1. Who we are
HeStylz is a fashion marketplace operated by HeStylz Retail Private Limited (“HeStylz”, “we”, “us”). We operate the HeStylz Android application and the website at https://hestylz.com.
For the personal data described here, HeStylz Retail Private Limited is the data controller (or, under India's Digital Personal Data Protection Act, 2023, the Data Fiduciary). Our registered address and grievance contact are on the contact page.
HeStylz is a marketplace. Products are sold by independent vendors listed on the platform. To fulfil an order we pass a limited amount of your information to the vendor and the delivery partner handling it — see section 5.
2. Data we collect
We collect only what an order, an account or a safety obligation actually requires. We do not sell your personal data, and we do not use it for advertising by third parties.
2.1 Data you give us
- Account details — your name, email address and/or mobile number. If you sign in with Google, we receive your Google account's name, email address and profile picture, and a Google account identifier. We never receive your Google password.
- Profile details — optional profile photo, gender and date of birth, if you choose to add them.
- Delivery addresses — recipient name, phone number, address lines, city, state and PIN code for each address you save.
- Order information — the items, sizes and quantities you order, the amount charged, the payment method chosen, order status, and the invoice generated on delivery.
- Returns and cancellations — the reason you select, any description you write, and any photographs you attach as evidence.
- Content you post — product reviews and ratings, live-stream chat messages, and any report you file about another user's content.
- Support conversations — the tickets you raise, your messages, and any attachment you send us.
- Programme applications — if you apply to sell as a vendor or join the influencer programme, the business, identity and payout details that application asks for.
2.2 Data collected automatically
- Device and install data — device model, operating system version, app version, a stable install identifier and a push notification token. This is what powers the “signed-in devices” list and lets you sign out of a device remotely.
- Usage and analytics data — screens opened, features used and similar events, collected in aggregate form so we can see which parts of the app work and which do not.
- Crash diagnostics — if the app crashes, a crash report is sent to us with the fault details, device model and OS version, so it can be fixed.
- Connection data — your IP address and standard server log data when the app or website contacts our servers, retained for security and fraud prevention.
2.3 Data we do not collect
- Card numbers, UPI PINs and bank credentials. Online payments are handled entirely by our payment gateway partner on their own systems. Those details never reach HeStylz servers.
- Precise GPS location. The app does not request location permission. Delivery estimates are based on the PIN code you type in.
- Your contacts, calendar, SMS or call logs. The app does not request access to any of these.
- Background audio or video. The camera and microphone are active only while you are on the go-live screen or explicitly attaching a photo.
3. Why we use it
Each purpose below is tied to a specific, disclosed use. We do not repurpose data for something you were not told about.
| What we use | What for | Legal basis |
|---|---|---|
| Email / phone / Google identifier | Creating your account, sending one-time sign-in codes, verifying it is you | Performance of our contract with you |
| Address, order and payment status | Taking payment, fulfilling and delivering the order, issuing an invoice, processing cancellations and refunds | Performance of our contract with you |
| Push token and device data | Sending order and delivery notifications, showing your active devices, letting you sign out remotely | Contract, and our legitimate interest in account security |
| Marketing notifications and emails | Offers, drops and campaign announcements | Your consent — withdrawable at any time |
| Analytics and crash data | Fixing faults, measuring feature use, improving the app | Legitimate interest in a working product |
| Reviews, chat messages and reports | Showing content to other shoppers, moderating it, and acting on reports | Contract, and our legitimate interest in a safe platform |
| Invoices and transaction records | Tax, accounting and statutory record-keeping | Legal obligation |
4. Device permissions
Android permissions are requested at the point of use, not on first launch, and every one of them can be declined without losing the ability to shop.
- Notifications — order, delivery and offer alerts. Declining means you shop without push updates.
- Camera — asked only when you start a live broadcast or take a photo for a return request or profile picture.
- Microphone — asked only when you start a live broadcast, for that broadcast's audio.
- Photos and media — asked only when you pick an existing image to upload.
- Prevent sleeping — held only while a broadcast is on screen, because a sleeping screen ends the stream.
You can review and revoke any of these at any time in Android Settings → Apps → HeStylz → Permissions.
5. Who we share it with
We share personal data only with the parties below, only to the extent each of them needs it, and only for the purposes stated. We do not sell or rent personal data to anyone.
- Vendors on the marketplace — the seller of an item you order receives the recipient name, delivery address, phone number and the order contents needed to pack and dispatch it. They may not use it for marketing.
- Delivery and logistics partners — the recipient name, delivery address and phone number, so the parcel can be delivered and the courier can call you.
