Privacy Policy

1.1This Privacy Policy explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and what you can do about it. It applies to the Drip Club mobile applications on Android and iOS, to holydrip.club, and to everything we do through them. We call all of that the Platform.

1.2This Policy forms part of our Terms of Use. Words defined in the Terms of Use, such as Account, Order, Product and Merchant Partner, carry the same meaning here.

1.3We have written this Policy to be read, not filed. Where a topic has a section of its own, we have given it one rather than folding it into a longer list. Information we obtain from your Google account is governed by Section 6. Where other Sections mention that information, they do so by reference to Section 6 and add nothing to what Section 6 permits.

1.4Indian data protection law is changing in stages. Until the provisions that repeal it commence on 14 May 2027, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to apply to us, and from that date the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 apply as they come into force. Where this Policy describes a standard drawn from the 2023 Act or the 2025 Rules before the provision behind it commences, we apply that standard as a matter of our own practice rather than because it is already binding on us.

2.1The Platform is operated by Audacity Club Private Limited, a company incorporated in India. We decide why and how your personal data is processed, which under the Digital Personal Data Protection Act, 2023 makes us the Data Fiduciary for that data. You are the Data Principal.

Registered office

Second Floor, 235, Firegro Stay Safe Client Care Division, Indiranagar Double Road, Indiranagar, Bengaluru, Karnataka 560038, India

CIN

U62099KA2026PTC213980

GSTIN

29ABECA5946K1Z6

Privacy contact

[PRIVACY CONTACT NAME], [PRIVACY CONTACT DESIGNATION], [PRIVACY EMAIL]

Customer support

[SUPPORT EMAIL]

2.2We operate under the brands HolyDrip, Drip and Drip Club. Whichever brand you encounter, the company responsible for your personal data is Audacity Club Private Limited. In this Policy "we", "us" and "our" mean that company.

2.3The person named as our privacy contact in clause 2.1 can answer any question you have about how we process your personal data. Their details also appear in every response we send to a request you make under Section 17.

3.1This Policy covers personal data about you that we process when you visit the Platform, create an Account, browse, place an Order, contact our support team, or use any feature we offer, whether or not you buy anything.

3.2It does not cover:

• How a Merchant Partner uses personal data we pass to it so that it can fulfil your Order or handle a claim you make against it. In respect of that use, the partner decides its own purposes and is responsible for its own compliance. Clause 10.3 explains what we pass on.
• Websites, applications and services operated by other people that you reach from the Platform, including a payment provider's own page. Their privacy notices apply there.
• Anything you choose to publish publicly on the Platform, which other users can see.

3.3This Policy is written for India and is governed by Indian law. The Platform is offered to people in India.

4.1We collect the following categories of personal data. Some of it you give us, some we generate as you use the Platform, and some we receive from other people who help us run it.

4.2We do not ask you for, and you should not send us, your card number, card expiry, CVV, UPI PIN, bank password or any one-time password. Section 11 explains how payments work.

4.3We do not buy personal data about you from data brokers, and we do not build profiles of you from information we have bought. Information we receive because you chose to connect another service to your Account, such as the Google account feature in Section 6, is not information we have bought, and Section 6 governs what we do with it.

4.4You can use much of the Platform without giving us most of this. What we genuinely need is set out in clause 8.3.

4.5Permissions we ask your device for. Some of the personal data in clause 4.1 reaches us only if you give the application a permission. We ask for each one separately, at the point it is needed, and you can refuse it, or withdraw it later in your device settings.

4.6We do not ask your device for access to your text messages, your call logs or your contacts. If you are ever asked for one of these in our name, it is not us.

4.7Some of what we hold about you is not information you gave us. We work it out from the categories above and from what you do on the Platform, for example the size we think will fit you, the price ranges and brands you tend to buy in, the result of the skin analysis if you gave us a selfie, and the outcome of the automated checks described in clause 9.6. What we work out about you is personal data too, it is covered by this Policy, and you can ask us for a summary of it or ask us to correct it under Section 17.

