Plum Privacy Policy 2026: Every Data Right Depends on Where You Live

Plum's privacy policy has the most complete list of data rights of the six Indian D2C privacy policies we read on 10 October 2026. It names a Right to Access / Know, a Right to Delete, a Right to Correct, a Right of Portability and a Right to Opt out of Sale or Sharing for Targeted Advertising. Beardo's policy, by comparison, offers one right and cites a repealed British statute for it.

Here is the sentence that introduces the list: "Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as per applicable laws."

Each right is then stated the same way. "You may have a right to request that we delete personal information we maintain about you." "You may have a right to request access to personal information that we hold about you." May have.

We counted the conditional phrasing across the document: six instances — three "Depending on where you live", two "Depending on where you reside", one "depending on where you are". That is not sloppy drafting; it is a template written to be used in many countries at once, and the hedge is what lets one document serve all of them.

If every right depends on where you live, the obvious question is whether the document says what happens if you live in India. It does not. We counted: the word "India" appears zero times in Plum's privacy policy. The Digital Personal Data Protection Act, 2023 — India's own data law — is not mentioned either.

Two jurisdictions do get named, and one of them gets its own section. The policy carries a paragraph beginning "If you reside in the UK or European Economic Area", and the European Economic Area is referred to twice. The children's clause is framed the same borrowed way: Plum does not knowingly collect information about "children under the age of majority in your jurisdiction" — a formulation that assumes the age of majority varies by jurisdiction, which in India it does not. The Indian Majority Act, 1875 sets eighteen nationally.

None of this means an Indian customer has no rights. Indian law applies to an Indian sale whatever a privacy policy says, and the company does publish a working contact for exercising rights. The practical problem is narrower and real: a shopper in Mumbai reading "you may have a right to request that we delete personal information" has no way to tell from this page whether that sentence is about them. The one document that should answer the question declines to.

Plum is not unusual in this. We read Neemans' privacy policy the same morning and found the identical template — the same six conditional phrases, the same UK and EEA paragraph, the same structure. Four other brands read that morning run different documents entirely.

The document says so itself, in a section headed "Relationship with Shopify": "The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside."

That explains the hedging — this is the standard privacy notice Shopify provides to merchants, written to satisfy Californian, European and British law at once. And because it was written to satisfy those regimes, it discloses something most Indian-drafted policies do not:

"With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalized advertising with third-party services based on your online activity with different merchants and websites."

Your online activity with different merchants. Not with Plum — across stores. The policy goes further: "to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify."

This is an ordinary and lawful feature of modern e-commerce and an enormous number of stores use it. The reason to read it carefully is that the borrowed template is more forthcoming than the Indian-drafted alternatives: Beardo's policy names no advertising partner at all, and Minimalist's refers only to "other parties". The template hedges on your rights and is candid about the tracking; the local documents do the reverse.

Three things in this document beat every bespoke Indian policy we read on 10 October, and they deserve saying.

It honours the Global Privacy Control signal. "Please note that if you visit our website with the Global Privacy Control opt-out preference signal enabled, depending on where you are, we will automatically treat this as a request to opt-out for the device and browser that you use to visit the website." That is a browser-level setting honoured without you asking, and no other policy we read this month mentions one.

It names the categories of recipient. Data goes to "Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping)". Beardo's policy names no recipient at all; Minimalist's says "trusted third parties".

It is honest about security. "Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee 'perfect security.' In addition, any information you send to us may not be secure while in transit." Most policies claim "suitable physical, electronic and managerial procedures" and leave the impression that nothing can go wrong.

The retention answer is weaker: "How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies." No period is stated — but at least the question is asked, which is more than five of the six policies manage.

Do not try to work out from the page whether a right is yours. Email sprasad@pureplaylabs.com, the address the policy gives for exercising rights, and ask for what you want — access, deletion, correction — without citing the policy's conditional wording back at it. The contact is real and the operator, Pureplay Skin Sciences at LODHA iThink in Thane West, is named with an address.

If the targeted advertising is what bothers you, turn on Global Privacy Control in your browser, because the policy commits to treating that signal as an opt-out automatically. That is faster than any email, and it works across every Shopify store running this same notice — which, on the evidence of these six reads, is a growing share of them.

Nothing on this page is legal advice, and nothing here says Plum has breached any law, denied any request or mishandled anyone's data. This describes a published document as it stood on 10 October 2026, and the policy shown on plumgoodness.com prevails over anything written here.