Privacy Policy

Controller / Business Name: Tynari Private Limited Corporate Identity Number (CIN): U47912TS2025PTC207888 Phone: +91 80696 40720 (Monday to Saturday, 10:00 to 18:00 IST) Registered Office: Plot No. 135, Silicon Hills Township, Kondapur, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500084, India Website: www.tynari.com Privacy Email: privacy@tynari.com Support Email: support@tynari.com Privacy Page: www.tynari.com/privacy-policy/ Cookie Policy / Cookie Settings: www.tynari.com/cookie-policy/ Privacy Contact Details: Tynari Private Limited, Plot No. 135, Silicon Hills Township, Kondapur, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500084, India Tynari Private Limited ("Tynari," "we," "us," or "our") respects your privacy and is committed to protecting personal data in a lawful, fair, transparent, accountable, and secure way. This Privacy Policy explains how we collect, use, share, store, transfer, and otherwise process personal data when you access or use our websites, apps, APIs, dashboards, hosted stores, marketplace features, integrations, seller tools, creator tools, AI tools, design studio, smart mockup features, support channels, and related services (together, the "Services"). This Privacy Policy applies to people who visit our website and apps; buyers and end customers; sellers, merchants, creators, artists, influencers, and brand owners who use Tynari; people who buy products through Tynari-powered stores, marketplace experiences, or integrations; suppliers, print partners, logistics providers, and business contacts; and applicants, contractors, employees, and consultants, where relevant. By using our Services, you confirm that you have read and understood this Privacy Policy. Where the law requires consent for a specific activity, we will ask for that consent separately, and this Privacy Policy is the notice that goes with it.

To make this Privacy Policy easier to read, we use the following defined terms throughout. - Personal Data means any information that relates to an identified or identifiable person. This includes, where they apply, "personal data" under the EU/UK General Data Protection Regulation, "personal information" under U.S. state privacy laws, and "personal data" under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025). - Processing means anything we do with personal data, whether or not by automated means. This includes collecting, recording, organizing, structuring, storing, adapting, retrieving, using, disclosing, transferring, restricting, erasing, or destroying it. - Controller (also called a "Business" under U.S. state laws, and similar to a "Data Fiduciary" under the DPDP Act) means the organization that, alone or with others, decides why and how personal data is processed. - Processor (also called a "Service Provider" or "Contractor" under U.S. state laws, and similar to a "Data Processor" under the DPDP Act) means an organization that processes personal data on behalf of, and on the instructions of, a Controller. - Data Principal means, under the DPDP Act, the individual the personal data is about. - Data Subject means, under the GDPR and similar laws, the individual the personal data is about. When we say "you" in this Privacy Policy, we mean, as applicable, Data Principals, Data Subjects, and consumers. - Consent Manager means a person or platform registered with the Data Protection Board of India that lets a Data Principal give, manage, review, and withdraw consent through an accessible, transparent, and interoperable interface, as set out in the DPDP Act. - Services has the meaning given at the start of this policy.

Tynari runs a global, multi-sided print-on-demand and design platform. Our role under data protection law depends on what we are doing at the time. We are a controller, business, or data fiduciary when we decide why and how personal data is processed for our own business. This covers running our website, apps, accounts, dashboards, hosted stores, and marketplace features; managing seller, creator, buyer, supplier, and business accounts; billing, settlements, fraud prevention, support, platform analytics, platform security, and legal compliance; running and improving our AI and design tools; sending service messages and marketing where allowed; and recruiting and managing our workforce. We may be a processor, service provider, contractor, or data processor when we handle personal data on behalf of a seller, merchant, creator, brand, or other business customer, only to provide services on their documented instructions. This covers receiving order data from connected stores or integrations; processing product and print instructions; making, printing, packing, and shipping products; handling tracking, returns, and delivery support; and giving customer support about fulfillment. If you buy from or deal with a seller, creator, or merchant who uses Tynari, that party may also be a separate controller or data fiduciary of your personal data, and their own privacy policy may also apply. Where we act only as a processor for that party, you may need to send requests about your personal data to them, and we will help them as the law requires. Even when Tynari acts as a processor or service provider for order fulfillment, we may act as an independent controller for a few limited purposes, such as security, fraud prevention, abuse prevention, accounting, audit, sanctions screening, legal compliance, and bringing or defending legal claims.