4.8Some of what we hold about you comes from other people rather than from you. Our courier and order management partners tell us where your package is and what happened to it. A Merchant Partner tells us the outcome of a return, an exchange, a claim or a warranty you raised on its Product, and what it found. Our payment partners tell us whether a payment succeeded and give us a reference for it, as clause 11.2 explains. We record what they tell us against your Order, and you can ask us to correct it under Section 17. This Policy does not govern how any of those parties handled the information before they gave it to us.

5.1Two features ask for information about your body, and both are optional.

5.2Fit and sizing. You can tell us your height, weight, body type and skin tone. We use this to recommend sizes, to filter what we show you, and to make our styling and recommendations more useful to you. You can change or remove these details at any time. Where we provide a control for it in the app, it is at [IN-APP PATH: FIT AND STYLE], and you can in every case ask us at [PRIVACY EMAIL]. Changing or removing them does not affect any Order you have already placed.

5.3Skin analysis. You can upload a selfie so that we can analyse your skin tone and undertone and use the result to recommend colours and products. If you do:

• We process the photograph to produce the analysis, and we use a service provider, [SKIN ANALYSIS PROVIDER], to do that on our instructions. Clause 10.2 records what that provider receives.
• We use the analysis to personalise what we show you.
• We do not use your photograph, or the analysis, to train or improve any artificial intelligence model, and we require the provider that performs the analysis to retain nothing and to train on nothing.
• We do not use your photograph for identification, we do not match it against any other person's photograph, and we do not permit the provider that performs the analysis to do either.
• We do not publish your photograph, and we do not use it in marketing, unless you separately agree.
• You can have the photograph and the analysis deleted at any time, without closing your Account. Use the control at [IN-APP PATH: SKIN ANALYSIS] where we provide one, and in every case by writing to us at [PRIVACY EMAIL]. Clauses 15.1 and 15.2 say what happens then. Clause 15.4 covers the different case of deleting your Account.

5.4Some features show clothing on a model rather than on you. Those images are generated from our own photography of our own models, and your photograph is not used to make them.

5.5You can use the Platform, browse, and buy without giving us any of the information in this Section.

This Section is long because the feature is unusual. Five things in it would change most people's decision, so they are here at the top, and each links to the clause that governs.

What we read. Only messages Gmail itself classifies as purchases, from fashion and lifestyle retailers on a list we maintain, from the last 180 days. Clause 6.4. It keeps running. This is not a one-time import; our systems keep checking until you disconnect. Clause 6.5. Message content goes to an outside provider. To turn a message into structured purchase details we send the relevant part of it to a third-party artificial intelligence provider, under contract, on our instructions. Clause 6.6. What we never do with it. No advertising, no retargeting, no model training, no sharing with a Merchant Partner, no reading by our staff, and no input into what marketing we send you. Clauses 6.9 and 13.4. Disconnecting and deleting are two different things. Disconnecting stops the reading; deleting removes what we already took. You choose both at the point you disconnect. Clause 6.10.

6.1The Platform offers an optional feature that reads the shopping emails in your Google account so that we can build a purchase history for you and show it to you. This Section describes that feature in full. Other Sections mention information from your Google account only to say what category it falls into, who processes it for us, how long we keep it and what happens when you delete your Account, in particular clause 4.1, clause 7.1, clause 9.1, clause 10.2 and clause 15.1. None of them permits any use beyond the two in clause 6.8, and if any other Section appears to go wider, clause 6.8 prevails.

6.2It is optional. You can create an Account, browse, buy, return and use every other part of the Platform without connecting your Google account. We do not make connecting a condition of anything, we do not charge more if you decline, and we do not withhold Products, prices or promotions from you if you decline.

6.3What we ask Google for. When you connect, Google asks you to approve a specific level of access. We request:

We ask for read-only access because it is the narrowest scope that lets the feature work. We do not request the ability to send or modify mail, and we cannot obtain it without asking you again.

6.4Which emails we look at. We do not read your mailbox generally. We ask Google only for messages that meet both of the following:

• Gmail has itself classified the message as a purchase message; and
• the message arrived in the last 180 days.

We then apply our own filters to what Google returns. We keep a message only where the sender is a fashion or lifestyle retailer on a list we maintain, and only where the message is not one our rules identify as a non-fashion purchase, such as food delivery, travel or bill payment. Everything else is discarded, is not stored, and goes no further.

