Privacy Notice
Last updated: July 2026 ·
Data Fiduciary
The Data Fiduciary (and GDPR controller) responsible for your personal data is:
Veer Technovation Pvt. Ltd.12309 BerlinGermanyRepresented by: Mitul GotiEmail: admin@buy-your-diamond.comPhone: +91 9870024832 (WhatsApp only)Scope
This notice explains how we handle the personal data of sellers who use the Buy Your Diamond seller portal to list and manage loose-diamond inventory. It is provided under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”); because the platform is operated from Germany, the same entity is also the controller under the EU General Data Protection Regulation (GDPR). Buyers are covered by a separate notice.
Personal data we process
- Account: your email address and password (stored only as a hash) — to create and secure your account.
- Profile: salutation, first and last name, company name, company logo, WhatsApp/phone number, country and seller type (manufacturer or reseller).
- Listings and deals: the inventory you upload and the shipping quotes, bids, offers, orders and responses you make to buyer requests. This is business data but may identify you as the individual acting for the business.
- Messages: the content of your chats with buyers or with the platform.
- Notifications: if you enable them, your browser's web-push endpoint and keys.
- Technical data: IP address, device/browser (user agent) and timestamps of your requests.
Purposes and basis for processing
We process your personal data on the basis of the consent you give at sign-up and as necessary to provide the platform to you:
- to create, secure and administer your seller account;
- to publish your listings to eligible buyers and enable enquiries, offers, shipping quotes and orders;
- to send you transactional notifications about activity on your listings and deals;
- to help you map your spreadsheet's columns when you upload inventory, including an optional AI assist for column names we don't recognise;
- to operate, protect and improve the platform and prevent misuse.
Service providers and recipients
We use carefully selected service providers who process personal data on our behalf:
| Recipient | Purpose and data | Location |
|---|---|---|
| Supabase (Supabase Inc.) | Authentication, database and storage of your account, profile, listings and deal data. | Servers in Ireland (EU); US parent company under a data-processing agreement. |
| Vercel (Vercel Inc.) | Hosting and delivery of the portal; processes technical data (IP address, user agent). | United States. |
| Resend | Sending transactional email notifications; the recipient email address and message content. | United States. |
| OpenAI (OpenAI, L.P.) | Optional AI column-mapping assist on inventory upload: when a spreadsheet column name isn't recognised automatically, that column's header and one sample value from it are sent to suggest which field it is. Not used to train models, and not used for buyer-facing search here. | United States. |
| Browser push services (Apple, Google, Mozilla) | Delivering web-push notifications, if you enable them; the push endpoint and message content. | Determined by your browser vendor. |
Storage location and international transfer
Your data is stored on servers within the EU (Ireland). Some of the service providers above are located in the United States. Under the DPDP Act, personal data may be transferred outside India except to countries restricted by the Government of India; such transfers are covered by appropriate contractual safeguards with each provider.
Retention
We keep your personal data for as long as your account is active or as needed for the purposes above and to meet legal obligations. We delete it on request, unless we are required to retain it.
Your rights as a Data Principal
Under the DPDP Act you have the right to:
- obtain a summary of the personal data we process and our processing activities;
- request correction, completion, updating or erasure of your personal data;
- raise a grievance with us about how we handle your data;
- nominate another person to exercise your rights in the event of your death or incapacity.
You may withdraw your consent at any time by contacting us. Withdrawal does not affect processing already carried out, and it may limit your ability to use the platform.
Contact and grievance redressal
For any question, request or grievance about your personal data, contact the Data Fiduciary using the details at the top of this notice. We will respond within the time the DPDP Act requires.
Changes to this notice
We update this notice when the underlying data processing or the law changes. The version published here is the one that applies.