Privacy Policy

Last Updated: 29 September 2026

Only Carat (“Only Carat,” “we,” “us,” or “our”) respects the privacy of Buyers, Suppliers, and other Users of the Only Carat Platform.

This Privacy Policy explains how we collect, use, share, store, and protect personal data when Users access or use:

onlycarat.ai — Buyer-facing website and marketplace;

ocai.in — Supplier-facing website and inventory management platform;

Only Carat Android and iOS Buyer applications; and

related Only Carat services and communications.

Together, these websites, applications, and related services are referred to as the “Platform.”

The Buyer Platform enables eligible Buyers to register, search and discover diamond inventory, view Supplier and product information, submit inquiries, and use other Buyer functionality provided by Only Carat.

The Supplier Platform enables eligible Suppliers to register, complete applicable business/KYC verification, create and manage Supplier profiles, upload and manage inventory, receive Buyer inquiries, and use other Supplier functionality provided by Only Carat.

This Privacy Policy applies to both Buyers and Suppliers unless a provision specifically applies to one category of User.

Platform Operator: DK INFOWAY, operating the Only Carat platform/brand.

1. Information We Collect

The information we collect depends on whether you are a Buyer or Supplier and the functionality you use.

A. Account and Contact Information

We may collect:

Personal or business name

Company/business name

Email address

Mobile and WhatsApp number

Business address

Country/location information

Login and account information

Account verification/status

Other information voluntarily provided by you

B. Google Registration and Login

Buyers and Suppliers may choose to register or sign in using their Google account.

When Google Sign-In is used, Only Carat may receive information made available by Google for authentication, such as name, email address, profile image where available, Google account identifier, and other basic information authorized by the User.

Only Carat does not receive the User's Google password.

Additional information may be required to complete an account, business profile, KYC, or Supplier verification.

C. Supplier KYC and Business Verification

Where applicable, we may collect:

Personal or Business Name

Business Registration Details

GST Details, where applicable

IEC (Import Export Code), where applicable

Business Documents

Business Address

Contact Information

Other reasonably required verification information

D. Supplier Profile and Inventory Information

Suppliers may provide company information, company logo, contact/location information, diamond inventory, stock or packet information, diamond specifications, certificate/report information where applicable, pricing, availability, images, videos, and other Listing information.

Information intended for a Supplier profile, store, or diamond Listing may be visible to Buyers.

E. Buyer Search and Activity Information

We may collect Buyer search and Platform activity, including search criteria, filters, date/time, result counts, repeat searches, Supplier or Listing interactions, inquiry activity, and other Platform interactions.

Search criteria may include Natural/Lab-Grown, Certified/Non-Certified, shape, carat/weight, color, clarity, cut, polish, symmetry, fluorescence, laboratory, price, size/measurement, location, and other available diamond parameters.

2. Grounds for Processing, Consent and How We Use Information

Only Carat processes personal data for lawful purposes and, where required by applicable law, based on User consent or another basis permitted by law, including certain legitimate uses.

Where processing is based on consent, Users may withdraw consent through functionality made available by Only Carat or by contacting us. Withdrawal does not affect processing lawfully carried out before withdrawal and may affect functionality that requires the relevant personal data.

Only Carat may process personal data to:

Create, authenticate, and manage accounts

Conduct KYC/business verification

Operate Buyer and Supplier functionality

Display Supplier profiles and inventory

Provide diamond search functionality

Facilitate Buyer-Supplier inquiries

Generate aggregated Market Intelligence

Manage Supplier subscriptions

Provide customer and technical support

Analyze and improve Platform performance

Maintain security and prevent fraud, spam, or misuse

Send account, security, service, subscription, and legal communications

Resolve complaints and disputes

Enforce our Terms & Conditions

Comply with applicable legal requirements

Where permitted by applicable law, Only Carat may also process personal data for certain legitimate uses or other lawful purposes.

3. Buyer Inquiries and Information Sharing

When a Buyer intentionally sends an inquiry or contacts a Supplier through available Platform functionality, Only Carat may share information reasonably necessary to facilitate the interaction, including:

Buyer name

Company/business name

Contact information

Relevant diamond or Listing information

Inquiry details

Other information intentionally included by the Buyer

Suppliers must use Buyer information for legitimate business purposes relating to the inquiry and in accordance with applicable law.

Buyer information must not be misused for fraud, spam, unauthorized disclosure, or other unlawful purposes.

4. Supplier Information

Supplier-specific functionality is primarily provided through ocai.in.

Only Carat may process Supplier information for account management, KYC/business verification, Supplier profile/store management, inventory management, displaying inventory to Buyers, facilitating inquiries, managing Supplier subscriptions, security, and marketplace administration.

Supplier profile and Listing information intended to be public may be displayed through onlycarat.ai, the Buyer mobile applications, and other Only Carat marketplace interfaces.

5. Shared Platform Processing

onlycarat.ai and ocai.in are parts of the same integrated Only Carat marketplace.