We collect personal data at different points as you use the Services. We may collect personal data when you visit our websites or apps; create an account or profile; place an order or buy a product; create, upload, save, edit, or publish designs, templates, mockups, or assets; use our AI design studio, prompt tools, smart mockup tools, product idea tools, trend tools, or Tynari GPT; connect a marketplace, e-commerce platform, social commerce account, or external store; bulk publish products or sync listings across sales channels; contact support or otherwise message us; subscribe to updates, newsletters, or marketing; take part in surveys, promotions, research, or interviews; apply for a role or contract with Tynari; or when we receive information from integrations, merchants, marketplaces, payment providers, shipping providers, fraud-prevention tools, or other business partners. We also collect some information automatically through cookies, logs, device data, analytics tools, tracking technologies, and similar tools when you use our Services. We explain our use of cookies and similar technologies in our Cookie Policy at www.tynari.com/cookie-policy/.

We collect the following types of personal data, depending on how you use the Services. A. Identity and Contact Data This may include your name, email address, phone number, billing address, shipping address, business address, username and password, account credentials, and communication preferences. B. Account, Store, and Business Data This may include your store name and storefront details, merchant or creator profile information, payout and settlement details, account settings, permissions, roles, preferences, tax or verification information, and connected marketplace or platform details. C. Order and Transaction Data This may include your order number and order history, the items you bought, product variants and customization details, recipient details, order status, shipping, delivery, and tracking information, returns, refunds, disputes, and related records, and billing and transaction metadata. D. Design, Upload, and Content Data This may include uploaded artwork, graphics, logos, images, product files, and design assets; saved drafts, templates, layers, mockups, generated previews, and product configurations; text, names, messages, and personalization fields in designs or products; design library content; and publishing or sharing settings. E. AI, Automation, and Seller-Assistant Data This may include prompts, instructions, and input text you submit to Tynari GPT or our AI tools; generated outputs, design suggestions, product ideas, niche suggestions, marketing suggestions, tags, titles, listing suggestions, and related results; smart mockup requests, trend insights, and recommendation data; and any feedback you give on AI outputs, suggestions, or generated content. F. Platform Usage and Technical Data This may include your IP address, browser type and version, device type and identifiers, operating system, language and time zone, approximate location worked out from your IP address, referral URL, log files, clickstream data, crash logs, usage data, session activity, cookie identifiers, and similar technical data. G. Communications and Support Data This may include emails, support tickets, chats, messages, recordings where lawful, complaint records, feedback, survey responses, research participation records, and internal notes about resolving your issue and supporting you. H. Supplier, Partner, and Compliance Data This may include business contact details, contracts, invoices, quality records, service records, shipping, production, or printer performance information, and verification, tax, compliance, and due diligence information. I. Recruitment and Workforce Data Where relevant, this may include CVs, resumes, cover letters, interview notes, references, candidate assessment data, payroll, tax, benefits, attendance, access-control, and HR administration data, and contractor and consultant records. J. Sensitive or Special Categories of Data We do not deliberately ask customers, sellers, creators, or buyers for sensitive or special category personal data unless it is needed and lawful for a specific purpose, and, where required, we have your explicit consent. Because Tynari is a design and print-on-demand platform, content you upload into print files, custom products, prompts, images, or personalization fields can sometimes contain personal or sensitive information. The person uploading that content is responsible for making sure they have the right to provide it and have given any required notices or obtained any required permissions or consents under the law. Please do not upload unnecessary sensitive data, government identifiers, biometric information, medical information, financial account details, or children's personal data into designs, prompts, or print fields unless it is strictly necessary and lawful.

