Privacy Policy

Effective date: 25/07/2026
Last updated: 25/07/2026

1. Introduction

Arviah Jewellery Private Limited, operating under the brand name “Arviah”, respects your privacy and is committed to handling personal data responsibly, transparently and securely.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you:

• visit arviahstudio.com;
• access or use app.arviahstudio.com;
• create or manage an Arviah account;
• submit a custom jewellery project;
• review or accept a manufacturer proposal;
• purchase jewellery or related services from Arviah;
• communicate through the Arviah platform;
• apply to participate as a manufacturer or supplier;
• contact customer support; or
• otherwise interact with Arviah.

The website, web application and related services are collectively referred to in this Privacy Policy as the “Platform.”

This Privacy Policy should be read together with our Terms and Conditions, Payments and Refunds Policy, Cookie Policy and any project-specific notices presented to you.

2. Who is responsible for your personal data?

The entity responsible for the processing described in this Privacy Policy is:

Arviah Jewellery Private Limited
CIN: U47733MH2026PTC473724
Registered office: 225 Fl 2, Shreeji Chamber, Tata RD 2 Roxy Cinema, Opera House, Mumbai, Mumbai- 400004, Maharashtra
Privacy contact: krish@arviahstudio.com
Telephone: +91 73047 80849

For the purposes of applicable Indian data-protection law, Arviah acts as the Data Fiduciary in relation to personal data for which it determines the purpose and means of processing.

Manufacturers participating on the Platform act as suppliers to Arviah. They may receive limited personal data where necessary to prepare proposals, manufacture an item, provide project updates or assist Arviah with after-sales support.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed by or on behalf of Arviah through the Platform and its related business operations.

It does not govern:

• websites, applications or services operated independently by third parties;
• a third party’s processing carried out for its own independent purposes;
• information that does not relate to an identifiable individual; or
• information that has been irreversibly anonymised so that no individual can reasonably be identified.

Third-party services may have their own privacy policies. You should review those policies before providing personal data directly to them.

4. Personal data we collect

The personal data we collect depends on how you interact with Arviah.

4.1 Account and identity information

We may collect:

• full name;
• username;
• email address;
• mobile number;
• account credentials;
• verification status;
• profile photograph;
• preferred language;
• communication preferences; and
• other information you add to your account.

Passwords should be stored only in securely hashed form. Arviah does not need to know or retrieve your original password.

4.2 Project and design information

When you create or participate in a jewellery project, we may collect:

• project briefs and written instructions;
• sketches, photographs and reference images;
• design preferences;
• jewellery type;
• metal, purity and finish preferences;
• stone preferences and specifications;
• ring size or other measurements;
• dimensions;
• engraving text;
• approximate budget;
• preferred completion date;
• CAD files and renders;
• proposal details;
• specification approvals;
• revision requests;
• manufacturing updates;
• quality-control records;
• hallmark and HUID information; and
• other project-related materials.

Project files may contain personal or sensitive information that you voluntarily include, such as names, photographs, dates, personal inscriptions or details about an engagement, wedding or gift recipient. Please submit only information that is reasonably necessary for your project.

4.3 Proposal, order and transaction information

We may collect:

• proposals received and reviewed;
• accepted proposal details;
• order numbers;
• approved specifications;
• order value;
• applicable taxes;
• payment stages;
• payment status;
• transaction references;
• invoices;
• refunds;
• chargeback or dispute information;
• manufacturer settlement information;
• delivery status; and
• records relating to cancellations, alterations, repairs or warranties.

Arviah does not intend to store complete payment-card numbers, card verification values, UPI PINs, banking passwords or one-time passwords. Payments are processed through authorised payment providers such as Razorpay, which may collect payment information directly under its own privacy and security practices.

4.4 Delivery information

We may collect:

• recipient name;
• billing address;
• delivery address;
• mobile number;
• delivery instructions;
• postcode;
• shipment value;
• tracking information;
• delivery confirmation;
• signature or delivery-verification information; and
• information required for loss, damage or insurance claims.

