# Privacy policy

> How GehnaLab collects, uses, shares and protects your personal data under the Digital Personal Data Protection Act, 2023 and Rules, 2025.

Last updated: 23 October 2026 · Canonical: https://gehnalab.com/privacy

This notice explains what personal data GehnaLab collects, why, who we share it with, how long we keep it and how you can control it. It is written to meet the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) and the Information Technology Act, 2000.

GehnaLab (sole proprietorship of Shubham Gautam), 60 Gyan Vihar, Ajmer, Rajasthan, India (“GehnaLab”, “we”, “us”) is the Data Fiduciary for the personal data described here. You are the Data Principal. You can read this notice in English; to ask for it in any language listed in the Eighth Schedule to the Constitution of India, write to ishubham2101@gmail.com.

## 1. The short version

- We collect your phone number to sign you in, the photos you upload, the images we make for you, your payment records and some usage data.
- By default your photos are used only to make your images. Using them for quality review or to improve models on your own pieces happens only if you switch those options on.
- We never sell your personal data.
- We use a small number of service providers, some outside India, to run the Service. They may use your data only on our instructions.
- You can see, correct, download or delete your data and withdraw consent at any time from your account settings or by writing to us.

## 2. What we collect

|  |  |
| --- | --- |
| Account | Mobile number (for OTP sign-in); name and email if you sign in with Google; business name, GSTIN and billing address if you add them; your consent choices. |
| Your images | Photos you upload, the Outputs we generate, the settings and Look you chose, and any notes or feedback you give on a result. Photos can contain incidental personal data, such as a hand, a face or location metadata (EXIF). |
| Payments | Pack or plan bought, amount, date, invoice details and the payment status and reference sent to us by Zoho Payments. We do not receive your full card number, CVV, UPI PIN or net banking password. |
| Credits | Credit balance, purchases, use and refunds. |
| Ad attribution | If you arrive from an ad, the ad click identifier (such as gclid, gbraid, wbraid, fbclid or fbp) and campaign tags (utm values), kept in a first-party cookie and linked to your account when you sign up or pay. |
| Usage and device | Pages and features used, events such as “job started”, approximate location from IP address, browser and device type, and error logs. |
| Support | Messages you send us by email, WhatsApp or phone, and our replies. |

We do not intentionally collect sensitive information such as health, financial account or biometric data. We do not use photos to identify people.

## 3. Why we use it

We use each kind of data only for the purposes below.

|  |  |
| --- | --- |
| Provide the Service | Sign you in, run your jobs, check the piece is unchanged, store your images so you can download them, and keep your credit balance. Uses account, image and credit data. |
| Take payment and keep accounts | Process payments and refunds, issue GST invoices and meet tax and accounting law. Uses account and payment data. |
| Keep the Service safe and lawful | Prevent fraud and abuse, reject jobs that name real people, add AI labels and provenance metadata, handle complaints and respond to lawful requests. Uses all categories as needed. |
| Support you | Answer questions and resolve problems. Uses support, account and image data. |
| Improve the product | Understand which features are used and where things break, using product analytics. Uses usage and device data. |
| Measure our advertising | Tell Google and Meta that a sign-up or purchase came from one of their ads, so we can see which ads work. Uses ad attribution data and event details. |
| Quality review and evaluation (opt-in) | Let our team review your Uploads and Outputs and include them in internal test sets used to check new versions of the Service. Only if you switch on “Use for quality review”. |
| Training on your own pieces (opt-in) | Fine-tune or adapt models on your own pieces so future results for your catalogue are better. Only if you switch on “Train on my pieces”. These models are used only for your account. |

We do not use your Uploads or Outputs to train general AI models for other customers, and we do not allow our AI providers to do so.

## 4. Consent and legal basis

We process your personal data on the basis of your consent, which you give when you sign up and when you switch on optional features, and for “legitimate uses” allowed by Section 7 of the DPDP Act, such as complying with law, responding to court or government orders, and handling the payment and invoice details you give us voluntarily to buy credits.

