Privacy Policy

Bombay Print Lab (“we”, “us”) makes custom hand-painted figurines from photos you upload. This policy explains, in plain language, what personal data we collect when you use bombayprintlab.com or place an order, why we collect it, who we share it with, and what rights you have over it under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). If you have questions after reading this, contact us using the details at the bottom of this page.

Information we collect

• Contact and identity details — your name, phone number, and email address, collected when you place an order or contact support.
• Shipping address — collected to deliver your figurine, paint pots, and painting guide.
• Photographs you upload — photos of you, your family, or your pets that you submit so we can generate a cartoon figurine likeness and 3D-print it as a resin miniature. These photos show identifiable people (and sometimes minors, e.g. in family photos) and are the most sensitive category of data we handle. We use them only to generate your figurine art and painting guide, and to fulfil and support your order — never for advertising or resold to third parties.
• Order and payment metadata — order contents, price paid, coupon usage, and payment status. We do not receive or store your card, UPI, or bank account details directly — these are handled by Razorpay (see below).
• WhatsApp OTP verification data — your phone number and a one-time passcode we send to confirm you own the number before we start an order.
• Support and order communications — messages you send us about your order, including any tweak requests or notes.
• Usage and device data — pages visited, approximate location inferred from IP address, browser/device type, and interaction events on our site, collected via cookies and analytics tooling described in “Cookies & analytics” below.

How we use your information, and why

• Order fulfilment — your name, address, and order details are used to manufacture, package, and ship your figurine, and to keep you updated on its status.
• AI figurine generation — your uploaded photos are sent to our AI image-generation and vision providers (named below) solely to produce your cartoon figurine art and to validate that a photo is usable (e.g. detecting how many people/pets are in frame) before we generate anything.
• Identity verification (WhatsApp OTP) and fraud prevention — your phone number is used to send a one-time passcode via WhatsApp and to cap free AI generations per phone number, to stop abuse of the free-preview flow.
• Payments — order value and your contact details are shared with Razorpay to process payment and confirm it succeeded.
• Customer support — your order history and messages are used to answer questions, handle reprint/replacement requests, and resolve complaints.
• WhatsApp order updates — your phone number may be used to send order-status messages over WhatsApp.
• Service reliability and analytics — usage and device data help us fix bugs, understand which steps of the order flow are confusing, and diagnose errors.

We do not use your uploaded photographs, your figurine art, or your order data for advertising, and we do not sell personal data to anyone.

Your consent

When you upload a photo and proceed through checkout, you are giving us your consent to process that photo — and the personal data of anyone identifiable in it — to generate AI figurine art, to have it 3D-printed as a resin miniature, and to produce your painting guide, as described above. If the photo includes another identifiable person (for example, a family member, partner, or child), please make sure you have their permission (or, for a child, a parent/guardian’s permission) before uploading it.

You may withdraw consent at any time by emailing us at bombayprintlab@gmail.com. If you withdraw consent before your order is generated or produced, we will stop processing and delete the uploaded photos. If you withdraw consent after your figurine has already been generated, printed, or shipped, we may not be able to complete or refund that order, since the photo is essential to producing it — withdrawing consent does not affect the lawfulness of anything we already did with your data before withdrawal.

Who we share your data with, including outside India

We do not sell your personal data. We share it only with the service providers below, each of whom processes it strictly to help us run the service. Several of these providers operate servers outside India — the DPDP Act permits transfer of personal data outside India by default (except to countries the Central Government specifically restricts), but we list our providers here for transparency:

• AI image-generation service providers — receive your uploaded photos to generate your cartoon figurine art. Located outside India; processing occurs on their servers.
• AI photo-analysis (computer vision) service providers — receive your uploaded photos to validate subject count and basic photo attributes before generation. Located outside India; processing occurs on their servers.
• Cloud storage providers — store your uploaded photos, generated figurine art, and painting guide images. Infrastructure is geographically distributed, so storage may occur outside India.
• Razorpay — processes your payment. India-based.
• WhatsApp (operated by Meta) — delivers your OTP code and order-status messages, via a messaging-platform partner. Message delivery may involve processing outside India.
• Order-management / fulfilment-tracking systems — used internally by us to track order and fulfilment status; not used as our storefront or checkout (those run directly on bombayprintlab.com). May process order data outside India.
• Product analytics and session-recording tools — receive usage/device data, and, for debugging purposes, session recordings of the order flow that may include the photos and figurine art you viewed on screen. Hosted outside India.

We don’t name individual sub-processors here by brand, to avoid publishing a roadmap of our internal systems — but the categories above are complete, and we’ll tell you the specific provider for any category on request (email us using the details below).

We may also disclose personal data if required by law, court order, or a valid request from a government authority.

Cookies & analytics

We use cookies and similar technologies for essential site functionality (e.g. keeping you signed in to view your orders) and for product analytics and error tracking via a third-party analytics tool, which helps us understand how the order flow is used and diagnose bugs. You can adjust your browser settings to block or delete cookies, though this may affect features like staying signed in.

How long we keep your data

• OTP codes — expire after 10 minutes and are not retained once your phone number is verified.
• Uploaded photos and generated figurine art — retained for up to 5 years from your order date (to support reprints, replacements, and customer-support queries), after which they are deleted. You can request earlier deletion at any time, subject to the consent-withdrawal limits above.
• Order, payment, and shipping records — retained as long as reasonably necessary for support, warranty, accounting, and legal/tax record-keeping obligations.
• Analytics and session-replay data — retained per our analytics provider’s standard retention window, after which it is automatically deleted or aggregated.

Your rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed.
• Correction of inaccurate or incomplete personal data.
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to the order-fulfilment limits described in “Your consent” and “How long we keep your data” above.
• Withdraw your consent at any time, with the effects described in “Your consent” above.
• Grievance redressal — raise a complaint with our Grievance Officer (below), and if unresolved, with the Data Protection Board of India.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email bombayprintlab@gmail.com from the email or phone number associated with your order so we can verify the request.

Grievance Officer

In accordance with the DPDP Act, 2023, the Grievance Officer for Bombay Print Lab is:
Rishi Agarwal
Email: rishi@bombayprintlab.com
Phone / WhatsApp: +91 7076267167
Address: Cluster 4, Tower 11, Runwal My City, Diva Manpada Road, Opp. Ryan School, 421204

We will acknowledge grievances within 48 hours and aim to resolve them within 30 days.

Children’s data

Our service is not directed at children, and orders must be placed by adults (see “Age & legal compliance” in our Terms of Service). Photos submitted with an order may depict children as subjects of a figurine (e.g. a family photo) — this is expected, but the order itself, including consent for photo processing, must be placed by an adult on the child’s behalf.

Security

We use reasonable technical and organisational safeguards to protect your personal data, including encryption of data in transit and access controls limiting who can view order and photo data internally. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy as our service or legal obligations change. We will post any changes on this page with an updated “Last updated” date, and for material changes affecting how we use your photos or other personal data, we will make reasonable efforts to notify you directly.

Contact us

Email: bombayprintlab@gmail.com
Phone / WhatsApp: +91 7076267167
Address: Cluster 4, Tower 11, Runwal My City, Diva Manpada Road, Opp. Ryan School, 421204