Privacy Policy

This Privacy Policy explains how Graybyte Private Limited ("Glymp", "we", "us", or "our"), acting as a Data Fiduciary, collects, uses, stores, discloses, and protects the personal data of Data Principals (you, the user) when you access or use our services ("Services").

• Visiting our website https://glymp.app
• Downloading and using the Glymp User App
• Downloading and using the Glymp Business App
• Discovering nearby products, stores, and services
• Posting content, reviews, or engaging with businesses
• Earning or redeeming Glymp Coins
• Engaging with us through marketing, promotions, or customer support

This policy is published in compliance with the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021"); and the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP Act/Rules"), to the extent their provisions have come into force. In the event of any conflict between these frameworks, the DPDP Act/Rules shall prevail to the extent of such conflict.

If you do not agree with this Privacy Policy, please do not use our Services. For privacy questions, contact us at privacy@glymp.app.

A. Legal Basis for Processing#

Under the DPDP Act 2023, we process your personal data only where we have a lawful basis. The table below summarises our main processing activities and their legal basis.

Where processing is based on consent, you may withdraw it at any time by contacting us at privacy@glymp.app. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

1. Information We Collect#

2. How We Use Your Information#

3. Cookies and Tracking Technologies#

The Glymp website uses the following cookie categories. You can manage your preferences via the cookie banner shown on your first visit or by contacting us.

No advertising cookies are used on the Glymp website. The website is purely informational. You can change your analytics cookie preference at any time by clearing your browser storage or contacting us. On the mobile app, you can reset your advertising identifier or opt out of personalised ads through your device's privacy settings.

4. Third-Party Integrations and Data Sharing#

We share data with the following categories of service providers, bound by contractual data protection obligations. We do not sell your personal data.

• Cloud infrastructure — Hosting, storage, and content delivery (AWS / Google Cloud / Cloudflare, India and US regions)
• Website analytics — Google Analytics (USA) and Microsoft Clarity (USA) — only with your cookie consent
• Payment gateways — Secure payment processing (Razorpay, India)
• Push notification services — Firebase Cloud Messaging (Google, USA)
• Media processing — Image and video optimisation (ImageKit, India)
• AI/ML services — Search, recommendations, and content categorisation. We do not share your personal data with AI providers for the purpose of training their public models without your explicit consent.
• Communication tools — Email delivery and customer support

We may also share information:

• With law enforcement or government authorities when required by law or valid legal process
• During business transfers, mergers, or acquisitions (you will be notified)
• With other users when you post content publicly (your public profile and posts)
• To protect the rights, safety, and property of Glymp and its users

5. Data Retention#

We retain your personal data only as long as necessary for the purposes described in this policy. The schedule below sets out our standard retention periods.

Data may be retained beyond these periods only where required for legal compliance, active dispute resolution, or fraud prevention. Anonymised, aggregated data (which cannot identify you) may be retained indefinitely for analytics. Glymp Coins balances are forfeited upon account termination.

6. Your Privacy Rights#

Under the DPDP Act 2023, the DPDP Rules 2025, the IT Act 2000, and the SPDI Rules, you (as a Data Principal) have the following rights:

• Right to Access — Request a summary of the personal data we hold about you and the purposes for which it is processed.
• Right to Correction and Erasure — Update inaccurate personal information or request deletion of your personal data where it is no longer necessary for the stated purpose.
• Right to Withdraw Consent — Withdraw previously given consent for data processing at any time; withdrawal does not affect lawfulness of prior processing.
• Right to Data Portability — Request your data in a structured, commonly used format.
• Right to Grievance Redressal — File a complaint with our Grievance Officer, with escalation rights to the Data Protection Board of India (once constituted).
• Right to Nominate — Under the DPDP Act 2023, you may nominate another individual to exercise your data rights in the event of your death or incapacity. Submit nomination requests to our Grievance Officer.
• Right to Object — Object to processing of your personal data for direct marketing purposes, honoured within 7 working days.