We also limit how much we look at, so what we build for you comes from a sample of your shopping email rather than all of it. In a run we retrieve the full content of no more than the first 30 qualifying messages, we process no more than 200 messages in total, and where we send a message on for the extraction described in clause 6.6 we send no more than the first 2KB of it. This means your purchase history may not show every purchase you have made.

We do not ask Google for anything outside the categories above, and we do not go looking for your personal correspondence.

6.5It is an ongoing connection. This is not a one-time import. Once you connect, our systems keep checking for new qualifying messages until you disconnect. We do not work through your whole mailbox at once: there is a limit on how many messages we examine in any one pass, currently up to 200, so what you see in your purchase history is what we have been able to extract within that limit and not necessarily every purchase message you have. We keep an internal record of the message identifiers we have already examined so that we do not normally examine the same message twice. That record holds up to 1,000 recent identifiers, so on a busy mailbox an older identifier drops out of it and a message we examined some time ago can be examined again, and its content sent for extraction again as clause 6.6 describes.

6.6How the reading is done. Reading and processing happen on our servers, not on your device. To turn the content of a qualifying message into structured purchase details, we send part of that message to a third-party artificial intelligence provider, which processes it on our instructions and returns the extracted details to us. What we send is the opening part of the message body, cut to the first 2KB of it. That cut is by size, not by hand, so it can include text that is not itself a purchase detail, such as a greeting addressed to you or a delivery address printed at the top of a confirmation. We do not send attachments, and we do not send messages that fail the tests in clause 6.4. Clause 10.2 names the providers involved, and some of them are reached through an aggregator that passes the request on to a model provider on our behalf. Some of that processing happens outside India, and Section 14 explains our position on that.

6.7What we keep, and what we do not. We do not store your emails. We store only the details extracted from them, together with the record of examined message identifiers described in clause 6.5. The details we store are:

• the brands you have bought from;
• the purchases we can identify, which is the item as the message describes it, together with the retailer and the date;
• the price ranges you buy in;
• the identifiers of the messages we have already examined, as described in clause 6.5; and
• a technical record of the version of the software that produced the extraction.

We do not store the subject line or body of your emails, your attachments, your contacts, or the addresses of the people you correspond with.

Two further things are stored, and they are not extracted purchase details. We store an identifier for the Google account you connected, so that we link the right mailbox to your Account. We also store the access credentials Google issues to us when you connect, which are an access token and a refresh token. The refresh token is what allows our systems to keep reading new qualifying messages without asking you to sign in again. Clause 6.10 explains how those credentials are removed, and clause 15.1 sets out how long they are held.

6.8What we use it for. We use the extracted details for two things and no others:

• to build and show you the purchase history feature in the Platform, which you can open and see; and
• to personalise the recommendations, sizing and styling we show you.

6.9What we will never do with it. Information we obtain from your Google account, and anything we derive from it:

• is not used to serve you advertisements, for retargeting, or for interest-based or personalised advertising, and is never transferred to an advertising platform, an advertising network or a data broker;
• is not used by us to create, train, improve or evaluate any artificial intelligence or machine learning model, including any general-purpose or foundational model. Where we send part of a message to a provider for extraction under clause 6.6, our contract with that provider requires it to use the content only to return the extraction to us, and prohibits it from retaining the content or using it to train or improve any model;
• is not sold, licensed or transferred to anyone for their own purposes;
• is not shared with a Merchant Partner;
• is not used to decide what marketing messages we send you, and is not used to build any marketing audience, segment or campaign, as clause 13.4 confirms; and
• is not accessible to our staff. Our systems process it; our people do not read it, and today there is no interface through which a member of our staff could open a message in your mailbox. The only exceptions are the narrow ones Google's own policy allows, namely where you have given us your explicit and recorded agreement that a named person may look at specific messages, for example to help us resolve a problem you have reported, where access is necessary for security purposes or to investigate abuse, where the law requires it, or where the data has been aggregated and anonymised so that it no longer identifies you and is used for internal operations. Clause 6.6 explains the automated processing that does read the content of a qualifying message.

