Privacy policy

Privacy Policy

POSHIS GLOBAL PRIVATE LIMITED (trading as “a i c e”)

Last updated: 04 Sep 2026

Previous version effective 7 August 2026. This version adds section 3, covering the J’ai skin analysis service.

1. Who we are, and what this covers

POSHIS GLOBAL PRIVATE LIMITED, trading as a i c e, is the data fiduciary responsible for the personal data described in this policy.

This policy explains what we collect when you use shopataice.com, buy from us, or use the J’ai skin analysis service, why we collect it, who we share it with, and what rights you have over it.

We handle personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it.

POSHIS GLOBAL PRIVATE LIMITED
Bangalore, Karnataka, India – 560068
Email: contact@poshisglobal.com
Phone: +91 90350 42857

2. What personal data we collect

2.1 Identity and contact information

Your name, email address, phone number, and billing and delivery addresses.

2.2 Account credentials

Information used to sign you in and keep your account secure. We sign you in using your phone number and a one-time code; we do not store a password for you.

2.3 Transaction details

What you bought, when, how much you paid, order and invoice numbers, delivery status, and returns or refunds.

2.4 Payment data

Payments are processed by our payment providers. We do not store your full card details. We receive confirmation of payment and limited information such as the payment method and the last four digits.

2.5 Communications

Messages you send us by email, phone, chat or social media, and our replies, including any support or complaint history.

2.6 User-generated content

Reviews, ratings, photographs and other material you choose to submit to the Site.

2.7 Marketing preferences

Whether you have opted in to marketing, and by which channel.

2.8 Technical and usage data

Your IP address, device and browser type, operating system, referring pages, the pages you visit on the Site, and how you move through it. Some of this comes from cookies and similar technologies — see section 6.

2.9 Optional profile information

Anything you choose to tell us about your preferences, skin type or interests to help us serve you better.

3. J’ai skin analysis — biometric and health data

J’ai is our skin analysis service, available at shopataice.com/pages/skin-analysis. It uses your device camera to analyse your skin and recommend products. This section applies in addition to the rest of this policy.

J’ai records and stores the sessions you have with it. This includes an image of your face. Using J’ai is optional, and you cannot use it without agreeing to this on the screen where you begin.

3.1 What J’ai collects

  • Images of your face. One or more still images captured from your camera during a scan, together with a facial landmark map derived from them. A facial image is biometric data, and you may be identifiable from it on its own.
  • Analysis results. The skin characteristics detected, their location on your face, and their assessed severity.
  • Recommendations. The products suggested to you and the inputs behind that suggestion.
  • Information you tell J’ai. Your age bracket, location, gender, and answers about sleep, stress, diet, environment, sunscreen use, skincare goals, budget and experience.
  • Health information. Ingredient sensitivities, medical skin conditions, and whether you are pregnant or breastfeeding. We ask so we can avoid recommending something unsuitable or unsafe for you. This is health data and is treated as such.
  • Products you already own, where you scan or upload them.
  • Your conversation with J’ai, including transcripts of anything you say to it.

3.2 Why we collect it

Two distinct purposes:

  1. To provide the service to you. Producing your reading, comparing it against your previous scans so you can see what has changed, and making recommendations suited to your skin and your safety information.
  2. To improve J’ai. Your sessions are used to train and improve the accuracy of our skin detection and recommendation systems.

We do not sell your personal data, and using data to improve our own service is not selling it. We do not share your images or analysis results with advertisers, brands, or any third party for their own purposes.

3.3 Our lawful basis

We rely on your consent, given by an affirmative act before you begin. The checkbox is not pre-ticked, and you cannot proceed without it. Agreeing covers both purposes above.

You can withdraw at any time — see section 3.8. Because the service cannot operate without this data, withdrawing ends your access to J’ai. The rest of shopataice.com is unaffected.

3.4 Age

J’ai is for people aged 18 and over. We ask your age bracket before the camera starts and do not proceed if you tell us you are under 18. We do not knowingly collect biometric or health data from children. If you believe a child has used J’ai, contact us and we will delete the data.

3.5 If you use J’ai without an account

You can use J’ai without signing in. If you do, your session is held separately, for 30 days only, and is not used to train or improve J’ai during that period.

  • If you sign in within that time, the session is added to your account and this policy applies to it in full.
  • If you do not, it is deleted automatically and never enters our training data.

3.6 How long we keep it

We keep J’ai session data for 24 months from the date of the scan, unless you ask us to delete it sooner.