We use personal data for the purposes below. Each one is supported by a lawful basis, which we set out in Section 7. A. To Provide and Run the Services For example, to create and manage accounts; sign users in securely; host stores and product listings; process and fulfill orders; generate mockups and previews; enable bulk publishing and channel syncing; power AI-assisted features, design tools, and seller tools; and arrange shipping, delivery, support, and returns. B. To Run Marketplace, Hosted Store, and Seller Features For example, to create, manage, and publish product listings; support hosted stores and marketplace participation; manage seller dashboards, analytics, product metadata, and performance reporting; and improve product discovery, merchandising, and store operations. C. To Power AI and Product Intelligence Features For example, to process prompts and instructions you submit to our AI tools; generate or help with design suggestions, titles, tags, descriptions, and marketing ideas; provide niche suggestions, trend insights, product recommendations, mockups, and related help; and improve how accurate, relevant, safe, and usable our features are. Where the law and our contracts allow, we may also use aggregated or de-identified data to improve our Services, analytics, performance models, and product experience. We do not publish a merchant's end-customer personal data in public galleries, trend feeds, or public content libraries. D. To Process Payments, Settlements, and Accounting For example, to process payments, refunds, and chargebacks; work out earnings, commissions, or settlements; keep tax, billing, and financial records; and meet accounting and corporate obligations. E. To Communicate With You For example, to send order updates, security alerts, and admin notices; respond to support requests, complaints, and questions; send platform updates and service messages; and send marketing or promotional messages where the law allows. F. To Improve, Monitor, and Secure the Services For example, to analyze traffic, usage, feature adoption, and performance; fix problems and improve reliability; prevent fraud, abuse, spam, policy violations, suspicious activity, and unauthorized use; and keep our systems secure, resilient, and ready to respond to incidents. G. To Meet Legal and Regulatory Obligations For example, to comply with tax, consumer, privacy, sanctions, trade, fraud, and other laws; respond to lawful requests from courts, regulators, law enforcement, or authorities; enforce our terms; protect our rights; and resolve disputes. H. To Recruit and Manage Staff For example, to assess job applications; manage hiring and onboarding; and administer payroll, benefits, attendance, training, and compliance.

We rely on one or more lawful bases for each thing we do with your data, depending on the law that applies to you. Where UK GDPR, EU GDPR, or similar laws apply, we use personal data under one or more of these legal bases: - To perform a contract, where we need to process your data to provide the Services you asked for or to manage our relationship with you. - To take steps you asked for before entering into a contract. - To comply with legal obligations we are subject to, such as tax, accounting, and regulatory rules. - For our legitimate interests, such as securing and improving our Services, preventing fraud and abuse, running our business, and marketing to existing customers — except where your interests or fundamental rights override ours. - With your consent, where required. You can withdraw consent at any time, and this does not affect any processing we carried out before you withdrew it. - To establish, exercise, or defend legal claims. Where we rely on legitimate interests, we weigh our interests against yours (a balancing assessment), and you can email privacy@tynari.com to learn more about that assessment. Where India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025) applies, we process digital personal data for lawful purposes, either with your consent or for certain legitimate uses that the Act allows. Section 14 explains this in more detail. Where U.S. state privacy laws apply, we process personal information for the business and commercial purposes described in this Privacy Policy and in line with those laws. Section 13 explains this in more detail.