6.10How to disconnect, and what happens then. There are five separate things that can happen, and they are not the same:

When you disconnect, we stop reading your mailbox and we stop using anything we took from it to personalise what we show you. We then ask you what should happen to the details we have already extracted: keep them, so that your purchase history is still there if you reconnect, or delete them there and then. If you keep them and you have not reconnected within [PERIOD AFTER DISCONNECTION], we delete those details and the record of examined message identifiers without your having to ask. You can also ask us to delete them at any time, in your profile using the path in the table above or by writing to us at [PRIVACY EMAIL], and we will. Deleting your Account deletes them too. Clause 15.5 explains the narrow records we cannot delete straight away.

6.11The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

7.1We use your personal data for the purposes in the table below, and for no other purpose without telling you and, where the law requires it, asking you first.

7.2We collect only the personal data that is necessary for the purpose we collected it for.

7.3Where we want to use your personal data for a purpose that is not in the table in clause 7.1, we will tell you about that purpose and obtain your consent before doing so.

8.1We process most of your personal data with your consent. Part of what we do rests instead on grounds that the Digital Personal Data Protection Act, 2023 allows without consent, chiefly complying with a law in force or with an order of a court or an authority. The legal and regulatory purposes in the table in clause 7.1, the disclosures in clause 10.4, and the records we have to keep under clause 15.5 are of that kind. You cannot switch those off by withdrawing your consent, and we say so here rather than leave you to find it out later. Where we do rely on your consent, we will give you, before we ask for it, a notice that tells you in plain language what personal data we want, what we want it for, how to withdraw your consent, how to exercise your rights, and how to complain to the Data Protection Board of India. That notice will be a separate document from this Policy, designed to be understood on its own. This Policy is the fuller account behind it.

8.2Your consent is given by a clear affirmative action, and it is specific to the purpose we asked about. We do not treat silence, a pre-ticked box, or your continued use of the Platform as consent to something you were not asked about.

8.3Some things we genuinely cannot do without certain personal data, and some things are part of running the Platform safely rather than a choice. We need your mobile number to create and secure your Account, because that is how you sign in. To deliver an Order we need your name, your delivery address and a contact number for the courier. That is the whole of what is required. The checks for fraud and for abuse of returns described in clause 9.6 are not a choice either, and they continue for as long as you hold an Account. Everything else is a choice. In particular, the following are optional, and declining them does not stop you using the Platform or buying from us:

• connecting your Google account under Section 6;
• giving us your height, weight, body type or skin tone;
• uploading a selfie for skin analysis;
• allowing access to your device's precise location, as clause 4.1 explains;
• receiving marketing messages;
• giving us your email address, which we use to send you Order confirmations and invoices and, where you have asked for them, marketing emails. You sign in with your mobile number, so you can create an Account and buy without giving us an email address;
• sending us a photograph or a video to support a return or a claim, although without it we may not be able to approve that claim; and
• allowing push notifications, which you control in your device settings.

8.4You can withdraw your consent at any time, and doing so should be no harder than giving it. Where we provide a control in your profile for an optional item in clause 8.3, you can withdraw it there, at [IN-APP PATH]. Access to your device location works differently: you give it and you withdraw it in your device settings, as clause 4.1 describes, and permission for push notifications is a device setting too, which clause 13.5 covers. You can also stop marketing messages using the opt-out carried in any message we send you. In every case you can withdraw by writing to us at [PRIVACY EMAIL], and we will act on it. Withdrawal takes effect going forward, and it stops us using information from the source you have withdrawn to personalise what we show you. It does not make unlawful anything we did while your consent was in place, and it does not affect processing we are separately required by law to carry out, such as keeping Order records for tax.

8.5If you withdraw consent for something the feature depends on, the feature stops working. For example, if you withdraw the skin analysis, we can no longer recommend colours on that basis. We will tell you what you are turning off before you turn it off.

8.6Where you give us personal data about another person, for example when you have an Order delivered to someone else, you confirm that you are entitled to give it to us for that purpose.

9.1Much of what you see on the Platform is chosen for you rather than shown to everyone. We use what we know about you, including what you have browsed and bought, your fit and style details, your skin analysis if you gave us one, and your purchase history from Section 6 if you connected it, to decide which Products to show you, in what order, and which size and colour to recommend.

9.2This is automated. No person reviews each individual recommendation before it is shown to you.

