Privacy Policy

1. Introduction & Corporate Standing

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), Section 43A of the Information Technology Act, 2000, and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Primoha Tech Fashion Hub Private Ltd, incorporated under the Companies Act, 2013, with its registered office at F-501, Marvel Zephyr, S. No. 66/1A, Kharadi, Pune 411014, Maharashtra, India, operates a curated e-commerce marketplace specialised in plus-size apparel. In accordance with the DPDP Act, 2023, PriMoha acts as a "Data Fiduciary" concerning the Personal Data collected from users ("Data Principals", "You", "Your") navigating or purchasing from the Platform.

2. Categories of Personal Data Collected

We process only such personal data as is necessary for the specified purpose of delivering curated fashion and guaranteeing accurate garment fitment. The principle of Purpose Limitation (Section 4, DPDP Act, 2023) governs all collection:

• •Identity & Contact Data: Full name, phone number, email address, delivery and billing addresses. Required for account authentication, order fulfilment, and delivery coordination. Retained for the active account lifecycle plus a 15-day purge window post-deletion.
• •Anthropometric Data: Physical height, weight, bust girth, waist girth, hip girth, and upper hip measurements (sizing vectors). Processed via the Universal Fit Engine (UFE) for personalised fit recommendations. Retained in encrypted E2E databases during the active account lifecycle.
• •Biometric-Adjacent Data: User-submitted full-body photographs or live camera streams for Virtual Try-On (VTO). Processed to simulate fabric drape and real-time pattern scaling. Ephemeral: permanently deleted from session RAM within 5 minutes of rendering.
• •Transaction & Billing Data: Payment references, order history, and refund ledgers. Used for transaction processing and tax compliance. Excludes raw card credentials, CVVs, or UPI access credentials. Subject to mandatory statutory financial record retention periods.
• •Technical & Telemetry Data: IP addresses, device metadata, browser properties, and behavioural clickstreams. Used for system stabilisation, performance audits, and fraud mitigation under the IT Act. 15-day purge window following account deletion.

3. Universal Fit Engine (UFE) & Anthropometric Data Isolation

A core specialised function of the Platform is resolving the systemic sizing crisis via digital infrastructure. To accomplish this, we utilise a proprietary sizing logic based on extensive regional anthropometric datasets.

• •Purpose Specification: In strict compliance with the Purpose Limitation principles under the DPDP Act, 2023, your anthropometric parameters (bust, waist, hip, and upper hip) are processed exclusively for your personalised fit recommendations.
• •k-Means Clustering Architecture: The Platform utilises a k-means clustering data wall to completely decouple raw measurement figures from individual identities. Raw metrics are processed to generate standardised dual-sizing and fit-mapping labels.
• •Vendor Blindness Guarantee: Independent vendors and clothing manufacturers receive only non-identifiable, aggregated sizing requirements or generalised standardised size labels to execute physical production. Raw anthropometric datasets are never shared with downstream manufacturers.

4. Virtual Try-On (VTO) & Ephemeral Processing Charter

• •5-Minute Ephemeral Caching Rule: Visual assets uploaded for VTO are treated as volatile, short-lived cache objects. These images are permanently deleted from operational application servers and session RAM within five minutes of the composite render being displayed.
• •No Persistent Biometric Storage: PriMoha does not maintain permanent storage of user-uploaded images or biometric vectors used for VTO. The system executes real-time pattern scaling and fabric drape calculations solely for rendering.
• •Sovereign Local Storage: All VTO images uploaded for processing are retained exclusively on end-to-end (E2E) encrypted secure servers located geographically within the borders of India, during the ephemeral processing window.
• •Anonymous Token Processing: No Personally Identifiable Information (PII) is transmitted across VTO API boundaries. All images are parsed using anonymous, non-reversible token strings.

5. User-Generated Content (UGC) & Photo Reviews

• •Non-Exclusive Media Licence: If you voluntarily upload photographs showing product fit for public display within the Platform's community elements in exchange for loyalty point bonuses, you explicitly grant PriMoha a perpetual, non-exclusive, sub-licensable, and worldwide licence to display, modify, and distribute those specific images for proof-of-fit marketing and social verification modules.
• •User Control & Deletion Cascades: Data Principals may remove these images at any time through their account settings. Removal triggers an automated deletion cascade across all active databases.
• •Reward Fraud Cooling Window: To prevent reward manipulation, loyalty points associated with UGC are held in a pending state for a 15-day Cooling Period post-delivery, ensuring the statutory return window has closed.