4.5 Communications

We may collect and retain:

• messages exchanged through the Platform;
• messages between customers and manufacturer usernames;
• support emails;
• telephone or video-call records where recorded with appropriate notice;
• complaint and dispute records;
• survey responses;
• review submissions;
• feedback; and
• communications relating to payments, delivery, alterations and warranty support.

Communications conducted through the Platform may be reviewed where reasonably necessary to:

• facilitate a project;
• resolve a dispute;
• investigate suspected fraud or misconduct;
• enforce restrictions on off-platform transactions;
• protect users and Arviah; or
• comply with law.

4.6 Manufacturer and supplier information

For manufacturer applicants and suppliers, we may collect:

• legal and trading names;
• owner, director or authorised-representative details;
• identity-verification information;
• business-registration information;
• PAN and GST details;
• BIS registration information;
• registered and workshop addresses;
• bank-account verification information;
• portfolio materials;
• trade references;
• manufacturing capabilities;
• commercial terms;
• performance records;
• quality-control results;
• customer ratings;
• strike, suspension or investigation records; and
• contractual and tax documents.

Sensitive supplier documents should be collected through approved, access-controlled systems and should not be displayed publicly.

4.7 Technical and device information

When you access the Platform, we or our service providers may automatically collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• device identifiers;
• language;
• approximate location derived from IP address;
• time zone;
• login timestamps;
• referring pages;
• pages and features accessed;
• session information;
• crash reports;
• security logs; and
• cookie or similar-technology identifiers.

4.8 Marketing and preference information

Where applicable, we may collect:

• whether you have opted into marketing;
• preferred communication channels;
• campaign engagement;
• email opens and link interactions;
• product or content interests; and
• consent and withdrawal records.

4.9 Information from other sources

We may receive information from:

• payment providers;
• courier and logistics providers;
• manufacturers and suppliers;
• Assaying and Hallmarking Centres;
• BIS verification sources;
• gemstone laboratories;
• fraud-prevention and verification providers;
• analytics and technology providers;
• publicly accessible business registers;
• professional advisers; and
• government or regulatory authorities.

We will use information received from other sources only for lawful and disclosed purposes.

5. How we collect personal data

We collect personal data:

• directly from you;
• when you use the Platform;
• when you communicate with Arviah or a manufacturer through the Platform;
• when another person places an order for you or identifies you as a recipient;
• from participating manufacturers and suppliers;
• from payment, delivery and verification providers;
• through cookies and similar technologies;
• from publicly available sources where appropriate; and
• where required or permitted by law.

Where another person provides your personal data to Arviah, that person must have authority to provide it and must ensure that doing so is lawful.

6. Purposes for which we process personal data

We process personal data for the following purposes.

6.1 Account administration

To:

• register and authenticate users;
• maintain accounts;
• provide account functionality;
• verify contact information;
• manage account preferences; and
• provide password recovery and security notifications.

6.2 Providing the Platform

To:

• accept and display project briefs;
• make relevant projects available to eligible manufacturers;
• receive and compare proposals;
• operate project messaging;
• record specifications and approvals;
• administer production stages;
• manage quality-control records; and
• provide project and order status information.

6.3 Performing customer orders

To:

• enter into and perform contracts with customers;
• obtain jewellery from suppliers;
• process staged payments;
• issue invoices;
• arrange CAD or design work where included;
• coordinate manufacturing;
• arrange hallmarking and HUID recording;
• conduct quality control;
• arrange delivery;
• provide warranty and alteration support; and
• manage remakes, exchanges and refunds.

6.4 Supplier administration

To:

• receive and assess manufacturer applications;
• verify supplier information;
• manage supplier contracts;
• assess capabilities and performance;
• allocate access to projects;
• administer commissions and settlements;
• investigate quality or conduct concerns; and
• suspend or remove suppliers where appropriate.

6.5 Communications and customer support

To:

• respond to enquiries;
• provide service notifications;
• request approvals or payments;
• provide delivery updates;
• resolve complaints;
• investigate disputes;
• administer refunds;
• provide warranty support; and
• retain an appropriate record of the matter.

6.6 Safety, fraud prevention and enforcement

To:

• protect customer and supplier accounts;
• detect and prevent fraud;
• investigate suspicious transactions;
• prevent off-platform payments or circumvention;
• detect misuse of the Platform;
• enforce our Terms and supplier agreements;
• protect Arviah’s rights, property and users; and
• establish, exercise or defend legal claims.