9.3Personalisation changes what we show you. It does not change a Product's listed price. We do not vary a Product's listed price between customers on the basis of personal data. Promotional offers and Store Credit are a separate matter and can differ between customers.

9.4Training. We do not use your personal data, your photographs or the content you submit to train or improve our own artificial intelligence models. What we do is run your information through models to produce a result for you, which is a different thing. Where a feature sends your information to a service provider's model, our contract with that provider requires it not to use what we send to train or improve any model of its own and not to keep it beyond what the processing requires. If our own position changes, we will update this Policy, tell you before the change takes effect, and where consent is required we will ask for it. Information from your Google account is outside all of this in any event. Clause 6.9 rules out training on it absolutely, by us and by any service provider, and because Google's own policy makes that permanent, it is not a position that can change.

9.5We do use information that does not identify you, including aggregated and statistical information, to make our recommendations and our catalogue better.

9.6We also use automated checks to detect fraud and abuse, including abuse of returns. Where an automated check leads us to limit your return privileges, decline an Order or suspend your Account, we will tell you, and you can ask us to review the decision under our Terms of Use. We will look at the decision again, tell you the outcome and give you the reason for it.

10.1We do not sell your personal data. We do not rent it, and we do not trade it. Clause 10.5 explains the one situation in which personal data may pass to another company, which is a reorganisation, merger or sale of our business.

10.2We share personal data with service providers who do specific work for us, on our instructions. They are bound to keep it confidential, and we require them to use it only for that work and not for their own purposes.

10.3Merchant Partners. Where a Product you order is sold by a Merchant Partner, we give that partner what it needs to fulfil the Order and to deal with a return, a claim or a warranty, which is your name, delivery address, contact number and Order details. A Merchant Partner is responsible for its own use of that information. We do not give a Merchant Partner your browsing history, your fit or skin details, your photographs, or anything from your Google account.

10.4Legal and protective disclosures. We may disclose personal data where we are required to by law, by a court, or by a government authority acting under law, and where it is necessary to establish, exercise or defend a legal claim, to investigate fraud or abuse, or to protect the safety of any person. Where we are permitted to tell you about such a disclosure, we will.

10.5Business transfers. If our business, or part of it, is reorganised, merged, sold, or transferred in an insolvency, personal data may transfer to the person taking it over as part of that transaction. We will tell you before the transfer takes effect, on the Platform and by message to the mobile number or email address on your Account, and we will tell you who the person taking over is. Until the transfer takes effect you can delete your Account or withdraw your consent as Sections 8 and 15 describe. We will require the person taking over to be bound by this Policy, or by a policy at least as protective of you, in the agreement that transfers the data. We do not sell your personal data, and a transfer of this kind is not a way around that.

10.6Content you make public. If you post a review, a rating, a comment or an image in a public part of the Platform, other users can see it, and so can anyone else who can reach that page. We store it, we display it and we decide how it appears, so this is processing by us as well as a choice by you. We show it under [DISPLAY NAME CONVENTION]. We may moderate it or remove it under our Terms of Use. What happens to public content when you delete your Account is [PUBLIC CONTENT ON DELETION]. Please do not put anything in a public post that you would not want a stranger to read, including your address, your phone number or your Order number. A photograph you upload to a private feature, including a selfie for skin analysis, is not published and is not used in marketing unless you separately agree, as clause 5.3 says.

10.7We also use Slack for internal team messaging and RazorpayX for business banking. These are internal business tools rather than parts of the Platform, which is why they are not in the table in clause 10.2. Where personal data about you reaches either of them, it is because someone on our team has recorded it there while running the business, for example while resolving a support query or making a refund payment.

11.1Payments are taken by our payment partners, not by us. When you pay, your card, UPI, netbanking or wallet details are collected by the payment partner, whether on its own page or through its interface presented inside the Platform.

11.2We do not ask for or handle your full card number, your card expiry, your CVV, your UPI PIN, your netbanking credentials or any one-time password. You enter those with the payment partner. What we receive back from the payment partner is whether the payment succeeded, a reference for it, and, where the partner returns them, the last four digits and card network so that you can recognise which method you used. Clause 4.1 lists this under Payment.

11.3Where a payment method is saved for you, it is saved by the payment partner under the rules applicable to it, not by us.

