you.
• Campaign records — if a marketing message is sent to you, the campaign it belonged to, your number and the delivery outcome.
• Notification logs — for each automated notification, the event type, the template, the business reference (such as an order number), a masked destination number, the delivery status, Meta's message identifier, the attempt count and timestamps. These logs do not contain the message text.

Who can see it and how it is protected:

• Conversations are visible only to our own staff who have been given a role in the WhatsApp inbox (owner, manager, agent or viewer). Staff sign in to the inbox separately; the session expires after 8 hours and can be ended from our server, and what each role may do is checked on our server for every action.
• Actions in the inbox — including opt-outs and any deletion — are recorded in an internal audit log that identifies the staff member (or the automated process) and the record concerned; the log is filtered so that it does not copy message text or phone numbers.
• We accept incoming WhatsApp data only when it carries a valid signature from Meta.
• WhatsApp one-time-code login is used only for our own staff accounts. Customer accounts sign in with a password or an emailed code.
• Messages travel through Meta's WhatsApp Business Cloud API, so Meta processes them to deliver them between you and us, under Meta's own terms and privacy policy.

AI reply suggestions:

• Our team may enable an AI assistant that suggests reply drafts. When a staff member requests a suggestion, up to the 12 most recent messages of that conversation (yours and ours, each shortened to 600 characters) are sent to the AI model provider we have configured, together with public information about our company and products. Your contact record — such as your number, email address and our notes — is not added to that request, but anything written in the messages themselves is included.
• Before a request leaves our server, automated filters mask certain long number sequences and credential-like strings, and refuse the request if any remain. This does not remove names, addresses or other personal details from the messages.
• The assistant only suggests text. It cannot send messages: a member of our team reviews the suggestion, edits it if needed and decides whether to send it. The draft, the reviewer and the model used are stored with the conversation.
• Please do not send passwords, one-time codes, bank details or card details to us on WhatsApp.

Stopping WhatsApp messages:

• To stop all WhatsApp messages from us, including marketing, reply "STOP" or "UNSUBSCRIBE" as the whole message, or tap the opt-out button in one of our marketing messages (such as "Stop promotions"). Our system records your opt-out automatically. From then on it refuses to send WhatsApp messages to your number, whether a staff reply, a marketing message or an automated notification.
• You can also ask us by email or phone; our team then records the opt-out in the same way.
• Automated notifications only — you can instead switch WhatsApp notifications off in the account portal (Notifications → Communication preferences). That setting controls automated notifications only. Account-security notices, such as sign-up verification and password changes, are sent by email and are not affected by it.
• To receive WhatsApp messages from us again after opting out, tell us; we do not restart messages on our own.
• You can also block our number inside WhatsApp at any time.

WhatsApp conversations and contact records do not expire automatically. "How long we keep your data" below explains how long each type of record is kept, and the Data Deletion page explains how to have it deleted.

• Customer data is stored in the PostgreSQL database configured for the website deployment. The application code does not specify the database provider or data-centre region, which can vary by deployment.
• Passwords are hashed with bcrypt. Session tokens are signed with a server-side secret that never leaves the deployment environment.
• One-time codes are stored only as HMAC hashes, with a short expiry and an attempt limit.
• Credentials saved through the system's encrypted secrets vault use AES-256-GCM; its root key is held in the deployment environment and is not stored in the database. Credentials supplied directly through deployment environment variables are managed by the hosting configuration instead.
• Sign-in and OTP endpoints use rate limits. Some public forms, including sample requests, also apply rate limits, payload caps and a honeypot; protections vary by form.
• Access to customer data inside our business is limited to the proprietor and authorised operators through a separate, password-protected admin area with its own session, step-up verification and audit log.
• WhatsApp conversations are stored in the same database and are available only to staff with a WhatsApp inbox role, through a separate sign-in (see "WhatsApp Business communication" above). The WhatsApp access token and app secret are held on the server and are never sent to the browser.
• Backups and disaster-recovery copies are written to private object storage when the business has configured it; where it is not configured, they remain on the application instance.

We share data only with the services listed below, only to the extent needed for the purpose stated, and never for advertising. We do not sell or rent customer data.

There is no payment processor in this list because this website has no online checkout. Payment is settled directly by bank transfer, UPI, cheque or advance against proforma.

You can contact us to request any of the following. We will reply using the email address or phone number already on record for you, which is how we confirm the request is really from you. Your requests are handled under the laws currently in force in India and our business process; the Digital Personal Data Protection Act, 2023 is being brought into force in phases.

• Access and summary — ask what personal data we hold about you (enquiries, quotations, orders, invoices, account and profile) and receive a summary of it.
• Correction and completion — update your profile, addresses and contact details yourself in the account portal, or ask us to correct a record.
• Erasure — ask us to delete your personal data. See the Data Deletion page for exactly what can and cannot be removed.
• Opt-outs — contact us to remove your newsletter subscription; switch automated email and WhatsApp notifications off in the account portal; reply "STOP" or "UNSUBSCRIBE" to our WhatsApp number, or tap the opt-out button in a marketing message, to stop all WhatsApp messages including marketing; or ask us to stop following up on an open enquiry.
• Grievance redressal — raise a complaint with the contact person named at the end of this policy, and escalate if it is not resolved.
• Nomination — where and when this right is in force under India's data protection framework, you may nominate another person to exercise rights on your behalf.

Customer account, enquiry, order, chat, WhatsApp conversation and delivery-log records do not have a general automatic expiry job in the application. Eligible data is removed when a deletion request is processed; records required by law and random-id analytics may remain. Backup retention is configured separately and can vary by deployment. The table below states the position for each type of data.

You can ask us to delete your personal data at any time, with or without an account. The full procedure — how to send the request, how we verify it, what we delete and what we must keep — is published on the Data Deletion page.

• Email kelashughareja@gmail.com with the subject “Data Deletion Request”.
• Or send a WhatsApp message to +91 99098 99496.
• Or call +91 99098 99496 during Mon – Sat · 9:30 AM – 7:00 PM.

• This website sells industrial ceramic foundry filters to foundries and businesses. It is not directed at anyone under 18, and we do not knowingly solicit personal data from children. If you believe a child has submitted information, contact us so we can review and take appropriate steps under applicable law.
• Our business is based in Gujarat, India. Hosting, database, email, Meta and AI services may process data in other jurisdictions depending on the deployment and provider settings; we do not claim a particular data-centre location. Only the data needed for that specific service is shared.
• Our website links to WhatsApp and embeds a Google Map. We are not responsible for what happens on those third-party services once you leave this website.
• We may combine enquiry and order data internally to answer repeat enquiries and re-price repeat orders. We do not use it for automated decisions that produce legal effects about you.

This policy was last updated on 13 October 2026 (version 1.1). If what the website does with data changes, this page is updated with it and the date above is revised. The current version is always available at https://www.jyotirefractories.com/privacy-policy.

Questions about this policy, or a complaint about how your data has been handled, should be addressed to the contact person below. Please include the email address or phone number your records are held against, so we can find them.