Privacy Policy

We collect only what is necessary to operate the platform:

• Phone number — used for OTP-based authentication
• Name & email — optional, for your profile and order communication
• Delivery address & pincode — required to fulfil orders and to personalise discovery by region
• Location (approximate) — used for delivery pin-code suggestions and to surface nearby sellers; we never track background location
• Style preferences — your taste profile built during onboarding and updated over time (genres, colour palette, fit preferences)
• Virtual Try-On images — selfies and generated try-on results; see Section 3 for full details
• Chatbot interactions — messages you send to our AI assistant to help with product discovery and support
• Camera & photo library — accessed only when you initiate Virtual Try-On
• Order history, cart & wishlist — to process transactions and personalise your feed
• Anonymous engagement events — product views, add-to-carts, and purchases; used for ad measurement (see Section 4)

We use collected data for the following purposes:

• Account creation and authentication
• Processing, fulfilling, and communicating about your orders
• Personalising your discovery feed, size recommendations, and search results based on your style profile
• Improving the platform — fixing bugs, understanding feature usage, and developing new capabilities
• Sending transactional notifications (order updates, shipping, OTPs) — these cannot be opted out as they are essential to the service
• Sending promotional notifications — only with your consent; you can opt out at any time in device settings
• Measuring advertising effectiveness via Meta Conversions API (anonymised; see Section 4)

We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.

We share data only where necessary to operate the platform:

• Meta Platforms (Facebook/Instagram) — We send anonymised, hashed event signals (e.g. product viewed, purchase completed) via Meta Conversions API (CAPI) for ad measurement and campaign optimisation. Events are hashed before transmission; we do not send raw personal identifiers. You can opt out of personalised advertising in your device Settings, or by emailing support@sarvh.com.
• Razorpay — Our payment processor. Card details and UPI credentials are handled entirely by Razorpay and are never visible to Sarvh. Razorpay's privacy policy governs payment data.
• Amazon Web Services (AWS) — Infrastructure provider. Our database, file storage (S3), and AI services (Bedrock) run on AWS. AWS acts as a data processor under contract; they do not use your data for their own purposes.
• Seller partners — Sellers receive only the information needed to fulfil your order: name, delivery address, phone number, and items ordered.

We do not sell, rent, or barter your personal data to any third party. We do not share data with data brokers.

We retain your data for as long as your account is active or as required to provide our services:

• Account data — retained while your account exists; deleted within 30 days of account deletion
• Order records — retained for 7 years as required under the GST Act and Indian accounting law
• Virtual Try-On images — retained until you delete individual results or delete your account (see Section 3a)
• Chatbot history — retained to provide conversational context; deleted when you delete your account
• Anonymous engagement events — forwarded to Meta, subject to Meta's own retention policies; we retain the raw event logs for 90 days then delete them
• Support correspondence — retained for 2 years

You can request deletion of any data not subject to a legal retention obligation by emailing support@sarvh.com or using Delete Account in the app.

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right of Access — request a summary of the personal data we hold about you
• Right to Correction — request correction of inaccurate or incomplete data
• Right to Erasure — request deletion of your data (subject to legal retention obligations)
• Right to Grievance Redressal — raise a complaint and receive a response within a reasonable time
• Right to Nominate — nominate a person to exercise your rights in the event of death or incapacity

How to exercise your rights:

• Delete Account — available in Settings/Account; this triggers immediate erasure of non-legally-required data
• Data requests — email support@sarvh.com with subject line "DPDP Data Request"; we will respond within 30 days
• Complaints — if your grievance is not resolved, you may escalate to the Data Protection Board of India once it is constituted under the Act

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• The updated date at the top of this page will always reflect when the policy was last revised
• For material changes — such as new categories of data collection or new sharing partners — we will provide prominent notice at least 15 days before the change takes effect
• Continued use of the app after the effective date of a revision constitutes your acknowledgement of the updated policy

We encourage you to review this policy periodically.