Privacy Policy

Descrai is operated by [COMPANY LEGAL NAME] (CIN/LLPIN [CIN/LLPIN]), registered office [REGISTERED ADDRESS] ("Descrai", "we", "us"). For the personal data of the people who sign up for and use Descrai — merchants and their team members — we are the Data Fiduciary under the DPDP Act (the "controller" under the PDPL and the GDPR).

Descrai is a tool for businesses. Where we handle data about your own shoppers on your behalf — which is very little, see section 7 — we act as your Data Processor, only on your instructions.

Questions about this policy or your data: [privacy@your-domain], or our Grievance Officer (section 11).

Each kind of personal data we process, with the purpose we use it for:

We do not use advertising trackers or third-party analytics, we do not sell or rent personal data, and we do not use your photos or catalogue to train our own AI models.

Consent. When you create a workspace you consent, through that clear action, to the processing in section 2 for the purposes listed there. Connecting a store or ad account is a separate, specific consent you give on that platform's own screen.

Withdrawing consent. You can withdraw consent at any time, as easily as you gave it: disconnect a store or ad account in Settings (or on the platform), or email [privacy@your-domain] to close your workspace. Withdrawal doesn't affect processing already done. After it we stop the processing it covered — unless a law requires us to keep something — and the parts of the service that need that data stop working for you.

Other grounds. Some processing doesn't rest on consent: keeping tax and accounting records and responding to lawful requests from courts or authorities (legitimate uses under section 7 of the DPDP Act); and, for Gulf workspaces, performing our contract with you and our legitimate interest in keeping the service secure, as the PDPL allows.

Once registered Consent Managers are available under the DPDP Rules, you may also give, manage and withdraw consent through one.

We use the service providers below. Each receives only what its task needs, under terms that require it to protect the data.

Whether an AI provider may use submitted content to improve its own services depends on that provider's terms and the plan Descrai uses with it; some free tiers allow it. Please avoid putting confidential information in product photos or notes.

The platforms you connect — Shopify, WhatsApp Business, Meta Ads, Google Ads and Snapchat Ads (and, for Gulf workspaces, Salla, Zid and TikTok Ads) — are not our processors: they are independent services you have your own agreement with. Section 7 explains what we exchange with them.

Our database and file storage are hosted in AWS ap-south-1 (Mumbai, India). Some providers in section 4 — the app host and the AI, search, email and error-monitoring services — process data in other countries, mainly the United States and the European Union.

India: the DPDP Act allows transfers outside India except to countries the Central Government restricts by notification; we will stop or change any transfer such a notification covers. We transfer data only to providers that protect it to at least the standard this policy describes, as the IT (SPDI) Rules also require.

Saudi Arabia: transfers out of the Kingdom follow the PDPL and its regulation on transferring personal data outside the Kingdom — to places or recipients with adequate protection, or under appropriate safeguards — and only as far as the service needs.

We only use what the app needs to work:

• Sign-in cookies (set by Supabase) that keep you signed in.
• A studio auto-lock cookie that asks for your password again after you leave the studio for a while.
• Short-lived security cookies while you connect a store or ad account (they protect the connection step and expire within an hour).
• Browser storage for small preferences (language, sidebar) and unfinished drafts in Genesys and Exodus, kept on your device.
• A language cookie that remembers whether you chose English or Arabic, so pages open in that language.

No advertising or analytics cookies are used, so there is nothing to opt out of.

You choose which accounts to connect, and you can disconnect them in Settings or on the platform at any time.

• Shopify (and Salla and Zid for Gulf workspaces): your store's products, variants, prices and stock levels, to import, publish and keep them in step. For Salla, also the store owner's name and email as Salla provides them, used only to suggest linking the install to your Descrai account. To keep stock counts right we receive order and refund notifications, but we read only the product, variant, SKU and quantity of each line — never your customers' names, emails, phone numbers or addresses.
• WhatsApp Business (Meta): your WhatsApp Business account and catalog ID, and the catalog items Descrai publishes.
• Meta Ads, Google Ads and Snapchat Ads (and TikTok Ads for Gulf workspaces — TikTok isn't available in India): your ad account IDs, and the campaigns and creatives Descrai prepares and dispatches for them.

When you uninstall Descrai from Shopify, we delete that store's access token and store links when Shopify asks us to (48 hours after uninstalling).

