Privacy Policy

Why we process your data, and who is responsible

We process personal data only with your consent (for example, when you tick the consent box or create a shopper profile) or for a specific purpose the law permits, such as delivering a service you asked for, sending an OTP you requested, or issuing a GST invoice. You can withdraw consent at any time; withdrawing does not affect what was done before.

Kanchuki is responsible (the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023) for retailer account data and for shopper profiles. For the customer lists a retailer builds inside Kanchuki, the retailer decides why the data is used and Kanchuki processes it on the retailer's behalf. We stay responsible for keeping that data secure.

What we collect

• Retailer account data: phone number (for OTP login, verified via our SMS provider MSG91), business name, address, and GST details (for invoicing).
• Shop location (optional): during onboarding a retailer may tap “Get Location” to capture their shop's GPS coordinates. This is a one-time foreground request — there is no background tracking. The coordinates are used to pre-fill the address and to show a “Get directions” link on the retailer's public catalog page. Skip the button and no location is collected.
• Product photos: uploaded by retailers to build their catalog. Photos are processed by AI vision providers (e.g. Anthropic Claude, OpenAI, Google Gemini) to auto-tag category, color, and fabric, and by AI image- and video-generation providers to remove or replace backgrounds, generate studio-style catalog images, and produce short promotional videos (photo slideshows or AI-generated motion) that a retailer may publish to their storefront or connected social accounts.
• Design reference photos: retailers may upload design images (for example “Suits Designs” and other design galleries) that are watermarked and shown on their public storefront. These are handled like product photos.
• KYC documents: GST certificates and Aadhaar card images you upload for seller verification. They are stored securely, used only for verification and GST invoicing, and visible only to you and our verification team.
• Customer data: name, phone number, and style/budget preferences captured by a retailer when adding a customer to their CRM, or when you share your details, submit a review, or send an enquiry on a store's Kanchuki catalog page.
• Shopper profile (optional): if you create a Kanchuki shopper profile, we store your phone number, style preferences, and which products you view and favourite, to personalise recommendations across participating stores. This is consent-based; you can turn off personalisation, export your data, or delete the profile at any time from My Profile.
• WhatsApp messages: if a retailer enables WhatsApp catalog sync or messaging, product updates are sent to you via Meta's WhatsApp Business Cloud API.
• Payment data: processed directly by Razorpay; Kanchuki does not store card or UPI credentials.
• AI Stylist conversations: messages you type to the AI Stylist chat are sent to Anthropic Claude to generate product recommendations. They are used only to answer that conversation and are not linked to your name unless you've shared it with the store.
• Reviews: a review you submit, including your name if you provide one, is displayed publicly on that product's page. Your phone number is never shown publicly.

How we use it

To operate the catalog, customer CRM, WhatsApp collection links, storefront, and AI features a retailer has enabled — and nothing beyond that. We do not sell personal data. Some AI processing (photo tagging, image generation, the AI Stylist chat) is performed by providers located outside India; we only send what's needed for that specific feature.

Cookies & local storage

We use your browser's local storage (not tracking cookies) to remember that you've already shared your details with a store, so you're not asked again, and to prefill forms like reviews and enquiries. Clearing your browser data resets this.

Your rights

You can ask us to access, correct, or delete the personal data we hold about you by emailing privacy@kanchuki.app. We will respond within 30 days, subject to the retention obligations described below. You can also ask which service providers your data has been shared with, ask us to correct inaccurate or incomplete data, and withdraw consent at any time. Kanchuki retailer accounts are for users 18 and older; if a minor's details were shared without a parent or guardian's consent, contact us to have them removed.

Right to nominate: you can name a person to exercise your data rights if you die or become unable to. Shopper profile holders can add a nominee in My Profile; retailers can email us at the address below.

Complaints: if you are not satisfied with our reply to your grievance (see below), you may complain to the Data Protection Board of India.

Third parties we share data with

• AI vision and image-generation providers, to tag product photos and generate background-cleaned and studio-style catalog images.
• Cloudflare R2, to store product and KYC images.
• Razorpay, to process payments.
• Supabase, for authentication and database hosting.
• MSG91, to send OTP and transactional SMS.
• Meta (WhatsApp Business Cloud API), where a retailer enables WhatsApp catalog sync or messaging.
• Where a retailer connects their own Google Business Profile, Facebook, or Google Ads account, product data may be sent to those platforms using the retailer's own credentials.