6.7 Platform operation and improvement

To:

• maintain and troubleshoot the Platform;
• monitor availability and performance;
• identify errors;
• understand how features are used;
• improve user experience;
• develop new services;
• perform internal research and analytics; and
• protect the reliability and security of our systems.

Where practical, Arviah will use aggregated or anonymised information for analytics and development.

6.8 Legal and regulatory compliance

To:

• maintain corporate, accounting and tax records;
• comply with GST and invoicing requirements;
• comply with BIS and hallmarking requirements;
• respond to lawful requests;
• meet consumer-protection obligations;
• support audits;
• comply with payment and financial requirements;
• comply with applicable data-protection law; and
• report or investigate suspected unlawful conduct.

6.9 Marketing

Where you have chosen to receive marketing, we may use your contact and preference information to send:

• product updates;
• jewellery guides;
• project inspiration;
• service announcements;
• event information; and
• promotional offers.

You may withdraw from marketing at any time by using the unsubscribe facility or contacting us.

Withdrawing marketing consent does not affect essential communications about your account, order, payment, delivery, security or legal notices.

7. Grounds on which we process personal data

Arviah will process personal data only for lawful purposes.

Depending on the circumstances and applicable law, processing may be based on:

• your consent;
• processing voluntarily provided personal data for a specified purpose;
• taking steps requested by you or performing a contract with you;
• fulfilling Arviah’s legal obligations;
• responding to a medical emergency, threat to life or health, disaster or public-order situation where applicable;
• employment-related purposes where permitted;
• protecting against fraud, security threats and unlawful activity;
• establishing, exercising or defending legal claims; or
• another use permitted under applicable law.

Where processing depends on consent, you may withdraw that consent using a method that is reasonably comparable to the method by which it was provided.

Withdrawal does not make earlier lawful processing invalid. It may, however, prevent Arviah from continuing a service where the relevant personal data is necessary to provide it.

8. Project visibility and manufacturer access

Customer project briefs may be made available to eligible manufacturers during the proposal period.

Before a customer accepts a proposal, Arviah may share information reasonably necessary for manufacturers to:

• understand the requested jewellery;
• assess whether they can complete it;
• calculate a price;
• estimate production time; and
• submit a proposal.

Arviah should not ordinarily disclose the customer’s direct email address, telephone number, payment information or delivery address to all bidding manufacturers.

Once an order is placed, the selected manufacturer may receive additional information where necessary to manufacture the item or provide support. Arviah will seek to limit this information to what is reasonably necessary.

Manufacturers communicate through an Arviah username and are prohibited from using customer information to solicit off-platform business, send unrelated marketing or contact customers for unauthorised purposes.

9. Who we disclose personal data to

We may disclose personal data to the following categories of recipients.

9.1 Manufacturers and suppliers

We may provide selected manufacturers with project specifications, reference materials, communications, approvals and other information required to prepare or fulfil a proposal.

The selected manufacturer’s legal identity may remain hidden from the customer within the normal Platform interface. Arviah may nevertheless disclose or record that identity where required by law, BIS, an Assaying and Hallmarking Centre, a gemstone laboratory, an insurer, a courier, a court, a regulator or another competent authority.

9.2 Payment and financial-service providers

We may share transaction and identification information with Razorpay, banks, payment networks, fraud-prevention services and other payment providers as necessary to:

• process payments;
• verify transactions;
• administer refunds;
• prevent fraud;
• manage chargebacks; and
• comply with financial or legal requirements.

Payment providers may act as independent data fiduciaries or controllers for certain processing governed by their own notices.

9.3 Delivery, logistics and insurance providers

We may disclose recipient names, contact information, addresses, shipment information, order value and claim documentation to Sequel or other approved logistics, insurance and delivery providers.

9.4 Hallmarking, testing and laboratory providers

We may disclose order, item, supplier and contact information where required for:

• BIS registration or compliance;
• hallmarking;
• HUID generation or verification;
• metal testing;
• gemstone grading;
• appraisal; or
• authenticity documentation.

