Crayonz privacy & data

This privacy policy ("Policy") sets out how Crayonz, a brand operated by Aivolvix Private Limited ("we", "us", or "our"), uses and protects any information that you provide

First name and last name

Email address and bcrypt-hashed password (or Google OAuth identifier if you sign in with Google)

Order amount in INR, discount applied, payment status, payment instrument category (UPI / card / wallet — never the card number itself)

Shipping address (full name, address lines, city, state, pincode, country, phone) entered at checkout

Pages viewed, products viewed, items added to cart, checkouts started and orders completed — recorded as analytics events so we can see where the buying journey breaks

User-agent string and device type for layout switching

Text prompts you write to generate designs

We use this information to provide you with a safe, efficient, and customized experience, which includes displaying content such as recommended products and communicating with you about your orders, new products, and the latest promotional offers.

Analytics and advertising: we do run analytics and advertising measurement on the Platform.

IP address (used for rate-limit enforcement and abuse prevention; not stored beyond 30 days)

Account profile: retained while your account is active. Deleted within 90 days of an account-closure request.

Order records: retained for 7 years to comply with Indian GST and consumer protection record-keeping rules.

Uploaded reference images: auto-purged after 30 days if not attached to a saved draft.

IP address and request logs: rotated out of edge caches within 30 days; aggregated counters kept up to 90 days for abuse prevention.

OAuth tokens issued to MCP clients: revocable at any time; expire 90 days after last use.

Cloud database and storage provider (Supabase, hosted in Singapore)

Bound by a data processing agreement that prohibits any use beyond providing the service to us.

Request deletion of your account and associated data (subject to the order-record retention rules above)

Access the personal data we hold about you

Request correction of inaccurate data

Request deletion of your account and associated data (subject to the order-record retention rules above)

Withdraw consent for any optional processing

Object to direct marketing communications

Lodge a complaint with India's Data Protection Board (or your local data protection authority in the EU/UK)

We do not sell your personal information, and we do not use your design prompts or uploaded reference images to target advertising.