Privacy Policy

1. Information we collect

We collect account details you provide (name, email), browsing and preference data, and basic device information such as IP address and browser type. We do not ask for your phone number to create an account.

2. How we use information

We use your data to provide the product, personalize recommendations, communicate updates, improve performance, prevent abuse, and — when you tap through to a partner brand — to record that click so the commission we are owed can be checked against the brand's own statement. Nayuu is free for you because brands pay us a commission; see section 4 for exactly what that click record holds.

3. Sharing of data

We do not sell your personal data. We work with a small set of trusted service providers (sub-processors) who help us run the platform, each only for the purpose listed below and under confidentiality safeguards:

• Supabase— database, sign-in and secure storage of your account and saved pieces.
• Vercel— website hosting and privacy-friendly, cookieless usage analytics.
• Resend— sending you transactional email (sign-in codes, waitlist and back-in-stock alerts).
• Algolia— powering fast on-site search over our public catalogue.
• Groq & Google (Gemini)— generating Sakhi's styling replies; only your conversation text is sent, never your name or contact details.
• Sentry— error and performance monitoring to keep the site reliable.
• Cuelinks— attributing your outbound clicks to partner brands so we earn an affiliate commission.

4. Cookies, analytics, and recording a click out to a brand

Two different things happen when you use Nayuu, and only one of them is optional. We would rather spell both out than let a single sentence cover them:

• Always on — essential storage— sign-in, your saved pieces, your theme, and your bust, waist and hip if you add them to find your size. Nayuu cannot work without these and they are not used to profile you.
• Always on — the record of a click out to a brand— when you tap “Shop on …”, we record that a click happened: the garment, the brand, which page you tapped it from, where it sent you, and the time. If you are signed in, your account id is attached; if you are not, we attach a one-way scrambled code worked out from your network address, which exists only so that one tap counts once and cannot be turned back into your address. No cookie is set for this and your network address itself is never stored. This is not a measurement of you, and it does not depend on the consent banner: it is the only proof that a click a brand pays us for actually happened, and without it we could not check a commission statement or tell a brand honestly how much traffic we sent. We cannot give you a product that is free to use and also keep no record of the thing that pays for it.
• Optional — usage analytics and in-app activity— measuring how the site is used (privacy-friendly and cookieless) and recording your activity inside Nayuu, such as what you searched or asked Sakhi. This stays entirely off until you accept it on the consent banner, and you can change or withdraw your choice any time from “Cookie preferences” in the footer. Decline and none of it runs.

5. Data retention

We keep data only as long as necessary for product operation, legal compliance, and security obligations. In practice:

• Account data(name, email, style profile) — kept while your account is active; deleted within 30 days of you closing it or asking us to.
• Saved pieces & boards— kept while your account is active; for guests they live only in your browser until you clear it.
• Your measurements(bust, waist and hip, if you add them) — the numbers are never sent to us: they live only in your browser, and “Forget my measurements” under any size chart removes them. If you accept analytics, we count only whether a size could be named for you.
• Waitlist email— kept until launch and until you ask to be removed; one click in any email opts you out.
• Usage analytics(only if you accept) — retained in aggregate for up to 14 months, then removed; always cookieless.
• Outbound click records— kept for up to 24 months, because a commission can be queried or corrected long after the click; they hold no cookie and no network address, and for a guest no identifier beyond the one-way code described in section 4.
• Error & security logs— kept for up to 90 days, then deleted.

6. Security

We implement reasonable technical and organizational safeguards. No internet system is fully risk-free, but we continuously work to protect user data.

7. Your choices

You can request access, correction, or deletion of your data by contacting us. You can also opt out of non-essential communication.

8. Your rights under Indian law

Nayuu operates from India. We process personal data in line with India's Digital Personal Data Protection Act, 2023. You may withdraw consent, request access to or correction of your data, or ask us to delete it, at any time.

9. Governing law

This Privacy Policy is governed by the laws of India. Any disputes are subject to the courts of Gujarat, India.

10. Contact

For privacy questions or to exercise your rights, email: privacy@nayuu.in