9.5 Technology and professional-service providers

We may use service providers for:

• cloud hosting;
• file storage;
• database management;
• authentication;
• cybersecurity;
• email and communications;
• customer support;
• analytics;
• document management;
• accounting;
• auditing;
• tax;
• insurance;
• consulting; and
• legal services.

Such providers may process personal data only for agreed purposes and subject to contractual, confidentiality and security requirements appropriate to their role.

9.6 Corporate transactions

If Arviah is involved in a merger, investment, financing, restructuring, acquisition, sale of assets, insolvency or similar corporate transaction, relevant personal data may be disclosed to professional advisers, prospective counterparties, investors, lenders or successors.

Where appropriate, disclosures will be subject to confidentiality and use restrictions.

9.7 Authorities and legal recipients

We may disclose personal data where we reasonably believe disclosure is necessary to:

• comply with law or legal process;
• respond to a lawful request;
• protect the rights or safety of Arviah, users or others;
• prevent or investigate fraud or unlawful activity;
• enforce contracts;
• comply with tax, consumer, payment, BIS or hallmarking requirements; or
• establish, exercise or defend legal claims.

10. No sale of personal data

Arviah does not sell personal data for monetary consideration.

Arviah also does not permit manufacturers to sell, rent or independently exploit customer information obtained through the Platform.

This statement does not prevent Arviah from disclosing data to service providers, suppliers or transaction counterparties for the purposes described in this Privacy Policy.

11. International processing and transfers

Arviah currently accepts customer orders for delivery within India. However, some technology, communications, analytics or support providers may process or store personal data outside India.

Where personal data is transferred or made accessible outside India, Arviah will take measures required by applicable law, which may include:

• reviewing the destination and recipient;
• entering appropriate contractual protections;
• applying security and access controls;
• limiting the data transferred; and
• complying with restrictions or requirements issued by the Government of India.

Where international services or deliveries are introduced later, this Privacy Policy and the relevant transaction notices may be updated to address additional countries and recipients.

12. Data retention

Arviah retains personal data only for as long as reasonably necessary for the purpose for which it was collected, including to satisfy legal, accounting, tax, regulatory, security and dispute-resolution requirements.

Different categories of information may be retained for different periods.

Indicative retention periods include:

Account information

Retained while the account remains active and afterwards for the period reasonably necessary to:

• complete outstanding transactions;
• resolve disputes;
• prevent fraud;
• enforce agreements; or
• comply with law.

Unsuccessful or abandoned project briefs

Retained for 14 days after the last project activity, unless a longer period is required for a dispute, fraud investigation or legal obligation.

Order, invoice, payment and tax records

Retained for at least the period required under applicable company, tax, GST, accounting and limitation laws, which may generally require records to be retained for several years after the relevant transaction or financial year.

Project specifications, approvals and communications

Retained for the duration of the order and afterwards for the applicable warranty, dispute and legal-claims period.

QC photographs and inspection records

Retained for 14 days after delivery or for longer where a warranty, complaint, courier claim, legal dispute or regulatory requirement remains outstanding.

Manufacturer verification and performance records

Retained for the supplier relationship and for 14 days afterwards, subject to tax, contractual, fraud-prevention and legal requirements.

Marketing information

Retained until you unsubscribe, withdraw consent or the information is no longer reasonably required, subject to retaining a limited suppression record so that we can honour your preference.

Security logs

Retained for 14 days unless needed longer for investigation or legal purposes.

Arviah will delete, anonymise or securely isolate personal data when it is no longer required, unless retention is legally required or reasonably necessary to establish, exercise or defend legal claims.

A request to delete an account does not require Arviah to delete records that must lawfully be retained, including invoices, payment records, fraud-prevention records, contractual approvals or information connected with an unresolved dispute.

13. Cookies and similar technologies

Arviah may use cookies, pixels, local storage, software development kits and similar technologies.

These technologies may be used for:

• account authentication;
• session management;
• security;
• remembering preferences;
• Platform functionality;
• analytics;
• measuring performance; and
• advertising, where implemented and permitted.

We classify cookies and related technologies as follows:

Strictly necessary

Required for login, security, session management, payments or core Platform operation. These technologies cannot ordinarily be disabled through Arviah’s consent controls where they are essential to provide a service requested by you.