6. Legal Grounds for Data Processing

PriMoha processes personal information under the strict mandates of Section 4 of the DPDP Act, 2023, based on the following valid legal bases:

• •Explicit Consent: Triggered via affirmative, distinct, itemised consent banners before uploading body measurements or accessing the camera layout for the VTO simulator.
• •Contractual Necessity: Processing contact details, physical delivery address coordinates, and payment ledger metadata to fulfil your commercial purchase contract, process returns, or dispatch tracking alerts.
• •Legitimate Uses: Processing diagnostic technical metadata to ensure platform integrity, prevent cyber attacks, mitigate e-commerce fraud, and comply with binding judicial or regulatory disclosures in India.

7. Notice-and-Consent Mechanisms

1. 1.Affirmative Consent Banners: Distinct, itemised consent check-boxes are presented before a user can upload body measurements or access the camera layout for VTO.
2. 2.Right to Withdraw: The Data Principal has the absolute right to withdraw consent at any time through their account dashboard.
3. 3.Operational Consequences: Withdrawal of consent will result in the immediate termination of access to fit-engine personalisation tools and VTO utilities.
4. 4.Legal Proviso: Withdrawal of consent does not affect the legality of data processed prior to the withdrawal.

8. Data Processors & Third-Party Disclosure

We do not sell your personal data. PriMoha engages external Data Processors bound by written Data Processing Agreements (DPAs) to handle specific data elements:

• •Logistics Partners (WareIQ): Shared data includes Customer Name, Delivery Destination Address, Contact Number, and Cash-on-Delivery (COD) financial thresholds for order fulfilment.
• •Authorised Payment Aggregators: Shared data includes transaction reference keys and payment amounts necessary for processing refunds via RBI-authorised, PCI-DSS compliant pathways. Raw card credentials, CVVs, and banking credentials are never stored on PriMoha servers.
• •Cloud Infrastructure: Hosting, storage, and content-delivery providers process data on our behalf under strict DPAs. All infrastructure is geographically located within India.
• •Absolute Seller Segregation: Onboarded Sellers have zero structural access to Customer PII. Sellers receive only anonymised, aggregated statistical sales data. Individual identity markers are never shared.

9. Technical Security Safeguards

• •Encryption: All anthropometric and contact databases are subjected to strong end-to-end encryption, both in transit (TLS 1.3) and at rest (AES-256 standard cryptographic algorithms).
• •Principle of Least Privilege (PoLP): Access controls restrict access to sensitive datasets to verified operations personnel under strict non-disclosure obligations.
• •Payment Card Security (PCI-DSS): Payment pathways are processed entirely through certified, external PCI-DSS compliant payment gateway partners. PriMoha does not collect, record, or host sensitive banking information on its servers.

10. Statutory Rights of Data Principals

As a Data Principal under the DPDP Act, 2023, you retain robust legal control over your processed data profiles, manageable via your account dashboard or by contacting our privacy desk:

1. 1.Right to Summary and Access: Request a plain-language summary of all personal information currently held by us, along with descriptions of processing operations and lists of external processors exposed to your data.
2. 2.Right to Correction: Modify or update inaccurate or outdated anthropometric metrics through your account dashboard.
3. 3.Right to Erasure (Section 15, DPDP Act): Request the deletion of your account, which initiates a 15-Day Purge Sequence: Active UI de-indexing within 48 hours; complete technical deletion across active repositories, CDN caches, and backup loops within 15 working days. Exceptions apply for mandatory statutory financial tax records and active dispute resolution.
4. 4.Right to Withdraw Consent: Revoke processing permissions at any time. Withdrawal terminates downstream access to fit-engine personalisation tools without penalising prior processing actions.
5. 5.Right to Grievance Redressal: Lodge a complaint with our designated Grievance Officer or the Data Protection Board of India.

11. Grievance Redressal Mechanism

In adherence to Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020, and Section 32 of the DPDP Act, 2023, PriMoha has established a designated Grievance Redressal Desk.

• •Designated Grievance Officer: Ms. N. Agarwal, Lead Compliance & Grievance Officer
• •System Acknowledgement SLA: Every submitted complaint will receive a formal system acknowledgement and tracking reference within forty-eight (48) hours of electronic receipt.
• •Final Resolution Timeline: The Grievance Desk will investigate and deliver a comprehensive legal resolution or remediation outcome within a maximum window of one (1) month from the initial complaint date.

12. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of the Republic of India. Any legal actions or disputes arising from this policy shall be initiated exclusively within the courts located in Pune, Maharashtra, India.