Summary
Privacy Policy
Overview
At PoloPan (operated by Rofoso Consumer Private Limited), we are deeply committed to protecting your privacy and securing your personal data across all countries and territories we serve. This Global Privacy Policy explains how we collect, use, process, disclose, protect, and retain your information when you access our mobile applications, website (polopan.com), browser extensions, and AI fashion discovery services. We adhere to global data protection principles—including data minimization, purpose limitation, transparency, and enterprise-grade security—under the EU/UK General Data Protection Regulation (GDPR), California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and the Indian Digital Personal Data Protection Act, 2023 (DPDP Act).
Last Updated
October 12, 2026
Company Name
Rofoso Consumer Private Limited
Tradename
PoloPan
Data Collection
Information You Provide
- Account Credentials: International mobile phone number (E.164 format) and verification tokens for account creation and secure sign-in.
- Style & Fitting Preferences: Gender expressions, preferred aesthetics, brand affinities, price and budget bands, sizing inputs, and fit preferences.
- Visual Search & Wardrobe Media: Photos, screenshots, or outfit images you upload for visual similarity search, style analysis, or virtual try-on.
- Prompts & Interaction Feedback: Search queries, styling prompts, saved looks, feedback ratings, and customer support communications.
Information Collected Automatically
- Device & Network Telemetry: Device model, operating system version, unique device identifiers, IP address, coarse geographic location (country/region for catalog serviceability), and mobile network information.
- In-App Interactions: Look card swipes (likes/dislikes), product click-throughs, view durations, filter toggles (`mode=local` vs. `mode=global`), and navigation flows.
- Diagnostics & Crash Telemetry: Performance metrics, API latency logs, and error diagnostic dumps to ensure platform stability.
Permissions Based
We request optional device permissions only when required to deliver specific features: (a) Camera & Photo Library (for uploading garments and visual search); (b) Location (optional GPS/manual selection to determine localized weather for 'What to Wear Today?'); and (c) Device Contacts (optional, solely to facilitate sharing looks directly with friends). You can modify or revoke these permissions at any time in your device settings.
First Party Attribution Infrastructure
Summary: Proprietary First-Party Affiliate Attribution & Privacy Architecture
Details: PoloPan operates its own proprietary, in-house affiliate tracking and attribution engine. When you interact with outfit recommendations and click to visit a partner merchant's storefront, our system generates secure, first-party referral tokens to verify qualifying referral sales and calculate merchant partnership commissions. This infrastructure operates strictly within PoloPan's private, encrypted cloud environment and direct merchant API/webhook integrations. Crucially: (1) we DO NOT employ third-party ad network tracking pixels or cross-site data brokers; (2) we DO NOT ingest, process, or store sensitive merchant customer personal data (such as names, personal email addresses, shipping street addresses, or payment card details); and (3) we NEVER sell, rent, or trade your shopping telemetry, browsing habits, or personal identifiers to third-party data brokers or behavioral advertising networks.
Shopify App Data
Summary: Shopify Merchant App Privacy & Data Minimization
How We Receive: When a merchant installs the PoloPan Shopify app, we receive limited store and order verification webhooks through Shopify Admin APIs.
Data We Process: We process only the absolute minimum non-PII operational fields necessary for conversion verification and merchant billing: store domain identifier, order ID, order timestamp, order total, currency, line item IDs, and internal attribution session tokens.
Data We Do Not Process: We strictly exclude and do not collect customer names, personal customer email addresses, phone numbers, delivery addresses, billing addresses, or payment instrument details.
Purpose: First-party conversion attribution, merchant analytics, and commission settlement.
Zero Payment Card Data Ingestion
Summary: No Payment Card or Financial Data Ingestion
Details: PoloPan is a discovery intermediary and does not process retail checkout transactions for physical garments. We NEVER request, collect, store, transmit, or process consumer credit card numbers, debit card numbers, CVVs, banking credentials, or checkout billing addresses. All financial checkout transactions take place directly on the respective Third-Party Retailer's secured, PCI-DSS compliant checkout gateway.
Regional Privacy Schedules
EEA And UK GDPR
Title: Notice for European Economic Area (EEA) and United Kingdom (UK) Residents
Legal Bases: We process personal data under GDPR Art. 6: (a) Performance of Contract (providing discovery, account management); (b) Legitimate Interests (first-party attribution, platform security, fraud prevention); (c) Consent (AI styling, optional photos and location); and (d) Legal Obligation (tax, accounting, legal compliance).
Data Controller: Rofoso Consumer Private Limited is the Data Controller for personal data collected through the PoloPan consumer app.
International Transfers: Where personal data is transferred outside the EEA/UK, we ensure adequate safeguards are implemented, including standard contractual clauses (SCCs) adopted by the European Commission and the UK International Data Transfer Addendum (IDTA).
Supervisory Authority: You have the right to lodge a complaint with your local EU Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).
US State Privacy Laws CCPA CPRA
Title: Notice for California and United States Residents (CCPA/CPRA & State Privacy Acts)
Categories Collected: Identifiers (phone number, IP, device IDs); Internet activity (browsing history on PoloPan, look interactions); Inferences (style and sizing preferences).
Sale And Share Opt Out: PoloPan DOES NOT sell personal information and DOES NOT share personal information for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals.
Non Discrimination: We will not discriminate against you (e.g., by denying services or altering quality) for exercising any of your CCPA/CPRA privacy rights.
Shine The Light: Under California Civil Code Section 1798.83, California residents may request information regarding disclosures of personal information to third parties for direct marketing. PoloPan does not disclose personal information to third parties for direct marketing.
