Clozyy Privacy Policy

This Privacy Policy explains what personal data Wryvy Technologies Pvt Ltd (“Wryvy”, “we”, “us”, “our”) — the company behind Clozyy — collects when you visit this website or join the early-access list, why we collect it, who else sees it, and what you can ask us to do about it. Wryvy determines why and how that data is processed and is the responsible data fiduciary or controller where those terms apply under applicable law.

We have tried to write this in plain language rather than boilerplate. Where a term has a specific legal meaning, we have said so.

1. Who we are and what this policy covers

Clozyy is a product of Wryvy Technologies Pvt Ltd, a company incorporated in India. This policy covers this website (www.clozyy.com) and the early-access signup on it, at its current pre-launch stage.

This policy also covers information you choose to include when you email us about the Site or make a privacy request. It does not cover:

• The Clozyy app itself. The app is not yet available. When it launches it will process things this website never touches — wardrobe photographs, style preferences, device and usage data — and it will carry its own privacy policy and its own consent flow. Joining the early-access list does not consent you to any of that.
• Other websites and services we link to, including Instagram and www.wryvy.com. Once you follow a link off this site, that service’s own privacy policy applies, not ours.
• Messages sent on a third-party social platform. The platform’s policy applies to its own processing; our handling of a copy received by Wryvy is covered here.

2. What we collect

For the Site and early-access programme, we process the following limited categories.

a. What you give us through the early-access form

• Name — required by the form, so that our emails to you are not addressed to a blank.
• Email address — required; it is how we reach you at launch.
• Your consent choice — the submitted form records that the required, unticked consent box was selected. This lets us respect your choice and demonstrate consent where applicable law requires it.

The form also carries a hidden anti-spam field that a human never sees or fills in. It exists to catch automated submissions and holds no information about you.

b. What is logged automatically when you load a page

This website is hosted and served through Cloudflare’s platform. Like any web host and delivery network, Cloudflare processes the technical details of each request — IP address, browser and device type, approximate location derived from the IP address, the page requested, and the time — in order to serve the site and to protect it from attack and abuse. We do not build profiles from these logs, and we do not link them to anyone on the early-access list.

c. What you include when you contact us

If you email Wryvy or Clozyy, we receive your email address, message, attachments and ordinary message metadata. Please provide only what is needed for us to answer. We use it to respond, investigate a request or complaint, keep an appropriate record, and protect our legal rights.

3. What the Site does not ask you for

So that there is no doubt about the current pre-launch scope:

• No photographs, wardrobe images or clothing data. The scanning features described on this site are part of the unreleased app, not this website.
• No payment or financial information. Nothing on this site is for sale.
• The early-access form does not ask for a phone number, postal address, date of birth or government identifier. Please do not include those details in an email unless genuinely necessary.
• No special-category or sensitive personal data (health, biometrics, religion, caste, sexual orientation, political opinion or similar). Please do not send us any.
• No advertising identifiers, no cross-site tracking, and no data bought from third parties.

4. Purpose and lawful basis

We process the name, email address and consent choice you submit because you have specifically asked to receive Clozyy launch and early-access communications. The consent box is not pre-selected or bundled with another purpose. You may withdraw consent at any time using an unsubscribe link or the contact in Section 15; withdrawal does not invalidate processing that was lawful before it.

Where the GDPR, UK GDPR or a similar law applies, consent is our basis for optional launch communications. Processing limited technical request data is necessary for our legitimate interests in delivering and securing the Site, provided those interests are not overridden by your rights. We may also process data when necessary to comply with law, respond to lawful process, or establish, exercise or defend legal claims.

India’s DPDP Act has a staged commencement. Its core processing and data-principal rights provisions are scheduled to apply from 13 May 2027. We are adopting clear notice, purpose limitation, withdrawal and security practices ahead of that date; this sentence does not claim that a provision applies before its notified commencement.

5. How we use your data

• To email you when Clozyy launches and when your early access opens.
• To send occasional updates about Clozyy’s development — infrequent, and strictly about the product you signed up for.
• To respond to you if you contact us, including to action a privacy request.
• To keep the website working and to prevent spam, fraud and abuse of the form.
• To comply with law, and to establish, exercise or defend legal claims where we have to.

Every email we send you will carry a working way to unsubscribe.

6. What we never do

• We do not sell, rent or trade your personal data. We never have, and this is not a position we intend to revisit.
• We do not share it with anyone for their own marketing.
• We do not use it to target advertising to you, on this site or anywhere else.
• We do not use your name or email to train AI models.
• We do not email you about anything other than Clozyy.