We keep your workspace data while your account is open, so your catalogue, history and connections keep working, and erase it once it's no longer needed for the purpose you gave it for — at the latest when your account is closed.

When you close your account or ask us to erase your data, we erase your workspace data within 30 days of confirming the request, and have our processors do the same. Copies in our database provider's routine backups expire on its backup schedule.

We keep some records longer only where a law requires it — for example tax invoices and accounting records for the periods the GST and company laws set (up to eight years), and, from 14 May 2027, logs of processing of personal data for one year as Rule 6 of the DPDP Rules requires. Today, hosting logs are kept only briefly by our hosting provider; we will extend their retention before that date.

Email [privacy@your-domain] from your account email, or write to the Grievance Officer (section 11), to:

• access a summary of the personal data we process about you, what we do with it and who we've shared it with (DPDP Act, s. 11), or get a copy of your workspace data;
• correct, complete or update it (s. 12) — most details you can also change yourself in Settings;
• erase it, unless we must keep it to meet a law (s. 12);
• withdraw consent at any time (section 3);
• nominate someone to exercise your rights if you die or become unable to (s. 14);
• raise a grievance about how we handle your data (s. 13) — see section 11.

We may ask you to confirm your identity, for example by writing from your account email. We respond within 30 days — inside the 90 days the DPDP Rules allow and the one month the SPDI Rules set — and we don't charge for these requests.

Your duties under the DPDP Act (s. 15) are simple: give accurate information, and don't file false or frivolous complaints or pretend to be someone else.

Your customers' data: Descrai does not store your shoppers' personal details. If one of your customers asks about their data, contact us and we'll confirm what (if anything) we hold.

Descrai is for businesses and isn't offered to anyone under 18. We don't knowingly process children's personal data — so we don't collect the verifiable parental consent the DPDP Act would require for it — and we never track, monitor the behaviour of, or target advertising at children. If you believe a child has given us personal data, tell us and we'll erase it.

Our Grievance Officer answers questions and complaints about personal data on our behalf (DPDP Rules, Rule 9; IT (SPDI) Rules, Rule 5(9)):

• Name: [GRIEVANCE OFFICER NAME]
• Email: [GRIEVANCE OFFICER EMAIL]
• Address: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]

We acknowledge a grievance within 48 hours and resolve it within 30 days. If you're in India and not satisfied with our answer, you may complain to the Data Protection Board of India once you've used this process (DPDP Act, s. 13(3)).

We protect personal data with reasonable security safeguards: encryption in transit (HTTPS) and at rest at our hosting providers, database-level isolation of each merchant's data, store and ad-account tokens that only our servers can read, access limited to the people who need it, error reports scrubbed of tokens, passwords and cookies, and routine backups by our database provider. We require our processors to protect the data too. No system is perfectly secure.

Report a security issue to [security@your-domain].

If a breach affects your personal data, we'll tell you without delay — in your account or by email — what happened and when, its likely consequences for you, what we're doing about it, what you can do to protect yourself, and who to contact.

We'll also report it as the law requires: to the Data Protection Board of India without delay, with a full report within 72 hours (DPDP Rules, Rule 7); cyber-security incidents to CERT-In within 6 hours of noticing them (CERT-In Directions of 28 April 2022); and, for Gulf workspaces, to the Saudi Data & AI Authority (SDAIA) within 72 hours where the PDPL requires.

India. The DPDP Act and the DPDP Rules were notified in November 2025; most of their obligations apply from 14 May 2027, and we already follow them as this policy describes. Until then, section 43A of the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also apply. Of the "sensitive personal data" those Rules list, we hold only passwords (kept as one-way hashes by our sign-in provider), collected with your consent for sign-in only and never disclosed.

Saudi Arabia and the Gulf. For Gulf workspaces we process personal data under Saudi Arabia's Personal Data Protection Law and its Implementing Regulations. You have the right to be informed, to access and get a copy of your data, to have it corrected, to have it destroyed when it's no longer needed, and to withdraw consent, and you may complain to the Saudi Data & AI Authority (SDAIA). We answer requests within 30 days.

Elsewhere. If laws such as the EU or UK GDPR apply to you, you have the rights they give, including to object, to restrict processing and to complain to your data protection authority.

When our practices change we'll update this page and the date at the top. If a change needs your fresh consent, we'll ask for it; for other significant changes we'll email account owners before they take effect.