What we collect, and the very short list of what we do with it.

This policy explains what personal data Nolani collects through nolani.in, why we collect it, how long we keep it, and what you can require us to do with it.

Nolani Apparel Private Limited is the Data Fiduciary for that data under the Digital Personal Data Protection Act, 2023. You are the Data Principal.

It applies to this website only. It does not cover any third-party site you reach from a link here.

We currently operate a waitlist, not a shop. There is no cart, no checkout and no payment on this site, so we do not collect or process payment details of any kind.

When you join the waitlist we collect: your first name; your last name, if you give it; your email address; your phone number, if you give it; the size you tell us you expect to take; the piece you were looking at when you signed up; and any message you choose to write.

Only your first name and your email address are required. Every other field is optional and the form works without them.

We do not collect any special category data. We do not ask for, and do not want, any government identifier.

To tell you when the first run is available, and to tell you nothing else.

To ask whether you would like to test fit, if the size you gave us is one we need on the fit council.

To decide how much of each size to cut. Size intent from the waitlist is the only production data we will have before launch, and it is aggregated for that purpose.

We will not use your data for any purpose beyond these three without asking you again. We do not sell it, rent it, or trade it, and we do not share it with advertisers or data brokers.

You give consent by ticking the box on the form. The box is never pre-ticked, and the form will not submit without it.

You may withdraw consent at any time by writing to grievance@nolani.in or by using the unsubscribe link in any email we send. Withdrawing is as easy as giving consent was — that is a requirement of the Act and it is also the right way to behave.

Withdrawing consent does not make anything we did beforehand unlawful, but it stops us processing your data from that point, and we will erase it unless we are required to keep it.

Access — you may ask for a summary of the personal data we hold about you and what we have done with it.

Correction and erasure — you may ask us to correct anything inaccurate, complete anything incomplete, or erase your data entirely.

Grievance redressal — you may raise a complaint with our Grievance Officer, whose details are below. If you are not satisfied, you may escalate to the Data Protection Board of India.

Nomination — you may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

We do not charge for any of this and we will not ask why.

Until the first run ships, plus twelve months — or until you ask us to erase it, whichever comes first.

If you withdraw consent we erase your record within 30 days, other than a one-way hash of your email address kept solely so that a suppression list works and we do not accidentally email you again.

Aggregate, non-identifying counts — how many people wanted a size L, for instance — may be kept indefinitely. Those cannot be traced back to a person.

Cloudflare, Inc. — hosting and the endpoint that receives the form. Data is stored on Cloudflare infrastructure.

Resend (Plus Five Five, Inc.) — sends the confirmation email and any launch email. They process your email address and name for that purpose only.

That is the complete list. Both are bound by contract to process your data only on our instructions, and neither is permitted to use it for their own purposes.

Some processing may occur outside India. Where it does, it is on the basis permitted under section 16 of the Act.

This site sets no cookies. There is no advertising pixel, no tracking script, no session cookie and no local storage used to identify you.

That is why you have not been shown a consent banner. There is nothing to consent to.

Our server keeps standard access logs — IP address, timestamp, page requested — for security and to keep the site up. Those are retained for 30 days and are not used to build a profile.

The site is served over HTTPS only. The waitlist endpoint is rate-limited and validates every field before it stores anything.

Access to the waitlist store is restricted to the people who need it to do the work described above.

No system is perfect. If we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board as required by the Act.

This site is not directed at children. We do not knowingly collect data from anyone under 18, and we do not undertake any tracking, behavioural monitoring or targeted advertising — of children or of anyone else.

If you believe a child has given us data, write to the Grievance Officer and we will erase it.

[Grievance Officer name — to be supplied], Grievance Officer

grievance@nolani.in

Acknowledged within 48 hours, resolved within 30 days.

Nolani Apparel Private Limited, [Registered address — to be supplied]

If we change this policy materially we will email everyone on the waitlist before the change takes effect, rather than quietly updating the date at the top.

Last updated: 23 August 2026.