How we handle
your data.
The short version: Naked Compound collects your email address if you choose to subscribe to our newsletter or contact us. We use Google Analytics to understand how the site is used. We earn affiliate commissions through links to Amazon.in — clicking those links does not share any personal information with us. We do not sell your data, show you ads from advertisers, or share your information with anyone beyond the service providers listed in this policy. Your rights under India's DPDP Act 2023 and (where applicable) the GDPR are explained in full below.
1. Who we are
Naked Compound ("we," "us," or "our") operates the website nakedcompound.in — an independent editorial platform covering health supplements, nutrition, and beauty products for an Indian audience. We are based in India.
Under India's Digital Personal Data Protection (DPDP) Act 2023, we are a Data Fiduciary — the entity that determines the purpose and means of processing your personal data. You, the individual whose data we process, are the Data Principal.
For visitors from the European Economic Area (EEA) or the United Kingdom, we are the Data Controller under the GDPR/UK GDPR.
For questions about this policy or to exercise your rights, contact us at naked.business@yahoo.com.
2. What data we collect
Data you give us directly
| Data | When & why | Required? |
|---|---|---|
| Email address | When you subscribe to the Naked Compound newsletter. Used to send editorial update emails only. | Required to subscribe. Entirely optional. |
| Name | Optionally provided via the contact form. Used only to address a reply. | Optional. |
| Message contents | When you contact us via the contact form or by email. | Required to receive a response. |
| Article feedback & error reports | When you answer "Was this useful?" or use "Report an error" at the end of an article. We store the page, your answer or report, and an email address only if you add one for a reply. We do not store your IP address; a one-way code made from it, which changes every day, is used only to stop spam. | Optional. The email field is optional. |
Data collected automatically
When you visit any page on nakedcompound.in, the following data is collected automatically through your browser and our analytics tools:
- IP address — used by our hosting provider for security and geolocation (country-level only in analytics).
- Browser type and version
- Operating system
- Referring URL — the page you arrived from
- Pages visited and time spent
- Device type (desktop, mobile, tablet)
This data is collected by Google Analytics in aggregated, pseudonymised form. We cannot identify you personally from this data alone.
What we do not collect: We do not collect payment information, health records, government IDs, passwords, or any data classified as "sensitive personal data" under the DPDP Act 2023 (financial data, health data, biometric data, caste, religious belief, or sexual orientation). We have no user account system.
3. How we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Sending the Naked Compound newsletter | Email address | Consent (you opted in) |
| Responding to contact-form messages or emails | Name, email address, message contents | Consent / legitimate interest |
| Checking and correcting articles readers flag, and seeing which articles readers find useful | Article feedback, error reports, optional email address | Consent (you chose to send it) |
| Understanding how the site is used (analytics) | Aggregated usage data via Google Analytics | Legitimate interest (site improvement) |
| Maintaining site security and preventing abuse | IP address, server logs | Legitimate interest |
| Complying with applicable legal obligations | Any data required by law | Legal obligation |
We do not use your data for automated decision-making or profiling. We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.
4. Legal basis for processing
Under both the DPDP Act 2023 and the GDPR, we process personal data only where a lawful basis exists:
- Consent: You have given clear, specific, and informed consent — for example, by subscribing to our newsletter. You may withdraw consent at any time without penalty (see Your rights).
- Legitimate interests: We have a legitimate interest in understanding how our site is used and in maintaining its security. These interests are weighed against your rights and we process only the minimum data necessary.
- Legal obligation: Where we are required by Indian or applicable international law to process or retain data.
We do not process any special category data (as defined under GDPR Art. 9) or sensitive personal data (as defined under DPDP Act 2023).
5. Third parties we use
We share data only with the service providers listed below, and only to the extent necessary to operate the site.