Each provider that handles personal data for us is bound by a contract that requires it to protect that data. Some providers (AI, hosting, SMS) process data outside India; transfers are made only for the feature in use and only to the extent Indian law permits.

Deletion & retention

Deleted products, customers, and photos are soft-deleted immediately and permanently purged after 15 days. A copy is kept in a write-only backup vault for that period in case of accidental deletion, then it is purged too.

GST numbers, KYC documents, and invoicing records are retained as required by Indian tax law and our record-keeping obligations — including after account deletion — as described on our account deletion page.

Product photos and AI training

We do not use your photos to train AI models. A photo a retailer uploads is used only for the features that retailer asks for — auto-tagging category, colour and fabric; background clean-up and studio-style catalog images; a short promotional video; and publishing to the storefront or a connected social account.

That applies to our AI providers too: a photo is sent to a provider only to perform the specific operation requested, under a contract that does not permit the provider to use it to train its own models. An earlier consent-based programme that collected try-on photos for model training was withdrawn and removed on 31 August 2026, and no photos are collected for training now.

How long a photo is kept, and how to delete it. A photo is kept while it belongs to a live product, design, or account. Delete the photo or the product in the app and it disappears from your catalog immediately; the stored file is soft-deleted at once and permanently purged after 15 days — including the copy in our write-only recovery vault (see above). Deleting a retailer account removes its photos the same way. To have a photo deleted sooner, email privacy@kanchuki.app.

Virtual try-on: photos of you

A store may offer a virtual try-on, which uses AI to show you wearing an outfit. It is always your choice: nothing happens until you read a short notice and agree to it.

The photo you give us is never saved. It is used to make the picture and then it is gone — not kept on our servers, not in our database, not handed to any other store.

The picture we make is saved, because you and the store need to be able to look at it again or share it. It is stored on that store's account, is not shown publicly, and opens only through a private link that expires within an hour. If a store offered you a try-on at the counter instead of on your own phone, the same applies — you are asked at the counter too.

Neither photo is used to train AI models.

You can take this back. Withdraw your consent at any time from My Profile, and every try-on picture we made for you is deleted. If a try-on picture of you was made in a store rather than on your own phone, you can ask that store to delete it, or email us at privacy@kanchuki.app.

My Style: reading a photo of you

My Style can look at one photo of you to suggest colours and fits that suit you. It is always your choice: nothing happens until you read a short notice and agree to it. Adults only — please do not upload a photo of a child.

Your photo is never saved. It is read once by AI and then thrown away — not kept on our servers, not in our database, not in file storage, and not shared with any store.

What we keep is a short note about your colouring and frame, so your suggestions are ready next time. It is used only to rank clothes for you, and it is shown to you as a palette of colours.

Find similar works the same way. If you pick a photo of a garment you like, it is read once and thrown away — we do not keep it. We turn it into a short description of the clothing (for example “yellow kurti, printed”) that is held for a few minutes while we look for similar pieces. It is not saved to your account.

We never use your photo to train AI models.

You can clear it any time. Open My Style and choose Clear my data. The note is deleted and we stop using your photo consent. You can also email us at privacy@kanchuki.app.

Security

We protect personal data with encryption in transit, access controls so that staff see only what their job needs, restricted database roles, audit logging of sensitive actions, and regular backups. Access is reviewed and revoked when it is no longer needed.

Data breaches

If a personal data breach affects you, we will tell you without delay, explain what happened and what you can do, and report it to the Data Protection Board of India as the law requires.

Children

A child is anyone under 18. Kanchuki does not knowingly collect a child's personal data, and shopper profiles and retailer accounts are for people 18 and older. Where a child's data must be processed, we require verifiable consent from a parent or guardian, and we do not track or profile children or show them targeted advertising.

Keeping data only as long as needed

We erase personal data once the purpose it was collected for has ended, unless a law requires us to keep it (for example GST records).

Grievance officer

To raise a complaint about how your data is handled, write to our Grievance Officer at privacy@kanchuki.app. We acknowledge complaints promptly and resolve them within 30 days.

Contact

Questions about this policy or your data: privacy@kanchuki.app.