Privacy Policy

This Privacy Policy describes how Faaya Astu Pvt Ltd ("Faaya", "We", "Us" or "Our") collects, uses and discloses Your Personal Data when You use the Faaya application and related services (the "Service"), and Your rights in relation to that data.

By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Application refers to Faaya, the software program provided by the Company.
• Company (referred to as either "the Company," "We," "Us" or "Our" in this Agreement) refers to Faaya Astu Pvt Ltd, 1278, Street 2, Jain Nagari, Abohar, 152116, Punjab, India.
• Country refers to India.
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• DPDP Act means the Digital Personal Data Protection Act, 2023 of India.
• Personal Data is any information that relates to an identified or identifiable individual, and includes "personal data" as defined under the DPDP Act.
• Service refers to the Application.
• Service Provider means any natural or legal person who processes the data on behalf of the Company, including cloud hosting providers, communication platforms, and analytics tools.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service.

Data Controller

Faaya Astu Pvt Ltd, having its registered office at 1278, Street 2, Jain Nagari, Abohar, 152116, Punjab, India (CIN U72900PB2023PTC057617), is the data controller for all Personal Data collected through the Service. For questions about how We process Your Personal Data, or to exercise Your rights under this Privacy Policy or applicable law, contact Us at privacy@faaya.io.

Collecting and Using Your Personal Data

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. This may include:

• Email address
• First name and last name
• Phone number (including for use by retailer accounts to reach You over WhatsApp, subject to Your consent)
• Address, State, Province, ZIP/Postal code, City
• Usage Data

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data. When You access the Service by or through a mobile device, We may collect certain information automatically, including the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, and other diagnostic data.

WhatsApp Business Platform

Faaya uses the WhatsApp Business Platform (operated by WhatsApp LLC and Meta Platforms, Inc.) to enable Our retailer customers to send messages to their own customers who have opted in to WhatsApp communications.

When You interact with a retailer through WhatsApp via Faaya:

• Your phone number (which the retailer already holds), the message template used, the values of any template variables (such as Your name or order number), and message delivery events (sent, delivered, read, failed) are transmitted to Meta to route the message to WhatsApp.
• Meta may store copies of these messages and delivery events on its own systems in accordance with its policies.
• The processing performed by Meta is subject to Meta's own WhatsApp Business Messaging Policy and WhatsApp Privacy Policy. Faaya is not the controller of the data Meta processes.

Faaya only stores the metadata necessary to operate the messaging feature — the retailer, the template used, the customer phone number, the delivery outcomes, and the opt-in status. Faaya does not store the message body separately from the template it was rendered from.

Consent for WhatsApp Marketing

Faaya only allows a retailer to send WhatsApp messages to a customer whose opt-in status is recorded as OPTED_IN. Opt-in is captured through one of the following channels:

• In-store — the retailer records Your consent at point of sale.
• Website — You consent when providing Your phone number on the retailer's Faaya-powered storefront.
• Imported — the retailer imports a list of contacts who had previously opted in through the retailer's own channels; the retailer is contractually responsible under Our Terms of Service for the legitimacy of that consent.

You may withdraw Your consent at any time by:

• Replying STOP to any WhatsApp message received through Faaya (this action is processed immediately by Our webhook receiver and blocks further messages from any retailer using Faaya to that phone number).
• Asking the retailer directly to remove You from their contact list.
• Contacting Us at privacy@faaya.io.

Faaya records the source of Your opt-in, the timestamp at which it was captured, and (if applicable) the timestamp and reason at which You opted out.

Information from Third-Party Login Services

The Company allows You to create an account and log in to use the Service through the following third-party login providers:

• Google

If You use Google Sign-In, We receive Your name, email address, and profile picture as returned by Google. We do not receive Your Google contacts, Google Drive contents, or other Google account data.