Preference

Used to remember choices such as language or display settings.

Analytics

Used to understand Platform performance and how users interact with features.

Advertising

Used, where implemented, to measure campaigns or provide relevant advertising.

Where consent is required, non-essential technologies will be activated only after the relevant choice has been made.

You may manage available choices through the cookie banner, the Privacy Choices link or your browser settings. Browser controls may not prevent all forms of storage or tracking.

Additional details, including the technologies currently deployed and their duration, should be provided in Arviah’s separate Cookie Policy.

14. Uploaded photographs and metadata

Photographs may contain metadata, including device information, timestamps or location data.

Arviah may remove or minimise metadata when technically and operationally appropriate, but you should remove unnecessary location or identifying metadata before uploading an image.

Project images are intended to be accessible only to Arviah, authorised service providers and eligible or selected manufacturers as necessary for the project. They should not be publicly downloadable unless you deliberately submit them for a public portfolio, review or marketing feature.

15. Data security

Arviah uses technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• alteration;
• disclosure;
• destruction; and
• misuse.

Depending on the system and risk, measures may include:

• encrypted transmission using current transport-security protocols;
• secure password hashing;
• encryption at rest where appropriate;
• multi-factor authentication for privileged accounts;
• role-based access controls;
• access logging;
• secure development and change-management practices;
• network and application security controls;
• malware protection;
• backup and recovery procedures;
• vulnerability management;
• incident-response procedures;
• employee and contractor confidentiality obligations;
• supplier-security reviews;
• data minimisation; and
• periodic review of access rights.

Only personnel and providers with an appropriate business need should have access to personal data.

No system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying Arviah promptly if you suspect unauthorised account activity.

Do not send card numbers, UPI PINs, banking passwords or one-time passwords to Arviah or to a manufacturer through messages, email or telephone.

16. Personal-data breaches

Arviah maintains procedures to assess and respond to suspected personal-data breaches.

Where a breach is confirmed, Arviah will take steps appropriate to the nature and risk of the incident, which may include:

• containing the incident;
• securing affected systems;
• investigating the cause and scope;
• preserving relevant evidence;
• taking corrective action;
• notifying affected individuals;
• notifying the Data Protection Board of India or another authority; and
• documenting the incident and response.

Notifications will be made where and within the time required by applicable law.

17. Children

The Platform is not intended for persons under 18 years of age to create accounts or place orders independently.

Arviah does not knowingly seek to process a child’s personal data without appropriate and verifiable consent from a parent or lawful guardian where required.

If you believe that a child has provided personal data without appropriate authorisation, contact krish@arviahstudio.com.

Arviah may take reasonable steps to verify age or parental authority where required by applicable law.

18. Automated processing

Arviah may use automated tools to:

• detect fraud or suspicious activity;
• identify spam or prohibited contact information;
• prioritise support or security alerts;
• match projects with eligible manufacturers; or
• support internal risk assessment.

Arviah does not intend to make a decision producing significant legal or similarly substantial effects on a customer solely through automated processing without appropriate review, unless the processing is authorised by law and appropriate safeguards are provided.

19. Your rights and choices

Subject to applicable law and verification of your request, you may have the right to:

19.1 Obtain information about processing

You may request a summary of the personal data Arviah processes about you, the processing activities undertaken and the identities or categories of recipients with whom the data has been shared, where required by law.

19.2 Correct or update personal data

You may request correction of inaccurate or misleading personal data and completion or updating of incomplete personal data.

Certain account information may be updated directly through the Platform.

19.3 Request erasure

You may request deletion of personal data that is no longer necessary for the specified purpose, subject to:

• legal retention requirements;
• active orders;
• warranty obligations;
• unresolved disputes;
• tax and accounting requirements;
• fraud-prevention requirements; and
• the establishment, exercise or defence of legal claims.

19.4 Withdraw consent

Where processing is based on consent, you may withdraw that consent.

Withdrawal does not affect processing lawfully carried out before withdrawal. Where the relevant information is necessary to provide a requested service, withdrawal may affect Arviah’s ability to continue that service.

