Privacy Policy

1. Introduction

Welcome to Dhyat. Dhyat is a collection-based platform where users log what they own and ask questions to other verified owners. The data this creates — what we call your ownership graph — is sensitive, and we treat it that way.

This Privacy Policy explains what data we collect, how we use it, what we share (and what we never share), and the specific rights you have under India's Digital Personal Data Protection Act 2023 and applicable global privacy laws.

2. Information We Collect

Personal Information

When you create an account, we collect:

• Name
• Email address
• Profile information you choose to provide (photo, bio, location)

2(a). When you log items in your collection, we collect:

• Product name and brand (e.g., "Adidas Samba")
• Category (e.g., sneakers, electronics, skincare)
• Images you upload of items you own
• Tags and metadata you add (size, year purchased, condition)
• Interaction history related to these items (questions asked, answers given, offers unlocked)

This data is used to:

• Match you with relevant questions from other owners
• Provide personalized recommendations
• Enable brands to send you offers based on aggregated ownership patterns (see Section 4)

You decide what to log. You decide what to make visible. The collection itself is private by default — only you see your full collection until you choose otherwise.

2(b). Usage Data

• App activity (which items you view, which questions you open, time spent in different sections)
• Question and answer interactions (what you ask, what you answer, who you reply to)
• Filter usage (which audience filters you apply when asking questions — e.g., location, age, interest)
• Device and log information (device type, OS version, IP address — used for security and troubleshooting)

Usage data is used to improve matching, recommendations, and question routing based on ownership patterns.

3. How We Use Your Information

We use your information to:

• Match you with relevant questions from owners of products in your collection
• Provide personalized recommendations based on your ownership patterns
• Enable targeted offers from brands based on aggregated collection data (see Section 4 for how this works)
• Route questions you ask to the most relevant verified owners
• Send service updates and security notifications
• Detect and prevent fraud, abuse, and policy violations

4. Sharing of Information

We never sell your personal data. We never share your individual collection. Here is how data flows out of Dhyat — exactly:

How brands interact with your data

Brands may partner with Dhyat to offer relevant deals to users. When this happens:

• Brands NEVER see your personal identity (name, email, profile)
• Brands NEVER see your individual collection
• Brands receive aggregated ownership groups only — for example, "users who own iPhone 13 in Mumbai aged 25-34"
• Brand offers are delivered to you by Dhyat. Brands cannot contact you directly.
• You can opt out of brand offers entirely in Privacy Controls (Section 8).

Other limited sharing

• Service providers (cloud hosting, analytics, fraud detection) — under contract that limits use to providing services to Dhyat. They cannot use your data for their own purposes.
• Legal authorities — only if compelled by valid legal process. We will notify you when legally permitted.
• Other Dhyat users — only the parts of your profile and collection you've made visible in Privacy Controls.

Your personal data is never sold. Your individual collection is never shared with brands or third parties.

5. Data Retention

We retain your data only as long as your account is active, or as long as needed to provide services to you.

If you delete your account:

• Your personal data (name, email, profile) is deleted within 30 days
• Your collection data is deleted or anonymized within 30 days
• Your questions and answers are anonymized — they remain visible to other users (because other owners may have already relied on them) but are no longer associated with your identity
• Aggregated data (ownership group statistics) may be retained — this data is not personally identifiable

Legal retention exceptions

We may retain certain data longer than 30 days only when required by law (tax records, fraud prevention logs, legal disputes). When this happens, we retain only the minimum necessary, and only for as long as legally required.

If you have a question about specific data retention timelines, contact our Grievance Officer (see Section 10).

6. Your Rights

Under India's Digital Personal Data Protection Act 2023 (and similar global laws like the EU GDPR), you have the following rights:

To exercise any of these rights, email support@dhyat.com or use the in-app Privacy Controls.

7. DATA SECURITY

We protect your data with the following safeguards:

• All data is encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• Authentication uses bcrypt password hashing and supports two-factor authentication
• Access to user data inside Dhyat is limited to engineers who need it for product or support, and is logged and audited
• We undergo annual third-party security reviews

If we discover a data breach affecting your personal information, we will notify you and the Data Protection Board of India within 72 hours of discovery, as required by DPDP Act §8(6).

No system is completely secure. Help us protect your account by using a strong unique password and enabling two-factor authentication.

8. YOUR PRIVACY CONTROLS

You have full control over:

• Collection visibility — choose which items in your collection are visible to other users (private by default, item-level toggle)
• Profile visibility — choose what parts of your profile other users can see
• Question/answer visibility — choose whether your questions and answers are tied to your profile or anonymous
• Brand offers — opt in or out of receiving brand offers based on your collection
• Notification settings — choose what notifications you receive and how

All controls are in the app's Settings > Privacy section.

9. Keep As-Is (with minor edits)

These existing sections are fine. Only where words replacement necessary:

10. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Grievance Officer ★ NEW (DPDP §13 requirement)

For data privacy complaints or requests to exercise your rights under Section 6:

If your grievance is not resolved within 30 days, you may escalate to the Data Protection Board of India (https://dpbi.gov.in).