We share personal data only where it is needed, as described below, and we require those who receive it to protect it properly. We may share personal data with these types of recipients where needed: print providers, manufacturers, personalization partners, and fulfillment partners; shipping carriers and logistics providers; payment processors, payout providers, banks, and finance tools; hosting, cloud storage, infrastructure, analytics, communications, support, CRM, and security providers; identity verification, fraud prevention, sanctions screening, and compliance providers; marketplaces, store integrations, social commerce tools, and connected third-party platforms that you choose to connect; professional advisers such as lawyers, insurers, accountants, and auditors; group companies for internal operations, administration, compliance, and reporting; regulators, courts, law enforcement, tax authorities, and public bodies where the law requires or allows; and investors, lenders, buyers, or other parties in connection with a financing, merger, acquisition, restructuring, or sale of assets, with appropriate safeguards in place. When we use processors and service providers, we do so under written contracts that require them to process personal data only on our documented instructions, to keep it confidential, to put appropriate security measures in place, and to help us meet our obligations under the law. We keep a current list of the categories of processors and service providers we use at www.tynari.com/legal/sub-processors, and we require each of them to meet written confidentiality, security, data-retention, deletion, and breach-notification obligations. We may also share personal data with sellers, creators, merchants, or storefront operators where it is needed to complete transactions, give support, fulfill orders, resolve disputes, or meet legal and contractual obligations. We do not sell personal data for money. That said, some advertising, analytics, attribution, or related disclosures may count as a "sale," "sharing," or similar regulated activity under some U.S. state privacy laws. If Tynari does any of this, we will give the required notices and offer the opt-out choices that apply, as described in Section 13.

Because Tynari operates worldwide, your personal data may cross borders. When it does, we apply safeguards. Tynari is a global platform. Your personal data may be processed in India and in other countries where we, our group companies, service providers, suppliers, print partners, or logistics partners operate. These countries may have data protection laws that differ from those where you live. Because Tynari may route orders to printers or service providers in different regions, some order-related personal data may need to be sent to another country so we can provide the Services. Where the law requires it, we use appropriate safeguards for international transfers. These may include: - Adequacy decisions or adequacy regulations confirming that the destination country provides an adequate level of data protection. - The European Commission's Standard Contractual Clauses (SCCs) for transfers from the EEA. - The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs for transfers from the United Kingdom. - The Swiss Federal Data Protection and Information Commissioner's recognized clauses for transfers from Switzerland. - Extra contractual, technical, and organizational measures, together with transfer risk or transfer impact assessments where required. Where the DPDP Act applies, we may transfer personal data outside India, except to any country or territory that the Government of India restricts for such transfers, and subject to any conditions the Government may set. If you want more information about our international transfer safeguards, or a copy of the relevant safeguards where you have a right to one, please email privacy@tynari.com.

We use cookies and related technologies to run, secure, and improve the Services, with your consent where required. We use cookies and similar technologies, including pixels, browser storage, tags, and related tools, for purposes such as core website and platform functionality, account login and authentication, security and fraud prevention, cart, checkout, and session continuity, language, currency, and dashboard preferences, analytics and performance measurement, product improvement, and advertising, attribution, and campaign measurement where enabled and lawful. Where the law requires it, we ask for your consent before using non-essential cookies or similar technologies. You can manage your cookie choices through our cookie banner and settings, our Cookie Policy at www.tynari.com/cookie-policy/, and your browser or device settings, where available. Turning off certain cookies may affect some features of the Services.

You control the marketing you get from us. We may send marketing messages about Tynari, our Services, product updates, educational content, features, offers, and events where the law allows. You can opt out at any time by clicking the unsubscribe link in a marketing email, updating your communication preferences where available, or emailing us at privacy@tynari.com or support@tynari.com. Even if you opt out of marketing, we may still send you service, transactional, legal, security, or operational messages that we need to send to run your account or the Services.

Depending on where you are and the law that applies to you, you may have a range of rights over your personal data. Depending on your location and the law, you may have the right to: see your personal data; know what types of personal data we collect, use, disclose, or share; correct or complete data that is wrong or incomplete; delete or erase your personal data; restrict certain processing; object to certain processing; withdraw consent where we rely on consent; get a portable copy of certain data; opt out of the sale, sharing, or targeted advertising, or certain profiling, where it applies; nominate someone else to exercise your rights if you die or lose capacity, where it applies; complain to a regulator, supervisory authority, or statutory body; and not be treated unfairly for exercising your privacy rights. If we process your personal data only on behalf of a seller, merchant, creator, or other business customer, we may pass your request to that party where appropriate, while helping them as the law requires. To exercise your rights, please email privacy@tynari.com or support@tynari.com, or use the privacy page at www.tynari.com/privacy-policy/. We may need to confirm your identity before we act on certain requests, and we will respond within the time the law allows. There is usually no fee for exercising your rights, although we may charge a reasonable fee or refuse to act on requests that are clearly unfounded, excessive, or repetitive, to the extent the law allows.