11.4Payment partners handle your information under their own privacy policies and under the rules that apply to them as regulated payment entities.

12.1On the website we use cookies and similar technologies. In the applications we use the equivalent device and installation identifiers. We use them to keep you signed in, to remember your preferences and what is in your bag, to keep the Platform secure, and to understand how the Platform is used.

12.2We group them as follows:

• Necessary. Required for the Platform to work, including sign-in, security and keeping your bag. Blocking them will stop parts of the Platform working.
• Analytics. Used to understand which features are used and where people run into problems. We use Mixpanel for this. On the website you can block analytics cookies in your browser. In the applications analytics is built into the application itself, and there is no setting today that lets you switch it off. We are building one, and we will update this Section when it is available.
• Preference. Used to remember choices you have made, such as your size or your recently viewed items.

12.3On the website you can control cookies in your browser, including the analytics cookies described in clause 12.2. If you block necessary cookies, parts of the Platform will not work. In the applications, analytics is collected by a component built into the app, which neither your browser settings nor your device advertising identifier reach, and there is no in-app control to switch it off today. If you want us to stop collecting analytics about your use of the applications, write to us at [PRIVACY EMAIL]. The identifiers we have described as necessary cannot be switched off, because sign-in, security and your bag depend on them.

12.4[ADVERTISING AND RETARGETING POSITION, INCLUDING WHETHER THE DEVICE ADVERTISING IDENTIFIER IS USED]

13.1We send you two kinds of message, and they are treated differently.

13.2Service messages are about your Account and your Orders, such as one-time passwords, Order confirmations, dispatch and delivery updates, return and refund updates, and important changes to our terms. You cannot opt out of these while you hold an Account, because they are part of the purpose for which you gave us your details when you opened your Account or placed the Order, which is a legitimate use under section 7 of the Digital Personal Data Protection Act, 2023.

13.3Marketing messages are about new arrivals, offers and recommendations. We send them only where you have consented, and separately for each channel. For WhatsApp, we ask for your consent in the application before we send you anything. You can withdraw your consent for any channel at any time, at [IN-APP PATH: MARKETING PREFERENCES], by using the opt-out in the message, or by writing to us at [PRIVACY EMAIL]. Withdrawing marketing consent does not stop service messages.

13.4We personalise marketing messages using the information described in Section 9, except for anything we obtain from your Google account. Information from your Google account is used only for the two purposes in clause 6.8. It is never used to decide what marketing we send you, and it is never used to build a marketing audience or segment you are placed in.

13.5Push notifications are controlled by the permission you give in your device settings, and you can withdraw that permission there at any time.

14.1We store and process your personal data on servers located in [CLOUD REGION].

14.2Some of the service providers in clause 10.2 process personal data outside India. Where that happens, it is limited to what that provider needs in order to do the work we have engaged it for, and we require that provider to keep it confidential and to use it only for that work. The rules that govern the transfer are these. Today, Rule 7 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 permits a transfer outside India only to a recipient that maintains the same level of data protection those Rules require, and only where the transfer is necessary to perform our contract with you or you have consented to it. We apply that condition when we choose a provider and when we decide what to send it. When section 16 of the Digital Personal Data Protection Act, 2023 is brought into force, a transfer will also be subject to any restriction the Central Government imposes on transfers to a particular country or territory, and when Rule 15 of the Digital Personal Data Protection Rules, 2025 commences we will also have to meet any requirement the Central Government specifies about making personal data available to a foreign State, or to a person or entity controlled by or acting for a foreign State. We comply with any such restriction or requirement that applies to us. None of this displaces another law in force in India that gives your personal data a higher degree of protection or restricts its transfer more tightly, including the Reserve Bank of India directions on the storage of payment data, which apply to our payment partners.

14.3Transferring personal data outside India does not reduce our responsibility for it. We remain answerable to you for what our service providers do with it.

15.1We keep personal data for as long as we need it for the purpose we collected it for, and then for as long as the law requires us to keep it.

15.2Where personal data no longer serves the purpose it was collected for and we are not required to keep it, we delete it or make it permanently unidentifiable.