To exercise your rights, visit our Data Management page at https://glymp.app/data-management or email privacy@glymp.app with the subject line "Data Rights Request". We will verify your identity and respond within 30 calendar days.

7. Age and Parental Consent#

Glymp is available to users aged 13 and above. We process personal data of users under 18 as follows:

• Users aged 13–17: At the time of registration, users in this age group are shown a confirmation screen stating that they require a parent or guardian's permission to use the Services. By proceeding, they confirm that such permission has been granted. We record this confirmation along with a timestamp in our consent log.
• We do not knowingly collect personal data from any person under 13 years of age. If we become aware that a user is under 13, we will immediately terminate the account and delete all associated personal data.
• Business accounts may only be created by individuals who are at least 18 years of age and have the legal authority to represent the business.
• If you are a parent or guardian and believe your child is using Glymp without your permission, or that a child under 13 has created an account, please contact us immediately at privacy@glymp.app and we will act without delay.
• We do not serve any targeted advertising to users and have no mechanisms for profiling. All data minimisation and purpose limitation requirements under the DPDP Act apply fully to our platform.

Glymp is rated 12+ on the Apple App Store and Teen on Google Play.

8. Security Practices#

We implement reasonable security practices and procedures as required under the SPDI Rules, including:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256)
• Secure authentication mechanisms (token-based, OTP verification)
• Role-based access controls for internal systems
• Regular security assessments and vulnerability testing
• Firewalls, intrusion detection, and DDoS protection
• Secure cloud infrastructure with SOC 2 compliant providers
• Employee training on data protection and privacy

While we strive to protect your personal information, no method of transmission or electronic storage is 100% secure. We encourage users to use strong passwords and not share credentials.

9. Cross-Border Data Transfer#

Your data is primarily stored on servers located in India. Some service providers may process data in other jurisdictions:

• United States — Google (Analytics, Firebase, Cloud), Microsoft (Clarity), Cloudflare (CDN, analytics)
• We ensure adequate data protection through contractual Data Processing Agreements (DPAs) with each provider.
• Service providers are contractually bound to process data only for the stated purpose and to implement security safeguards equivalent to those described in this policy.
• We will update this section promptly if the Central Government issues any direction under the DPDP Act restricting data transfer to specific countries, and will take immediate steps to comply.

10. Artificial Intelligence Features#

Glymp uses AI-powered features to enhance your experience:

• AI-powered search and discovery — matching your location and interests to relevant businesses
• Content recommendations and personalisation
• Image recognition and content categorisation
• Automated content moderation (human review available on request — see Grievance Policy)

Personal data processed through AI features is handled in accordance with this Privacy Policy. We do not share your personal data with AI providers for the purpose of training their public models. AI decisions are not used as the sole basis for actions with significant effects on you; where automated moderation affects your account, you may request human review through the Grievance process.

11. Data Breach Notification#

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India (once constituted under the DPDP Act 2023) as required by applicable law and regulation.
• Notify affected Data Principals promptly where the breach is likely to result in high risk to their rights or interests — we target notification within 72 hours of becoming aware of a qualifying breach.
• Describe the nature of the breach, categories and approximate volume of personal data affected, likely consequences, and measures taken or proposed.
• Maintain an internal breach register and conduct post-incident reviews to prevent recurrence.

If you suspect your account or personal data has been compromised, contact us immediately at privacy@glymp.app.

12. Do-Not-Track Signals#

We do not currently respond to Do-Not-Track (DNT) browser signals due to the absence of a uniform industry standard. We rely instead on the cookie consent mechanism described above. We will update this policy if a standard is adopted.

13. Changes to This Policy#

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

• Material changes will be communicated via in-app notification or email at least 7 days before they take effect.
• The "Last updated" date at the top will be revised.
• Continued use of the Services after changes constitutes acceptance of the revised Policy.
• We encourage you to review this policy periodically.

14. Grievance Officer#

In accordance with the Information Technology Act, 2000, the IT Rules 2021, and the DPDP Act 2023, the details of our Grievance Officer are:

15. Contact Information#