Privacy policy

• We collect your name and email, or your phone number, to sign you in, the photos you upload, the images we make for you, your payment records and some usage data.
• By default your photos are used only to make your images. Using them for quality review or to improve models on your own pieces happens only if you switch those options on.
• We never sell your personal data.
• We use a small number of service providers, some outside India, to run the Service. They may use your data only on our instructions.
• You can see, correct, download or delete your data and withdraw consent at any time from your account settings or by writing to us.

Account

Name and email from your Google account when you sign in with Google; your mobile number if you sign in with a one-time password (OTP) where we offer it; business name and billing address if you add them; your consent choices.

Your images

Photos you upload, the Outputs we generate, the settings and Look you chose, and any notes or feedback you give on a result. Photos can contain incidental personal data, such as a hand, a face or location metadata (EXIF).

Payments

Pack bought, amount, date, receipt details and the payment status and reference sent to us by our payment processor. We do not receive your full card number, CVV, UPI PIN or net banking password.

Credits

Credit balance, purchases, use and refunds.

Ad attribution

How you first found us: the page you landed on, the website that sent you (domain only, such as google.com), the time, and, if you came from an ad, the ad click identifier (such as gclid, gbraid, wbraid, fbclid or fbp) and campaign tags (utm values). This is kept in a first-party cookie and linked to your account when you sign up or pay.

Usage and device

Pages and features used, events such as “job started”, approximate location from IP address, browser and device type, and error logs.

Support

Messages you send us by email, WhatsApp or phone, and our replies.

We do not intentionally collect sensitive information such as health, financial account or biometric data. We do not use photos to identify people.

We use each kind of data only for the purposes below.

Provide the Service

Sign you in, run your jobs, check the piece against your photo, store your images so you can download them, and keep your credit balance. Uses account, image and credit data.

Take payment and keep accounts

Process payments and refunds, issue receipts and meet tax and accounting law. Uses account and payment data.

Keep the Service safe and lawful

Prevent fraud and abuse, reject jobs that name real people, add AI labels and provenance metadata, handle complaints and respond to lawful requests. Uses all categories as needed.

Support you

Answer questions and resolve problems. Uses support, account and image data.

Improve the product

Understand which features are used and where things break, using product analytics. Uses usage and device data.

Measure our advertising

Tell the advertising platforms we use that a sign-up or purchase came from one of their ads, so we can see which ads work. Uses ad attribution data and event details.

Quality review and evaluation (opt-in)

Let our team review your Uploads and Outputs and include them in internal test sets used to check new versions of the Service. Only if you switch on “Use for quality review”.

Training on your own pieces (opt-in)

Fine-tune or adapt models on your own pieces so future results for your catalogue are better. Only if you switch on “Train on my pieces”. These models are used only for your account.

We do not use your Uploads or Outputs to train general AI models for other customers, and we do not allow our AI providers to do so.

We process your personal data on the basis of your consent, which you give when you sign up and when you switch on optional features, and for “legitimate uses” allowed by Section 7 of the DPDP Act, such as complying with law, responding to court or government orders, and handling the payment and invoice details you give us voluntarily to buy credits.

Your consent is free, specific, informed and unambiguous. It is limited to the purposes listed above. You can withdraw it at any time as easily as you gave it. Withdrawing consent does not affect processing already done, and if you withdraw consent needed to run the Service we may have to close your account.

Under the DPDP Rules you will also be able to give, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India once these are available. We will list any Consent Manager we work with on this page.

You choose how your images may be used in Settings → Data use. You can change this at any time and it applies from then on.

Process only (default)

Your images are used only to make your Outputs, store them for you and keep the Service safe. Nobody at GehnaLab looks at them unless you ask for support or a complaint requires it.

Quality review (opt-in)

Our team may view your Uploads and Outputs and keep copies in internal evaluation sets to test and improve quality. Copies are kept for up to 24 months or until you switch this off, whichever is sooner.

Train on my pieces (opt-in, explicit)

We may use your Uploads and Outputs to adapt models that improve results for your own pieces. You give this consent separately and it can be withdrawn at any time. When withdrawn, we stop training and delete the adapted models and training copies within 30 days.

We never sell your personal data. We share it only with the service providers (Data Processors) below, under contracts that require them to process it only on our instructions and keep it secure, and with authorities where the law requires.

AI image-processing providers

Generate your images. Receive your photos and job instructions. They may not use your data to train their models.

Cloud hosting and storage providers

Host the website, our database and your images, and protect the site from abuse. Store your sign-in account, active sessions with their IP address and browser details (sessions expire after 7 days), your pieces, jobs, credits, payment records, Uploads and Outputs.

SMS provider

Sends sign-in OTPs by SMS when phone sign-in is offered. Receives your mobile number only if you use it.

Google Sign-In

Signs you in if you choose Google. Shares your name and email with us.

