Data Protection Policy

• Collect only what the service genuinely needs.
• Keep public profile information separate from private account information.
• Restrict access at the database level so members can only reach their own private data.
• Describe only what the software actually does — no aspirational claims.

FyndMe does not collect GPS or precise device location. Location is limited to the city or area you type into your profile.

Contractual terms with these providers are governed by their standard agreements. FyndMe does not claim any additional bespoke safeguard that has not been signed, and international transfer positions are subject to review by qualified counsel.

The Velyra boutique is a separate Shopify storefront. FyndMe reads its public product catalogue on the server side and sends no member identity, email, profile or browsing data to Shopify. If you buy something on Velyra, that purchase is handled entirely under Velyra's own terms and privacy notice.

Settings → Delete account permanently runs a single server-side routine. In one transaction it removes your profile, all profile and private album photos and their stored files, your conversations with their messages, attachments and media, likes, favourites, connections, profile views, blocks, private album permissions, notifications and preferences, push devices, privacy settings, verification records and photos, AI data, payment requests and uploaded payment proofs, and your membership.

Two things are deliberately not destroyed: payment transaction records, which are kept for accounting but detached from you, and staff audit and safety records, which keep the fact that an action happened without keeping your profile link. Copies may persist briefly in encrypted infrastructure backups until those backups roll over.

Deactivation is different: it hides you from discovery and keeps your data so you can return. Use deletion if you want the data gone.

• Encrypted transport (HTTPS) for all traffic.
• Row-level access rules on every table holding member data.
• All five storage buckets are private; files are served only through short-lived signed links.
• Private albums are released only after the owner approves an access request, and can be revoked.
• Staff functions require an explicit staff role and write to an audit log.
• Bot and abuse checks on sensitive actions, plus per-account interaction limits.

• Access a copy of your data — email support@nblendinc.com from your account email. A self-service export is not built yet; requests are handled manually.
• Correct your information — edit your profile, preferences and photos directly in the app. For account email or date of birth, contact support.
• Delete your data — Settings → Delete account permanently.
• Withdraw optional consent — Privacy Center → Cookies & consent, and the AI assistance toggles.
• Raise a grievance — see Contact.

We verify that a request comes from the account holder before acting on it, and we will not disclose personal data to an unverified requester.

Our incident process is: detect, contain, investigate, assess what data was involved, remediate, and then notify affected members and any authority we are legally required to notify. We do not publish a guaranteed notification deadline, because the applicable timelines depend on the incident and on provisions whose commencement is still being confirmed with counsel.

This policy describes implemented behaviour that has been checked against the running application and database. It is not a legal opinion and it is not a claim of compliance with any particular statute. It remains subject to review by qualified Indian legal and privacy counsel.