If you live in a U.S. state with a comprehensive privacy law, you have the extra rights set out in this section. If you live in California or another U.S. state with applicable privacy rights (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states as their laws take effect), you may have extra rights, including: - The right to know and access the categories and specific pieces of personal information we have collected about you, where it came from, why we collected it, and the categories of third parties we share it with. - The right to correct inaccurate personal information. - The right to delete personal information, subject to legal exceptions. - The right to opt out of the "sale" or "sharing" of personal information and of targeted advertising. - The right to limit how we use and disclose sensitive personal information, where it applies. - The right not to be treated unfairly for exercising your privacy rights, including no denial of goods or services, no different prices, and no different level or quality of service, except where the law allows. You can exercise these rights by emailing us at privacy@tynari.com or through the privacy page at www.tynari.com/privacy-policy/. We will verify requests as the law requires. Authorized agents may submit requests on your behalf where the law allows, and we may ask for proof that they are authorized and confirm your identity. Tynari honors browser-based opt-out preference signals, including the Global Privacy Control (GPC), where the law requires, and treats a qualifying signal as a valid request to opt out of sale or sharing for that browser or device. We also respond to Do-Not-Track and similar signals to the extent the law requires; because there is not yet a single industry standard for these signals, we explain our response in our Cookie Policy. If you want to appeal our decision on a privacy request and the law gives you an appeal right, you can email your appeal to privacy@tynari.com, and we will respond within the time that law allows.

If you are in India, or your personal data is otherwise covered by the DPDP Act, this section explains how we comply with that Act and the rights it gives you. Tynari acts as a Data Fiduciary for digital personal data where it decides the purpose and means of processing, and as a Data Processor where it processes digital personal data on behalf of another Data Fiduciary. When you give personal data to us, you do so as a Data Principal. Notice and lawful basis. Where required, we give you a clear, plain-language notice describing the personal data we want to collect, why we are processing it, how you can exercise your rights, and how you can complain to the Data Protection Board of India. We process digital personal data either with your consent or for certain legitimate uses that the DPDP Act allows, such as where you have voluntarily provided your data for a specified purpose, for the performance of legal functions, or for other legitimate uses the Act recognizes. Consent, Consent Managers, and withdrawal. Where we rely on consent, we ask for it through an action that is free, specific, informed, unconditional, and unambiguous, and limited to the personal data we need for the specified purpose. You can give, manage, review, or withdraw your consent at any time, including, where available, through a Consent Manager registered with the Data Protection Board of India. Withdrawing consent is as easy as giving it and does not affect any processing we carried out before you withdrew it. If you withdraw consent, we will stop processing your personal data for that purpose within a reasonable time, unless another lawful basis or legal requirement applies, and we will require our Data Processors to do the same. Rights of the Data Principal. Subject to the conditions and exceptions in the DPDP Act, you have the right to: - Access information about the personal data we process about you, a summary of how we process it, and the identities of other Data Fiduciaries and Data Processors we have shared your personal data with, along with a description of what we shared. - Have your personal data corrected, completed, and updated, and have personal data erased when it is no longer needed for the purpose it was processed for, unless the law requires us to keep it. - Have your grievance addressed through a readily available means, with a response within the time set under the DPDP Act and its rules. - Nominate another person to exercise your rights under the DPDP Act if you die or lose capacity. Duties of the Data Principal. The DPDP Act also requires you to follow the law when exercising your rights, not to impersonate anyone else, not to hide material information, and not to file false or frivolous grievances or complaints. Grievance redressal and the Data Protection Board. If you are not happy with our response to your grievance, you can approach the Data Protection Board of India under the DPDP Act. You can contact our Grievance Officer using the details in Section 15. For India privacy or grievance matters, you can email privacy@tynari.com or write to Tynari Private Limited, Plot No. 135, Silicon Hills Township, Kondapur, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500084, India.