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Google Analytics (Google Ireland Ltd / Google LLC) |
Site usage analytics. Helps us understand which content is useful. | Pseudonymised usage data, IP address (truncated by Google before storage). | policies.google.com/privacy |
| Newsletter provider (e.g. Mailchimp / ConvertKit — update as applicable) |
Sending editorial newsletter emails. | Email address, first name if provided. | See provider's policy. |
| Web host / CDN (Cloudflare / hosting provider — update as applicable) |
Serving the site, DDoS protection, performance. | IP address, HTTP request logs. | cloudflare.com/privacypolicy |
| Google Translate (Google LLC) |
Machine translation, only if you choose a language other than English in the footer. | The text of the page you're reading, and your IP address. On our free tools, your results stay in English and are not sent. | policies.google.com/privacy |
| Neon (Neon, LLC — database, AWS US East) |
Storing article feedback and error reports. | The page, your answer or report, and an email address if you add one. | neon.com/privacy-policy |
We do not use advertising networks, retargeting pixels, social media tracking widgets, or any other tracking technology beyond Google Analytics. No advertiser or brand has access to any data collected through this website.
International data transfers
Google Analytics and newsletter providers may process data outside India. Where this occurs, we rely on the contractual mechanisms approved for cross-border data transfers under the DPDP Act 2023 and, for EEA data, Standard Contractual Clauses (SCCs) as approved by the European Commission.
6. Affiliate links
Clicking an affiliate link does not share your personal data with Naked Compound. When you follow a link to Amazon.in marked with tag=nakedcompound-21 or using a link.amazon/… short link, Amazon records that the referral came from Naked Compound's affiliate account and may pay us a commission if you make a purchase. This is governed by Amazon's own Privacy Notice, not ours.
We are a participant in the Amazon Associates India programme. Affiliate commission does not influence our editorial recommendations, scores, or rankings. Our affiliate policy is published at nakedcompound.in/pages/conflicts-policy.
No health, purchase, or personal data about you passes from Amazon to Naked Compound as a result of using affiliate links.
7. Cookies & tracking technologies
We use a small number of cookies. You can manage or block cookies through your browser settings without losing access to any content on this site.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Distinguishes unique visitors for analytics. No personally identifiable information is stored. | 2 years |
| _gid | Google Analytics | Distinguishes users within a session. | 24 hours |
| googtrans | nakedcompound.in / Google Translate | Remembers the language you picked in the footer. Only set if you choose a language other than English. | 1 year, or until you switch back to English |
| Theme preference | nakedcompound.in | Remembers whether you have set dark mode. Stored in localStorage only. | Persistent (local only) |
We do not set advertising cookies, social-sharing cookies, or fingerprinting scripts. We do not use cross-site tracking.
Google Analytics IP anonymisation
We have enabled IP anonymisation in Google Analytics. This means your IP address is truncated before being stored by Google — we never have access to your full IP address through analytics. You may opt out of Google Analytics tracking entirely at tools.google.com/dlpage/gaoptout.
8. How long we keep your data
| Data | Retention period | Reason |
|---|---|---|
| Newsletter email address | Until you unsubscribe | Required to send emails. Deleted within 30 days of unsubscription. |
| Contact form / email messages | Up to 2 years | To maintain a record of correspondence and respond to follow-up questions. |
| Article error reports | Up to 2 years | To check the report, fix the article and keep a record of the correction. Ask us and we delete your report or email sooner. |
| "Was this useful?" answers | Up to 2 years | To see which articles need work. Stored without your name, email or IP address, only the daily-changing anti-spam code. |
| Analytics data (Google) | 14 months (our setting in GA) | Understanding long-term traffic trends. Anonymised; cannot be traced to an individual. |
| Server access logs | 90 days | Security monitoring and abuse prevention. |
When the retention period ends or when you request deletion, we delete or anonymise the data unless a legal obligation requires us to retain it for longer.
9. Security
We take reasonable technical and organisational measures to protect the data we hold, including:
- HTTPS (TLS) encryption on all pages of this site
- Access controls limiting who can view subscriber or contact data
- Using reputable, SOC 2-certified service providers for newsletter and analytics
No system is perfectly secure. While we do our best to protect your data, no electronic transmission over the internet can be guaranteed 100% secure. If you believe your data has been compromised as a result of an interaction with Naked Compound, please email naked.business@yahoo.com immediately.
10. Your rights
Depending on where you are located, you have the following rights regarding your personal data. To exercise any of them, email us at naked.business@yahoo.com with the subject line "Data Rights Request." We will respond within 30 days.
Right to access
Request a copy of the personal data we hold about you.
Right to correction
Ask us to correct inaccurate or incomplete data about you.
Right to erasure
Ask us to delete your personal data. We will do so unless a legal obligation requires us to retain it.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time. Unsubscribe links are included in every newsletter email.
