Privacy Policy

1. Who We Are

VDrape ("we", "us", "our") is a product of Visual Vastra Technologies, a fashion-technology company registered in India. We operate the VDrape platform — a B2B and B2C virtual garment try-on service available at visualvastra.com.

Under the Digital Personal Data Protection Act 2023 (DPDPA), we act as a Data Fiduciary. When we process data on behalf of a retail brand (tenant), we may also act as a Data Processor under a Data Processing Agreement.

2. Data We Collect

3. How We Use Your Photos

When you upload a photo for virtual try-on:

• Your photo is sent to our backend server (hosted on Google Cloud Run, Asia-South1 region).
• Our server sends the photo to Google Gemini API (Google's AI model) solely to generate a virtual try-on image.
• Google processes the image under their Gemini API Terms. Google does not use API data to train their models.
• Temporary files on our server are deleted immediately after processing.
• Uploaded photos and generated images are stored in encrypted cloud storage for up to 30 days, then permanently deleted.
• We do not use your photos for training AI models, advertising, or any purpose other than generating your try-on result.

4. AI-Generated Content Disclosure

All try-on images produced by VDrape are AI-generated synthetic content, not real photographs. These images are created by artificial intelligence and may not accurately represent how a garment will look in real life. Generated images carry an "AI-Generated" label and should not be mistaken for real photographs.

Misuse prohibition: You must not use AI-generated try-on images to impersonate, deceive, defame, or harass any person. Doing so may violate the IT Act 2000 (Sections 66D, 66E) and attract criminal penalties.

5. Children's Data (Under 18)

Under the DPDPA 2023 Section 9, processing personal data of any person below 18 years requires verifiable parental or guardian consent.

• If you use VDrape to try on garments for a child, you must confirm that you are the child's parent or legal guardian.
• We prompt for parental consent before processing any photo when the Kids category is selected.
• Children's photos are processed with the same safeguards as adult photos and are auto-deleted within 30 days.
• We do not track, behaviorally monitor, or target advertising at children.

6. Third-Party Services

No personal data is shared with advertisers, data brokers, or any other third parties.

7. Cross-Border Data Transfer

Your data may be processed in servers located outside India (Google Cloud, Supabase infrastructure). We ensure adequate safeguards per DPDPA Section 16 and, where applicable, GDPR Standard Contractual Clauses (SCCs). We do not transfer data to any country restricted by the Government of India.

8. Your Rights

Under the DPDPA 2023 and GDPR (if applicable), you have the right to:

• Access — request a summary of your personal data and how it is processed.
• Correction — request correction of inaccurate personal data.
• Erasure — request deletion of all your personal data, including photos and generated images. Use the "Delete My Data" option in Settings, or email us.
• Withdraw consent — withdraw consent at any time. Withdrawal is as easy as giving consent.
• Data portability (GDPR) — request your data in a machine-readable format.
• Grievance redressal — file a complaint with our Grievance Officer (details below).
• Nominate — nominate another person to exercise your rights in case of death or incapacity.

To exercise any right, email support@vdrape.com. We will respond within 30 days.

9. Data Security

• All data in transit is encrypted with TLS 1.2+.
• All data at rest is encrypted (Supabase AES-256, Google Cloud encryption).
• Access to production data is restricted to authorised personnel only.
• We implement security practices aligned with IS/ISO/IEC 27001 standards as required under IT Act Section 43A.
• In the event of a data breach, we will notify the Data Protection Board of India and affected users as required under DPDPA.

10. Cookies & Local Storage

We use minimal client-side storage:

• Authentication cookies (essential) — managed by Supabase for session management. Cannot be disabled.
• App mode preference (localStorage) — remembers your dashboard/kiosk preference. No personal data.
• Rate limiting (localStorage) — prevents brute-force login attempts. No personal data.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

11. Data Retention & Deletion

• Person photos and generated try-on images: auto-deleted after 30 days.
• Account data (name, email): retained until you delete your account.
• Free trial data (fingerprint, usage): auto-deleted after 90 days.
• You may request immediate deletion at any time via Settings > Delete My Data or by emailing support@vdrape.com.

12. Grievance Officer

In accordance with IT Rules 2011 Rule 5(9) and DPDPA 2023, our Grievance Officer is:

13. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or in-app notice. Continued use of VDrape after changes constitutes acceptance of the updated policy.

14. Contact Us

For any privacy-related questions or requests:

Email: support@vdrape.com