We have appointed a Grievance Officer to receive and deal with privacy and data-protection grievances. Grievance Officer: Siddhant Chopra You can reach the Grievance Officer at privacy@tynari.com. Postal address: Tynari Private Limited, Plot No. 135, Silicon Hills Township, Kondapur, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500084, India. We respond to grievances within the time the law requires, including under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025) and the Information Technology Act, 2000 and the rules made under it. If your grievance is about personal data that we process only on behalf of a seller, merchant, creator, or other business customer, we may work with that party and pass your grievance to them, while helping as the law requires.

If you are in the UK, EEA, or Switzerland, you have specific rights and remedies under the GDPR and equivalent laws. If you are in the UK, EEA, or Switzerland, you have the rights described in Section 12 as given effect by the UK GDPR, the EU GDPR, and the Swiss Federal Act on Data Protection. These include the rights of access, rectification, erasure, restriction, objection, and data portability, and the right not to be subject to certain decisions made solely by automated means. You also have the right to complain to your local supervisory authority. For people in the EEA, this is the data protection authority in the country where you live, work, or where the alleged breach happened; for people in the UK, this is the Information Commissioner's Office (ICO); and for people in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). We would, though, welcome the chance to address your concerns before you go to a supervisory authority, so please consider contacting us first. Where we are required to appoint a representative in the EU or the UK, we will provide their details here once appointed: [EU/UK Representative to be appointed, if applicable]. You can email us at privacy@tynari.com for privacy questions or to make a rights request.

We keep personal data only as long as we need it, and we apply set criteria for how long we hold each type. We keep personal data only for as long as we reasonably need it for the purposes described in this Privacy Policy. This includes providing the Services, keeping business and financial records, meeting tax, accounting, legal, and regulatory obligations, resolving disputes, enforcing agreements, detecting and preventing fraud and abuse, and protecting our rights and operations. When we decide how long to keep data, we consider the amount, nature, and sensitivity of the data, the risk of harm if it were used or disclosed without permission, why we process it, whether we can achieve those purposes another way, and the law that applies, including tax and regulatory rules. How long we keep data depends on the type of data and the business need. In general, our criteria are: - Account and profile data: kept for the life of the account and for a reasonable time afterwards, then deleted or de-identified, unless the law or an active legal hold requires us to keep it longer. - Order and transaction records, including invoices and settlement records: kept for the period required by tax, accounting, and corporate law, which is usually several years from the relevant transaction. - Connected sales-channel data, including order and recipient personal data we receive when you connect a marketplace or online store (such as Amazon, Shopify, Etsy, Flipkart, WooCommerce, Wix, TikTok Shop, Instagram Shop, or YouTube Shopping): kept only as long as needed to provide the Services. Recipient personal data used to fulfil an order is deleted no later than 30 days after the order is delivered, unless a documented legal exception applies or the connected channel requires a shorter period. - Design files, prompts, projects, mockups, and uploaded assets: kept until you delete or remove them, or until they are no longer needed, subject to backups, support needs, completed-order requirements, legal holds, or contractual storage settings. - Support and communications records: kept for a reasonable support and dispute-management period after the matter is resolved. - Marketing records: kept until you unsubscribe, object, or withdraw consent, plus a limited period on a suppression list so we can honor your opt-out. - Security, fraud, and audit logs: retained for at least 12 months, and for as long as we reasonably need them to detect, prevent, investigate, and protect against legal risk, while avoiding unnecessary personal data in them. - Supplier, payout, and settlement records: kept for the length of the contract and the related legal or accounting retention period. - Recruitment and workforce records: kept in line with legal and operational needs. We keep unsuccessful applicant data only for the period needed to run the recruitment process and handle any related legal claims, unless you agree to a longer period. - Cookie and similar technology data: kept for the period described in our Cookie Policy. Where we cannot delete data straight away — for example, because of backups, legal holds, or secure archives — we will isolate, restrict, and protect it, and do nothing further with it, until we can delete it.

