![Six beauty products from earlier Nykaa price reads - a mascara, an Exagger-Eyes mascara, a Morphe blush duo, a kohl pencil, a SUGAR eyeliner and a MARS lipstick - in their own product photographs on a yellow colour-blocked banner]()
Nykaa publishes its privacy policy at nykaa.com/privacy-policy, stamped "Last updated: 29th Jan, 2026. Version: 1.4" and naming NYKAA E-RETAIL LIMITED as the company that holds your data. We read it on 2 November 2026.
It is franker than most of its peers. It names the analytics firms that receive your app data, lists card number and bank name among the fields it stores, describes exactly what SkinScan keeps — and states in a section of its own that if your browser sends a Do Not Track signal, Nykaa's sites do not respond to it.
📅 Update log:
2 Nov 2026: first published. Every clause described and quoted on this page was read from Nykaa's own published privacy policy at nykaa.com/privacy-policy on 2 November 2026, from India, with nothing bought. The document carries Nykaa's own stamp, "Last updated: 29th Jan, 2026. Version: 1.4", which is reproduced here rather than replaced with our reading date. The page's HTML title reads "Privacy Policy Demo | Nykaa"; its canonical link, version number, registered-office address and named grievance officer all point to it being the operative document, and the oddity is flagged on the page rather than omitted.
Nykaa publishes its privacy policy at nykaa.com/privacy-policy. The document is headed "Nykaa Beauty Privacy Policy", names NYKAA E-RETAIL LIMITED as the company holding your data, and carries its own stamp: "Last updated: 29th Jan, 2026. Version: 1.4". We read it on 2 November 2026.
It is more candid than most. It names the analytics companies that get your app data. It states exactly what card fields it stores. And in a headed section of its own, it says that if your browser sends a "Do Not Track" signal, Nykaa ignores it.
This is a plain-English reading of a published policy, not legal advice. Every clause described below is quoted in Nykaa's own words so you can check it against the document, and this is not a complete summary — read the live policy before relying on anything here. One oddity worth flagging: the page's browser title reads "Privacy Policy Demo | Nykaa". Its canonical link points at nykaa.com/privacy-policy, and it carries a version number, a registered-office address and a named grievance officer, so we have treated it as the operative document — but we would rather tell you about the word "Demo" than leave you to find it.
The policy at a glance
| What the policy covers | What it says |
|---|
| Document read | Nykaa Beauty Privacy Policy, nykaa.com/privacy-policy |
| The policy's own stamp | Last updated: 29th Jan, 2026 — Version 1.4 |
| Read on | 2 November 2026, plain fetch, from India |
| Who holds the data | NYKAA E-RETAIL LIMITED, 104 Vasan Udyog Bhavan, Lower Parel, Mumbai 400013 |
| Do Not Track | Ignored — "not currently set up to respond to those signals" |
| Cookies for users in India | Strictly necessary, functional and performance |
| Cookies for international users | "Only strictly necessary data" |
| Card data collected | Transaction amount, Bank Name, Card Type, Card number |
| Skin data collected | Skin rating and skin type via SkinScan; "Picture including skin type" |
| Is the skin image shared? | Nykaa states "No PII including your image is shared with any Third Parties" |
| Analytics SDKs named | Clevertap, Appsflyer, Crashlytics, Gamooga |
| Payment SDKs named | PayU, Razorpay, Cashfree |
| Login SDKs named | Google, Facebook |
| Data taken from elsewhere | Publicly available databases, marketing partners, payment gateways, and "open data and public records" |
| Cross-border transfer | Permitted; countries may have "potentially less stringent" confidentiality laws |
| Stated retention period | None given — "as long as it is required" |
| Your rights | Access, correction and account plus data deletion under the DPDPA 2023, via privacy@nykaa.com |
| Grievance officer | Mr. Pratiek Varma, Senior Manager – Customer Experience, grievanceofficercs@nykaa.com |
| Minimum age | Adults only — minors should not register or buy |
Nykaa says plainly that it ignores Do Not Track
Most retail privacy policies either skip this or bury it. Nykaa gives it a heading. In full: "Some web browsers have a ‘Do Not Track’ feature. This feature lets you tell websites you visit that you do not want to have your online activity tracked. These features are not yet uniform across browsers. Our sites are not currently set up to respond to those signals."
Do Not Track is not legally binding in India and ignoring it is both lawful and extremely common — what is less common is saying so in a clearly headed section rather than omitting it. The practical point for a shopper is simple: if you have switched that setting on in your browser and assumed it does something on Nykaa, it does not.
There is a second geography clause alongside it that is easy to miss. "If you are an international user accessing our Platform, we only collect strictly necessary data for the functioning of our Platform." Functional and performance cookies, in other words, are served to users in India and not to users abroad.
| Cookie type | What Nykaa says it does | Served to | Notes |
|---|
| Strictly necessary | Run the site, keep a logged-in session secure, meet regulatory obligations | Yes — everyone | Disabling may make parts of the site inaccessible |
| Functional | Remember your user ID, region or country, language, accessibility options | Users in India | International users: not collected |
| Performance | Measure how customers use the site, combined and studied to improve services | Users in India | International users: not collected |
| Other trackers | Pixel tags, log files, clickstream analytics | Listed in the policy | No opt-out mechanism described |
| Do Not Track browser signal | Tells sites you do not want to be tracked | Not honoured | "Our sites are not currently set up to respond to those signals" |
It names the companies that get your app data
This is the most useful disclosure in the document and very few Indian retail policies match it. Nykaa states that its app "contains third party SDKs that collect personally identifiable information (PII)", sorts them into three groups, and names the vendors in each.
