Data fiduciary: Nittish Baboria (operating Finds), based in India.

Address: [Insert registered business or correspondence address in India]

General contact: nittishbaboria123@gmail.com

Grievance / privacy contact: Nittish Baboria — nittishbaboria123@gmail.com. You may use this contact to exercise your rights or raise a grievance under the DPDP Act. We will endeavour to respond within timelines prescribed under applicable rules.

Finds is a curated product-listing showcase with Amazon affiliate links. We do not sell products or process payments. When you tap a product, you leave our site and Amazon processes your data under its own policies.

There is no public user registration. Only pre-authorised administrators can sign in to manage listings and view internal analytics.

Visitors (public browsing)

• Identifiers: first-party pseudonymous visitor and session IDs stored in your browser (localStorage / sessionStorage) when you consent to analytics.
• Usage data: pages viewed, approximate active time on page, outbound affiliate link clicks, referrer URL, UTM campaign parameters, and parsed device/browser/OS from your User-Agent string.
• Network-derived data: IP address is hashed on our servers (one-way) for uniqueness metrics; we may receive coarse location (country, region, city) from our hosting or CDN edge headers (e.g. Cloudflare), not precise GPS.
• Local preferences: theme choice and cached product list / image URLs in browser storage for performance (see Cookie Policy).

Administrators

• Email address and account identifiers stored in our database.
• Security audit logs: sign-in/out events, timestamps, email, IP address, User-Agent, and related metadata for failed attempts.
• Session cookies issued by NextAuth for authenticated admin sessions.

We do not knowingly collect sensitive personal data (as defined under the DPDP Act) through this site, and we do not load third-party advertising or social tracking pixels on the public storefront.

• Analytics and improvement: understand aggregate traffic, click-through, and engagement — based on your consent (withdrawable at any time).
• Site functionality: display products, remember theme, cache listings — based on legitimate uses necessary to provide the service you request.
• Security and fraud prevention: admin authentication and audit logging — based on legitimate uses and compliance with applicable law.
• Affiliate attribution: Amazon handles purchases; we only record click events on our site when analytics consent is given.

Non-essential analytics runs only after you choose "Accept analytics" in our consent banner. You may choose "Essential only" to decline analytics while still using the site. You can change your choice at any time:

Loading privacy controls…

Consent is specific to the purposes described here and tied to consent version 2026-09-26. If we materially change processing, we will update this policy and may ask for renewed consent.

• Analytics session and event data: up to approximately 24 months, unless deleted earlier on request or when no longer needed.
• Security audit logs: up to approximately 24 months for accountability and incident investigation.
• Browser-stored IDs and preferences: until you clear site data or withdraw consent (we remove analytics IDs when you withdraw).
• Admin JWT session cookies expire per NextAuth configuration (typically until sign-out or expiry).

• Hosting / infrastructure: servers, database (PostgreSQL), and optional rate-limiting (e.g. Upstash Redis) under our control or contracted providers.
• Amazon: affiliate links; Amazon is an independent controller for activity on amazon.in / amazon.com.
• CDN / tunnel: e.g. Cloudflare for delivery and security headers — may process connection metadata according to their terms.

We do not sell your personal data.

Our primary operations and data fiduciary are in India. If infrastructure or subprocessors process data outside India, we will do so in accordance with the DPDP Act and applicable transfer rules (including permitted jurisdictions or appropriate safeguards as required at the time of transfer). Contact us for current transfer details relevant to your data.

Subject to the DPDP Act and applicable exceptions, you may have the right to:

• Obtain information about personal data we process about you.
• Request correction of inaccurate or misleading data.
• Request erasure when consent is withdrawn or processing is no longer necessary.
• Withdraw consent for consent-based processing (e.g. analytics).
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grieve to us and, if unresolved, to the Data Protection Board of India as provided by law.

To exercise rights, email nittishbaboria123@gmail.com with enough detail for us to verify your request. We may need to verify identity for administrator account requests.

Finds is not directed at children under 18. We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

We use administrative, technical, and organisational measures appropriate to the risk, including HTTPS, access controls for admin areas, password hashing, rate limiting on APIs, and hashed IP handling for analytics. No method of transmission or storage is completely secure.

We may update this policy from time to time. The "Last updated" date at the top will change. Continued use after notice may constitute acknowledgement where permitted by law; material changes to consent-based processing will be reflected in our consent flow.

Terms of Service · Cookie Policy