Privacy Policy

1. Who we are

Tulam ("Tulam", "we", "us") is an independent service operated from India. It is not yet incorporated as a company, so there is no registered entity or registered office to name here; we would rather say that than print a name that does not exist. For any privacy question, or to exercise the rights in section 6, contact hello@tulam.io and we will respond within 30 days.

2. What we collect

a. If you join the waitlist or create an account

• Your email address, and the page you signed up from.
• If you create an account: any preferences you choose to give us (such as gender, sizes or favourite brands) so we can show more relevant products.

b. When you click through to a retailer

• Which product and which retailer you clicked, which page of ours you came from, and your browser's user-agent.
• Your IP address is shortened before it is stored: we drop the last part of it, so what remains identifies roughly your network and not your device. That shortened value is then put through a keyed one-way hash, and the key is held on our server and never in the database. We do not store your full IP address, and someone who obtained a copy of our database could not work backwards from the stored value to your address.
• The page address we record is stripped of its query string, so what you typed into search does not travel into our click records.

c. Photos and messages you send to the AI stylist

• If you use visual search or the digital wardrobe, the photo you choose is uploaded and sent to a third-party AI provider to be described. If you chat with the stylist, your messages are sent the same way, along with a short summary of your wardrobe and taste preferences (item names, categories, brands and colours — never your photos).
• We do not store your photos or your chats on our servers. They are passed through to the model and the result is returned to you. Your photos and chat history remain in your browser.
• We ask the provider to route these requests only to models whose operators do not retain or train on the content. We cannot audit them, so please do not send a photo you would not want a third party to process — and note that a photo of an outfit is often a photo of a person.

d. Stored on your device, not on our servers

• Your likes, skips, saved items, boards, style preferences, stylist chat history and any wardrobe photos you take are kept in your browser's local storage. They are never uploaded, except that a wardrobe photo is sent for one-off analysis as described above. Clearing your browser data deletes all of it.
• Because this data sits in your browser, any script running on the page can in principle read it. We keep third-party scripts to a minimum (see section 4), but if you share a device, clearing your browser data is the reliable way to remove it.

e. What we never collect

We do not ask for or store payment details, card numbers, bank details, government IDs, your phone number or your address. We never handle a password — signing in uses an emailed link, so there is no password for us to store or leak. Purchases happen entirely on the retailer's own website.

3. Why we use it

• To operate the search and comparison service you asked for.
• To make recommendations more relevant to you.
• To measure whether our affiliate links resulted in a sale, so we can be paid.
• To detect abuse and rate-limit automated traffic.

We do not use your data for advertising profiling, and we do not sell or rent it to anyone.

4. Third parties

These are all of them:

• Cuelinks (affiliate network). Its script loads on our search and stylist pages as soon as the page opens, not only when you click, and it rewrites retailer links so a sale can be credited to us. Being on the page, it can set its own identifiers.
• EarnKaro (affiliate network). Used to prepare retailer links in advance; it does not run on the page.
• OpenRouter, and through it the AI model provider it routes to, for the stylist and for visual search. This is the only third party that receives your photos or your messages, and only when you use those features. See section 2c.
• Supabase (our database) and Netlify (hosting) process data on our behalf under their own security commitments.

Once you leave Tulam for a retailer, that retailer's and that network's own privacy policies apply. We do not use any advertising or analytics SDK, and there is no Google Analytics, no Meta pixel and no session-recording tool anywhere on this site.

5. How long we keep it

Click records are retained for up to 24 months for commission reconciliation, then deleted. They contain no email address and no reversible IP, so they are not linked to you by name.

Your email address and price alerts are kept until you delete them, which you can do yourself at any time from the Delete your data panel. Photos and stylist messages are not retained by us at all: they are sent for analysis and the result is returned to your browser.

6. Your rights (Digital Personal Data Protection Act, 2023)

If you are in India, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Erase your data, without asking us and without an account. The Delete your data panel on the account page erases your email address and every price alert we hold for it, and clears everything stored in your browser. It takes effect immediately and cannot be undone.
• Withdraw consent at any time, as easily as you gave it. Every price-drop email also carries a one-click unsubscribe link that needs no login.
• Nominate another person to exercise these rights if you die or become incapacitated.
• Complain to us first, and then to the Data Protection Board of India if you are not satisfied.

Erasure is self-service at the link above. For anything else — access, correction, nomination or a complaint — email hello@tulam.io. We respond within 30 days.

If you are in the EEA or UK, you have equivalent rights under the GDPR, including data portability and the right to object to processing.

7. Children

Tulam is not directed at children under 18 and we do not knowingly collect their data.

8. Cookies

Tulam itself sets no cookies at all — not for advertising, not for analytics, not even to keep you signed in. Our own analytics use a random identifier that lives only for as long as the browser tab is open and is discarded when you close it.

The Cuelinks affiliate script described in section 4 runs on our search and stylist pages and may set its own attribution cookie; that exists solely to credit a sale to us.

9. Grievance Officer

Tulam is operated by an individual in India and has no incorporated entity or registered office at present. Grievances under the Digital Personal Data Protection Act, 2023 should be sent to hello@tulam.io, which is monitored directly by the operator. We aim to acknowledge within 72 hours and resolve within 30 days. This page will be updated with the registered entity and a named Grievance Officer once Tulam is incorporated.

10. Changes

If we change this policy materially, we will update the date above and, where we hold your email, tell you directly.