Legal
Effective 13 August 2026 · Last updated 13 August 2026 · Zuri AI · Aravi Tech Labs Pvt. Ltd.
Effective date: 13 August 2026. Last updated: 13 August 2026.
This notice explains what personal data Zuri AI collects, why, who it is shared with, how long it is kept, and the rights you have over it. It is issued by Aravi Tech Labs Private Limited (“the Company”, “we”, “us”), which is the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
Plain summary, before the detail: we collect your email, your phone number, the garment photos you upload and the images we generate for you. We use them to run your account and produce your images. We do not sell them, and we do not train AI models on them.
Account data: your email address (used for one-time sign-in codes and receipts), your display or business name, your phone number, and optionally your Instagram handle. We do not collect or store passwords — sign-in is by one-time code.
Content data: the garment photographs and any style-inspiration images you upload, the images and videos generated from them, and the garment specification our classifier reads from your photo along with any corrections you make to it.
Transaction data: your Credit balance, purchases, the Credits each shoot consumed, and payment records. Card numbers, UPI PINs and bank credentials are handled by our payment gateway and never reach our servers.
Technical data: IP address, browser and device information, and log and diagnostic records including a trace identifier for each request, used for security and debugging.
Usage data: which features you use, which shot types and settings you choose, and whether a generation succeeded or failed.
We do not knowingly collect data about children. The Service is for business users aged 18 or over. If you believe a child has given us personal data, write to the Grievance Officer and we will delete it.
To provide the Service: to authenticate you, to generate your images, to show your gallery, and to deliver what you paid for. Basis: performance of our contract with you and the consent you give at sign-up.
To take payment and meet tax obligations: to process purchases, issue receipts and keep the records the law requires. Basis: contract and legal obligation.
To keep the Service secure and working: to detect abuse, enforce generation limits, investigate incidents and fix faults. Basis: our legitimate use in maintaining the Service and preventing misuse.
To support you: to answer your messages and handle grievances. Basis: contract.
To improve the Service: using operational and usage data — which shots were chosen, how long a generation took, what failed. Basis: legitimate use. This is data about how the Platform performed; it is not a licence over your photographs.
To send you service messages: sign-in codes, receipts, and notices about changes to these documents. Marketing email, if we ever send it, will be separately opted into and will carry an unsubscribe link.
Your uploads are used to generate your outputs, and for nothing else.
They are transmitted to our AI provider for processing, under contract, and returned as generated images. They are never sold, never published, never used to advertise to anyone else, and never shown to other users.
We do not use your uploads or the images generated from them to train, fine-tune or improve any generative AI model — ours or anyone else's. We select AI providers whose commercial terms exclude training on customer content.
Staff access is limited to what support and debugging genuinely require, is restricted to authorised personnel, and is logged.
We do not sell personal data, and we do not share it for anyone else's advertising.
We share it with processors who run parts of the Service for us, under contract, and only as far as their function requires: our AI provider, Google (Gemini models), which receives your uploaded photographs to generate outputs; our payment gateway, which receives what it needs to take payment; our email provider, which receives your email address to deliver sign-in codes and receipts; and our cloud hosting and storage provider, where the Platform and your gallery run.
We may disclose personal data where required by law, court order or a lawful request from a public authority, and where necessary to establish, exercise or defend a legal claim.
If the business is involved in a merger, acquisition or sale of assets, personal data may transfer as part of it. We will notify you, and the protections in this notice will continue to apply.
We set a session cookie so you stay signed in. It is strictly necessary — without it, the Service cannot keep you logged in.
We use privacy-respecting product analytics to understand which features are used. We do not run advertising trackers, and we do not sell analytics data.
Your uploaded photographs and generated images are never captured in analytics or in session recordings.
Uploads, generated images and account data: kept while your account is active, so your gallery stays available to you.
After you ask us to delete your account: uploads, generated images and profile data are erased within thirty (30) days.
After a long period of inactivity: if an account is dormant for three (3) years, we will contact you at your registered email before erasing the content held in it.
Financial and tax records: retained for eight (8) years, as required under Indian tax and companies law. These are transaction records, not your photographs.
Security and access logs: retained for one hundred and eighty (180) days.
Backups: deleted data can persist in encrypted backups for up to ninety (90) days before it is overwritten on the ordinary backup cycle.
Under the DPDP Act you have the right to: obtain confirmation of what personal data we process about you and a summary of it; have inaccurate or incomplete data corrected, completed or updated; have your personal data erased, subject to records we must keep by law; nominate another individual to exercise these rights on your behalf if you die or become incapacitated; withdraw a consent you have given, as easily as you gave it; and have your grievance heard through the route in Section 9.
Withdrawing consent to the processing that is necessary to run your account means we can no longer provide the Service, and your account will be closed. Withdrawal is not retrospective — it does not undo processing already carried out lawfully.
To exercise any of these, write to kunal@araviai.com from your registered email address. We respond within thirty (30) days. There is no charge. We may ask you to confirm your identity before acting, to make sure we are not disclosing your data to someone else.
Deleting your account is also available directly from your settings.
Data is encrypted in transit. Sign-in is passwordless and by one-time code, which removes the risk of a reused password exposing your account. Access to production systems is restricted to authorised personnel and logged.
No system is perfectly secure, and we do not claim otherwise.
If a personal data breach affects you, we will notify you and the Data Protection Board of India in the form and within the timelines the DPDP Rules require, and tell you plainly what happened, what data was involved, and what to do about it.
Grievance Officer: Kunal Bairwa, Aravi Tech Labs Private Limited. Email: kunal@araviai.com.
Write with a description of your complaint and your account email. We acknowledge within twenty-four (24) hours and aim to resolve within fifteen (15) days.
If you are not satisfied with how we have handled a complaint about your personal data, you may escalate it to the Data Protection Board of India under the DPDP Act.
Some of our processors — including our AI provider and cloud infrastructure — operate servers outside India, so your data may be processed abroad.
We make those transfers under contract and only to the extent the Service requires, and only to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act.
We may update this notice. Material changes will be announced in-product and by email to your registered address, and the “last updated” date above will change.
Where a change requires your consent under the DPDP Act, we will ask for it before the change applies to you.
Aravi Tech Labs Private Limited · kunal@araviai.com · or message us on WhatsApp.
See also our Terms & Conditions, which cover credits, refunds and the labelling of AI-generated images.
Questions about your data? Write to kunal@araviai.com or message us on WhatsApp.