Privacy Policy
Last updated: 18 July 2026. This Privacy Policy explains how StarvoxLabs Private Limited ("Tridi", "we", "us", "our") — the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") — collects, uses, shares, and protects your personal data when you use tridi.in. Please read it in full.
1. Who we are
The Site is operated by StarvoxLabs Private Limited, a company incorporated in India, having its registered office at BKC, Mumbai, Maharashtra. In this document "you" refers to the Data Principal — the natural person to whom the personal data relates. "Personal data" has the meaning given to it under the DPDP Act, 2023.
2. Data we collect
Directly from you: name, mobile number, email address, billing and shipping address, GSTIN and company name (only if you choose a tax invoice), any message you send us, and User Content (e.g. Studio prompts, reviews, photographs). Automatically when you use the Site: IP address, device and browser type, operating system, referring URL, pages visited, timestamps, and cookie identifiers. From our payment processor: only a transaction reference and the last four digits of the card you used — we never receive or store your full card, CVV, or UPI PIN.
3. Purposes for processing
We process your personal data to: (a) create and manage your account; (b) fulfil orders (payment, dispatch, delivery, invoicing and GST compliance); (c) provide customer support and respond to grievances; (d) send transactional communications (order confirmations, shipping updates, invoices, cancellations); (e) send marketing communications where you have consented and opted-in; (f) prevent fraud, secure the Site, and comply with law; (g) improve our products, service, and website through aggregated analytics.
4. Legal basis under the DPDP Act
We process personal data on the basis of the free, specific, informed, unconditional consent you provide when you create an account, place an order, or subscribe (Section 6, DPDP Act); on the basis of the "certain legitimate uses" listed in Section 7 of the DPDP Act (fulfilment of orders, employment, medical emergency, etc., where applicable); and to comply with legal obligations under Indian law including the CGST Act, 2017, the Companies Act, 2013, and the Consumer Protection Act, 2019.
5. Cookies & tracking technologies
The Site uses first-party cookies for session management (keeping you signed in, remembering your cart) and third-party cookies from Google Analytics 4 and Meta Pixel to measure traffic, understand which products resonate, and (with your consent) show relevant ads on Meta / Google properties. You can disable cookies in your browser settings; note that some Site features may not function without them.
6. Data Processors we share data with
We use carefully-selected third parties who process personal data on our behalf under written agreements requiring confidentiality and DPDP-compliant safeguards: Razorpay Software Pvt Ltd (payments, India), Cloudinary (product and Studio media hosting, USA / EU), Supabase (database hosting, EU), Resend (transactional email, USA), Google LLC (Google Analytics 4, USA), Meta Platforms Inc. (Meta Pixel and Instagram embeds, USA), and our shipping partners (India). Each of these is a Data Processor engaged only to the extent required for the specific purpose stated in this policy.
7. Cross-border transfers
Where a Data Processor is located outside India, we transfer personal data only to countries which are not restricted by the Central Government under Section 16 of the DPDP Act, and only under agreements that impose confidentiality, security, and data-protection obligations comparable to Indian law.
8. Retention
We retain personal data only for as long as is necessary for the purpose it was collected, or as required by law. Order and invoice records are retained for the period prescribed under the CGST Act, 2017 and the Companies Act, 2013 (typically eight years). Marketing consent data is retained until you withdraw consent. Aggregated, anonymised analytics data may be retained indefinitely.
9. Your rights as a Data Principal
Under the DPDP Act you have the right to: (a) obtain confirmation of and access to your personal data; (b) request correction, completion, or updating of inaccurate or incomplete personal data; (c) request erasure of personal data no longer required for the stated purpose (subject to legal retention requirements); (d) nominate another individual to exercise your rights in the event of death or incapacity; (e) withdraw the consent you have given, at any time, without affecting the lawfulness of prior processing; and (f) have your grievances addressed by our Grievance Officer (see clause 12).
10. Marketing communications
We send marketing emails and WhatsApp messages only to customers who have opted in. Every marketing email carries an unsubscribe link that takes effect immediately; you can also reply STOP to any promotional WhatsApp message. Transactional messages (order confirmations, shipping updates, refunds, security alerts) are sent regardless of marketing consent, because they are necessary to fulfil the contract.
11. Security
We follow reasonable security practices as required under the Information Technology Act, 2000 and the DPDP Act: HTTPS for all traffic, strict Content-Security-Policy headers, HSTS, encrypted database at rest, principle-of-least-privilege access controls, admin login rate-limiting, and prompt patching of vulnerabilities. However no method of Internet transmission or storage is 100 % secure, so we cannot guarantee absolute security.
12. Grievance Officer
In accordance with Section 8(9) of the DPDP Act, 2023, Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules, 2011, and Rule 3(11) of the Intermediary Guidelines 2021, our designated Grievance Officer can be reached at: The Grievance Officer, StarvoxLabs Private Limited, BKC, Mumbai, Maharashtra, India · Email: hello@tridi.in. We aim to acknowledge every request within 48 hours and resolve every grievance within 30 days.
13. Children's data
The Site is not intended for children under the age of 18. We do not knowingly collect personal data from any person known to be a child within the meaning of the DPDP Act. If you become aware that a child has provided us with personal data, please notify the Grievance Officer and we will delete it promptly.
14. Data breach
If we experience a personal data breach that is likely to result in a risk to your rights, we will notify the Data Protection Board of India and the affected Data Principals in the manner and time frame prescribed under the DPDP Act.
15. Changes to this policy
We may update this Privacy Policy from time to time. The updated version takes effect from the date it is posted, indicated by the "Last updated" date above. Material changes will also be notified by email to registered users. Please review this page periodically.
16. Contact us
For any question about this Privacy Policy, your personal data, or to exercise any of the rights above, please email hello@tridi.in or write to: The Grievance Officer, StarvoxLabs Private Limited, BKC, Mumbai, Maharashtra, India.