We protect personal data using a mix of technical and organizational safeguards. We put in place appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include: - Role-based and least-privilege access controls. - Encryption in transit and, where appropriate, at rest. - Authentication, password protections, and account controls, including support for extra authentication factors where available. - Monitoring, logging, vulnerability management, and incident response procedures. - Vendor due diligence and contractual controls with our processors and service providers. - Staff training, confidentiality obligations, and access governance. - Data minimization, pseudonymization where appropriate, and retention controls. - Backup, redundancy, and resilience processes to support availability and recovery. No method of sending or storing data is completely secure. However, we take commercially reasonable, risk-appropriate steps to protect personal data, and we review and update our measures as threats and our Services change. You are responsible for keeping your credentials confidential, using strong and unique passwords, and telling us promptly at support@tynari.com or privacy@tynari.com if you think someone has accessed or used your account without permission.

We are open about how we use automated tools, and we provide safeguards where the law requires them. We may use automated tools, rules, and risk signals to help detect fraud, suspicious orders, spam, policy violations, and abusive behavior; spot payment anomalies or account compromise; improve moderation, security, and platform integrity; and help with product recommendations, trend insights, listing suggestions, and seller support features. We do not make decisions solely by automated means that have legal or similarly significant effects on you, unless the law allows it and we have appropriate safeguards in place. Where this kind of processing does happen and the law requires it, the safeguards available may include giving you meaningful information about the logic involved, offering meaningful human review, letting you give your point of view, and letting you contest the decision. To ask for human review of a qualifying automated decision, please email privacy@tynari.com.

We have procedures to detect, respond to, and report personal data breaches. If we become aware of a personal data breach, we will investigate, contain, assess, document, and fix the issue without undue delay. We will notify affected individuals, customers, merchants, regulators, supervisory authorities, the Data Protection Board of India, the Indian Computer Emergency Response Team (CERT-In), and other authorities where, and within the timelines, the law requires, including the GDPR, U.S. state laws, the DPDP Act, and the Information Technology Act, 2000 and the rules made under it. Where we act as a processor or service provider, we will tell the relevant controller or business about a personal data breach without undue delay and help them meet their own notification obligations. Our notifications will, to the extent required and where known, describe the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, the steps we have taken or plan to take to address it, and the steps you can take to protect yourself.

We take particular care with children's personal data and do not knowingly collect it unlawfully. Tynari's Services are meant for adults and are not aimed at children. We do not knowingly collect personal data from children in breach of the law. Where the DPDP Act applies, a "child" is anyone who has not turned eighteen, and we will not process a child's data in a way that is likely to harm their well-being, and we will not track, monitor the behavior of, or run targeted advertising aimed at children, except where the law allows. Where the law requires verifiable parental or guardian consent to process a child's personal data, or the personal data of a person with a disability who has a lawful guardian, we will obtain that consent in the way the law requires. If you think a child has given us personal data without proper authorization, please email us at privacy@tynari.com. If we learn that we have collected such personal data unlawfully or without the required consent, we will take appropriate steps to delete it or otherwise address it promptly. You should not upload children's personal data into designs, prompts, print fields, or other content unless you are lawfully entitled to do so and have obtained any required consents.

We are not responsible for the privacy practices of third parties you choose to use, and we encourage you to read their notices. Our Services may integrate with or link to third-party marketplaces, stores, websites, platforms, social networks, payment providers, shipping providers, design tools, analytics tools, AI providers, and other external services that Tynari does not control. We are not responsible for the privacy, security, or content practices of third parties, except to the extent the law requires. When you connect a third-party service or follow a link, that third party may collect information from you under its own notices. We encourage you to read their privacy notices before you deal with them.

You control what you publish, and you are responsible for making sure it is lawful. Some Tynari features let you publish products, storefronts, listings, designs, or related content to marketplace pages, hosted stores, connected external channels, public listings, or collaborative or shared workflows. Where these features are available, content is private by default unless you choose to publish, share, list, or otherwise make it visible through the relevant feature. You are responsible for making sure that any content, personal data, images, names, or other material you publish or share through Tynari is lawful, and that you have the rights, permissions, consents, and notices you need. Personal data that you choose to make public may be collected, used, or further shared by others, and that further processing is outside our control.

