Privacy Policy

1. Who we are

1.1 The Yarn to Yards app is operated by YARN TO YARDS PRIVATE LIMITED, registered at 439 & 442, B Wing, 4th Floor, Kewal Industrial Estate, Senapati Bapat Marg, Lower Parel (W), Mumbai – 400013, Maharashtra, India. In the language of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the information described in this policy.

1.2 This app is a private trade catalogue for our business customers. Accounts are issued by us to businesses we already trade with. There is no public sign-up.

1.3 Your use of the app is also governed by our Terms of Use.

2. What this app is not

2.1 We do not sell anything through the app. There are no payments, and we collect no card or bank details.

2.2 We do not show advertising, and we do not share your data with advertisers.

2.3 We do not use third-party analytics or tracking services.

2.4 We do not access your camera, microphone, contacts, photos or files.

2.5 We do not use your device's GPS, and we do not ask for location permission.

3. What we collect, and why

3.1 Account information

Your login ID, your business name, and the name of the person the account is issued to. Your password is stored only as a cryptographic hash; we cannot read it.

Why: to give you access to the catalogue we have agreed you should see.

3.2 Session and device information

The time you sign in, an identifier for the device you sign in from, and your IP address. From your IP address we derive an approximate location, typically the city.

Why: to keep the account secure. Our catalogue images are commercially sensitive, and this lets us detect an account being used from two places at once or from somewhere unexpected. We do not use your device's GPS, and the location is approximate — derived from network information, not from your phone's positioning.

3.3 Enquiry information

The designs, shades and quantities you add to an enquiry, and any reference you supply.

Why: so our team can respond to your enquiry.

3.4 Screen capture events

If you attempt to take a screenshot or begin screen recording while viewing catalogue images, we record that an attempt happened, when, and from which account.

Why: our designs and photographs are our commercial property, and this is how we protect them. We record only that an attempt occurred. We never capture, store or transmit the contents of your screen.

3.5 Technical logs

Error reports and performance information generated by the app and our servers.

Why: to find and fix faults.

4. What we do not collect

4.1 We do not collect your precise location, your activity outside this app, your contacts, your photographs, or any special category data. We do not build advertising profiles.

5. Our lawful basis for processing

5.1 We process this data to perform our contract with your business, and for our legitimate interest in protecting our commercial property.

5.2 Where consent is required under the DPDP Act we obtain it before processing, and you may withdraw it at any time by contacting us. Withdrawing consent for account and session data means we can no longer provide the app to you.

6. How long we keep it

6.1 When an account is closed we delete or anonymise personal data on the schedule above, except where we must keep records to meet a legal or tax obligation.

7. Deleting your account

7.1 You can delete your account yourself, from inside the app, at any time. Open the Account tab and choose Delete account. You will be asked for your password to confirm it is you.

7.2 Deletion takes effect immediately and does not require our approval. Your login stops working straight away, every device you signed in from is signed out, your access to the catalogue ends, and your sign-in location history is erased.

7.3 Your past enquiries are retained, because they are commercial records of dealings between our two businesses, but they are stripped of the details that identify you.

7.4 Deletion cannot be undone. We cannot restore a deleted account, and a new one would have to be issued from scratch.

7.5 If you would rather we did it for you, or you no longer have the app installed, you can request deletion at our account deletion page or by emailing accounts@yarntoyards.com. We action the request and confirm it to you.

8. Who we share it with

8.1 We do not sell your data and we do not share it for marketing.

8.2 We share it only with service providers who host the app's infrastructure on our behalf — our cloud database, application hosting and image storage providers — and only to the extent needed to run the service. They are bound to process it only on our instructions.

8.3 Our database and application servers are in Singapore. Catalogue photographs are held on object storage in the Asia-Pacific region. Where any processing takes place outside India, we do so in line with the transfer requirements of the DPDP Act.

8.4 We may disclose information if required by law, or to establish or defend legal claims — including claims arising from unauthorised copying or distribution of our designs.

9. How we protect it

9.1 Passwords are hashed with argon2id. Traffic is encrypted in transit. Sessions are bound to the device they were issued to, and access tokens rotate. Access to catalogue images is restricted per account. Administrative actions are recorded in an audit log. We apply reasonable security safeguards as required by the DPDP Act.

9.2 We are honest about the limits: the app makes screenshots difficult and records attempts, but no app can prevent someone photographing a screen with another device.

10. Your rights

Under the DPDP Act you may:

• ask what personal data we hold about you and how we process it
• ask us to correct or complete inaccurate data
• ask us to erase data we no longer need
• nominate another person to exercise these rights if you are unable to
• withdraw consent where processing relies on it
• raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied

10.1 To exercise any of these, email accounts@yarntoyards.com. We respond within 30 days.

11. Data breaches

11.1 If a breach affects your personal data we will notify you and the Data Protection Board of India within the timelines required by the DPDP Rules, describing what happened, what it affects, and what we are doing about it.

12. Children

12.1 This app is for business use only and is not directed at anyone under 18. We do not knowingly issue accounts to children or process their data.

13. Grievance Officer

Questions, complaints or requests about how we handle personal data should go to:

Neelkumar Jain

439 & 442, B Wing, 4th Floor, Kewal Industrial Estate, Senapati Bapat Marg, Lower Parel (W), Mumbai – 400013, Maharashtra, India
Email: accounts@yarntoyards.com

13.1 We acknowledge a grievance promptly and aim to resolve it within the timelines set by the DPDP Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Attribution

14.1 The approximate city shown against a sign-in is derived using GeoLite2 data created by MaxMind, available from www.maxmind.com.

15. Changes to this policy

15.1 If we change this policy we will post the new version at the address above and update the effective date. Material changes will be notified in the app.

15.2 This notice is published in English. Under section 5(3) of the DPDP Act you may ask us for its contents in Hindi, Marathi, Gujarati or any other language specified in the Eighth Schedule to the Constitution, and we will provide them. Email accounts@yarntoyards.com.