Data protection
Effective 20 August 2026 · Under the DPDP Act, 2023 · Zuri AI · Aravi Tech Labs Pvt. Ltd.
Zuri AI is operated by Aravi Tech Labs Private Limited (“the Company”, “we”, “us”). For the personal data described here we are the Data Fiduciary, and you are the Data Principal, as those terms are used in India’s Digital Personal Data Protection Act, 2023 (“the DPDP Act”).
This page is the plain-language version of the deal: what we take responsibility for, and what you take responsibility for. It is written to be read once, in full, in a few minutes.
It sits alongside two other documents and does not replace them. The Privacy Policy is the itemised notice the DPDP Act requires — exactly what we collect, why, who it goes to, how long we keep it, and every right you hold. The Terms & Conditions cover the commercial relationship: credits, refunds, ownership of what you make, and the labelling of AI-generated images.
Effective date: 20 August 2026. Last updated: 20 August 2026.
When you created your account you ticked two separate boxes. The first was agreement to the Terms & Conditions and the Privacy Policy — a contract. The second was your consent, under Section 6 of the DPDP Act, for us to process your personal data for the purposes below. They are kept separate on purpose: a contract and a consent are different things, and the Act lets you withdraw the consent without tearing up the contract.
The purposes you consented to, and nothing wider: to create and secure your account; to run the photo shoots you ask for; to take payment and keep the credit ledger; to send you service messages about your own shoots; to answer your questions and handle complaints; and to understand, in aggregate, who our sellers are so we build the right things.
We record the date and time of that consent. If you ever ask what you agreed to and when, we can tell you precisely.
Section 6(1) of the Act limits consent to the data necessary for the purpose stated — and its own illustration makes clear that consent does not stretch to extra data merely because a box was ticked. We hold ourselves to that reading: the optional questions about your shop are asked separately, are genuinely optional, and are not covered by this consent unless you choose to answer them.
Asking before we take. We collect what a purpose needs, and we ask separately for anything beyond it. Nothing on this platform is pre-ticked.
Telling you plainly. Our notice is written to be understood, not to be survived. If a sentence in it can only be parsed by a lawyer, that is our defect and we will rewrite it.
Keeping your photographs yours. The garment photos you upload and the images we generate from them belong to you. We use them to run your shoot and to show them back to you. We do not sell them, we do not licence them to anyone else, and we do not put them in our marketing without asking you first and separately.
Securing what we hold. Access controls, encryption in transit, restricted internal access on a need-to-know basis, and logs of administrative action. Security is a duty under Section 8(5) of the Act, not a feature we offer.
Not keeping things forever. Each category of data has a retention period, stated in the Privacy Policy. When a period ends, or when you delete your account, we erase — except for the narrow records tax and company law require us to keep.
Telling you if something goes wrong. If a breach affects your data we will notify you and the Data Protection Board of India within the timelines the DPDP Rules set, and we will tell you what actually happened, what data was involved, and what you should do — not a euphemism.
Honouring your rights quickly. Access, correction, erasure, nomination, withdrawal and grievance are all listed in Section 4 below, with the route to use.
Standing behind our processors. Where a vendor processes data on our behalf, they are bound by contract to the same limits, and we remain answerable to you for what they do.
Labelling what the machine made. Images generated here carry an invisible provenance mark and are declared as AI-generated where the IT (Intermediary Guidelines) Amendment Rules 2026 require it. We will not help anyone pass a generated image off as an unretouched photograph of a real person.
This is the half that protects other people, and it is the half a photography product cannot honour on your behalf.
The rights to what you upload. You confirm you own the garment photographs you send us, or have permission to use them. If a photograph was taken by someone else — a studio, a photographer, a supplier — you need their permission before it comes here.
Other people in your photos. If a photograph contains an identifiable person — a model, a friend, a family member, a customer, a passer-by — you are responsible for having their consent to upload it and to have images generated from it. Do not upload photographs of people who have not agreed. Never upload a photograph of a child.
Not uploading what you do not need to. Do not send us identity documents, bank details, customer lists, medical information, or anyone else’s personal data. This product needs a photograph of a garment. If you send more, you have created a risk for someone that neither of us needed.
Truthful account details. Your name, phone number and email are how we reach you about your own shoots and how we verify it is you. Keeping them accurate is a duty the DPDP Act places on you as well as good sense.
Your own credentials. Do not share your password or your session. Anything done from your account is treated as done by you.
Using the output honestly. The images are for selling your own products. Do not use a generated model’s likeness to imply an endorsement that did not happen, do not present a generated image as a photograph of a real person where that would mislead, and do not remove or tamper with the provenance mark.
Making false claims about a person’s data is an offence under the Act, and the Data Protection Board can impose a penalty on an individual for it. We mention this not as a threat but because most people do not know it.
Confirmation and access — what we hold about you, and a summary of it.
Correction and completion — anything wrong or out of date, fixed.
Erasure — your data deleted, except records we are legally required to retain.
Nomination — naming someone to exercise these rights if you die or become incapacitated.
Withdrawal — take back the consent recorded at signup, as easily as you gave it. The optional answers about your shop can be edited or cleared yourself, at any time, in Settings → Your shop. To withdraw the wider consent, write to the Grievance Officer; we will tell you plainly what stops working as a result, because withdrawing consent to process your photographs means we can no longer run shoots for you.
Grievance — a complaint heard, with a reply, before you need to go anywhere else.
How: write to kunal@araviai.com with the words “Data request” in the subject, or message us on WhatsApp from your registered number. We aim to acknowledge within 72 hours and to resolve within 30 days. If we cannot meet that, we will tell you why and when.
If we misuse your data. You can complain to us first (Section 4). If we do not resolve it, you may escalate to the Data Protection Board of India, whose decisions bind us. Nothing in our Terms takes away that right, and no clause anywhere on this platform should be read as trying to.
If the platform is misused. Uploading someone else’s photograph without permission, uploading images of children, sending us data that has no business being here, or using generated images to deceive are all misuse. Where we find it we will remove the content and may suspend the account; where a person has been harmed we will cooperate with them and with any lawful authority.
Reporting misuse. If you believe an image on this platform is yours, or is of you, and should not be here, write to kunal@araviai.com with enough detail to identify it. We treat that as a grievance with the same clock as Section 4.
What we will not do. We will not use a complaint as a reason to hold your images hostage, and we will not require you to give up a right in order to have a complaint heard.
The DPDP Act received assent in August 2023 and the DPDP Rules were notified in November 2025, but the substantive notice-and-consent obligations are phased and are not fully enforceable until 13 May 2027.
We have built to them anyway. Consent architecture is expensive to retrofit and cheap to get right at the start, and a seller trusting us with their livelihood’s photographs deserves the standard now rather than on the compliance deadline.
If the Rules change what is required, this page changes with them, and we will tell you what moved rather than quietly re-dating the document.
Grievance Officer · Aravi Tech Labs Private Limited · kunal@araviai.com · or message us on WhatsApp.
See also the Privacy Policy for the itemised notice of what we collect and why, and the Terms & Conditions for credits, refunds and image labelling.
Want your data, or want it gone? Write to kunal@araviai.com with “Data request” in the subject.