The analytics purpose list is quoted verbatim in the table below, including the two phrases worth noticing: "better target users" and "collect and combine behavioral and contextual data to build user personas". Nykaa adds that it has "put in place appropriate contracts and personal data protection obligations on the third-parties engaged by us".
| SDK type | Vendors Nykaa names | What the policy says they do |
|---|
| Analytics | Clevertap, Appsflyer, Crashlytics, Gamooga | Analyse app visitors, resolve errors, "better target users", push notifications and digital ads, and "collect and combine behavioral and contextual data to build user personas" |
| Payment | PayU, Razorpay, Cashfree | Complete payment transactions |
| Login | Google, Facebook | Help users sign in to Nykaa |
Naming your processors is a good thing, not a bad one. A policy that lists Clevertap, Appsflyer, PayU and Razorpay by name is telling you more than one that says "trusted partners", and nothing on this page suggests otherwise. It is reproduced here because it lets you actually go and read those companies' own policies — which, as Nykaa notes, "have separate and independent privacy policies".
What it collects: your card fields, your skin, and things you never gave it
The card list is unusually specific. Under "Demographic & Identity Data", Nykaa lists "Transaction amount, Bank Name, Card Type, Card number", alongside name, email, phone, shipping address, country, date of birth and "Picture including skin type".
The SkinScan feature gets its own clause: when you use it, Nykaa "will collect, calculate and store your skin analysis results with the help of third-parties, which include your skin rating and skin type", and uses them "to personalize product recommendations and promotions". The policy then states the limit on that in terms: "No PII including your image is shared with any Third Parties." Both halves matter, and both are quoted here.
The policy is also explicit that not all of your data comes from you. It lists "Open data and public records such as information about YOU that is openly available on the internet" as a category it collects, and says it receives information "from other sources, including publicly available databases, marketing partners, and other third parties incl. Payment Gateways" — used to "correct and update our records" and "verify information you've provided".
Who your data can be disclosed to, and where it can go
The policy lists the recipients directly:
- Group companies, subcontractors, agents and service providers who "may have access to your personal data however may not use it for other purposes".
- Law enforcement, government authorities, courts, regulators, auditors and any party appointed by a regulator to investigate or audit Nykaa.
- Overseas regulators.
- Anyone you instruct Nykaa to share it with.
One of the stated reasons for disclosure is simply that Nykaa or the recipient "have a legitimate business reason for doing so", and another is that they "want to send you information and promotional material regarding our products and services".
On cross-border transfers the policy is unusually frank. Your data "may be transferred to other countries outside your residential country", and "you understand and accept that these countries may have differing (and potentially less stringent) laws relating to the degree of confidentiality afforded to the information it holds", including that it "can become subject to the laws and disclosure requirements of such countries". Nykaa says it will "use best endeavors to put in place appropriate controls and safeguards".
On retention, no period is given. Nykaa keeps data "for as long as it is required for the purposes set out in this Privacy Policy and for legal or regulatory reasons", and will "take reasonable steps to delete or permanently de-identify Personal Information that is no longer needed". There is no number of months or years anywhere in the document.
Your rights, and the one procedural catch
Nykaa points at the Digital Personal Data Protection Act 2023 and confirms the right that matters most: "as enshrined by the DPDPA'23 you as a customer can also opt to get your account and associated data deleted". Access and correction are covered too. The route for all of them is one email address: privacy@nykaa.com.
Complaints go somewhere else. The grievance officer named under the Information Technology Act 2000 is Mr. Pratiek Varma, Senior Manager – Customer Experience, at grievanceofficercs@nykaa.com, at the Lower Parel address. General support is support@nykaa.com or 1800-267-88888, 8 AM to 10 PM, every day.
The catch is procedural and worth knowing before you escalate. Nykaa "reserves the right to divert the e-mails to support@nykaa.com in event customers have directly written to grievanceofficercs@nykaa.com without exhausting the Grievance Redressal communication Procedure mentioned above". In other words: go to the grievance officer first and your complaint can be sent back down to ordinary support. Use the normal channels, keep the complaint number Nykaa says it issues, and escalate with that in hand.
Nykaa also states it will never ask you for an OTP, CVV, PIN, card number or bank account details, and that it "never call users/customers with offers, discounts on products and offering free gifts". Anyone phoning you claiming to be Nykaa with an offer is, by Nykaa's own account, not Nykaa. The policy adds that Nykaa "shall not be liable" for losses where a customer has shared such details with fraudsters.
What to do with this
- Do not rely on your browser's Do Not Track setting here. Nykaa says in terms that its sites are not set up to respond to it.
