Privacy Policy

1. Overview & Scope

TrendX ("we", "our", "us") is committed to safeguarding your privacy and personal data. This Privacy Policy sets forth our policies regarding the collection, use, processing, and protection of personal data when you use our website, in compliance with:

• Digital Personal Data Protection Act, 2023 (DPDP Act, India);
• Information Technology Act, 2000 and the SPDI Rules 2011 (India);
• General Data Protection Regulation (EU GDPR) & UK GDPR;
• California Consumer Privacy Act (CCPA / CPRA).

2. Information We Collect

We minimize data collection strictly to what is necessary to fulfill your 1980s retro photo transformation request:

• User-Provided Images (Transient Data): When you upload a photograph for transformation, that image is processed ephemerally in RAM during the active synthesis session. We extract high-level visual styling cues (e.g. gender, hair length, lighting) solely to anchor the vintage output to the subject.
• Transaction & Payment Information: Payment processing for ₹10 is handled directly by Razorpay Software Private Limited. We receive only transaction metadata (Payment ID, Order ID, timestamp, transaction status). We do NOT collect, process, or store your credit card numbers, debit card numbers, UPI PINs, or banking credentials.
• Technical Telemetry: Standard non-identifying server logs (IP address, browser type, operating system) for DDoS mitigation, rate limiting, and server health diagnostics.

3. Non-Retention Policy & Private On-Device Storage

No Cloud Photo Archiving: We do not operate persistent cloud storage databases holding your private photos. Once your 1980s retro image is rendered and returned to your browser, the transient memory buffer on our backend server is cleared.

User-Controlled Local Storage: All generated photos and original references are stored exclusively on your device inside your web browser's private local storage. This data never leaves your browser unless you choose to export it. You have immediate, permanent control to delete single images or click "Clean All" in the My Generations tab to purge your gallery completely.

4. Purpose and Legal Basis for Processing

Under the Indian DPDP Act 2023 and GDPR Article 6, we process data based on:

• Contractual Necessity: To execute the digital service you requested and paid for (transforming your photo into a 1980s retro portrait).
• Explicit Consent: Provided by you when you upload an image and initiate the transformation.
• Legal Obligation: To maintain verifiable transaction audit trails required under Indian tax and e-commerce consumer protection regulations.

5. Third-Party Service Providers (Sub-Processors)

We partner only with industry-leading sub-processors adhering to stringent security standards:

• Razorpay: RBI-licensed, PCI-DSS Level 1 compliant payment gateway for processing transactions securely.
• Cloud Inference Infrastructure: High-security API endpoints operating under strict enterprise data protection agreements prohibiting the use of customer inputs for public foundational model training.

6. Rights Under Indian DPDP Act, 2023

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you hold the following statutory rights:

• Right to Access Information: Summary of your personal data being processed.
• Right to Correction & Erasure: Because images are kept locally on your private device, you can exercise instant erasure directly through the "Clean All" button in your browser.
• Right to Grievance Redressal: Direct recourse to our designated Data Protection & Grievance Officer.
• Right to Nominate: Nominate an individual to exercise rights on your behalf in the event of death or incapacity.

7. International User Rights (GDPR & CCPA)

For users located in the European Union, United Kingdom, or California:

• Right to Rectification & Deletion (GDPR Art. 17): Absolute right to remove your personal data.
• No Sale of Personal Information (CCPA/CPRA): We do NOT sell, rent, or monetize your personal or visual data to data brokers, advertisers, or third parties.
• Cross-Border Transfer Safeguards: Transfers conform to Standard Contractual Clauses (SCCs).

8. Grievance Officer & Data Inquiries

To exercise any of your statutory data protection rights, or if you have privacy inquiries: