Privacy Policy

1. Identity of the data fiduciary

This Privacy Policy is issued under the Digital Personal Data Protection Act, 2023 (DPDPA 2023), read with the Information Technology Act, 2000 and the Consumer Protection Act, 2019, as applicable. The data fiduciary for personal data collected on this website is Vynza Pharmaceuticals Pvt. Ltd., a company incorporated under the laws of India. Registered office: Vynza Pharmaceuticals Pvt. Ltd., Plot No. 115, Phase 1, Industrial Area Phase 1, Panchkula, Haryana 134113. EX1 (Exact Nutrition) is a brand of Vynza Pharmaceuticals Pvt. Ltd.

2. Purpose of processing and lawful basis

Each processing activity below is tagged with its lawful basis under DPDPA 2023 (consent under Section 6, or legitimate use under Section 7).

• EX1 Updates signup, to send launch offers, product news, and evidence-based wellness tips. Lawful basis: explicit consent at the point of signup (Section 6).
• Placing and fulfilling a direct-store order (name, address, phone, email, order contents, payment status), to accept, process, ship, and support your order. Lawful basis: your voluntary provision of this data for this specified purpose (Section 7(a)), and legal obligation for tax/invoicing records (Section 7(d)).
• Account sign-in and management (email address, one-time code verification records, session identifiers, and a device identifier), to authenticate you, secure your account, and prevent fraud on it. Lawful basis: your voluntary provision of this data for this specified purpose (Section 7(a)).
• Referral program administration (which account referred which, IP address and device identifier at signup), solely to prevent abuse of the referral credit mechanic (for example, one person creating multiple accounts to refer themselves). Lawful basis: your voluntary provision of this data for this specified purpose (Section 7(a)).
• Customer support, to respond to enquiries sent to care@ex1nutrition.com. Lawful basis: your voluntary provision of this data for this specified purpose (Section 7(a)).
• Serving and securing the website itself. Your IP address reaches Cloudflare, our hosting and content-delivery provider, whenever you request a page, because a web request cannot be answered without one. Lawful basis: your voluntary provision of this data for this specified purpose, namely receiving the page you asked for (Section 7(a)). Cloudflare Web Analytics runs on top of this: it is cookieless, sets no identifier for you, and reports aggregate traffic figures only, so the measurement itself retains no personal data and engages no separate lawful basis.
• We use Google Analytics 4 and the Meta Pixel to understand site usage and measure advertising. You can opt out at any time via the Cookie Preferences link in the footer. When enforcement of DPDPA consent provisions commences, these will run on an opt-in consent basis.
• Legal and regulatory compliance, where retention or disclosure is required by Indian law, including tax and consumer-protection law. Lawful basis: legal obligation under DPDPA Section 7(d).

3. Categories of personal data collected

• Email address (and, for reservations, the optional product categories you select), when you subscribe to EX1 Updates.
• Email body content, name, and any details you voluntarily share when you email care@ex1nutrition.com.
• Order data: name, delivery address, phone number, email address, the items and amount of your order, and payment status, when you place a direct-store order. Card, UPI, and netbanking details are collected and held by our payment partner, Cashfree Payments, not by us.
• Account data: your email address, a hashed record of one-time sign-in codes (never the code itself once used), session identifiers, a first-party device identifier, and, if you choose to add them, your name, phone number, and saved addresses.
• Referral data: your own referral code, which account (if any) referred you, and the IP address and device identifier recorded at your account signup, used only for fraud prevention as described above.
• IP address, received by Cloudflare, our hosting and content-delivery provider, whenever you load a page, and used to route and secure that request. Cloudflare Web Analytics derives aggregate traffic figures from page loads without setting a cookie or storing an identifier for you.
• Usage data collected by Google Analytics 4: pages viewed, time on page, approximate location (city-level), device type, and browser type. Google Analytics 4 does not log or store individual IP addresses. They are used only to derive approximate location and are then discarded.
• Cookie-consent choices: your Analytics and Advertising choices, together with your IP address and browser user agent, recorded as the audit trail for your consent. Retained for 12 months.

We do not collect government identifiers or health condition data on this website. A purchase made on Amazon India follows Amazon's own privacy terms; we do not receive Amazon customer data beyond aggregate sales reports.

Children's data: EX1 products are formulated for adults and our marketing is directed at adults. Creating an account requires confirming you are 18 or older. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has provided us personal data, email care@ex1nutrition.com and we will delete it. Where DPDPA 2023 requires verifiable parental consent for any future processing of a minor's data, we will obtain that consent before processing.

Launch reservations. If you reserve a launch offer, we collect your email address and, optionally, the product categories you select. Reserving joins the unified EX1 Updates list. We process this to send your locked offer and EX1 Updates by email, on the lawful basis of your consent. We record your consent timestamp, IP address, user agent, and the version of the consent text you agreed to as the audit trail. You can withdraw consent at any time via the unsubscribe link in our emails or by writing to care@ex1nutrition.com; we retain the record until you withdraw.

4. Recipients and third-party processors

Personal data may be processed by the following third-party services that EX1 relies on for site infrastructure, order fulfilment, and communications:

• Cloudflare: content delivery network, Web Analytics, and our application database. Data may transit through Cloudflare's global edge, including the Singapore region for traffic from the Indian subcontinent; our order and account database is hosted in the Asia-Pacific region.
• Google Workspace: email handling for the care@ inbox.
• Amazon India: for product purchases made on Amazon. Amazon's own privacy policy governs transactions on their platform. EX1 does not receive your name, address, or payment data through Amazon beyond aggregate sales reports.
• Cashfree Payments: payment processing for direct-store orders. Cashfree receives your payment details directly and processes them under its own privacy policy and security standards; we receive only a payment status and reference, never your card or bank details.
• Shiprocket: courier and shipment tracking for direct-store orders. Shiprocket receives your name, delivery address, and phone number to arrange and track delivery. Additionally, if you verify your phone number at checkout, or to sign in to your EX1 account, and give consent, Shiprocket verifies that number, creates or uses an account for you on their own Checkout network, and EX1 receives saved delivery addresses associated with that phone number from that network (shared across the brands that use it), to help autofill your address. This is captured through an unticked consent checkbox at checkout or at phone sign-in, is entirely optional, and you may always enter your address manually or sign in with email instead.
• Resend: email delivery for EX1 Updates, order confirmations, shipping updates, and account sign-in codes. Data processed in the United States. See Resend's privacy policy.
• Anthropic: used at content-generation time only to draft EX1 Updates newsletter copy. Subscriber and customer personal data is not sent to Anthropic; only product and blog content from the site is included in prompts. See Anthropic's privacy policy.
• Cloudflare Turnstile: CAPTCHA challenge on the newsletter, reservation, and checkout forms to mitigate automated abuse. Processes IP and challenge-interaction signals at the moment of submission. See Cloudflare's privacy policy.
• Google Analytics 4: we use Google Analytics 4 to understand how visitors use ex1nutrition.com. It sets cookies and collects usage data such as pages viewed, time on page, approximate location, and device and browser type. Google Analytics 4 does not log or store individual IP addresses; they are used only to derive approximate location and are then discarded. Google processes this data on our behalf to provide aggregate, non-identifying analytics. We do not use it to identify you personally or to sell your data. You can opt out at any time via the "Cookie Preferences" link in the footer (Section 10), with the Google Analytics Opt-out Browser Add-on , or by managing cookies in your browser. When enforcement of DPDPA consent provisions commences, this will run on an opt-in consent basis. Data is processed in the United States. See Google's Privacy Policy. Our Google Analytics property is linked to a Google Ads account for conversion reporting. Personalised advertising features are disabled, so your data is not used to build advertising audiences through this link.
• Microsoft Clarity: session-replay analytics recording page interactions, scroll behaviour, and clicks, to help us understand how visitors use the site. Data is processed by Microsoft. You can opt out at any time via the "Cookie Preferences" link in the footer (Section 10), or by clearing cookies in your browser settings. When enforcement of DPDPA consent provisions commences, this will run on an opt-in consent basis. See Microsoft's Privacy Statement.
• Meta Platforms, Inc.: we use the Meta Pixel to measure how our advertising performs and to build retargeting audiences. It sets a cookie and shares pseudonymous browser and device data with Meta for this purpose. We do not enable Meta's Automatic Advanced Matching, so this does not include sending your email address or phone number to Meta. You can opt out at any time via the "Cookie Preferences" link in the footer (Section 10). When enforcement of DPDPA consent provisions commences, this will run on an opt-in consent basis. Data is processed in the United States. See Meta's Privacy Policy.

5. Retention periods

• Newsletter email addresses: retained until you unsubscribe via the link in every email or by emailing care@ex1nutrition.com. Unsubscribed records are retained for 30 days for audit purposes before deletion.
• Newsletter consent metadata (consent timestamp, IP address, and user agent recorded at signup): retained alongside the subscriber record for the same period as above.
• Orders and GST tax invoices: retained for the period required under applicable Indian tax law (currently up to eight years under the Income Tax Act, 1961 and the CGST Act, 2017), regardless of whether the account that placed the order is later deleted. See Section 7 for how this interacts with account deletion.
• Account sign-in code records: the six-digit code itself is stored only as a one-way hash, never in plain text. The row also carries the email address the code was sent to, so it can be matched to your sign-in attempt. These records are retained for no more than 30 days after the code expires or is used.
• Where an order is started but payment is not completed, the details entered (name, address, phone, email) are retained for up to 18 months, to support order recovery, customer service and fraud prevention, after which they are deleted or anonymised. This data is not used for marketing unless you separately subscribed to EX1 Updates.
• Account data (email, name, phone, saved addresses, device identifier): retained while your account is active, and for 48 hours after you request deletion (see Section 7), after which the account itself is anonymised.
• Email correspondence with care@: retained for 24 months from the date of last interaction.
• Cloudflare Web Analytics data: 90 days (Cloudflare default).

6. Your rights as a data principal under DPDPA 2023

Under the Digital Personal Data Protection Act, 2023 (DPDPA 2023), you have the following rights as a Data Principal:

• Right to access information about personal data (Section 11 of DPDPA 2023): obtain a summary of personal data being processed, the processing activities, and the identities of data fiduciaries and processors with whom your data is shared. If you have an EX1 account, you can also request a machine-readable export of your own account data from your account page.
• Right to correction and erasure (Section 12): request correction of inaccurate or incomplete personal data, or erasure of personal data that is no longer necessary for the purpose for which it was processed, subject to legal retention requirements (see Section 7).
• Right of grievance redressal (Section 13): file a complaint with the Grievance Officer named in Section 8 below. The Grievance Officer is required to respond within the period prescribed by DPDPA 2023.
• Right to nominate (Section 14): nominate any other individual who shall, in the event of your death or incapacity, exercise these rights on your behalf. If you hold an EX1 account, a nominee-details field is available on request while we complete the in-product flow for it.
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time by emailing care@ex1nutrition.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email care@ex1nutrition.com with the subject line "DPDPA Request" and a description of the right you wish to exercise. We respond within 30 days of receipt.

7. Account deletion: what is retained, and why

Deleting your EX1 account is a two-stage process. When you request deletion, your account is signed out on every device immediately, and we send you a confirmation email. Your account data (name, phone, saved addresses, and other account-only records) is permanently anonymised 48 hours after your request, unless you write to care@ex1nutrition.com within that window to cancel the request.

What is NOT deleted, and why.Your past orders and their GST tax invoices are kept on file even after your account is deleted. This is not an oversight: each order and invoice already carries its own independent snapshot of the buyer's name, address, and order details, taken at the moment of purchase, and Indian tax law (the Income Tax Act, 1961 and the CGST Act, 2017) requires us to retain sale and invoicing records for a fixed period regardless of whether a customer's account still exists. This is a legal-obligation basis for retention under DPDPA Section 7(d), separate from and unaffected by your consent withdrawal or account deletion. Retaining an order record after account deletion does not give the deleted account any renewed access; the record can no longer be viewed through the (now-deleted) account and exists solely for our own compliance and support purposes.

We also retain a minimal record (your email address, not any other account detail) in an internal list of deleted accounts, solely so the referral program cannot be abused by deleting and recreating an account to claim a referral credit twice.

8. Grievance Officer

As required under Section 13 of DPDPA 2023, EX1 has designated a Grievance Officer for the resolution of any complaint relating to personal data processing.