19.5 Manage marketing

You may stop marketing communications by:

• selecting the unsubscribe option in a marketing email;
• changing available account preferences; or
• contacting Arviah.

Service, transaction, account and security communications may continue where necessary.

19.6 Raise a grievance

You may raise a grievance concerning Arviah’s processing of personal data by contacting the privacy contact identified below.

19.7 Nominate another person

Where applicable, you may nominate another individual to exercise your rights in the event of your death or incapacity, in the manner made available by Arviah and permitted under law.

19.8 Complain to the competent authority

Where available under applicable law, you may approach the Data Protection Board of India after using Arviah’s grievance process.

Nothing in this Privacy Policy limits rights that cannot lawfully be excluded.

20. Your responsibilities

When using the Platform, you should:

• provide accurate information;
• update material changes;
• protect your account credentials;
• avoid impersonating another person;
• obtain permission before providing another person’s personal data;
• avoid uploading unnecessary sensitive information;
• avoid including payment credentials in messages;
• use Platform information only for authorised purposes; and
• notify Arviah if personal data provided by you is inaccurate or unauthorised.

Where you provide information about a gift recipient, family member, employee, representative or other person, you are responsible for ensuring that you are permitted to provide that information.

21. Exercising your rights

To submit a privacy request, email:

krish@arviahstudio.com

Use the subject:

Privacy Request — [Your Name]

Include:

• your name;
• your account email address or mobile number;
• the right or action requested;
• relevant project or order number, if any; and
• sufficient information for Arviah to identify the relevant records.

Arviah may request reasonable information to verify your identity and protect personal data from unauthorised disclosure or deletion.

Arviah will acknowledge and respond within the period required by applicable law. Where no specific period applies, Arviah will aim to provide an initial response within 30 days.

Complex requests, multiple requests or requests involving archived information may require additional time. Where appropriate, Arviah will inform you of the delay and expected next steps.

Arviah may decline or limit a request where permitted by law, including where the request:

• cannot be verified;
• would disclose another person’s data;
• conflicts with a legal-retention requirement;
• is fraudulent or abusive; or
• would prejudice an investigation or legal claim.

22. Privacy grievances

Privacy grievances may be submitted to:

Privacy Contact
Krish Parikh
Arviah Jewellery Private Limited
Email: krish@arviahstudio.com
Telephone: +91 73047 80849
Address: 225 Fl 2, Shreeji Chamber, Tata RD 2 Roxy Cinema, Opera House, Mumbai, Mumbai- 400004, Maharashtra

Arviah will maintain a process to:

• acknowledge the grievance;
• assign it for review;
• request further information where needed;
• investigate the matter;
• communicate the outcome; and
• retain a record of the resolution.

The current target is to respond to customer communications within one day. A privacy grievance requiring investigation may take longer, but Arviah will respond within the period required by applicable law.

23. Third-party links and services

The Platform may contain links to third-party websites, services or applications.

Arviah is not responsible for the independent privacy or security practices of a third party. The inclusion of a link does not mean that Arviah controls or endorses the third party’s processing.

Review the third party’s privacy notice before providing information directly to it.

24. Changes to this Privacy Policy

Arviah may update this Privacy Policy to reflect:

• changes in law;
• regulatory guidance;
• Platform features;
• business operations;
• service providers;
• security practices; or
• processing activities.

The updated policy will display a revised “Last updated” date.

Where a change materially affects the way personal data is processed, Arviah will provide an appropriate notice through the Platform, email or another reasonable channel.

Where fresh consent is required by law, Arviah will request that consent before carrying out the relevant processing.

Continued use of the Platform does not by itself constitute consent to a new processing purpose where applicable law requires specific consent.

25. Contact us

For questions, privacy requests or concerns about this Privacy Policy, contact:

Arviah Jewellery Private Limited
CIN: U47733MH2026PTC473724
Registered office: 225 Fl 2, Shreeji Chamber, Tata RD 2 Roxy Cinema, Opera House, Mumbai, Mumbai- 400004, Maharashtra
Email: krish@arviahstudio.com
Telephone: +91 73047 80849
Website: arviahstudio.com

For general customer support, you may also use the contact form available at:

arviahstudio.com/contact-us