Your consent is free, specific, informed and unambiguous. It is limited to the purposes listed above. You can withdraw it at any time as easily as you gave it. Withdrawing consent does not affect processing already done, and if you withdraw consent needed to run the Service we may have to close your account.

Under the DPDP Rules you will also be able to give, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India once these are available. We will list any Consent Manager we work with on this page.

## 5. Your choices for your images

You choose how your images may be used in Settings → Data use. You can change this at any time and it applies from then on.

|  |  |
| --- | --- |
| Process only (default) | Your images are used only to make your Outputs, store them for you and keep the Service safe. Nobody at GehnaLab looks at them unless you ask for support or a complaint requires it. |
| Quality review (opt-in) | Our team may view your Uploads and Outputs and keep copies in internal evaluation sets to test and improve quality. Copies are kept for up to 24 months or until you switch this off, whichever is sooner. |
| Train on my pieces (opt-in, explicit) | We may use your Uploads and Outputs to adapt models that improve results for your own pieces. You give this consent separately and it can be withdrawn at any time. When withdrawn, we stop training and delete the adapted models and training copies within 30 days. |

## 6. Who we share data with

We never sell your personal data. We share it only with the service providers (Data Processors) below, under contracts that require them to process it only on our instructions and keep it secure, and with authorities where the law requires.

|  |  |
| --- | --- |
| Google (Gemini API, Vertex AI) | Generates the images. Receives your photos and job instructions. Under our terms with Google, your data is not used to train Google’s models. |
| Cloudflare | Website hosting, content delivery, security and bot protection. Handles all traffic to gehnalab.com. Stores your sign-in account (mobile number, and name and email if you use Google), active sessions with their IP address and browser details (sessions expire after 7 days), one-time codes and sign-in rate-limit counters in its D1 database, located in the Asia-Pacific region. |
| Google Cloud (Cloud SQL database and API servers, Mumbai region) | Hosts our Postgres database with your pieces, jobs, credits and payment records. |
| Cloudflare (R2 object storage and website hosting) | Stores your Uploads and Outputs. |
| MSG91 | Sends sign-in OTPs by SMS. Receives your mobile number. |
| Google Sign-In | Signs you in if you choose Google. Shares your name and email with us. |
| Zoho Payments | Processes payments and refunds. Receives payment details directly from you. |
| Google Ads and Meta (Conversions APIs) | Measure ad performance. Receive the click identifier, event type, time and purchase value, and may receive a one-way hashed phone number or email to match the event. |
| PostHog (EU Cloud, Frankfurt) | Product analytics. Receives usage events (such as pages viewed, buttons clicked, jobs started and delivered, purchases) and device data, linked to a pseudonymous account ID. It never receives your phone number, email or photos. Session recording is off. |
| Sentry | Error diagnostics. Receives technical details of errors (error message, stack trace, page or API path, browser type). Phone numbers, emails, tokens and link signatures are removed before sending, and it does not receive your photos. |

We may also share data with professional advisers under a duty of confidence, with a buyer of our business (who must honour this notice), or with courts, police and government agencies when the law requires it.

## 7. Transfers outside India

Some of our service providers process data on servers outside India, including in the United States, the European Union and Singapore. The DPDP Act allows this except to countries the Central Government has restricted by notification. We will not transfer data to any restricted country, and we require providers to protect your data to the standard in this notice.

Our database is hosted in Mumbai, India. Images are stored with Cloudflare R2, which may keep data in data centres outside India, and AI processing by Google may take place outside India. These transfers are permitted under the DPDP Act unless the Government restricts a destination country.