7. Who else touches your data

We use service providers to operate and secure the Site and deliver communications. They may process data on our instructions, while some may separately process limited information for network security, fraud prevention or their own legal obligations as explained in their policies. Key providers in the current data path are:

• Web3Forms (web3forms.com) — a product of Web3Creative, a registered business based in Kerala, India. It receives what you submit through the early-access form and relays it to our mailbox. Web3Forms states that its servers are in the United States (US-East region). Its public documentation is not fully consistent about retention: its FAQ says submissions are forwarded without being stored and server logs are deleted every two months, while its product pages describe submission storage of 30 days on free plans and up to one year on paid plans. We therefore disclose the more conservative position: submission data may be processed and retained in the United States for the period applicable to our Web3Forms plan, up to one year, and related server logs may be retained for up to two months.
• Cloudflare, Inc. (United States) — hosts and serves this website, its DNS and its security layer. It processes technical request and traffic data described in Section 2(b) across its global network.
• Wryvy’s business email provider — receives and stores signup messages relayed by Web3Forms and messages you send directly to our published addresses. Its access is limited to providing and securing Wryvy’s business communications and is governed by the provider’s applicable service terms, privacy documentation and Wryvy’s account settings.

Beyond those, we may disclose personal data in three narrow situations:

• When the law requires it — to a court, regulator or law-enforcement authority acting under valid legal process. We will satisfy ourselves that the request is lawful and, where we are permitted to tell you about it, we will.
• To protect people — where disclosure is genuinely necessary to prevent or investigate fraud, a security incident, or a threat to someone’s safety.
• In a corporate transaction — if Wryvy or the Clozyy business is merged, acquired or reorganised, signup data may transfer to a successor for the same purposes, subject to applicable law. Where required, we will notify you of a material change and provide a way to withdraw.

8. How long we keep it

• Name and email: while the early-access purpose remains active. We will review the list at least annually and delete or anonymise entries no longer needed, or act sooner if you withdraw or request deletion, subject to lawful retention.
• If you withdraw consent or ask for deletion: we stop optional messages and delete or anonymise signup data without undue delay, subject to identity verification, technical processing time and any record we must retain by law. We may keep a minimal suppression record so that we do not accidentally contact you again.
• If Clozyy does not launch: we will close the early-access programme and delete or anonymise the list when it is no longer needed, subject to lawful retention.
• Consent and complaint records: while we use the related data and for a limited period afterwards where reasonably needed to demonstrate your choice, handle a dispute, or comply with law.
• Cloudflare request logs: retained on Cloudflare’s standard schedule for security and abuse-prevention purposes, and not retained by us separately.
• Web3Forms submission data and logs: retained according to the service tier and logging periods described in Section 7, with a disclosed maximum of one year for submission data and two months for server logs.

9. How we protect it

The Site is served over HTTPS, uses HSTS and a restrictive Content Security Policy, and runs no third-party scripts. We use proportionate access controls, minimise the information collected, and require personnel and service providers handling it to do so only for authorised purposes.

We should be honest that no method of transmission or storage is completely secure, and we cannot guarantee absolute security. What we can commit to is proportionate, industry-standard safeguards for the limited data we hold at this stage. If a personal-data breach occurs, we will investigate, contain and make any notice to affected people or authorities required by the law then in force.

10. Your rights

Depending on where you live and which law applies, you may have some or all of the following rights. We will also consider the same requests voluntarily where reasonably possible:

• Access — a copy of the personal data we hold about you, and a summary of how it is processed and who it has been shared with.
• Correction — have inaccurate or incomplete data fixed or completed.
• Erasure — have your data deleted, except the little we are legally required to keep.
• Withdrawal of consent — at any time, as easily as you gave it. Use the unsubscribe link in any email, or write to privacy@wryvy.com. Withdrawal does not make the processing we did beforehand unlawful.
• Portability — a copy of the data you gave us, in a structured, commonly used, machine-readable format.
• Objection and restriction — object to processing based on legitimate interests, or ask us to pause processing while a dispute is resolved.
• Nomination — once the relevant DPDP Act provisions commence, nominate another individual to exercise your rights in the event of death or incapacity, in the manner prescribed by applicable law.
• Complaint — raise a grievance with us first (Section 15) and, if we have not resolved it, use any regulator or supervisory-authority route available to you under applicable law.