• Name: Ayush Goyal
• Designation: Grievance Officer
• Email: care@ex1nutrition.com (subject line: "Grievance")
• Response SLA: 30 days from receipt of grievance, per the timeline prescribed by DPDPA 2023

If your grievance is not resolved within the SLA, you may escalate to the Data Protection Board of India, constituted under DPDPA 2023.

A complaint about an ORDER, a product, or a direct-store purchase (rather than about personal data) is handled under a separate statutory timeline; see our Consumer Grievance Officer page.

9. Cross-border data transfer

Because Cloudflare operates a global edge network, IP address and request metadata may transit through Cloudflare data centres outside India, including but not limited to Singapore. This transfer is incidental to content delivery, not a deliberate export of personal data. Google Analytics 4 usage data, Meta Pixel data (where you consent to advertising cookies), and Resend email delivery are processed in the United States. We do not otherwise store personal data outside India; order, account, and referral data are stored in Cloudflare's Asia-Pacific region.

10. Cookies and similar technologies

We use Google Analytics 4, Microsoft Clarity, and the Meta Pixel to understand site usage and measure advertising. You can opt out of Analytics and Advertising at any time using the "Cookie Preferences" link in the footer of every page, which opens a panel with two separate choices; an opt-out you make there is honoured immediately. When enforcement of DPDPA consent provisions commences, we will ask for your consent before any analytics or advertising cookie is set, with neither category loading until you say yes to it.

Strictly necessary (no consent required, cannot be disabled)

• Consent-preference cookie: a first-party cookie that remembers your Analytics and Advertising choices, so we do not ask again on every visit. Contains no personal data, only your two yes/no choices and the version of this notice you agreed to.
• Account session cookie: a first-party, secure, encrypted cookie that keeps you signed in to your EX1 account. Strictly necessary for account features; not used for advertising.
• Checkout phone-verification cookie: a first-party, secure, encrypted cookie set only if you choose to verify your phone number at checkout (via Shiprocket's Checkout Login service). It proves that verification within the current checkout session, so we can offer cash on delivery and, if you consent, autofill a saved address. It expires within 20 minutes if you do not complete verification, or within 1 hour of completing it, whichever comes first; not used for advertising.
• Referral-link cookie: a first-party cookie that remembers a referral code from a link you followed, so credit can be attributed correctly if you later create an account. Contains no personal data, only a code, and expires after 30 days.
• Cloudflare Web Analytics: first-party, cookieless beacon. It sets no cookie and stores no identifier for you, and reports aggregate traffic figures only, so it is not gated by the consent banner.

Analytics (set unless you opt out)

• Google Analytics 4: sets cookies (_ga, _ga_*) to distinguish visitors and measure usage. Google Analytics 4 does not log or store individual IP addresses. You can withdraw consent via the "Cookie Preferences" link, the Google Analytics Opt-out Browser Add-on, or by clearing cookies in your browser settings.
• Microsoft Clarity: sets cookies (_clck, _clsk) to record session replay data, page interactions, scroll behaviour, and clicks. You can withdraw consent via the "Cookie Preferences" link, or by clearing cookies in your browser settings.

Advertising (set unless you opt out)

• Meta Pixel: sets a cookie (_fbp) to help us measure advertising performance and build retargeting audiences on Meta's platforms. You can withdraw consent via the "Cookie Preferences" link at any time.

11. Policy updates

We review this Privacy Policy at least once every six months and update it when our data practices materially change. The Last reviewed date at the top of this page reflects the most recent review. Material changes are communicated to newsletter subscribers and account holders ahead of taking effect.

12. Data breach notification

In the event of a personal data breach, EX1 will notify the Data Protection Board of India and each affected Data Principal in the manner and within the timelines prescribed under Section 8(6) of DPDPA 2023. We will provide a description of the breach, the categories and approximate number of Data Principals affected, the likely consequences, and the measures taken or proposed to mitigate the effect.

13. Security

We implement reasonable security safeguards proportionate to the volume and sensitivity of personal data we process, including transport-layer encryption (HTTPS) for all data in transit, encrypted session tokens, access controls on internal systems, and vendor selection that prioritises providers with established security certifications. No system is fully secure, and we make no warranty that breaches cannot occur.

If you sign in with a phone number, keep it up to date in your account. Telecom providers can reassign a number after a period of inactivity, so anyone who later holds your old number could use it to sign in. Update your number promptly if it changes.