PRIVACY POLICY

Last updated 18 August 2026

TABLE OF CONTENTS

1. 1. WHO THIS POLICY COVERS
2. 2. PERSONAL DATA WE COLLECT
3. 3. HOW WE USE PERSONAL DATA
4. 4. HOW WE SHARE PERSONAL DATA
5. 5. CROSS-BORDER TRANSFERS
6. 6. DATA RETENTION
7. 7. SECURITY
8. 8. YOUR RIGHTS
9. 9. MARKETING COMMUNICATIONS AND COOKIES
10. 10. CHILDREN'S DATA
11. 11. THIRD-PARTY LINKS
12. 12. CHANGES TO THIS POLICY
13. 13. GRIEVANCE OFFICER AND CONTACT

1. WHO THIS POLICY COVERS

This Privacy Policy explains how Ishanya Innovation Venture Pvt Ltd ("BeSpoke," "we," "us," "our") collects, uses, shares, and protects personal data when you use the BeSpoke website at bespokedesign.in and the "BeSpoke" customer mobile application, available on Google Play (package: in.bespoke.bespoke_customer) and Apple App Store (together, the "Platform"), to discover material brands and suppliers, browse furniture, submit a design brief, or manage a project with a matched Designer.

We act as "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") for personal data processed to operate the Platform. Suppliers and Designers you transact with are independent parties; where a Supplier or Designer independently uses your contact details for purposes outside the Platform (for example, after a direct off-Platform sale), they act as an independent data fiduciary for that use and are responsible for their own compliance.

2. PERSONAL DATA WE COLLECT

2.1 Provided directly by you

• Account details — name, email, phone number, password, city.
• Design brief details — property type, room-wise requirements, budget band, timeline, and any reference photos you upload.
• Order and enquiry data — items you enquire about or order from a Supplier, delivery address, and order status.
• Payment-related data — where you pay through the Platform, payment method type and transaction reference (full card/bank details are collected and stored by our payment gateway partner, not by us).
• Communications — messages to a Designer or Supplier through in-Platform chat, support enquiries, consultation-booking details, and reviews you post.

2.2 Collected automatically

• Device and usage data — IP address, device identifiers, browser/OS type, pages and listings viewed, and actions taken on the Platform, via cookies, SDKs, and similar technologies.
• Approximate or precise location — where you enable location permissions on the app (e.g. to prioritise Designers/Suppliers who serve your city) or where inferred from IP address.
• App permissions — camera and photo-library access (to upload brief or reference photos) and notification tokens (to send match, order, and project updates), each requested at the time of use and controllable from your device settings.

2.3 Received from third parties

• Payment status and transaction references from our payment gateway provider.
• Basic profile information if you sign in using a third-party account (e.g. Google), limited to what that provider shares with your consent.

3. HOW WE USE PERSONAL DATA

• To let you browse the Material Library and Furniture listings, and to show you Suppliers and Designers relevant to your city.
• To evaluate your design brief and match you with a Designer, and to host your project workspace (proposals, approvals, milestones, payment requests).
• To connect your enquiry or order with the relevant Supplier, and to process payment where you pay through the Platform.
• To provide customer support and respond to enquiries or consultation-booking requests.
• To send service communications (account, order, project, and security notices) and, where you have not opted out, product updates or promotions.
• To detect and prevent fraud, fake listings, and abuse of the Platform.
• To comply with legal obligations, including consumer-protection and tax-related record-keeping, and to respond to lawful requests from authorities.
• To improve the Platform, including through aggregated or de-identified analytics.

We process personal data on the basis of your consent, and, where applicable, on the "legitimate uses" recognised under the DPDP Act, such as data you voluntarily provide for a specified purpose (e.g. a brief submitted to be matched with a Designer).

4. HOW WE SHARE PERSONAL DATA

• With the Supplier(s) you enquire with or order from, so they can respond to your enquiry and fulfil your order (name, contact details, delivery address, and order details).
• With the Designer you are matched with, so they can service your brief and project (brief details, contact details, and project communications).
• With our payment gateway provider, to process payments.
• With cloud hosting, analytics, customer-support, and communication (SMS/email/push) service providers who process data on our instructions under contract.
• With professional advisers (legal, accounting) where necessary.
• With regulators, courts, or law-enforcement authorities where required by law, or to establish, exercise, or defend legal claims.
• In connection with a merger, acquisition, financing, or sale of assets, subject to the acquiring party agreeing to honour this Policy (or a materially similar one) for previously collected data.

We do not sell personal data to third parties for their own marketing purposes.

5. CROSS-BORDER TRANSFERS

Some service providers (for example, cloud hosting or analytics infrastructure) may process data outside India. Where this occurs, we take steps to ensure an appropriate level of protection consistent with the DPDP Act, and, at the time of writing, we do not transfer personal data to any country the Central Government has restricted under the DPDP Act. This section will be updated to reflect the government's notified list, if any, and our then-current sub-processors.

6. DATA RETENTION

We retain personal data for as long as your account is active and for a reasonable period thereafter to meet legal, tax, accounting, and dispute-resolution requirements — for example, transaction records are typically retained for the period mandated under applicable tax and consumer-protection law. Where data is no longer required, we delete or anonymise it, subject to backup-cycle timelines.

7. SECURITY

We use administrative, technical, and physical safeguards designed to protect personal data, including access controls, encryption of data in transit, and restricted access to payment and identity-related records. No system is completely secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authority as required under applicable law.

8. YOUR RIGHTS

Subject to the DPDP Act and its implementing rules, you may have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Request correction, completion, or updating of inaccurate or outdated personal data.
• Request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Withdraw consent for processing that relies on consent (this will not affect processing already carried out, and may mean we can no longer match you with a Designer or Supplier without that data).
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, once such mechanisms are enabled.
• Register a grievance, and if unsatisfied with our response, approach the Data Protection Board of India once constituted.

To exercise these rights, write to us at contact@bespokedesign.in. We will respond within the timelines prescribed by applicable law.

9. MARKETING COMMUNICATIONS AND COOKIES

You may opt out of promotional emails, SMS, or push notifications at any time using the unsubscribe link, in-app settings, or by writing to contact@bespokedesign.in. You will continue to receive essential service, order, and project communications even after opting out of marketing.

We use cookies and similar technologies for authentication, remembering preferences, and analytics. You can control cookies through your browser settings; disabling some cookies may affect Platform functionality.

10. CHILDREN'S DATA

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under 18. If we learn that we have collected data from a minor without appropriate consent, we will delete it.

11. THIRD-PARTY LINKS

The Platform may link to third-party sites or services (e.g. payment processors, maps). This Policy does not cover their practices; please review their privacy policies separately.

12. CHANGES TO THIS POLICY

We may update this Policy from time to time. Material changes will be notified through the Platform or by email, and the "Last updated" date above will reflect the latest revision. Continued use of the Platform after changes take effect constitutes acceptance.

13. GRIEVANCE OFFICER AND CONTACT

In accordance with the Information Technology Act, 2000, rules made thereunder, and the DPDP Act, you may contact our grievance officer / Data Protection Officer at:

Ishanya Innovation Venture Pvt Ltd
Grievances, data protection queries and general support: contact@bespokedesign.in
Registered office: [Registered office address, India]