Privacy Policy

This Privacy Policy explains how [Legal entity name — set in Keystatic > Site info] ("we", "us", "TrueFrame by SARV") collects, uses, stores and shares personal data when you use our website and photo-generation service (the "Service"), and what rights you have over that data.

1. Who is responsible for your data

[Legal entity name — set in Keystatic > Site info] is the data controller (called "data fiduciary" under India's Digital Personal Data Protection Act, 2023). Our address is [Registered address — set in Keystatic > Site info]. You can contact us at [Contact email — set in Keystatic > Site info].

2. What we collect

• Account data. When you sign up or sign in we receive your name, email address and sign-in identifiers. Authentication is handled by our identity provider, Clerk.
• Content you upload. The product photos and close-ups you upload, and the choices you make for a job (for example capability, colours, aspect ratios and other options).
• Generated results. The images the Service produces from your uploads.
• Usage and account records. Your jobs and their status, the plan and credits on your account, and when you used the Service.
• Technical data. Device and browser type, IP address, and basic logs needed to keep the Service secure and working.
• Communications. Anything you send us, such as support emails.

We do not knowingly collect sensitive personal data, and the Service does not need photos of people to work. Please do not upload images of identifiable individuals unless you have their permission.

3. How we use it

• To provide the Service: store your uploads, produce results, show your job history and manage credits.
• To create and secure your account and prevent misuse or fraud.
• To communicate with you about the Service, including support and important changes.
• To maintain, debug and improve the Service.
• To meet our legal obligations.

Our legal bases (where GDPR or similar law applies) are performing our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and compliance with the law.

4. Who we share it with

We share data only with service providers that help us run the Service, and only as needed:

• Clerk for sign-up, sign-in and session management.
• Cloudflare for storing uploaded and generated images.
• Hosting and infrastructure providers that run our website and processing services.
• Authorities, where we are legally required to, or to protect our rights and users.

We do not sell your personal data and we do not share it for third-party advertising. If we are involved in a merger or sale of the business, your data may transfer to the new owner under the same protections.

5. International transfers

Our providers may process data in countries other than yours, including outside India and the European Economic Area. Where required, we rely on appropriate safeguards such as contractual protections.

6. How long we keep it

We keep your data while your account is active and for as long as needed to provide the Service. When you ask us to delete your account or content we will delete or anonymise it within a reasonable period, except where we must keep some records to meet legal, tax or security obligations.

7. Your rights

Depending on where you live, you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate data or complete it;
• ask us to delete your data;
• withdraw consent you gave us, at any time;
• ask us to restrict or stop certain processing, or object to it;
• receive your data in a portable format;
• nominate another person to exercise your rights if you die or become unable to;
• if you are in the EU or UK, complain to your data protection authority; if you are in India, complain to us first and then to the Data Protection Board of India;
• if you are in California, know what we collect, ask us to delete or correct it, and opt out of the sale or sharing of personal data (we do neither). We will not treat you differently for using these rights.

To use any of these rights, email [Contact email — set in Keystatic > Site info]. We may need to verify your identity first.

8. Cookies

We use only the cookies needed to keep you signed in and secure. See our Cookie Policy for details.

9. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections and access controls. No system is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will change the "last updated" date above and, for material changes, tell you through the Service or by email.

12. Contact and grievances

Questions, requests or complaints about your data: [Contact email — set in Keystatic > Site info].

Grievance Officer: [Grievance officer — set in Keystatic > Site info].