## 8. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires, and then erase it or make it anonymous.

|  |  |
| --- | --- |
| Account details | While your account is open. Erased within 30 days of closing it. |
| Uploads and Outputs | While your account is open, so you can download them again. You can delete any image at any time. Deleted images are removed from live systems within 30 days and from backups within a further 35 days. |
| Inactive accounts | If you do not sign in for 3 years, we will remind you at least 48 hours before deleting the account and its images. |
| Payment records and invoices | 8 years from the end of the financial year, as required by GST and accounting law. Kept even after you close your account. |
| Ad click identifiers | The cookie lasts 90 days. Click data linked to your account is kept for up to 13 months. |
| Product analytics | Up to 24 months, then deleted or anonymised. |
| Security and access logs | At least 1 year, as required by the DPDP Rules, then deleted unless needed for an investigation. |
| Support messages and grievances | Up to 3 years from the last message. |
| Opt-in evaluation and training copies | As set out in section 5, or until you withdraw consent. |

## 9. Your rights and how to use them

Under the DPDP Act you have the right to:

- get a summary of the personal data we hold about you, how we use it and who we have shared it with;
- correct, complete or update inaccurate or incomplete data;
- have your data erased when it is no longer needed or you withdraw consent, unless the law requires us to keep it;
- withdraw any consent at any time;
- nominate another person to exercise your rights if you die or become unable to do so; and
- have your grievances addressed by us and, if not satisfied, complain to the Data Protection Board of India.

To exercise these rights, use Settings in the app (download, delete images, delete account, data-use choices) or write to ishubham2101@gmail.com from the phone number or email on your account. We may ask you to verify your identity. We will acknowledge your request within 24 hours and respond as soon as we can, and in any case within 30 days, which is well within the 90 days allowed by the DPDP Rules.

## 10. How we protect data

We use reasonable security safeguards as required by the DPDP Act and Rules, including encryption in transit (TLS) and at rest, access controls limited to staff who need them, short-lived signed links for images, logging and monitoring of access, regular backups and contracts with processors that require the same care. No system is perfectly secure, so please also keep your phone and Google account secure.

## 11. If something goes wrong

If a personal data breach affects you, we will tell you without delay, in plain language, what happened, when, the likely impact, what we are doing about it and what you can do to protect yourself. We will report the breach to the Data Protection Board of India without delay and send it a detailed report within 72 hours, and report to CERT-In within the time required under the IT Act.

## 12. Children

The Service is for adults running a business. We do not knowingly allow anyone under 18 to create an account or process children’s personal data, and we do not track or target ads at children. Uploads must not show children. If you believe a child has given us personal data, write to ishubham2101@gmail.com and we will delete it.

## 13. Cookies and attribution

We use a small number of cookies and similar technologies:

|  |  |
| --- | --- |
| Essential | Keep you signed in and protect the site from abuse (our session cookie and Cloudflare security cookies). The Service cannot work without them. |
| Attribution (atl_attr) | A first-party cookie that remembers which ad or campaign brought you to us, for 90 days. It is read only by gehnalab.com. When you sign up or pay, we link it to your account and send the conversion to Google or Meta as described above. |
| Analytics | PostHog stores a pseudonymous ID in a first-party cookie and local storage to understand product use. On our marketing pages it loads only after you click or choose something; in the app it loads when you sign in. |

We do not load Google or Meta advertising pixels that track you across other websites. You can block or delete cookies in your browser; essential cookies are needed to sign in.

## 14. Changes to this notice

We will post any update here with a new date. If a change affects how we use data you have already given us, we will tell you in the app or by SMS or email, and ask for fresh consent where the law requires.

## 15. Contact and grievances

For any question about your personal data, or to exercise your rights, contact the person responsible for data protection at GehnaLab:

|  |  |
| --- | --- |
| Grievance Officer | Shubham Gautam |
| Email | ishubham2101@gmail.com |
| Phone | +91 99507 46862 |
| Post | GehnaLab (sole proprietorship of Shubham Gautam), 60 Gyan Vihar, Ajmer, Rajasthan, India |

If you are not satisfied with our response, you can complain to the Data Protection Board of India through its online portal. See our [Grievance redressal](https://gehnalab.com/grievance) page for the full process.