15.3Deleting your Account. You can delete your Account yourself, from [IN-APP DELETION PATH] in the applications and at [ACCOUNT DELETION REQUEST URL] on the website. You can also ask us to delete it by writing to [PRIVACY EMAIL]. Where you have an Order, a return or a refund in progress, we complete it before we delete the Account, and we tell you when that is.

15.4When you delete your Account, we stop using your personal data to serve you, we remove your profile, fit and style details, skin analysis, any photograph you uploaded, your wishlist, your Google account credentials and the details extracted from them, and we stop sending you messages. Clause 10.6 explains what happens to anything you posted in a public part of the Platform, such as a review or a rating. Anything we are required to keep under clause 15.5 is retained separately, is not used to profile you or market to you, and is deleted when the period that requires it ends.

15.5What we cannot delete straight away. Some information has to be kept even after you ask us to delete it:

• Transaction and access records relating to your Orders, together with the associated traffic data and processing logs. We keep these for a minimum of one year from the date they arise. We apply that floor from launch as our own decision, and Rule 8(3) of the Digital Personal Data Protection Rules, 2025 will make it binding on us from 14 May 2027. This bullet does not extend to your profile, your fit and style details, your skin analysis, any photograph you uploaded, your wishlist or the details extracted from your Google account, all of which are deleted under clause 15.4;
• Order, invoice, payment and tax records that tax and company law require us to keep;
• Records needed to establish, exercise or defend a legal claim, or to comply with an order of a court or authority; and
• Records of fraud or abuse, kept to stop it happening again.

We keep these for the period the law requires and no longer, and we restrict who can access them.

16.1We take reasonable security safeguards to protect personal data in our possession. In particular:

• Personal data is encrypted in transit between your device and our systems.
• Where we have assessed that it is warranted, personal data is also encrypted at rest. We are extending that coverage as the Platform grows, and we do not claim that everything we hold is encrypted at rest today.
• Access to personal data inside the company is controlled by role. People are given access to what their job requires and not to the rest.
• Access to systems holding personal data is logged.
• The service providers in clause 10.2 are bound by confidentiality obligations to us covering the personal data we give them.

16.2We review these measures and improve them as the Platform grows.

16.3No system is completely secure, and we do not claim that ours is. What we do claim is that we take the measures described above and that we act promptly if something goes wrong. Section 19 explains what we do then.

16.4You also have a part in this. Keep your sign-in credentials and one-time passwords to yourself. We will never ask you for an OTP, a PIN or a password, whether by phone, message or email, and anyone who does is not us.

16.5If you think your Account has been accessed by someone else, tell us at once at [SUPPORT EMAIL].

17.1We give you the following rights now, as our own commitment to you, in relation to the personal data we hold about you. That includes personal data you gave us, personal data we generated as you used the Platform, and anything we worked out about you from either, such as your size and style profile, your skin analysis result and the purchase details described in clause 6.7. These rights are drafted to match the Digital Personal Data Protection Act, 2023. Not every provision of that Act which confers them has been brought into force yet, and the mechanics for them in the Digital Personal Data Protection Rules, 2025 commence on 14 May 2027. From the date each provision commences, these will also be rights the Act gives you. You do not have to wait for that date to use them with us.

17.2How to exercise a right. Write to us at [PRIVACY EMAIL] from the email address or using the mobile number registered on your Account. Tell us which right you are exercising and, where it helps us find the right records, the Order or the date it concerns. That is all we need in order to identify your request. We will confirm to you that we have received it, and clause 17.4 says when we will respond. Some things you can do yourself, and faster: you can change or remove your fit and style details as clause 5.2 explains, you can disconnect your Google account as clause 6.10 explains, and you can delete your Account as clause 15.3 explains.

17.3We will verify that the request comes from you, because acting on a request from someone pretending to be you would itself be a breach. We will not ask you for more information than we need to do that.

17.4We respond to a request within [RIGHTS REQUEST RESPONSE PERIOD] of receiving it. That period is set independently of the grievance response period in clause 21.3, which answers a different obligation, and it is shorter. If we cannot do what you have asked, we will tell you why, and tell you how to take it further.

17.5Exercising these rights is free.

17.6When section 15 of the Act is brought into force, it will also place duties on you. From that date you must comply with applicable law when exercising your rights, you must not impersonate another person when giving personal data, you must not suppress material information when giving personal data for a document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities, you must not register a false or frivolous grievance or complaint, and you must give information that is verifiably authentic when exercising the right to correction or erasure. The penalty the Act provides for breach of those duties applies from the same date. We set the duties out here so that you know the position in advance.