- Our payment gateway partner — for processing online payments and refunds. Card, UPI and bank details are collected and held by the gateway directly, under their own privacy policy, and are never passed to us.
- Push notification, analytics and crash reporting providers — for delivering order notifications, measuring feature use in aggregate, and diagnosing crashes. If you sign in with Google, Google also processes that sign-in.
- Cloud hosting and storage providers — the infrastructure our servers, database and uploaded images run on, under contract and bound to confidentiality.
- Communication providers — the email and SMS services that deliver your one-time sign-in codes and order notifications.
- Law enforcement and regulators — where we are legally required to disclose, or where disclosure is necessary to investigate fraud or protect someone's safety.
- A successor entity — if the business is merged or acquired, your data may transfer, subject to this policy continuing to apply.
6. Payments
HeStylz accepts online payment (UPI, cards, netbanking and wallets) and, where it is available, cash on delivery.
We never see your payment credentials
When you pay online, you are handed to a certified payment gateway's own checkout. Your card number, CVV, UPI PIN and netbanking credentials are entered there and are never transmitted to, or stored on, HeStylz servers. We receive only the payment reference, the amount and whether the payment succeeded.
Refunds on an online payment are issued back through the same gateway, to the same instrument you paid with. See the cancellation and refunds policy for timelines.
7. Cookies & identifiers
The mobile app does not use browser cookies. It stores a small amount of data on your device — your session token, your theme preference and a stable install identifier — so you stay signed in between launches. Clearing the app's storage or uninstalling it removes them.
The website uses strictly necessary cookies and local storage for the same purposes (session, cart, theme). Analytics identifiers are used to count sessions in aggregate, not to build a profile about you.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account profile and saved addresses | Until you delete your account |
| Order records, invoices and tax documents | 8 years, as required by Indian tax and accounting law — retained even after account deletion |
| Reviews and live-chat messages | Until you delete them, or until account deletion, after which they are removed or anonymised |
| Support tickets | 3 years from the date the ticket is closed |
| Push tokens and device records | Until you sign that device out, uninstall the app, or delete your account |
| Analytics and crash data | Up to 14 months, in aggregated form |
| Server and security logs | Up to 12 months |
9. Your rights & choices
Under India's Digital Personal Data Protection Act, 2023 — and, where they apply to you, the GDPR and similar laws — you have the right to:
- Access a copy of the personal data we hold about you.
- Correct anything inaccurate or out of date. Your name, profile details and addresses can be edited directly in the app.
- Delete your account and the data tied to it — see section 10.
- Withdraw consent to marketing at any time, by turning off notifications in the app or in Android settings, or by using the unsubscribe link in any marketing email. Transactional messages about an order you placed are not marketing and continue.
- Object to or restrict processing based on our legitimate interests.
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
- Complain to us at gmb.hestylz@gmail.com, and to the relevant data protection authority if you are not satisfied with our answer.
To exercise any of these, email gmb.hestylz@gmail.com from the address registered on your account. We respond within 30 days, and may ask you to verify your identity first — so that nobody else can obtain or erase your data by pretending to be you.
10. Deleting your account
You can delete your HeStylz account and its data at any time. The full procedure, what gets erased, what is retained for legal reasons and how long it takes is set out on the Account & Data Deletion page.
11. How we protect it
- All traffic between the app and our servers is encrypted with HTTPS/TLS; the release build refuses cleartext connections outright.
- Sign-in uses one-time codes or Google Sign-In, and sessions are held as expiring tokens rather than stored passwords.
- Access to production data is restricted to staff who need it for their role, and administrative actions are logged with the account that performed them.
- Payment credentials never enter our systems (see section 6).
- Uploaded images are stored as private object keys and served through time-limited URLs, not as guessable public paths.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the appropriate authority as required by law.
12. Children
HeStylz is intended for adults. You must be at least 18 years old to create an account and place orders. We do not knowingly collect personal data from children. If we learn that an account belongs to a child, we will disable it and delete the associated data. If you believe a child has given us personal data, write to gmb.hestylz@gmail.com and we will remove it. See also our Child Safety Standards.
13. International transfers
Our servers and primary data storage are located in India. Some processors we rely on may process data on infrastructure outside India. Where that happens, we rely on the provider's contractual data protection commitments and transfer only what the service needs.
14. Changes to this policy
We update this policy when the app or the law changes. The Last updated date at the top of this page always reflects the current version. For material changes we also notify you in the app or by email before they take effect. Continuing to use HeStylz after a change means you accept the updated policy.
15. Contact us
Privacy questions and data requests: gmb.hestylz@gmail.com
Grievance officer: gmb.hestylz@gmail.com
General support: gmb.hestylz@gmail.com
Postal address and the named grievance officer are listed on the contact page.