Trendmil Privacy Policy

TRENDMIL PRIVACY POLICY Version: 1.0 Effective date: 25 August 2026 This Privacy Policy explains how MRD APP WORLD OPC PVT LTD, trading as Trendmil ("Trendmil", "we", "us" or "our"), collects, uses, shares, stores and protects personal data when you use the Trendmil Android application, trendmil.in, our account-deletion service, customer support, custom 3D-printing quotation service, or any related service that links to this Policy (together, the "Services"). Our contact details are: MRD APP WORLD OPC PVT LTD Nirmal Colony, Saraiya Road Etawah, Uttar Pradesh 206001 India Email: support@trendmil.in Customer care phone: +91 70881 00007 Grievance Officer: Raj Dubey, Director 1. SCOPE AND YOUR ACKNOWLEDGEMENT This Policy applies to customers, prospective customers, people who request a quotation or support, and visitors to our public website. It does not apply to the independent privacy practices of third parties whose services you choose to use, such as Google or Razorpay. Their own notices also apply to data they collect directly. By using the Services, you acknowledge this Policy. Where the law requires consent for a particular activity, we will ask for it separately. You may withdraw a consent through the relevant in-app control or by contacting us, but withdrawal does not affect processing already lawfully completed and may prevent us from providing a feature that depends on that data. 2. PERSONAL DATA WE COLLECT We collect only the data reasonably needed for the purposes described below. Depending on how you use Trendmil, this may include: 2.1 Account and identity data - name, email address, phone number, account status and verification status; - password hash and authentication records (we do not store your password in readable form); - Google account identifier, name and email when you choose Google Sign-In; - locale, time zone, profile preferences and account creation/update timestamps; - optional profile information that you submit, such as an avatar, date of birth or GSTIN; and - records of the Terms and Privacy Policy version you accepted and any other consent choices. 2.2 Address, order and fulfilment data - recipient name, phone number, delivery and billing address, postal code and country; - cart, wishlist, product, quantity, variant, material, colour, dimensions and customization selections; - order number, quotation number, price, discounts, tax, shipping charge, invoice, order status, production status, delivery option, courier, tracking number and delivery events; and - communications and instructions connected with an order, quotation, production proof, cancellation, return, refund or dispute. 2.3 Custom 3D-printing and upload data - 3D models, drawings, images, PDFs or archives that you choose to upload, including file name, type, size, checksum and malware-scan status; - project title, quantity, material, colour, infill, layer height, dimensions, tolerances, use case, special instructions and preferred contact channel; - confirmation that you own or are authorized to use the submitted design; and - quotation messages, revisions, acceptance records and manufacturing information. Do not upload information that is unnecessary for the quotation or manufacturing request. In particular, do not include passwords, payment credentials, government identity documents, health data or another person's personal data unless it is strictly required, lawful and you are authorized to provide it. 2.4 Payment and refund data Razorpay processes payment credentials directly. Trendmil receives and stores transaction-related information such as the Razorpay order, payment and refund identifiers, amount, currency, status, method category, verification result, timestamps and reconciliation records. Trendmil does not receive or store your complete card number, CVV, UPI PIN, net-banking password or other secret payment credential. 2.5 Support, feedback and review data - support ticket category, subject, messages, permitted image/PDF attachments and resolution history; - ratings, reviews, review images, reports and moderation records; and - responses to service communications or other feedback you choose to provide. 2.6 Notification and communication data - email and push-notification preferences, including separate marketing choices; - Firebase Cloud Messaging installation token, delivery status and invalid-token events; - in-app notification content and read status; and - transactional communications about account security, quotations, payments, orders, production, shipping, refunds and support. 2.7 Device, diagnostic and security data - IP address, date and time, request identifier, user agent, app version/build, operating-system and device characteristics, network status, session and login-attempt data; - security tokens and verdicts from Firebase App Check and Google Play Integrity, used to identify tampered apps, automated abuse and suspicious requests; - crash reports, stack traces, app state, installation identifiers and diagnostic data through Firebase Crashlytics in non-debug releases; and - app start, network request and screen-render performance measurements through Firebase Performance Monitoring in non-debug releases. The current Trendmil app disables Firebase Analytics collection and does not intentionally use advertising identifiers for advertising or personalized advertising. We do not operate an advertising network in the Services. If this changes, we will update this Policy and obtain any consent required before the change applies. 2.8 Website and form data Our website may use strictly necessary session and security cookies or similar technologies to operate forms, prevent cross-site request forgery, maintain a secure session and protect against abuse. We do not use these necessary technologies to build advertising profiles. 