17.7How to nominate someone. To nominate another individual to exercise your rights, write to us at [PRIVACY EMAIL] from the email address or using the mobile number registered on your Account, and tell us the nominee's name and how to contact them. We will confirm the nomination to you and record it, and you can change or cancel it at any time in the same way. When a nominee contacts us we will verify their identity and their authority before we act, and clause 17.3 applies to them as it applies to you.

17.8We acknowledge a request under this Section within 48 hours of receiving it and give it a reference. Where you write to us, we send that reference by reply, and you can use it at any time to ask us where your request has got to. A request that reaches us through our ordinary support channel is treated as a request under this Section and is given the same reference and the same clock, not closed as a support ticket.

18.1Under Indian data protection law, a child is anyone under the age of eighteen.

18.2The Platform is intended for adults. Our Terms of Use require you to be at least eighteen to hold an Account and to place an Order.

18.3We do not knowingly collect personal data about a child. If we find that an Account belongs to a child, we will close the Account, we will stop processing that personal data other than as the law requires, and we will delete the height, weight, body type, skin tone and any photograph we hold for that person, together with any analysis derived from them. We keep only what clause 15.5 requires us to keep.

18.4If you are a parent or guardian and you believe a child has given us personal data, write to us at [PRIVACY EMAIL] and we will deal with it.

19.1If personal data we hold is subject to unauthorised access, disclosure, alteration, loss or destruction, we will investigate immediately, take steps to contain it and limit the harm, and put in place measures to stop it happening again.

19.2We will tell you, without delay, if your personal data is affected. We will describe what happened, what data was involved, what we have done, what we suggest you do, and who to contact for more.

19.3From the date the breach notification rules made under the Digital Personal Data Protection Act, 2023 commence, we will notify the Data Protection Board of India without delay and provide it with the detailed particulars those rules require within the periods they prescribe, which are seventy-two hours of becoming aware of the breach or any longer period the Board allows on request.

19.4Separately, where an incident is one we are required to report to the Indian Computer Emergency Response Team under the Information Technology Act, 2000 and the directions issued under it, we report it within the period those directions require and we retain logs for the period they require. Reporting an incident to any authority does not replace telling you under clause 19.2.

20.1We may change this Policy. When we do, we will post the updated version on the Platform and change the version number and the effective date at the top.

20.2Where a change materially affects how we use your personal data, we will tell you at least [NOTICE PERIOD, e.g. 14 days] before it takes effect, both on the Platform and by message to the mobile number or email address on your Account, and where the change requires your consent we will ask for it rather than assume it. Continuing to use the Platform is not how you consent to a new purpose. If you do not want the change, you can withdraw your consent under Section 8 or delete your Account under Section 15 before it takes effect.

20.3We keep previous versions of this Policy and will provide one on request.

21.1If you have a question or a complaint about how we handle your personal data, tell us first. Write to our privacy contact at [PRIVACY EMAIL], or to our Grievance Officer at the details below.

21.2Our Grievance Officer, appointed under Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and under Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020, is:

Name

[GRIEVANCE OFFICER NAME]

Designation

[DESIGNATION]

Email

[GRIEVANCE EMAIL]

Phone

[PHONE]

Address

Second Floor, 235, Firegro Stay Safe Client Care Division, Indiranagar Double Road, Indiranagar, Bengaluru, Karnataka 560038, India

Hours

[e.g. Monday to Friday, 10:00 to 18:00 IST]

21.3We acknowledge a complaint within 48 hours of receiving it, and we respond to it within [GRIEVANCE RESPONSE PERIOD, NO LONGER THAN ONE MONTH] of receiving it. Where your complaint also concerns an Order, a delivery, a return or a refund, the period in Section 29 of our Terms of Use applies to it as well, and we respond within the shorter of the two.

21.4If you are not satisfied with our response, you may complain to the Data Protection Board of India, in the manner the Board provides.

21.5Complaints about an Order, a delivery, a return or a refund are handled under the grievance process in our Terms of Use, which uses the same Grievance Officer.