Privacy Policy

1. Who We Are (Data Fiduciary)

Gold Glide AI Tech Private Limited, registered office at [REGISTERED ADDRESS], is the Data Fiduciary responsible for your personal data under the DPDP Act.

2. Data We Collect

3. AR Try-On Data — Special Notice

3.1 AR try-on uses your device camera to detect facial or hand landmarks solely to position virtual jewellery renders. Where technically feasible, this processing occurs on-device and raw camera frames are not transmitted to or stored on our servers.

3.2 If landmark data or session snapshots are transmitted for feature improvement (e.g., to fix rendering errors), this occurs only with your explicit, separate consent at first use of the AR feature, and such data is retained for no longer than [90] days unless you separately opt in to longer retention for a saved “virtual wardrobe.”

3.3 You may disable camera access at any time via device settings; this will disable AR try-on but not other Platform features.

3A. Beta Diagnostic Data

3A.1 During the Beta Program, we may collect additional diagnostic and usage data beyond what is described in Section 3 — including more frequent crash reports, session-level logs of AR/AI feature interactions, and, where you explicitly opt in, screen-recording of in-app sessions — solely to identify and fix defects before General Availability (“GA”).

3A.2 Beta diagnostic data is retained for [90] days from collection or until the relevant defect is resolved, whichever is later, and is not used for advertising or sold to third parties.

3A.3 If you submit feedback or bug reports, the content of that feedback may be retained and used to improve the Platform, consistent with the licence described in the Terms and Conditions, Section 15.4.

3A.4 At transition to GA, Beta diagnostic data not needed for an open defect will be deleted; your Account, order, and core profile data will carry over as described in the Terms and Conditions, Section 15.6.

4. How We Use Your Data (Purpose of Processing)

We process personal data to:

• Create and manage your Account;
• Process orders, payments, and deliveries;
• Operate AR try-on and AI-based personalisation/recommendations;
• Display accurate, current pricing (including live gold/silver rate feeds);
• Provide customer support and respond to grievances;
• Detect and prevent fraud, abuse, and security incidents (see Terms, Section 9);
• Send transactional communications and, with consent, marketing communications;
• Comply with legal obligations (tax, consumer protection, law enforcement requests).

5. Legal Basis and Consent

Under the DPDP Act, we process your data on the basis of your consent (for AR camera data, behavioural profiling, and marketing) or as necessary for performance of a contract with you (order fulfilment) or compliance with legal obligations (invoicing, tax records). You may withdraw consent at any time via Settings → Privacy or by emailing [PRIVACY EMAIL]; withdrawal does not affect processing already carried out and may limit certain features (e.g., AR try-on, personalised recommendations).

6. Data Sharing

We share personal data only with:

• Payment gateway partners (RBI-authorised), to process payments — we do not receive or store your full card/UPI credentials;
• Logistics/courier partners, to deliver orders;
• Cloud infrastructure providers (Google Cloud Platform, project yihika-498909), for hosting and processing, under contractual data protection obligations;
• Rate data providers (e.g., IBJA), for live pricing — this is a one-way data feed to us, not a data share of your information;
• Experience Centers, solely in connection with Experience Center appointment scheduling and in-store service, and only to the extent necessary;
• Law enforcement or regulators, where required by law or valid legal process;
• Professional advisors (auditors, legal counsel), under confidentiality obligations.

We do not sell personal data to third parties.

7. Cross-Border Data Transfer

Data may be processed on servers located outside India (e.g., Google Cloud regions). Where this occurs, we ensure appropriate safeguards consistent with DPDP Act requirements and any government-notified restrictions on cross-border transfer that may apply from time to time.

8. Data Retention

We retain personal data only as long as necessary for the purposes above:

• Account and profile data: for the life of your Account plus [30] days post-deletion (see Section 11);
• Transaction/invoice data: statutory retention period (up to 8 years under tax/company law);
• AR session data: as described in Section 3;
• Data relevant to an open fraud investigation or legal dispute: until resolution.

9. Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access a summary of personal data we hold about you and the processing activities;
• Correct or update inaccurate or incomplete data;
• Erasure of personal data no longer necessary for the purpose collected (subject to Section 8 exceptions);
• Withdraw consent at any time;
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Grievance redressal through our Grievance/Data Protection contact below, and thereafter to the Data Protection Board of India.

To exercise these rights, contact [PRIVACY EMAIL]. We will respond within the timeline prescribed under applicable law.

10. Account Deletion and Its Effect on Your Data

10.1 You may request deletion of your Account via Settings → Account → Delete Account or by emailing [PRIVACY EMAIL].

10.2 Upon a valid request: Account access is deactivated within [7] days, and personal data is deleted or irreversibly anonymised within [30] days, except data listed in Section 8 that we are legally required to retain.

10.3 Where your Account is instead terminated by us for malicious practice (see Terms, Section 9), we retain data relevant to the investigation, any related legal claim, and fraud-prevention records (e.g., to prevent re-registration under a new identity) for as long as reasonably necessary, even though your Account access is revoked immediately.

11. Security Measures

We use encryption in transit and at rest, access controls, and monitoring to protect personal data. Payment data is handled exclusively by PCI-DSS compliant gateway partners. No system is completely secure; we will notify affected users and, where required, the Data Protection Board, in the event of a data breach likely to cause harm.

12. Cookies and Tracking

The Platform uses cookies/SDKs for essential functionality, analytics, and (with consent) personalised marketing. You can manage cookie preferences via the in-app/web cookie settings.

13. Children’s Privacy

The Platform is not directed at individuals under 18. We do not knowingly collect personal data from minors without verifiable parental consent, as required under the DPDP Act. If we learn a minor’s data was collected without such consent, we will delete it.

14. Grievance Officer / Data Protection Contact

Name: Varun M B

Email: support@yihika.com

Address: No 432, Krishnana Mane, Old Post office Padmashree, Oil Mill Road, V B Layout, Extension, Krishnarajapuram, Bengaluru, Karnataka 560036

Response timeline: Acknowledgement within 24 hours; resolution within 15 days or as prescribed by applicable law. If unresolved, you may approach the Data Protection Board of India.

15. Changes to This Policy

We may update this Privacy Policy periodically. Material changes affecting AR/AI data processing or your rights will be notified via the app/email at least [15] days in advance.

16. Contact Us

Gold Glide AI Tech Private Limited

No 432, Krishnana Mane, Old Post office Padmashree, Oil Mill Road, V B Layout, Extension, Krishnarajapuram, Bengaluru, Karnataka 560036

Email: support@yihika.com