- If you have used SkinScan, know what is stored: your skin rating and skin type, calculated with third-party help, used for recommendations and promotions. Nykaa states your image is not shared with third parties.
- To delete your account and data, email privacy@nykaa.com and cite the DPDPA 2023 — the policy names that right explicitly.
- Escalate in order. Contact support first and get a complaint number; emailing the grievance officer before exhausting that can get your mail routed straight back to support.
- Expect no retention deadline. The policy sets no period, so deletion is something you have to ask for rather than wait for.
- Read the SDK vendors' own policies if that matters to you — Nykaa names them precisely so that you can.
Frequently Asked Questions
Does Nykaa respect Do Not Track?
No, and it says so itself. The policy's Do Not Track section reads: "Some web browsers have a ‘Do Not Track’ feature... Our sites are not currently set up to respond to those signals." Do Not Track is not legally binding in India and ignoring it is both lawful and very common — stating it in a clearly headed section, rather than omitting it, is the unusual part. There is a related geography clause: "If you are an international user accessing our Platform, we only collect strictly necessary data", so functional and performance cookies are served to users in India and not to users abroad.
What data does Nykaa's SkinScan collect?
The policy is specific. When you use SkinScan, Nykaa "will collect, calculate and store your skin analysis results with the help of third-parties, which include your skin rating and skin type", and uses those results "to personalize product recommendations and promotions". Separately, "Picture including skin type" appears in its list of demographic and identity data. The policy also states a limit on this in terms: "No PII including your image is shared with any Third Parties." Both the collection and the stated limit are Nykaa's own wording.
Which third parties does Nykaa share app data with?
Nykaa names them, which most Indian retail policies do not. It says its app "contains third party SDKs that collect personally identifiable information (PII)" and lists three types: analytics — Clevertap, Appsflyer, Crashlytics and Gamooga; payment — PayU, Razorpay and Cashfree; login — Google and Facebook. The stated analytics purposes include to "better target users" and to "collect and combine behavioral and contextual data to build user personas". Nykaa says it has contracts and data protection obligations in place with them, and notes they have their own separate privacy policies.
How do I delete my Nykaa account and data?
Email privacy@nykaa.com. The policy states that "as enshrined by the DPDPA'23 you as a customer can also opt to get your account and associated data deleted", alongside rights of access and correction, and gives that one address as the route for all of them. Worth knowing: the policy sets no retention period at all — it keeps data "for as long as it is required" and will "take reasonable steps" to delete what is no longer needed, with no number of months or years stated. Deletion is something you have to ask for.
Who is Nykaa's grievance officer and how do I escalate a complaint?
Mr. Pratiek Varma, Senior Manager – Customer Experience, at grievanceofficercs@nykaa.com, named under the Information Technology Act 2000, at 104 Vasan Udyog Bhavan, Senapati Bapat Marg, Lower Parel, Mumbai 400013. But go through normal support first. Nykaa "reserves the right to divert the e-mails to support@nykaa.com in event customers have directly written to grievanceofficercs@nykaa.com without exhausting the Grievance Redressal communication Procedure". Contact support@nykaa.com or 1800-267-88888 (8 AM to 10 PM daily), get the complaint number Nykaa says it issues, and escalate with that.
Prices & codes last verified: November 2, 2026
Every clause described, paraphrased or quoted on this page was read from Nykaa's own published privacy policy at nykaa.com/privacy-policy on 2 November 2026, from India, with nothing bought. The document carries Nykaa's own stamp, "Last updated: 29th Jan, 2026. Version: 1.4", which is reproduced here rather than replaced with our reading date. The page's HTML browser title reads "Privacy Policy Demo | Nykaa". We have treated it as the operative policy because its canonical link points to that same URL and it carries a version number, a registered-office address and a named grievance officer — but we disclose the word rather than conceal it, and a reader who needs certainty should confirm with Nykaa directly. This page is a plain-English reading of a policy document. It is not legal advice, it is not a complete summary, and it must not be relied on in place of the live policy, which Nykaa says it keeps "under regular review" and may change without notice. Sections on data security measures, links to other websites and definitions are not covered here. Nothing on this page alleges wrongdoing by Nykaa or by any company named. Ignoring Do Not Track signals is lawful in India, where the signal has no binding force, and is standard practice across the industry; collecting analytics data, transferring data across borders under safeguards, and engaging named processors are likewise ordinary and lawful practices, reported here as published fact. Where this page notes that Nykaa names its SDK vendors or states its Do Not Track position openly, that is recorded as more disclosure than most comparable policies give, not less. The named third parties — Clevertap, Appsflyer, Crashlytics, Gamooga, PayU, Razorpay, Cashfree, Google and Facebook — are listed because Nykaa lists them, and nothing here is a claim about any of their practices; as Nykaa notes, they have their own separate privacy policies. Names, email addresses and phone numbers quoted are those published in the policy on the date read and may change. Zoutons may earn a commission on purchases made through links on this page; this does not affect what is written above, and it did not influence which clauses were covered.
Booking com 
Hostinger 
Dell 
Udemy 
Agoda 
Nykaa 
Myntra 
Ajio