India DPDP
Title: Notice under India's Digital Personal Data Protection Act, 2023 (DPDP Act) & Rules 2025
Data Fiduciary: Rofoso Consumer Private Limited acts as a Data Fiduciary. We collect international E.164 phone numbers and styling inputs for explicit, specified purposes with your informed consent.
Consent Manager: You may review, manage, or withdraw consent at any time via in-app Privacy Settings or by contacting our Grievance Officer.
Grievance Officer SLA: Complaints are acknowledged within 24 hours and resolved within statutory timelines (within 7 to 30 days as prescribed by DPDP Rules).
Contact Information
For privacy questions, data subject requests, or regulatory inquiries, contact us at hey@polopan.com or privacy@polopan.com.
Company Details
Legal Name
Rofoso Consumer Private Limited
Cin
U47912GJ2024PTC152776
Registered Address
205, Samruddhi Complex, Gotri Road, Vadodara – 390021, Gujarat, India
Grievance Officer
Name
Shekhar Chatterjee
s@polopan.com
Role
Data Protection & Grievance Officer
Cookies And Tracking
We use first-party cookies, secure session tokens, and local cache storage to maintain user authentication, remember localization and currency preferences, and measure application performance. We respect user privacy choices and support Global Privacy Control (GPC) signals. We do not participate in cross-context third-party behavioral advertising exchanges.
Data Sharing
Service Providers And AI
We engage trusted enterprise cloud infrastructure and AI inference providers (such as Google Cloud Vertex AI, Microsoft Azure, OpenAI, and Anthropic) solely as data processors to host vector databases, process visual search queries, and generate outfit embeddings. These processors are bound by strict Data Processing Agreements, confidentiality obligations, and data security standards, and are strictly prohibited from using your personal data or uploaded images to train public or foundational models without explicit authorization.
Merchant Partners
When you navigate from PoloPan to a merchant storefront, we share only non-PII referral tokens and click IDs to verify referral provenance and process attribution.
Legal And Compliance
We may disclose information if required to do so by applicable law, regulation, valid legal process (e.g., court order or subpoena), or to protect the safety, rights, and security of our users, the public, or PoloPan.
No Sale Of Personal Data
We state unequivocally: PoloPan does not sell, rent, trade, or share your personal data or browsing telemetry with third parties for monetary or other commercial consideration, as defined under global privacy laws including the CCPA/CPRA, GDPR, and DPDP Act.
User Generated Content
Content you voluntarily post publicly on the Service (such as shared style boards, public reviews, or comments) may be viewable by other users. Please exercise discretion when sharing personal details in public areas.
Third Party Links
Our Service contains links to Third-Party Retailer websites. Once you leave PoloPan, your interactions and purchases are governed exclusively by that third party's privacy policy and terms. We encourage you to review their privacy practices.
Child Data Policy
Our Service is not directed to children under 13 (or under 16 in the European Economic Area / UK). We do not knowingly collect personal information from children under these age thresholds. If you become aware that a child has provided us with personal information without parental consent, please contact us at privacy@polopan.com, and we will promptly delete such data.
Security And Retention
Technical Measures
We maintain robust administrative, technical, and physical safeguards designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, access, or disclosure. All data in transit is encrypted using modern TLS 1.3/HTTPS protocols, and data at rest is encrypted using AES-256 standard. We enforce least-privilege role-based access controls, multi-factor authentication for administrators, and isolated cloud VPC environments.
Retention Period
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, maintain your account, deliver AI styling features, resolve disputes, and comply with statutory legal and accounting obligations. When data is no longer required, it is securely deleted, permanently anonymized, or destroyed.
User Rights
Global Rights
- Right of Access: You have the right to request a copy of the personal data we hold about you.
- Right to Rectification: You may update or correct inaccurate or incomplete profile and sizing information via in-app settings.
- Right to Erasure ('Right to be Forgotten'): You may request the permanent deletion of your account and associated personal data.
- Right to Data Portability: You may request an export of your personal data in a structured, commonly used, and machine-readable format.
- Right to Restrict or Object: You may restrict or object to certain processing activities, including AI preference modeling.
- Right to Withdraw Consent: You can withdraw consent for camera permissions, location sharing, or AI styling features at any time via App Settings → Privacy.
In App Account Deletion
You can permanently delete your account, styling profile, and associated personal data directly within the mobile application by navigating to Settings → Account → Delete Account. Upon confirmation, your personal data is purged from our active production databases without undue delay, subject only to minimal retention required for statutory compliance and fraud prevention.
International Data Transfers
PoloPan operates global cloud infrastructure spanning secure data centers and enterprise cloud availability zones. When you access the Service from outside India, your data may be processed in global cloud regions under rigorous security protocols, Standard Contractual Clauses (SCCs), and applicable cross-border data transfer safeguards.
Location Sharing
You can optionally share your location with us via GPS or manual city selection. Location is used strictly to provide localized weather context for the 'What to Wear Today?' discovery feature and to filter product feeds for regional delivery serviceability.
Chrome Extension Policy
If you install our Chrome or Edge browser extension, it processes product images client-side on your local device to perform visual similarity search against our indexed catalog. The extension does not track your general browsing history, read private website contents, or transmit your local image files to our servers for storage.
DPDP Compliance
Notice
As a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and Rules 2025, we provide clear notice before collecting your phone number. We collect your phone number in international format (+[country code]) for the specific purposes of: (1) creating and securing your account, (2) phone-based sign-in and authentication, and (3) delivering personalized AI outfit recommendations. You give informed consent upon sign-in and may withdraw consent anytime via Settings → Privacy or by contacting our Grievance Officer.
Grievance Officer
Grievance Officer: Shekhar Chatterjee
Email: s@polopan.com
Grievances will be acknowledged within 24 hours and resolved expeditiously under DPDP Rules.