← Nitaris

GDPR & Data Processing

Last updated: July 24, 2026

This statement explains how Vinayak Gaur (“Nitaris”, “we”, “us”) processes personal data under the EU and UK General Data Protection Regulation (“GDPR”). It supplements our Privacy Policy, which describes in full what we collect and why.

1. Our roles

For account data (such as your email), we act as a data controller. For the content you process through Nitaris — your product photos and the media we generate — and, for Shopify merchants, the store and product data we read on your behalf, we act as a data processor following your instructions.

2. Legal bases

  • Contract. To provide the Service you sign up for and to process your purchases.
  • Legitimate interests. To secure the Service, prevent fraud or duplicate credit grants, and improve the product.
  • Consent. Where you opt in, for example to push notifications. You can withdraw consent at any time.
  • Legal obligation. To retain certain records where the law requires it.

3. Sub-processors

We use the following processors to run Nitaris, each under agreements limiting them to processing on our behalf:

  • Clerk — authentication and account identity.
  • Cloudflare (R2) — storage of your photos and videos.
  • Anthropic — analyzes your uploaded photo to suggest directions.
  • Google — generates media (Gemini/Veo), processes payments, delivers push (Firebase).
  • Expo — relays push notifications to your device.
  • Shopify — for merchants, the store API we read products from and attach media to.
  • Neon (database) and Upstash (job queue) — backend hosting.
  • Product-analytics and error-monitoring providers (e.g. PostHog, Sentry), where enabled.

4. International transfers

Our providers may process data outside your country, including in the United States and Asia-Pacific. Where required, transfers rely on appropriate safeguards such as the processor’s Standard Contractual Clauses.

5. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You may also lodge a complaint with your local supervisory authority.

6. Data retention

We keep your photos, generated media, and account data while your account is active, and delete them on request (see “Exercising your rights”). Some records, such as purchase identifiers, may be retained where required for legal, tax, or fraud-prevention purposes.

7. Shopify merchants and shopper data

Nitaris reads only your store domain and product information (titles, images) and attaches generated media back to your products. We do not collect or store your shoppers’ personal information. We honor Shopify’s mandatory compliance webhooks — customers/data_request, customers/redact, and shop/redact — and because we hold no shopper data, the first two return nothing to erase; shop/redact removes your store record and its associated account.

8. Data Processing Agreement

If you require a Data Processing Agreement (DPA) for your use of Nitaris, contact us and we will provide one.

9. Exercising your rights

To exercise any of these rights, or to request a DPA, email hello@nitaris.com. Nitaris is operated by Vinayak Gaur, a sole proprietor based in India.

GDPR & Data Processing — Nitaris