Privacy Policy

1. Introduction

Rupam.ai is a product of RupamLab Private Limited, registered in Ahmedabad, Gujarat, Bharat. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our website, API, Shopify plugin, and related services (collectively, the “Services”).

We are committed to complying with Bharat’s Digital Personal Data Protection Act, 2023 (DPDPA) and applicable data protection regulations. By using our Services, you consent to the practices described in this policy.

2. Data We Collect

What we collect depends on how you use Rupam.ai: our website, the dashboard and API, the Rupam mobile app, or a brand’s store or site that uses our skin scan. We collect the following:

• Account information: Name, email address and password when you create a dashboard account (we keep only a scrambled version of the password, never the password itself). In the mobile app, the phone number you sign in with, which we keep as your account name. For Shopify stores, the shop address and email. We also record when and how you signed up.
• Billing information:Billing name or company name, address, country and GSTIN (if you give one), your plan, payment amounts and dates, invoice numbers, and reference numbers from our payment provider, Razorpay. Your card, UPI or bank details are entered on Razorpay’s screen and never reach our servers.
• Facial images: The photo you submit for a scan. When a scan is sent with image storage on, which is how the Rupam dashboard, mobile app, Shopify widget and website embed send it, we store your original photo and the result images made from it (an annotated face and one image per skin concern) in AWS S3 in Mumbai. Result images are deleted after 15 minutes on the Free and Starter plans, 7 days on Growth and 30 days on Professional. The original photo is kept until you or the account owner delete it, or the account is deleted. A scan sent without image storage is processed in memory and no photo is saved. Images may be stored and used to improve and train our AI models.
• Skin analysis results:The scores and findings for each skin concern, and our skin tone estimate, are sent back to the app or site that asked for the scan. We keep only your overall skin score and the scan’s reference number as your scan history, and a copy for up to one hour so a result can be handed over or repeated quickly. If a brand uses our product recommendations, we record which products were recommended and, using a one-way scrambled form of your IP address, which were clicked.
• Quiz answers: If a brand uses a Rupam skin quiz, the option you pick for each question, the time you submitted it and your IP address.
• Usage data: For each scan or API request: the time, where it came from (such as the API, the dashboard, a Shopify store or the mobile app), the type of request, whether it worked and how long it took, and scan counts for billing and limits. When you are signed in to the dashboard, the pages you open and your last sign-in time.
• Device, network and location data: IP address and browser or device type when you sign in and when you make sensitive account changes (such as changing your password, creating an API key, changing billing details or asking for links to your stored photos). When you sign up we look up an approximate location (city, region and country) from your IP address using a third-party lookup service (ip-api.com) and keep it with the IP address. We also keep short-lived counters by IP address, email or phone number to stop abuse; they are cleared daily.
• Website enquiries: If you fill in our contact or demo form: your name, work email, job role, company, company size, use case, expected monthly scans and message. With it we record how you reached our site (the first page you landed on, the page that sent you, campaign tags in the link, and Google or Meta ad click IDs), the page you sent the form from, your browser type and an approximate location worked out from your IP address (the IP address itself is not saved or emailed). This goes to our team by email and into a spreadsheet.

3. How We Use Your Data

We use your data for the following purposes:

• To provide, maintain, and improve the skin analysis API and related Services.
• To generate personalised skin analysis reports and product recommendations.
• To process payments and manage your subscription.
• To communicate with you about your account, service updates, and support requests.
• To monitor API usage, detect abuse, and enforce rate limits.
• To improve our AI models using anonymised and aggregated data (never individual facial images without explicit consent).
• To comply with legal obligations under Bharatiya law.

4. Facial Image Processing

Rupam.ai processes facial images solely for the purpose of skin analysis. We take the following measures to protect your biometric data:

• Images submitted for skin analysis may be retained and used to improve and train our AI models.
• We do not use facial images for facial recognition or identity verification.
• All image processing occurs on Bharat-hosted infrastructure (AWS Mumbai, ap-south-1 region).
• Images are encrypted in transit (TLS 1.3) and at rest (AES-256).
• You can request deletion of all stored images at any time via the API or by contacting us.

5. Data Storage and Security

All data is stored on Bharat-hosted infrastructure in the AWS Mumbai (ap-south-1) region. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access controls with principle of least privilege.
• Regular security audits and penetration testing.
• Automated anomaly detection on API access patterns.
• SOC 2 Type II compliance (available on Professional and Enterprise plans).

6. Data Sharing

We do not sell your personal data. We may share data only in the following circumstances:

• Service providers: Cloud hosting (AWS), payment processing, and email delivery services that process data on our behalf under strict contractual obligations.
• Legal compliance: When required by Bharatiya law, court order, or government authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.
• With your consent: When you explicitly authorise sharing with a third party.

7. Your Rights Under DPDPA 2023

Under Bharat’s Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: Request a summary of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to grievance redressal: File a complaint with our Grievance Officer or the Data Protection Board of Bharat.
• Right to nominate: Nominate another individual to exercise your rights in case of death or incapacity.

To exercise any of these rights, contact us at hello@rupam.ai or see our DPDPA Compliance page for full details.

8. Cookies and Tracking

Our website uses essential cookies required for functionality (session management, authentication). We use privacy-respecting analytics to understand site usage. We do not use third-party advertising cookies or cross-site tracking.

9. Data Retention

We retain your data for the following periods:

• Account data: For the duration of your account plus 90 days after deletion.
• Facial images: Result images are deleted after 15 minutes (Free, Starter), 7 days (Growth) or 30 days (Professional). Original photos are kept until you or the account owner delete them or the account is deleted.
• Analysis results: Retained for the duration of your subscription. Deleted within 30 days of account closure.
• API logs: Retained for 12 months for billing and compliance purposes.
• Payment records: Retained as required by Bharatiya tax and accounting regulations.

10. Children’s Privacy

Rupam.ai Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at hello@rupam.ai and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice on our website at least 30 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.