2.9 Data received from other sources We may receive data from: - Google, when you choose Google Sign-In or when Google supplies app-integrity, push-delivery, crash or performance information; - Razorpay, for payment authorization, verification, settlement, failure, chargeback and refund events; - courier or delivery partners, for pickup, tracking, delivery, failed delivery or return events; - security, infrastructure, email or support providers that process data for us; and - regulators, law-enforcement bodies, courts or other persons where legally permitted or required. 3. WHY WE USE PERSONAL DATA We use personal data for the following specific purposes: - to create, verify, secure and administer your account; - to show products, preserve your cart or wishlist and provide requested app features; - to assess a custom 3D-printing request, scan uploads for malware, prepare and revise a quotation, manufacture the accepted design and provide proofs or status updates; - to calculate price, discount, tax and shipping, accept and verify payment, issue invoices, process refunds, reconcile transactions and respond to chargebacks; - to manufacture, pack, ship, deliver, track and support an order; - to answer questions, resolve tickets, moderate reviews and handle cancellation, return, refund or dispute requests; - to send communications necessary for account security, quotations, payments, orders, production, shipping, refunds and support; - to send promotional email or push messages only when you have opted in and the relevant channel remains enabled; - to detect, investigate and prevent fraud, malicious uploads, unauthorized access, abuse, tampering and other security incidents; - to diagnose crashes and performance problems, maintain availability and improve reliability; - to maintain business, accounting, tax, audit and compliance records and establish, exercise or defend legal claims; and - to comply with applicable law, lawful orders and regulatory requirements. Depending on the activity and the law that applies, we process data to perform a contract or take requested pre-contract steps, based on your consent, for uses expressly permitted by law, to comply with a legal obligation, or to protect the security and legal rights of users, Trendmil and others. We do not use consent as a condition for a purpose that does not require the relevant data. 4. MARKETING AND TRANSACTIONAL COMMUNICATIONS Transactional messages are used for essential account, quotation, payment, order, production, shipping, refund and support events. You may be unable to disable a security or service message that is necessary to provide the Services or protect your account. Marketing is off by default. Trendmil sends a marketing email or push notification only when your profile has an active marketing opt-in and that specific channel is enabled. You may opt out at any time through notification preferences, the unsubscribe method in the message where available, your device settings, or by contacting us. Opting out of marketing does not stop necessary transactional communications. 5. HOW WE SHARE PERSONAL DATA We do not sell personal data. We may share the minimum necessary data with: - Razorpay and participating banks/payment networks to process, verify, reconcile, refund and protect payments; - Google services used by the app, including Google Sign-In, Firebase Cloud Messaging, Firebase Crashlytics, Firebase Performance Monitoring, Firebase App Check and Google Play Integrity; - hosting, storage, backup, email-delivery, malware-scanning, monitoring and technical support providers that act for us under appropriate confidentiality and security obligations; - courier, logistics and delivery partners to fulfil and track an order; - accountants, auditors, insurers, lawyers and professional advisers where reasonably necessary; - a successor or proposed successor in a merger, reorganization, financing or transfer of business, subject to appropriate protections; and - courts, regulators, law-enforcement or government authorities when disclosure is required by law or reasonably necessary to protect rights, safety, security or prevent fraud. Authorized Trendmil personnel may access personal data only for their assigned work, such as customer support, quotation review, manufacturing, fulfilment, payment reconciliation, security or compliance. Internal notes and access are restricted according to role. 6. INTERNATIONAL PROCESSING Trendmil is based in India. Some service providers, including Google, Razorpay or their subprocessors, may process or store data in India or other countries. Where cross-border processing occurs, we require appropriate contractual, organizational and technical protections and follow any transfer restriction notified under applicable Indian law. The privacy and data-protection laws in another country may differ from those in India. 7. RETENTION We retain personal data only for as long as it is needed for the stated purpose, an active customer relationship, an unresolved request or obligation, security and fraud prevention, a dispute or legal hold, or a period required by tax, accounting, company, payment or other applicable law. Subject to those exceptions, the intended operational schedule is: - downloadable account-export files expire after 7 days; - abandoned quote-draft files are deleted after 30 days; - files for rejected, expired or otherwise closed quotation requests are deleted after 90 days; - custom-design files connected to a cancelled custom order are deleted after 90 days after closure; - custom-design files connected to a completed custom order are deleted after 180 days after delivery or closure; - support attachments are deleted after 180 days after the ticket is closed; - read in-app notifications are deleted after 90 days and unread notifications after 180 days; - revoked device-token records are deleted after 30 days and login-attempt records after 90 days; and - payment, refund, invoice, tax, order and limited fraud/security records are retained for the applicable statutory or dispute period and then deleted or de-identified where permitted. A timer begins only