Log Data

When an error occurs in the app, We collect diagnostic data through third-party services to help Us fix the error. This includes:

• Your device Internet Protocol ("IP") address
• Device name and operating system version
• App configuration at the time of the error
• Time and date of the error

We use the following services to collect and process this data:

• Amazon CloudWatch Logs (Amazon Web Services) — server-side application logs.
• Firebase Crashlytics (Google) — mobile crash reporting.

Log data is retained for 30 days and then automatically deleted.

Cookies

Faaya's web surface uses cookies only for essential purposes, including maintaining Your login session and enforcing security. We do not use third-party advertising or tracking cookies.

Camera and Photo Library

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Pictures and other information from Your Device's camera and photo library

We use this information to provide features of Our Service, to improve and customize Our Service. The information may be uploaded to the Company's servers and/or a Service Provider's server or it may be simply stored on Your device. You can enable or disable access to this information at any time, through Your Device settings.

Face Data and Avatar Images

When You create or update an avatar, Faaya uses one photograph — captured with Your camera or chosen from Your photo library — and may crop it to Your face. We use it only to generate Your avatar and to power virtual fitting-room features. We do not use Your photograph to build a facial-recognition profile or any other biometric identifier, and we do not access Apple's Face ID data.

Your photograph and avatar images are kept while Your avatar or account is active, and are deleted within 30 days after You delete Your avatar or account, subject to any legal obligations that require Us to retain certain information.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.
• To manage Your Account: to manage Your registration as a user of the Service.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
• To contact You: by email, telephone calls, SMS, push notifications, or (subject to Your explicit opt-in) via WhatsApp, regarding updates or informative communications related to the functionalities, products or contracted services, including security updates when necessary or reasonable for their implementation.
• To operate the WhatsApp marketing feature where You are a retailer using Faaya, or Your retailer has opted You in and You are a recipient of their messages, as described in the "WhatsApp Business Platform" section above.
• To manage Your requests: to attend to and manage Your requests to Us.
• For business transfers: to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, in which Personal Data held by Us about our Service users is among the assets transferred.
• For product improvement: to analyse usage trends, determine the effectiveness of Our features, and improve Our Service, subject to appropriate safeguards.

Named Service Providers

We use the following third-party service providers to process Personal Data on Our behalf. Each is bound by a Data Processing Agreement that restricts their use of Your Personal Data to the purposes stated below.

• Amazon Web Services, Inc. (AWS) — cloud hosting, database storage, message queuing, secrets management, and application logging. AWS processes Personal Data in the ap-south-1 (Mumbai) AWS region.
• Meta Platforms, Inc. and WhatsApp LLC — WhatsApp Business Platform message routing and delivery. See the "WhatsApp Business Platform" section above.
• Google LLC (Firebase Cloud Messaging, Firebase Crashlytics) — push notification delivery and mobile crash reporting.
• Google LLC (Google Sign-In) — authentication for users who choose to log in with Google.

We may share Your personal information with these Service Providers strictly to the extent necessary to provide the Service. We may also share Your personal information:

• With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
• With business partners: Where a retailer using Faaya is Your service provider (e.g. You have purchased items from that retailer), We share necessary Personal Data (name, phone number, order details) with that retailer so they can fulfill Your order and communicate with You. Business partners are not permitted to use Your Personal Data for their own marketing purposes without Your explicit consent, and are contractually restricted from onward-selling Your data.
• With Your consent: We may disclose Your personal information for any other purpose with Your consent.
• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition.

Retention of Your Personal Data

We retain Your Personal Data for the following periods:

• Account and profile data: retained while Your account is active; deleted within 30 days of account deletion, except where legal obligations (e.g. taxation, statutory audit) require longer retention (typically up to 8 years).
• WhatsApp message metadata (delivery status, opt-in records): retained for 24 months from send, then anonymised or deleted.
• WhatsApp opt-in and opt-out audit records: retained for the lifetime of the associated customer record, as consent audit trail is legally required.
• Face and avatar data: as described in the "Face Data and Avatar Images" section above.
• Log data (IP addresses, device identifiers, error diagnostics): retained for 30 days.
• Usage data (anonymised analytics): retained indefinitely in aggregated form; individual-level data retained for 12 months.