Exercising any of these rights is free and will never disadvantage you. To make a request, email privacy@wryvy.com. We will acknowledge and respond without undue delay and within any deadline that applicable law requires. If we need more information, additional lawful time, or cannot fulfil a request, we will explain why and tell you about any available review or complaint route.

We may ask you to confirm your identity before we act, but only as far as is needed to be sure we are not disclosing your data to someone else. In return we ask that the information you give us is accurate and that requests are made in good faith — the DPDP Act places corresponding duties on individuals once its relevant provisions commence, including not impersonating another person or making a false or frivolous grievance.

11. Children’s data

This website and the early-access signup are meant for adults. We do not knowingly collect personal data from anyone under 18, and our Terms of Service require registrants to be 18 or over. If we learn that a child’s data has reached us without verifiable parental consent we will delete it promptly — if you believe that has happened, tell us at privacy@wryvy.com and we will act on it.

We do not track, profile or direct advertising at children. Before any future app permits use by a person under 18, Wryvy must implement the age assurance, verifiable parental consent and child-safety controls required by the law then in force. Otherwise the app must remain limited to adults.

12. Cookies, local storage and tracking

We set no cookies of our own. This site runs no analytics, no advertising, no social widgets, no session recording and no third-party tracking scripts of any kind. Our fonts are served from our own domain, so simply viewing this site sends no request to Google Fonts or any other third-party network.

The only thing we store on your device is a single browser localStorage entry, clozyy-theme, which remembers whether you chose the light or dark version of the site. It is written only when you use the theme toggle, is strictly functional, never leaves your browser, is never sent to us, and disappears if you clear site data. Because it is strictly necessary to deliver a feature you asked for it does not require consent — and it is why you are not being shown a cookie banner.

Cloudflare may set strictly necessary cookies for security and bot mitigation as part of protecting the site.

If we ever add analytics or any other tracking, we will update this section and put any consent mechanism the law requires in place before it goes live — not after.

13. Automated decision-making and profiling

We do not carry out any automated decision-making that produces legal or similarly significant effects for you, and we do not profile you, within the meaning of Article 22 of the GDPR. The styling intelligence Clozyy is being built around lives in the app, not on this website, and will be explained in the app’s own privacy policy before you ever use it.

14. Where your data is processed

Wryvy operates from India, and providers may process data in other countries. Cloudflare is a United States company operating a global network. Web3Forms is a Web3Creative product based in Kerala, India, but states that its servers are in the United States (US-East region). Wryvy’s business email provider may process data in the countries where it operates, as described in its applicable service terms and privacy documentation.

Cloudflare states that it primarily stores information in the United States and EEA and may transfer it globally. Where an international transfer is subject to a legal restriction, we will use a valid transfer mechanism, apply required safeguards, or stop that transfer. We do not claim that a particular contractual mechanism applies unless it is actually in place.

15. Privacy and grievance contact

Wryvy’s Privacy Team is the designated contact for Clozyy privacy questions and grievances. Publishing this practical contact prepares for the DPDP Act’s grievance framework; it does not represent that Wryvy has been notified as a Significant Data Fiduciary or that a statutory Data Protection Officer has been appointed.

• Designated privacy and grievance contact: Wryvy Privacy Team
• Email: privacy@wryvy.com
• General contact: hello@clozyy.com
• Registered-office correspondence: request Wryvy’s current registered office details from contact@wryvy.com. We do not publish an unverified street address.
• Our commitment: a timely acknowledgement, a response within the period required by applicable law, and an explanation if we cannot fulfil your request.

If we have not resolved your grievance, you may use the complaint route available under the law that applies to you, including the Data Protection Board of India once the relevant provisions and complaint mechanism apply, or an EEA or UK supervisory authority where it has jurisdiction.

16. Changes to this policy

We will update this policy as Clozyy develops — most significantly when the app launches and begins processing wardrobe photographs and usage data. The “last updated” date at the top always reflects the current version.

For changes that materially affect your rights, or how we use data you have already given us, we will email everyone on the early-access list before the change takes effect, and where the law requires fresh consent we will ask for it rather than assume it. Continuing to use the site is not treated as consent to a material change in how we process your personal data.

17. Governing law

This policy is governed by the laws of India. Nothing in it limits or removes any right you have under a data protection law that applies — including the GDPR or UK GDPR where its territorial scope is met. Where this policy and a mandatory law conflict, that law prevails.

See also our Terms of Service, which govern your use of this website.