Mamaearth Privacy Policy 2026: Your DND Listing Does Not Apply

A privacy policy is the one document nobody reads and everybody accepts, so it is worth reading the paragraph that does the most work. We read Mamaearth's Privacy Policy on 14 October 2026.

The paragraph in question appears early, before the policy has even defined what personal information means. "Further, you agree and consent to receive all communications related to our services on the mobile number provided by you to the Company, even if such mobile number is registered under DND/NCPR list under the Telecom Commercial Communications Customer Preference Regulations, 2018."

It then goes two steps further. "Notwithstanding your registration with the National Do Not Call Registry (In Fully or Partly blocked category under National Customer Preference Register set up under the Telecom Regulatory Authority of India), you hereby express your interest and accord informed consent to receive communications (including commercial communications) in relation to the Company's services." And: "You further confirm that no communication to you from the Company or on behalf of the Company shall be construed as Unsolicited Commercial Communication under Regulation 2(bw) of the TRAI Regulations."

Taking a customer's consent this way is lawful and entirely routine across Indian e-commerce, and nothing on this page suggests otherwise. The reason it is worth knowing is narrower: a shopper who went to the trouble of registering on the DND list is unlikely to realise that placing an order has, by the policy's own wording, set that registration aside — and that the way back is the unsubscribe link, not the registry.

Two rows there are worth pausing on. The gift recipient's data is collected from you, not from them — "names of people to whom purchases have been shipped including address and telephone numbers" — and that person has not read this policy and did not agree to it. Collecting a delivery address is of course necessary to deliver anything, and this page alleges nothing improper; it is simply data about someone who is not the customer.

And "any open data and public records such as information about you that is openly available on the Internet" names no source and no limit. It sits in the list of categories collected and processed, between a date of birth and a shipping address.

Credit where it is due. The policy states that it "limits itself to collect information which is necessary", that card data runs through "third-party intermediary PCI-DSS compliant service providers" and that "the Company does not, itself, process or store the payment information", and it publishes a legal basis for each kind of processing — performance of the contract, legitimate interests, legal obligation and consent — which many Indian D2C policies do not bother to do.

The opt-out routes are real and specific, which is the most useful thing in the document. If the DND clause above matters to you, these are the controls that answer it, and the policy names all three without burying them.

Two limits are stated plainly and are worth knowing before you rely on them. On withdrawing consent: "any processing that we have carried out before the withdrawal of your consent remains lawful", and "notwithstanding such request, this information may be retained to comply with our legal obligations, resolve disputes and enforce our agreements".

On deleting a review: "we will endeavour and try to ensure to honour your request to remove information, however, our removal of your information does not completely erase that information from the internet viz. historical copies, or 'caches,' may remain."

The policy states it clearly: "We do not rent or sell your Personal Information to any third party." Three separate clauses then describe circumstances in which data moves anyway, and none of them is a sale.

On a merger or sale of the business: "Should we plan to merge/sell all or substantially all of our business to another business entity... we may transfer or disclose your Personal Information to that business entity who may collect, use or disclose such information for the purposes of evaluating the proposed transaction or for operating and managing the affairs of the acquired business."

Within the group: "We may share Personal Information with our other corporate entities" to "help detect and prevent identity theft, fraud" and to "correlate related or multiple accounts to prevent abuse of our Platform". The stated alternative is blunt: "If you have any objection to such sharing, then we request not provide us with any information."

With a co-sponsor, on consent: "you may be offered the opportunity to consent to the sharing of your information with a third party such as an event or promotion co-sponsor. If you consent, we will share your information with such third party and the information you provide may be used by such third party for their own purposes and in accordance with their own policies." That is the one route where your data leaves under someone else's rules, and it is the one that depends on an answer you give at the time.

The policy also names its advertising and analytics partners, including Google AdSense, the "DART cookie" and the "DoubleClick cookie", and points to the Google Ad Settings page and the Network Advertising Initiative opt-out.

The security section is more specific than most, listing "locked filing cabinets, restriction of access to offices, and alarm systems", "passwords and encryption, using generally industry best practices", firewalls and SSL, plus "confidentiality agreements, limiting access on a need-to-know basis, staff training and security clearances".

It then disclaims liability for the outcome: "we shall not be liable to any Customers for any loss, damage (whether direct, indirect, consequential or incidental) or harm caused to the Customers due to the unauthorized access or misuse of the Personal Information by any third party." Whether such a clause has effect is a matter for a court or a regulator, and nothing here says a breach has occurred or that any safeguard is inadequate.

On age: "Out Platform is not designed for individuals under the age of eighteen (18) and we do not knowingly collect Personal Information from anyone under the age of eighteen (18)" — the typo is the policy's own — and under-18s "may browse our Platform" but cannot register.

On changes: the policy will carry a "Revised (date)." notation, and amendments are "effective immediately upon posting on this page", with continued use signifying agreement. A Grievance Officer is named and addressed on the policy page, published "pursuant to the provisions of applicable laws including but not limited to the Information Technology Act, 2000 and the Consumer Protection Act, 2019" — which is the right place to start if you want any of the above actioned.

This page describes a published document. It is not legal advice and it does not tell you what your rights are. Read the version on mamaearth.in that applies when you shop, and take your own advice, before acting.