What they may do · DPDP §6(4)
What Nykaa does with your data
Nykaa shows you interest-based ads and pulls in extra 'third-party signals' about you from analytics and marketing partners to make that targeting sharper. If you have ever used SkinScan, it has also calculated and stored an analysis of your skin taken from your photo.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
Nykaa’s own policy says “We may share your personal data with select third parties, group companies for the below purposes including but not limited to:”
Our summary shares personal data with select third parties and group companies.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
Nykaa’s own policy says “We use your personal information to display interest-based ads for features, products, and services that might be of interest to you.”
Our summary uses personal information to display interest-based ads.
-
Follows you onto other websites and apps
Their tracking carries on after you leave, through pixels and SDKs embedded elsewhere.
What this costs you. You get recognised on sites that have nothing to do with them. Closing the app does not close the file.
Show me where they say that
Nykaa’s own policy says “We rely on Third Party analytics partners to gather a variety of first-party & Third Party Signals i.e. our End-User's, data signal(s) in order to source high-value personalized insights to enhance personalisation and targeted marketing.”
Our summary relies on third-party analytics partners for first- and third-party signals to sharpen personalisation and targeted marketing.
-
Processes your face or other biometrics
Face matching, liveness checks or similar.
What this costs you. You can change a leaked password in a minute. You cannot change your face. A biometric breach is permanent in a way nothing else is.
Show me where they say that
Nykaa’s own policy says “Nykaa SkinScan - When you use the SkinScan feature, we will collect, calculate and store your skin analysis results with the help of third-parties, which include your skin rating and skin type.”
Our summary the opt-in SkinScan feature collects, calculates and stores skin analysis results derived from your photo. Not face recognition — see the withdrawal note.
What the policy does not mention
These are uses Nykaa’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Keeps your records long-term
- Trains AI models on your content
Nykaa is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does Nykaa do with my personal data?
According to Nykaa's own privacy policy, read on 2026-08-12, it discloses 4 of the six uses we track: shares your data with partners, builds an advertising profile of you, follows you onto other websites and apps, processes your face or other biometrics.
Can I withdraw my consent from Nykaa?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does Nykaa track me for advertising?
Yes — Nykaa's published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one Nykaa declared in its own published privacy policy, which we
read on 2026-08-12. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy