Privacy Policy

01Who is responsible for your data

Musheer decides why and how personal data is processed on NefyX and is the data fiduciary for it. You can reach us at support@nefyx.com; the full details are on the Contact page. Our grievance contact for privacy matters is listed at the end of this policy and on the Grievance Redressal page.

02What we collect

Visitor statistics. When someone views a creator's storefront or offer page we count the visit so the creator can see how many people are looking. The visit is recorded only as a short code computed from the visitor's connection and browser together with a secret and the current date. It cannot be turned back into a person and cannot be matched from one day to the next. Visits by the creator, by automated bots and by browsers that prefetch a page are not counted.

We do not knowingly collect personal data of anyone under 18. Accounts and purchases are for adults. If you believe a child has given us data, write to us and we will delete it.

03Why we use it

We use your data only for these purposes and for others that are clearly connected to them. Where the law requires your consent we ask for it, and you can withdraw it as described below. Some processing needs no consent because the law allows it, for example performing a purchase you asked for, complying with a legal obligation or responding to a medical or safety emergency.

04Who we share it with

We do not sell personal data. We share it only with the following, and only what each needs.

• The creator you buy from or contact. They see your name, e-mail address, what you bought and any note or question you send, so they can deliver it. A review you write is shown with your chosen display name.
• Payment services. Cashfree Payments processes payments and payouts and verifies payout accounts. It receives the details it needs to do that and applies its own privacy terms.
• Infrastructure providers. Supabase (database and file storage), Vercel (hosting) and Resend (transactional e-mail) process data on our behalf under their security and confidentiality terms.
• Google. If you choose Google sign-in or a creator connects Google Calendar, Google processes that connection under its own policy. Video sessions may use meeting links from third-party providers chosen by the creator or generated by the Platform.
• Authorities and professional advisers. Courts, law-enforcement and regulatory bodies, banks and payment gateways where a valid legal order, a fraud or money-laundering investigation, or a legal obligation requires it; and our accountants or lawyers under a duty of confidence.
• A successor. If NefyX is ever sold or reorganised, personal data may move to the new operator, which will be bound by this policy.

Some of these providers run servers outside India, so personal data may be processed abroad. We use providers that protect it appropriately and we comply with any restriction the Indian Government places on transfers to particular countries.

05What is public

A creator's storefront is public by design: display name, tagline, bio, images, social links, public offers, approved reviews and follower counts. Do not put anything in those fields you do not want public. Buyer information is never made public, with one exception you control: a review you write appears with the display name you posted it under.

06How long we keep it

07Your rights and choices

You have the right to know what personal data we hold about you and how it is used, to have inaccurate data corrected and incomplete data completed, to have data erased when it is no longer needed, to withdraw consent, to nominate someone to exercise these rights if you die or become incapacitated, and to complain if you are not satisfied.

• See and correct. Most account and storefront details can be changed yourself in your dashboard settings.
• Delete. Choose "Delete my data" in your settings. It erases your identity, profile, sessions, connected-calendar tokens and storefront address straight away and sends you a confirmation e-mail. We keep the payment records described above because the law requires it. If money, a refund, a dispute or a confirmed booking is still open, the page tells you what to settle first.
• Anything else. Write to support@nefyx.com and we will answer within the time the law allows, which we aim to keep to 15 days.
• Withdraw consent. Disconnect Google Calendar in your settings at any time. We send only service e-mails such as codes, receipts and notices about your orders, payouts and account. Withdrawing consent does not affect processing already done, and we may still keep or use data that the law requires or allows.

If you are not satisfied with our response you may complain to the Data Protection Board of India once it is open for complaints under the Digital Personal Data Protection Act, 2023. We ask that you contact us first so we can try to put things right.

08How we protect it

• Traffic is encrypted in transit. Sessions are server-side and can be ended immediately. Passwords are stored only as hashes.
• Sign-in and other sensitive endpoints are rate limited. Every table in our database denies direct access by default and the app reaches it only through server code that checks who is asking.
• Digital product files sit in a private store and are given out only through short-lived links after a payment check.
• Calendar access tokens are encrypted at rest. A creator's full bank account number and full PAN are not stored by us.
• Access to payout and account-restriction tools is limited to the operator and is recorded in an append-only audit log.

No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

09Cookies

NefyX sets only strictly necessary cookies, which keep you signed in and protect forms. We do not use advertising or tracking cookies. The Cookie Policy lists each one.

10Changes to this policy

When we change this policy in a material way we update the date at the top and notify registered users by e-mail before the change applies.

11Grievance contact

Grievance Officer: Musheer. E-mail: support@nefyx.com. We acknowledge every complaint within 24 hours and aim to resolve it within 15 days. More on the Grievance Redressal page.