Privacy policy

Privacy Policy

Last updated: Version 2 · 16 October 2026

This notice explains what personal data Shoopfor collects on shoopfor.com and in our app and browser extension, why, how long we keep it, who receives it, and how to use your rights under India's Digital Personal Data Protection Act, 2023 and its Rules.

In short

We do not sell your personal data. Each kind of data we hold is listed below with its purpose, how long we keep it and who receives it. Our cookies are first-party.

Photos you upload to search are deleted after 24 hours. You can pause, forget, download or delete your data yourself, and complain to our Grievance Officer — we acknowledge within 48 hours and resolve within one month.

On this page

Who we are

Shoopfor compares fashion prices across online stores and sends you to the store to buy. We do not sell products. We decide why and how your personal data is used, so we are its "Data Fiduciary" under the Digital Personal Data Protection Act, 2023.

Karan Patel(Shoopfor)
36, shive residency ,kadi, Gujarat, 382715
Customer care: support@shoopfor.com · +91 9586406946

What we collect, why, and for how long

Each kind of personal data we hold is listed below with the reason we need it, the longest we keep it, and who else receives it. We collect nothing else.

Your account

  • What: Email address, name, phone number (if you sign in by phone or add one), profile picture, and a referral code if you enter one.
  • Why: To create your account, sign you in, keep it secure and send the alerts you ask for.
  • How long: Until you delete your account.
  • Who receives it: Supabase (stores it and runs sign-in). Google, only if you sign in with Google. An SMS service run through Supabase, only if you sign in by phone.

Things you save

  • What: Saved products, collections, price alerts, Smart Watchlist watches, saved searches, brands you follow, store carts you track, your closet and saved looks. The closet includes pieces read from order emails you upload, forward to us, or import from Gmail — only the items found are kept, never the email.
  • Why: To keep what you saved, tell you when a price or stock changes, and plan outfits with what you own.
  • How long: Until you remove them or delete your account.
  • Who receives it: Supabase. If you connect Gmail, Google gives us read-only access to order emails from stores we list, for one request; we keep no copy of the emails.

Searches

  • What: The words you search for and the links you paste.
  • Why: To show results, shape your picks and answer in your language.
  • How long: Kept until you forget it in Your data, reset, or delete your account.
  • Who receives it: Supabase.

Products you view and store links you click

  • What: Which products you open, save or add to a cart, and which store link you click, with the time.
  • Why: Views shape your picks. A click record lets the store pay us a commission for the visit.
  • How long: Views until you reset or delete your account. Click records up to 365 days, for commission records; they are deleted, not anonymized, with your account.
  • Who receives it: When you click through, the store and the affiliate network (such as Cuelinks) receive a referral id for the visit — not your name, email or account.

Messages to the AI assistant

  • What: What you type or say to the assistant. We keep your last three chats.
  • Why: To answer you and let you resume a chat.
  • How long: Your last three chats, until you delete them or your account.
  • Who receives it: Anthropic, OpenAI or Google, only when that AI service is switched on, to word the answer. They receive the message, not your account details.

Photos you use for virtual try-on

  • What: Your photo and the items you chose.
  • Why: To make the AI try-on preview.
  • How long: Not kept — neither your photo nor the preview is stored.
  • Who receives it: Google, to make the preview.

Sizes and style preferences

  • What: Your sizes, who you shop for, your "Your Style" choices, short-term preferences such as "only black this month", and items you mark "not for me" with the reason.
  • Why: To show your size first and rank what you see.
  • How long: Until you forget them, reset, or delete your account.
  • Who receives it: Supabase.

Notifications and push

  • What: The alerts we send you, whether you opened them, and your browser or phone push address.
  • Why: To deliver alerts you asked for and send fewer that you ignore.
  • How long: Push addresses until you turn push off or delete your account. Alerts until you delete them or your account.
  • Who receives it: Your browser’s own push service (Google, Mozilla, Microsoft or Apple). Our email service (Resend, SendGrid or Postmark), only if you turn on email alerts.

Coupon feedback

  • What: Which codes you copied and whether you told us a code worked.
  • Why: To learn which codes work and show the best ones first.
  • How long: With the code’s success record. Your account link is removed when you delete your account.
  • Who receives it: Supabase.

The browser extension

  • What: A random install id sent with each request, the browser you linked to your account, and the cart rows you choose to sync (item name, price, link, store code and picture).
  • Why: To show prices on a store page you open, try coupon codes when you press the button, and fill Your Carts.
  • How long: Until you unlink the browser, remove the rows, or delete your account.
  • Who receives it: Supabase.

Sign-in history and security logs

  • What: Each sign-in and security event, with the full network (IP) address and the browser’s user agent.
  • Why: To protect your account, spot misuse and meet legal duties.
  • How long: Up to 2 years, then deleted. Deleting your account deletes them.
  • Who receives it: Supabase. Error reports go to Sentry with passwords, sign-in tokens, email addresses and keys removed first.

Visit counts

  • What: Which pages, shelves and deals were shown and clicked, with a one-way salted hash in place of any device or session id.
  • Why: To count visits and improve the site, without identifying you.
  • How long: Only as long as needed to measure trends. The hashes cannot be traced back to you.
  • Who receives it: Supabase.

