Privacy Policy

1. What we collect

• Account details: your mobile number, which every account verifies, your email address and name if you sign in with or link a Google account, and an account ID.
• Photos and Results: the photos you upload, the images and animations we generate, and the styles you chose.
• Payments: the pack you bought, the amount, currency, status and Razorpay order and payment IDs. Razorpay handles your card, UPI or bank details. We never see or store them.
• Usage: pages you visit and actions you take in the app (for example "generated an image"), device and browser type, and approximate location from your IP address. Account details and other sensitive fields are masked in our analytics.
• Technical data: IP address, server logs and error reports, kept to run and secure the service.
• Messages: what you send us when you contact support.

2. Why we use it

We process your personal data on the basis of your consent, which you give when you sign up and accept these terms, and for the legitimate uses the DPDP Act allows, to:

• sign you in and run your account;
• generate and store your images and animations;
• process payments, keep your credit balance and send receipts and important service emails;
• prevent fraud and abuse (for example, free credits are given once per verified mobile number), and enforce our Terms;
• understand how ShineSnap is used and fix problems;
• meet legal obligations, such as tax and accounting records.

We do not sell your personal data, show you third-party ads, or use your photos or Results to train AI models.

3. How AI processing works

To create a Result, we send your photo and the style you chose to an AI provider (listed below), which returns the generated image. Before generation, photos may pass automated safety checks. We only use the providers' paid business services, whose terms do not allow them to use the data we send to train their models. [Confirm this for each provider before launch.] Providers may keep data briefly for abuse monitoring, as their terms describe.

4. Who processes it for us

These companies process personal data on our behalf, only to provide their service to us:

Some of these providers process data outside India, including in Singapore (where our servers and database run), the United States and the European Union. We only transfer data to countries the Government of India has not restricted under the DPDP Act. We may also share data when the law requires it, or with a buyer if ShineSnap's business is sold, under this policy.

5. How long we keep it

• Original photos and Results: until you delete them or your account. Photos you upload but never create anything from are deleted after 24 hours.
• Account details: until you delete your account. We may delete an account, with its photos and Results, after [3 years] without any sign-in, once we've emailed or texted you a warning at least 30 days before.
• Payment and credit records: as long as tax and accounting law requires (currently up to 8 years). They are anonymised once your account is deleted.
• Server logs, error reports and backups: up to [30] days.
• Analytics data: up to [12] months.

6. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and who we've shared it with;
• ask us to correct, complete or update your data;
• ask us to erase your data, or delete your account yourself (see below);
• withdraw your consent at any time. This doesn't affect processing already done, but we won't be able to provide the service without it;
• nominate another person to exercise these rights if you die or become unable to;
• complain to our Grievance Officer, and if you're not satisfied, to the Data Protection Board of India.

To use these rights, email support@shinesnap.example from your account's email or mention your account's phone number. We'll reply within 30 days. We may ask you to confirm your identity first.

7. Deleting your account

To delete a single photo, open the Result in the Studio and choose Delete. It disappears at once, and we erase the file within a few minutes.

To delete everything, go to Account and choose Delete account. We sign you out at once and then erase your photos, Results and personal details from our systems and providers, normally within a few minutes and always within 30 days, including backups. Payment records are kept in anonymised form, as the law requires.

8. Cookies and local storage

We use your browser's storage to keep you signed in (Firebase), remember small settings, and measure usage (PostHog). Razorpay sets its own cookies during checkout to prevent fraud. We don't use advertising or cross-site tracking cookies. Blocking storage in your browser may sign you out.

9. Security

We use reasonable security safeguards: encryption in transit (HTTPS), private storage that can only be reached through short-lived links, access controls on our systems, and monitoring. No system is perfectly secure. If a personal data breach affects you, we'll tell you and the Data Protection Board as the DPDP Act requires.

10. Children

ShineSnap is for people aged 18 and over. We don't knowingly collect personal data from children. If you believe a child has given us personal data, email support@shinesnap.example and we'll delete it.

11. Changes to this policy

We'll update the date at the top when this policy changes. If a change is significant, we'll tell you in the app or by email before it takes effect.

12. Grievance Officer and contact

[Name of Grievance Officer], Grievance Officer, [Legal business name], [Registered address, India]. Email: support@shinesnap.example. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.