We may update this Privacy Policy, and we will tell you about material changes. We may update this Privacy Policy from time to time to reflect changes in our Services, technologies, legal requirements, or privacy practices. When we update this Privacy Policy, we will change the "Last Updated" date above. If the changes are material, we may also give you extra notice through the website, your account, email, or another suitable way where the law requires, and, where the law requires, we will get your consent before the change takes effect. If you keep using the Services after an update takes effect, that shows you acknowledge the updated Privacy Policy, except where we separately need your consent.

This section explains how we handle personal data when you connect a third-party sales channel, such as a marketplace or online store, to Tynari. It applies to every channel we support or add over time, including Amazon, Shopify, Etsy, Flipkart, WooCommerce, Wix, TikTok Shop, Instagram Shop, YouTube Shopping, and any other marketplace or store platform you choose to connect (each, a "Connected Channel"). 25.1 How the connection is authorised You connect a Connected Channel by authorising Tynari through that channel's own secure authorisation process, usually OAuth. You control which channels you connect and which operations you enable. We access channel information only after you authorise us, and only to provide the Services you have asked for. 25.2 What channel information we access Depending on the Connected Channel and the features you enable, we may access product, listing, catalogue, inventory, and seller-controlled pricing information; order information; and, where an order is shipped to a recipient, the recipient's name, delivery address, and related shipping details. We access only the information reasonably needed to provide the Services. 25.3 How we use channel information We use channel information only to operate the Services you have enabled, for example to create and update listings and variations, synchronise seller-controlled prices and available inventory, import orders, route each order for production and fulfilment, and return carrier, tracking, and fulfilment updates to the channel. We do not sell channel information, use it for advertising or unrelated marketing, or build buyer profiles from it. 25.4 Who can access channel information Access to channel information is limited to you (the authorised seller), approved Tynari personnel with a legitimate business need, and the contracted providers that need limited information to fulfil a specific order, such as any print provider, manufacturer, or shipping carrier assigned to that order, together with our infrastructure and cloud-hosting providers. We share only the minimum information needed, through encrypted channels, and under written confidentiality, security, deletion, and breach-notification obligations. 25.5 How long we keep channel information We keep channel information only as long as needed to provide the Services. Recipient personal data used to fulfil an order is deleted no later than 30 days after the order is delivered, unless a documented legal exception applies or the Connected Channel requires a shorter period. Other channel records are kept in line with Section 17 (How Long We Keep Your Data), and we do not keep channel personal data for longer than the relevant channel's rules allow. 25.6 Disconnecting a channel and withdrawing authorisation You can disconnect a Connected Channel and withdraw Tynari's authorisation at any time, through your Tynari dashboard or the channel's own settings. When you disconnect a channel, we stop accessing new information from it, and we then delete or return the channel's personal data in line with this Privacy Policy and our retention schedule, except where we must keep limited information to complete an order already in progress, meet a legal or tax obligation, resolve a dispute, or prevent fraud.

If you have questions, concerns, complaints, or requests, please get in touch using the details below. If you have any questions, concerns, complaints, or requests about this Privacy Policy or our privacy practices, please contact us at: Tynari Private Limited Plot No. 135, Silicon Hills Township, Kondapur, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500084, India Grievance Officer: Siddhant Chopra Privacy Email: privacy@tynari.com Support Email: support@tynari.com Website: www.tynari.com Privacy Page: www.tynari.com/privacy-policy/ Cookie Policy: www.tynari.com/cookie-policy/ This Privacy Policy is governed by the laws of India, and the courts of Hyderabad, Telangana have exclusive jurisdiction over any dispute arising out of or in connection with it. This does not affect any non-waivable rights you may have to bring proceedings or make complaints in the country where you live under the law that applies to you.