3.7 Where it is processed, and who else sees it

J’ai runs on Cloud infrastructure located in Mumbai, India. [If any processing, storage or annotation occurs outside India, describe it here, name the countries, and state the safeguards.]

[If human reviewers or an annotation vendor see your images, state that here and describe them. If nobody outside our company sees them, state that instead.]

3.8 Withdrawing your consent, and what deletion means

You can withdraw your consent and ask us to delete your J’ai data at any time, from your profile in the app or by emailing us with the subject line DPDP Rights Request.

When you do:

  • We delete your images, analysis results, recommendations, conversations and the profile information you gave J’ai.
  • We exclude your data from every future training run.
  • Your access to J’ai ends, because it cannot operate without this data.

There is one thing deletion cannot do, and we would rather say so than imply otherwise. Where a system has already been trained using your data, an individual contribution cannot be removed from that trained system. What we can do, and do, is remove your data from our records, exclude it from all future training, and retrain from the corrected data on a 24-monthly cycle.

4. How we use your data

  • To take, process, fulfil and deliver your orders
  • To take payment and issue invoices and refunds
  • To create and manage your account
  • To answer your questions and handle complaints
  • To send you order and delivery updates
  • To send marketing where you have opted in, which you can stop at any time
  • To operate, secure and improve the Site, and to understand how it is used
  • To provide and improve J’ai, as described in section 3
  • To meet our legal, tax and accounting obligations, and to prevent fraud

5. Our lawful basis

We process your personal data on the basis of your consent — freely given, specific, informed, unconditional, and unambiguous — or on the basis of the legitimate uses permitted under Indian law.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect anything we did lawfully before you withdrew, and it does not affect data we are required to keep by law, such as invoices.

6. Cookies and similar technologies

We use cookies and similar technologies to keep the Site working, remember your basket and preferences, understand how the Site is used, and — where you have agreed — to measure marketing.

You can control cookies through your browser settings. Blocking some of them will affect how the Site works.

7. Who we share your data with

We share personal data with the following categories of recipient, only as far as they need it:

  • Shopify — hosting and running our store
  • Payment processors — taking payment and preventing fraud
  • Logistics partners — delivering your order
  • Communications providers — sending email, SMS and one-time codes
  • Analytics providers — understanding how the Site is used
  • Professional advisers and authorities — where we are required or permitted by law

We do not sell your personal data.

Images and analysis results from J’ai are not shared with any of the recipients above except as strictly necessary to run the service, and never for their own purposes. See section 3.7.

8. How long we keep your data

What How long
Order and transaction records, invoices, tax records At least 8 years, as required by law
Account information While your account is open, and for 12 months after you close it
Communications and support history 24 months from the last contact
Cookie and analytics data Typically not exceeding 24 months
Marketing preferences Until you opt out, plus a record of the opt-out itself
J’ai sessions — images, analysis results, recommendations, conversations and related profile and health information 24 months from the date of the scan, or until you withdraw consent, whichever is sooner.
Sessions from people who are not signed in: 30 days, then deleted automatically.

When a retention period ends we delete the data or anonymise it so that you can no longer be identified from it.

9. How we protect your data

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, access controls, and restricting access to staff who need it.

J’ai data is treated as our most sensitive category, because it contains biometric and health information.

No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act.

10. Your rights

Under the DPDP Act you have the right to:

  • Access a summary of the personal data we hold about you and how we process it
  • Correct data that is inaccurate, and complete data that is incomplete
  • Erase data we no longer need for the purpose it was collected for
  • Withdraw your consent at any time
  • Nominate someone to exercise these rights on your behalf if you die or become incapacitated
  • Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied

To exercise any of these, email contact@poshisglobal.com with the subject line DPDP Rights Request. We respond within 30 days.

Erasure and J’ai. If you ask us to erase data collected through J’ai, we remove it from our records and exclude it from all future training of our systems. Systems already trained before your request cannot have an individual contribution removed from them; those systems are retrained from the corrected data on a 24-monthly cycle. See section 3.8.

11. Children

The Site is not directed at children, and J’ai is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe we hold data about a child, contact us and we will delete it.

12. Changes to this policy

We may update this policy. The version on this page is the one that applies, and the date at the top shows when it last changed. Where a change materially affects how we use your data, we will take reasonable steps to tell you.

13. Grievance Officer and contact

If you have a concern about how we handle your personal data, contact our Grievance Officer:

Alan
Email: contact@poshisglobal.com
POSHIS GLOBAL PRIVATE LIMITED, Bangalore, Karnataka, India – 560068

We acknowledge within 48 hours and aim to resolve within one (1) month.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.