Right to object
Object to processing based on legitimate interests. We will stop unless we have compelling grounds to continue.
Right to portability
Receive your data in a machine-readable format where technically feasible.
Right to nominate (DPDP)
Under the DPDP Act 2023, you may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.
Right to complain
You may lodge a complaint with the Data Protection Board of India (DPDP Act) or the relevant supervisory authority in your jurisdiction (GDPR).
11. India: DPDP Act 2023
The Digital Personal Data Protection Act 2023 ("DPDP Act") is India's primary personal data protection law. This section explains how we comply with its requirements.
Consent notice
Under the DPDP Act, we are required to provide a clear consent notice before collecting your personal data. By subscribing to our newsletter or submitting the contact form, you are providing free, specific, informed, and unambiguous consent to the processing described in this policy. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Data Fiduciary obligations
As a Data Fiduciary, we commit to:
- Collecting only the data necessary for the stated purpose (data minimisation)
- Not retaining data beyond the period necessary for the stated purpose
- Implementing reasonable security safeguards
- Notifying you and the Data Protection Board of India in the event of a personal data breach that is likely to affect your interests
- Establishing a Grievance Redressal Mechanism (see Contact & grievances)
Children's data (DPDP Act)
We do not knowingly collect personal data from children below the age of 18. If we become aware that a child has provided data without verifiable parental consent, we will delete it promptly. Our site does not offer services directed at children. (See also Section 13.)
Cross-border transfers
We may transfer personal data to countries outside India through our use of Google Analytics and our newsletter provider. We ensure that any such transfer is subject to adequate safeguards as required under the DPDP Act and any applicable rules notified by the Indian Government.
Grievance redressal (DPDP Act)
Under the DPDP Act, you have the right to have your grievance addressed by us before approaching the Data Protection Board of India. To raise a grievance, contact us at naked.business@yahoo.com with the subject line "DPDP Grievance." We will acknowledge your grievance within 48 hours and resolve it within 30 days.
If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India at dpb.gov.in.
12. EEA / UK: GDPR
If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR) applies to your data. The following additional information is relevant to you.
Data Controller
Naked Compound is the Data Controller for personal data collected from EEA/UK visitors. Contact: naked.business@yahoo.com.
Legal bases under GDPR
- Article 6(1)(a) — Consent: Newsletter subscription and contact form submissions.
- Article 6(1)(f) — Legitimate interests: Site analytics and security. Our legitimate interest: improving the site and protecting it from abuse. Your interests are protected by IP anonymisation and the use of aggregated analytics only.
Your GDPR rights
In addition to the rights listed in Section 10, you have the right to lodge a complaint with your national data protection authority. In the EU, find your authority at edpb.europa.eu. In the UK, contact the ICO.
International transfers (GDPR)
Google LLC is an international data transfer recipient. Google is certified under the EU-US Data Privacy Framework and provides Standard Contractual Clauses (SCCs) for data transfers from the EEA. See Google's transfer documentation.
13. Children's privacy
This site is not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at naked.business@yahoo.com and we will promptly delete the data.
Under the DPDP Act 2023, we are required to obtain verifiable parental consent before processing the personal data of any child. We do not have the infrastructure to verify age or obtain parental consent, and therefore our services are available to adults only. If we discover that a minor has subscribed, we will delete the data and the subscription.
14. Changes to this policy
We review this policy at least once a year and whenever there is a material change to how we process data. When we make significant changes, we will:
- Update the "Last updated" date at the top of this page
- If you are a newsletter subscriber and the change affects you materially, notify you by email before the change takes effect
Continuing to use the site after a policy update constitutes acceptance of the updated policy.
Previous versions of this policy are available on request by emailing naked.business@yahoo.com.
15. Contact & grievances
For all privacy-related questions, data rights requests, or DPDP grievances, contact us here:
Naked Compound
Email: naked.business@yahoo.com
Subject line for rights requests: "Data Rights Request"
Subject line for DPDP grievances: "DPDP Grievance"
Website: nakedcompound.in
Country: India
We will acknowledge all requests within 48 hours and respond in full within 30 days. For unresolved grievances under the DPDP Act 2023, you may contact the Data Protection Board of India at dpb.gov.in. For EEA/UK complaints under GDPR, contact your local supervisory authority.