We retain Personal Data longer than the periods above only where required to comply with legal obligations, resolve disputes, or enforce Our legal agreements.

Your Rights

Under applicable data protection law (including the DPDP Act in India and, where applicable, the EU GDPR), You have the right to:

• Access the Personal Data We hold about You.
• Correct inaccurate or incomplete Personal Data.
• Delete Your Personal Data (subject to any legal retention obligations We have).
• Withdraw consent to Our processing of Your Personal Data at any time (which may affect Your ability to use certain features of the Service, including WhatsApp messaging).
• Object to specific processing activities where We rely on legitimate interests as the legal basis.
• Portability — receive Your Personal Data in a machine-readable format and transmit it to another controller.
• Nominate another person to exercise Your rights on Your behalf in the event of Your death or incapacity (as required by DPDP §14).
• Lodge a complaint with the Data Protection Board of India (once operational) or Your local supervisory authority if You believe We have violated Your rights.

To exercise any of these rights, contact Us at privacy@faaya.io. We will acknowledge Your request within 7 days and respond substantively within 30 days.

Grievance Officer (India)

In accordance with §10 of the DPDP Act, Faaya has appointed a Grievance Officer to address user concerns regarding processing of Personal Data:

• Name: Sahil Bajaj (Founder)
• Email: grievance@faaya.io
• Postal: Faaya Astu Pvt Ltd, 1278, Street 2, Jain Nagari, Abohar, 152116, Punjab, India

Grievances submitted to this contact will be acknowledged within 7 days and resolved within 30 days.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and by Our named Service Providers, which may include locations outside India. When Personal Data is transferred outside India:

• The transfer is only to jurisdictions where adequate data protection safeguards are in place, or under contractual clauses (Standard Contractual Clauses or equivalent) that provide equivalent protection.
• The AWS region used for primary storage is ap-south-1 (Mumbai), located in India.
• Meta / WhatsApp routing may involve transfers to Meta's global infrastructure, subject to Meta's own compliance framework.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

Deleting Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Our Service may give You the ability to delete certain information about You from within the Service. You may also update, amend, or delete Your information at any time by signing in to Your Account.

To request deletion of Your account and associated Personal Data, please submit our account deletion form or contact Us at privacy@faaya.io. We will process Your request within 30 days, subject to any legal obligations that require Us to retain certain information.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Faaya maintains a documented internal policy for handling such requests. Every request is reviewed for legal validity, jurisdiction, and scope before any response. Requests that appear to be unlawful, overbroad, or lacking required authority are challenged. We disclose only the specific Personal Data fields expressly named in a valid request, and We maintain a log of every request received and the response given.

Other Legal Requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation.
• Protect and defend the rights or property of the Company.
• Prevent or investigate possible wrongdoing in connection with the Service.
• Protect the personal safety of Users of the Service or the public.
• Protect against legal liability.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We implement organisational and technical measures reasonably suited to the sensitivity of the data, including access control, encryption in transit and at rest, and audit logging. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and We cannot guarantee absolute security.

Children's Privacy

Our Service is not directed to children under 18 years of age. We do not knowingly collect Personal Data from anyone under 18 without verifiable consent from a parent or lawful guardian. If You are a parent or guardian and believe Your child under 18 has provided Us with Personal Data, please contact Us at privacy@faaya.io and We will take steps to delete that information.

Where Our lawful basis for processing is consent and the individual is under 18, We rely on verifiable parental or guardian consent, as required by the DPDP Act.

Compliance

This Privacy Policy is designed to comply with the Digital Personal Data Protection Act, 2023 of India, and other applicable data protection law where relevant.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

• Privacy and data protection inquiries: privacy@faaya.io
• Grievance officer (India, DPDP Act): grievance@faaya.io
• General inquiries: info@faaya.io
• Postal: Faaya Astu Pvt Ltd, 1278, Street 2, Jain Nagari, Abohar, 152116, Punjab, India