when the record is in the relevant completed, closed, expired, rejected, abandoned or revoked state. A legal hold, open dispute, chargeback, warranty/support need, suspected fraud, safety issue, statutory duty or failed storage cleanup may delay deletion. Backups are protected and removed through a controlled rolling expiry cycle; deleted data is not restored to ordinary service from a backup. We periodically review retention settings and may shorten them. If we materially lengthen a period for a new purpose, we will update this Policy and take any additional step required by law. 8. ACCOUNT EXPORT, CORRECTION AND DELETION You can use the account controls in the Trendmil app to review or update eligible profile, address and preference data, request an account export, or request deletion. A requested export is prepared as a private, encrypted file and is available only to the authenticated account owner for a limited period. You may also request account deletion without reinstalling the app at: https://trendmil.in/account-deletion For security, we must verify that the requester controls the account. An in-app request requires recent reauthentication; a public request uses a one-time link sent to the registered email address. A deletion request revokes active access and enters a reviewed deletion process. After approval, eligible profile, saved-address, session, consent, cart, wishlist, notification, support, review and uploaded-file data is deleted or de-identified. Order, invoice, payment, refund, tax, chargeback, fraud-prevention, dispute, security or legal-hold records may be retained where required or permitted by law. A retained transaction or invoice record may continue to contain the recipient or billing name, phone, delivery/billing address and GSTIN recorded for that transaction where preserving the original record is required for tax, accounting, audit, fraud or dispute purposes. Free-text and custom-design content is removed or restricted where reasonably possible, and access to all retained records remains limited. Deleting the app from a device does not delete the account. You must use the in-app deletion control or the public deletion page. 9. YOUR PRIVACY RIGHTS AND CHOICES Subject to verification, applicable law and lawful exceptions, you may: - ask for a summary of personal data being processed and the processing activities; - request access to or an export of eligible account data; - correct, complete or update inaccurate personal data; - withdraw a consent or change marketing/notification preferences; - request deletion or de-identification of eligible data; - ask how to raise a grievance and receive a response; - nominate another person to exercise rights in circumstances recognized by applicable law; and - complain to the competent data-protection or consumer authority after using our grievance process, where applicable. Submit a privacy request through the in-app controls, the account-deletion page, or support@trendmil.in. We may ask for information reasonably necessary to authenticate the request and protect the account. We will not ask for your password, OTP, CVV or UPI PIN. We may refuse or limit a request where the law requires retention, the request would disclose another person's data, or an exemption applies; if so, we will explain the basis where legally permitted. 10. SECURITY We use measures designed to protect personal data, including HTTPS in transit, access controls, least-privilege administrative roles, administrator two-factor authentication, secure password hashing, Android Keystore protection for session secrets, private file storage, malware scanning, payment-signature verification, app-integrity checks, logging controls and tested account-deletion workflows. No system can be guaranteed completely secure. Keep your device, email account and Trendmil credentials secure, use a unique password, and notify us promptly if you suspect unauthorized activity. Never send passwords, OTPs, complete card numbers, CVVs or UPI PINs to Trendmil support. If a personal-data breach occurs, we will investigate, contain and notify affected users and competent authorities as required by applicable law. 11. CHILDREN The Services are intended for persons who are at least 18 years old and capable of entering a binding contract. We do not knowingly permit a child to create an account or knowingly process a child's personal data without legally valid authorization from a parent or lawful guardian. If you believe a child has provided data contrary to this section, contact us so that we can investigate and take appropriate action. 12. THIRD-PARTY LINKS AND SERVICES The Services may contain links to a payment page, courier tracking page, Google service or another external website. Trendmil does not control an independent third party's privacy practices. Review that party's privacy notice before providing data directly to it. 13. CHANGES TO THIS POLICY We may update this Policy to reflect changes in the Services, providers, security practices or law. We will publish the new version and effective date at https://trendmil.in/privacy. If a change materially affects your rights or introduces a new purpose that requires consent, we will provide an appropriate notice and seek consent where required. 14. CONTACT AND GRIEVANCE REDRESSAL For privacy, account, order or customer-service questions, contact: MRD APP WORLD OPC PVT LTD (Trendmil) Nirmal Colony, Saraiya Road, Etawah, Uttar Pradesh 206001, India Email: support@trendmil.in Customer care phone: +91 70881 00007 Grievance Officer: Raj Dubey Designation: Director Email: support@trendmil.in Phone: +91 70881 00007 Please include enough information to identify the issue and the account or transaction concerned, but do not send a password, OTP, complete card number, CVV, UPI PIN or unnecessary identity document. We aim to acknowledge consumer grievances within 48 hours and resolve them within one month, or within any shorter period required by applicable law.