Cookies

All our cookies are first-party. We do not use third-party tracking or advertising cookies. Besides the cookies that keep you signed in, we set these:

  • sc_seed — a short list of product ids and search words that personalizes the page before you sign in; never stored by us.
  • sc_did — a random device id. We store only a one-way hash of it, to measure whether personalization helps and to place this device in the small group that sees the plain cheapest-first order.
  • sc_pause — the character 1, set only when you pause personalization on this device; never stored by us.
  • sc_session — a random id that ties a photo you upload for photo search to its results; deleted with the photo after 24 hours.
  • sc_gmail_state — a ten-minute check cookie, set only while you connect Gmail to your closet.

You can remove them with "Clear This Device" below or in your browser settings. Sign-in will not work without the sign-in cookies.

Who processes your data for us

We do not sell your personal data. These services process it for us, each only for its task:

  • Supabase — our database, sign-in and file storage, and the SMS service for phone sign-in.
  • Vercel — hosts the website and keeps short server logs.
  • Google — AI answers and photo reading (Gemini), virtual try-on, Google sign-in, Gmail import if you connect it, and Chrome’s push service.
  • Anthropic and OpenAI — AI answers and photo reading, only when switched on.
  • Sentry — error reports, with passwords, tokens, emails and keys removed first.
  • Our email service (Resend, SendGrid or Postmark) — only if you turn on email alerts.
  • Browser push services (Google, Mozilla, Microsoft, Apple) — deliver notifications to your device.
  • Upstash — counts requests per network address for a few minutes, to stop automated attacks.
  • Affiliate networks such as Cuelinks, and the store you click through to — receive a referral id for the visit, not your account details.
  • Google’s website-icon service — to show a store’s logo, your browser may load it from Google, which then sees your network address and the page.

Some of these services run on servers outside India, for example in the United States or the European Union. We send them only what the task needs. We may also disclose data when the law requires it, or to protect our users’ rights and safety.

Personalization

Picks, "why this" lines and the assistant use what you view, save, search and tell us, to rank and explain what you are shown — and for nothing else. Signed out, these signals stay in this browser.

About one shopper in twenty is shown the plain cheapest-first order, so we can measure whether personalization helps. Pausing personalization stops this recording too.

How to withdraw consent

Stopping is as easy as starting. Each of these takes effect at once:

  • Pause: stop personalization without deleting anything — account panel → Settings → "Your data" → Pause. Signed out, use "Clear This Device" on this page.
  • Forget: remove one kind of data, or all of it, in "Your data".
  • Reset: clear everything that shapes your picks and start from nothing, in "Your data".
  • Push and email alerts: turn them off on your notifications page.
  • Gmail: remove Shoopfor from your Google account’s connected apps.
  • Delete: remove your account and its personal data at shoopfor.com/account/delete (also in account panel → Security → Delete my account).

Withdrawing consent does not undo processing that happened before it.

Your rights

Under the DPDP Act you have the right to:

  • Access — see what we hold: account panel → Settings → "Your data" shows each kind with its count.
  • Export: download your data from "Your data" as a file.
  • Correction — edit your profile in your account, or ask us to correct anything else.
  • Erasure — delete your account yourself at shoopfor.com/account/delete, or forget one kind of data in "Your data".
  • Grievance — complain to our Grievance Officer (below).
  • Nomination — name a person who may use these rights for you if you die or cannot act. Write to the Grievance Officer with their name and contact.

For anything you cannot do yourself, write to privacy@shoopfor.com. We may ask you to confirm it is your account.

Complain to the Data Protection Board of India

Please write to our Grievance Officer first. If you are not satisfied with the answer, you may complain to the Data Protection Board of India once it accepts complaints, through the means the Government notifies.

If your data is breached

If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay: what happened, what it may mean for you, what we are doing, and what you can do. We keep records of how your data is processed for at least one year.

Clear This Device

Without an account, what shapes your picks — products you viewed and saved, your recent searches, things you dismissed — is kept in this browser, not on our servers. You can clear it, or pause it on this device.

Children

Shoopfor is for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Other languages

This notice is available in Hindi and other languages of the Eighth Schedule of the Constitution on request — write to privacy@shoopfor.com. A short summary in Hindi is below.

हिंदी में सारांश

  • Shoopfor कपड़ों की कीमतों की तुलना करता है। हम खुद कुछ नहीं बेचते।
  • हम आपकी निजी जानकारी कभी नहीं बेचते।
  • हम आपका ईमेल, नाम, खोजें, सेव की गई चीज़ें और देखे गए उत्पाद इसलिए रखते हैं ताकि आपको सही उत्पाद और कीमत अलर्ट दिखा सकें।
  • फ़ोटो खोज के लिए डाली गई फ़ोटो 24 घंटे में मिट जाती है। ट्राय-ऑन की फ़ोटो रखी नहीं जाती।
  • आप अपने खाते में "Your data" से अपनी जानकारी देख, डाउनलोड या मिटा सकते हैं, और अपना खाता कभी भी मिटा सकते हैं।
  • शिकायत के लिए हमारे शिकायत अधिकारी को लिखें। हम 48 घंटे में शिकायत मिलने की पुष्टि करेंगे और एक महीने में उसे हल करेंगे।
  • संतुष्ट न हों तो आप भारत के डेटा संरक्षण बोर्ड से शिकायत कर सकते हैं।

Changes to this notice

When this notice changes we post the new version here with its number and date. If we want to use your data for a new purpose, we will tell you and ask for your consent first.

Grievance Officer

Founder
Patel Karan Ashvinbhai
Email: privacy@shoopfor.com

Write to this address with any complaint, about your personal data or about the service. We acknowledge a complaint within 48 hours and resolve it within one month.