Payment processors

Process payments and refunds. Receive payment details directly from you.

Advertising platforms

Measure ad performance. Receive the click identifier, event type, time and purchase value, and may receive a one-way hashed phone number or email to match the event.

Product analytics provider

Receives usage events (such as pages viewed, buttons clicked, jobs started and delivered, purchases) and device data, linked to a pseudonymous account ID. It never receives your phone number, email or photos. Session recording is off.

Error monitoring provider

Receives technical details of errors (error message, stack trace, page or API path, browser type). Phone numbers, emails, tokens and link signatures are removed before sending, and it does not receive your photos.

We may also share data with professional advisers under a duty of confidence, with a buyer of our business (who must honour this notice), or with courts, police and government agencies when the law requires it.

Some of our service providers process data on servers outside India, including in the United States, the European Union and Singapore. The DPDP Act allows this except to countries the Central Government has restricted by notification. We will not transfer data to any restricted country, and we require providers to protect your data to the standard in this notice.

Our database is hosted in Mumbai, India. Image storage and AI image processing may take place in data centres outside India.

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires, and then erase it or make it anonymous.

Account details

While your account is open. Erased within 30 days of closing it.

Uploads and Outputs

While your account is open, so you can download them again. You can delete any image at any time. Deleted images are removed from live systems within 30 days and from backups within a further 35 days.

Inactive accounts

If you do not sign in for 3 years, we will remind you at least 48 hours before deleting the account and its images.

Payment records and invoices

8 years from the end of the financial year, as required by tax and accounting law. Kept even after you close your account.

Ad click identifiers

The cookie lasts 90 days. Click data linked to your account is kept for up to 13 months.

Product analytics

Up to 24 months, then deleted or anonymised.

Security and access logs

At least 1 year, as required by the DPDP Rules, then deleted unless needed for an investigation.

Support messages and grievances

Up to 3 years from the last message.

Opt-in evaluation and training copies

As set out in section 5, or until you withdraw consent.

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you, how we use it and who we have shared it with;
• correct, complete or update inaccurate or incomplete data;
• have your data erased when it is no longer needed or you withdraw consent, unless the law requires us to keep it;
• withdraw any consent at any time;
• nominate another person to exercise your rights if you die or become unable to do so; and
• have your grievances addressed by us and, if not satisfied, complain to the Data Protection Board of India.

To exercise these rights, use Settings in the app (download, delete images, delete account, data-use choices) or write to support@gehnalab.com from the phone number or email on your account. We may ask you to verify your identity. We will acknowledge your request within 24 hours and respond as soon as we can, and in any case within 30 days, which is well within the 90 days allowed by the DPDP Rules.

We use reasonable security safeguards as required by the DPDP Act and Rules, including encryption in transit (TLS) and at rest, access controls limited to staff who need them, short-lived signed links for images, logging and monitoring of access, regular backups and contracts with processors that require the same care. No system is perfectly secure, so please also keep your phone and Google account secure.

If a personal data breach affects you, we will tell you without delay, in plain language, what happened, when, the likely impact, what we are doing about it and what you can do to protect yourself. We will report the breach to the Data Protection Board of India without delay and send it a detailed report within 72 hours, and report to CERT-In within the time required under the IT Act.

The Service is for adults running a business. We do not knowingly allow anyone under 18 to create an account or process children’s personal data, and we do not track or target ads at children. Uploads must not show children. If you believe a child has given us personal data, write to support@gehnalab.com and we will delete it.

We use a small number of cookies and similar technologies:

Essential

Keep you signed in and protect the site from abuse (our session cookie and our hosting provider’s security cookies). The Service cannot work without them.

Attribution (atl_attr)

A first-party cookie, kept for 90 days, that remembers how you first found us: the landing page, the referring website (domain only), the time, a random visitor ID, and any ad or campaign tags. It is read only by gehnalab.com. When you sign up or pay, we link it to your account; for ad visits we also send the conversion to the advertising platform as described above.

Analytics

Our product analytics tool stores a pseudonymous ID in a first-party cookie and local storage to understand product use. On our marketing pages we send one anonymous visit event when you first arrive (landing page and referring domain, with the random visitor ID and no personal details); the full analytics tool loads only after you click or choose something. In the app it loads when you sign in.

We do not load advertising pixels that track you across other websites. You can block or delete cookies in your browser; essential cookies are needed to sign in.

We will post any update here with a new date. If a change affects how we use data you have already given us, we will tell you in the app or by SMS or email, and ask for fresh consent where the law requires.

For any question about your personal data, or to exercise your rights, contact the person responsible for data protection at GehnaLab:

Grievance Officer

Named on our Grievance redressal page

Email

support@gehnalab.com

WhatsApp

Chat on WhatsApp

Post

See our Contact page

If you are not satisfied with our response, you can complain to the Data Protection Board of India through its online portal. See our Grievance redressal page for the full process.