This policy explains how Limitless Institute LLP ("Limitless", "we") collects, uses and protects personal information when you visit or buy from the Limitless shop at www.limitless.institute/shop/. We are responsible for this information. It is published for owner review before sales begin.
Information you give us
When you order, we collect your name, email address, mobile number, delivery address, state and PIN code, the items you buy and the order total. The delivery address is also used as the billing address on your invoice. If you contact us, we keep your messages, and if you use our help form we keep your request and its reference number.
Payment information
Payments are processed by Razorpay in its own checkout window. You enter your card, UPI or bank details with Razorpay, not on our website. For each payment, our systems store the Razorpay payment reference, status, amount and payment method type (for example "UPI" or "card"). Razorpay processes your payment details under its own privacy policy.
Information collected automatically
Our servers receive standard technical information from your browser, such as your IP address, browser type and the pages requested. We use your IP address in a protected (hashed) form to limit repeated attempts and protect checkout and the shop administration from abuse; these records expire within hours. See our cookie policy for what is stored in your browser.
How we use your information
- To process your order and payment, and to deliver it.
- To send order confirmations, dispatch and tracking updates, and replies to your questions.
- To handle cancellations, returns, exchanges, refunds and complaints.
- To prevent fraud and misuse of the shop.
- To keep the accounting and tax records the law requires.
Marketing
We do not send promotional emails unless you have separately agreed to receive them, and every promotional email includes a way to unsubscribe. Order and service emails are part of your purchase. We do not sell your information.
Who we share it with
We share only what each service needs:
- Razorpay, to process payments and refunds.
- Our logistics partner and its courier companies, to deliver your order (name, address, PIN code and phone number).
- Netlify, which hosts this website and stores order records for us.
- Google Workspace, which hosts our email inbox, and our transactional email provider, which sends order emails.
- Government authorities, where the law requires it.
International transfers
We are based in India. Some of our service providers, such as Netlify and our email providers, may store or process information outside India, including in the United States, under their contractual and security commitments.
How long we keep information
- Order, payment and invoice records: 8 years from the end of the financial year, as Indian accounting and tax law requires.
- Customer messages and help requests: up to 3 years after the matter is closed, unless they form part of an order record.
- Unpaid or expired checkout records with no payment: deleted after 180 days.
- Security records used to limit repeated attempts: hours.
Security
Order records can be accessed only by authorised Limitless staff through a password-protected administration area with time-limited sessions. Information travels over encrypted (HTTPS) connections, and payment card details never reach our systems. No system is completely secure, but we take reasonable steps to protect your information, and we will notify you and the authorities of a personal data breach as the law requires.
Your rights
You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it by law, or withdraw a consent you have given. You can also complain about how we handle your information. To make a request, email hello@limitless.institute; we may need to confirm your identity first, and we acknowledge requests within 48 hours.
Applicable law
We handle personal information under India's Information Technology Act, 2000 and its rules, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The Digital Personal Data Protection Act, 2023 applies as its rules commence: the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and most of their obligations take effect on 13 May 2027. We will update this policy as these obligations come into force.
Children
The shop is not intended for children to buy from without a parent or guardian. We do not knowingly collect information from children; if you believe a child has given us information, please contact us and we will delete it.
Links to other websites
Our pages link to other websites, such as YouTube and social media. Their own privacy policies apply when you visit them.
Changes to this policy
We may update this policy. The latest version is always published on this page.
Contact and privacy requests
Email hello@limitless.institute, or write to Limitless Institute LLP, No 3, Ratna Vilas Road, near South End Circle, Basavanagudi, Bengaluru (Bangalore) Urban, Karnataka 560004, India. Grievance Officer: hello@limitless.institute.