Information may be processed between the Buyer and Supplier Platforms where reasonably necessary to:

Operate the marketplace

Maintain User accounts

Display Supplier inventory to Buyers

Facilitate Buyer-Supplier interactions

Provide Platform functionality

Generate aggregated marketplace insights

Maintain security and prevent misuse

Provide support

Comply with applicable law

Use of separate Buyer and Supplier domains does not mean they operate as unrelated platforms for purposes of this Privacy Policy.

6. Buyer Search Data and Market Intelligence

Only Carat may analyze Buyer search activity together with marketplace inventory to understand demand and provide aggregated Market Intelligence.

This may include insights such as:

Most Searched Diamonds

Trending Buyer Demand

High Demand / Low Supply

Unfulfilled Search Demand

Market Opportunity Insights

Trending Categories

Where appropriate, Only Carat may aggregate, anonymize, deduplicate, or otherwise process search information before providing Supplier-facing analytics.

Supplier-facing Market Intelligence will generally not identify an individual Buyer merely because the Buyer searched for a particular diamond.

Buyer information may be shared with a Supplier when the Buyer intentionally sends an inquiry or chooses to contact that Supplier.

Market Intelligence reflects activity on Only Carat and does not represent complete market-wide sales data or guarantee future demand, sales, prices, profits, or other business results.

7. Technical Data, Google Analytics and Cookies

When Users access Only Carat, we may automatically collect limited technical and usage information, including:

IP address

Browser/device type

Operating system

Application version

Login/session information

Pages or screens viewed

Feature interactions

Date/time of activity

Error, crash, diagnostic, and security information

Only Carat uses Google Analytics to understand Platform usage, measure performance, and improve User experience.

The websites may also use cookies, local storage, session technologies, and similar technologies for authentication, security, preferences, analytics, and Platform operation.

Where required by applicable law, appropriate consent or choices will be provided for applicable cookies or similar technologies.

8. Mobile Application

Only Carat's Android and iOS applications are currently intended for Buyers.

Buyer accounts are currently free. The Buyer applications do not currently require a paid Buyer subscription or process Buyer subscription payments.

The mobile applications currently require Internet/network access to communicate with Only Carat servers and provide Platform functionality.

Only Carat does not currently request access to the device's camera, microphone, contacts, photos/media, or precise location.

If future functionality requires additional device permissions, Only Carat may request the applicable permission through the device operating system and update relevant privacy disclosures where required.

9. Supplier Subscription Payments

Supplier subscriptions, where applicable, are provided through the Supplier web Platform.

Supplier subscription payments may be processed by an authorized third-party payment provider. Only Carat may receive limited information such as payment status, transaction reference, subscription amount, currency/taxes, payment date, and Supplier plan information.

Where payment information is processed directly by a payment provider, the provider's privacy practices may also apply.

Supplier subscription payments are separate from transactions between Buyers and Suppliers.

Only Carat does not currently process Buyer-to-Supplier diamond purchase payments through the Buyer marketplace.

10. Data Processors and Third-Party Services

Only Carat may engage service providers or Data Processors for services such as:

Hosting and infrastructure

Google Sign-In/authentication

Google Analytics

Email and communications

Security and technical monitoring

Verification

Technical support

Supplier subscription payment processing

Where required by applicable law, Only Carat will engage Data Processors under appropriate contractual arrangements and require appropriate privacy and security safeguards.

Only Carat remains responsible for its applicable obligations concerning personal data processed by it or on its behalf.

Third-party services independently accessed by Users may be governed by their own privacy policies and terms.

11. Data Accuracy, Security and Safeguards

Only Carat takes reasonable steps, where required by applicable law, to ensure relevant personal data is complete, accurate, and consistent.

Users are responsible for providing authentic and current information and updating their information when necessary.

Only Carat implements reasonable technical and organisational measures designed to protect personal data against unauthorized access, disclosure, alteration, misuse, loss, destruction, or personal data breaches.

Safeguards may include appropriate authentication, access controls, monitoring, logging, backups, security controls, and other reasonable technical or organisational measures appropriate to the nature of the processing.

No internet-based service can guarantee absolute security.

12. Personal Data Breach

If Only Carat becomes aware of a personal data breach, we will take reasonable steps to investigate, contain, mitigate, and address the incident.

Where required by applicable law, Only Carat will notify affected Users and the applicable authority or Data Protection Board in the manner and within the timeframe prescribed by law.

Notifications may include information regarding the nature of the breach, potential consequences, measures taken, recommended protective actions, and relevant contact information.

13. Retention, Account Closure and Deletion

Only Carat retains personal data only for as long as reasonably necessary for the purposes for which it was processed or as otherwise required or permitted by applicable law.

Information may be retained where reasonably necessary for:

Security and fraud prevention

Business, tax, and accounting records

Legal or regulatory compliance

Dispute resolution

Establishment, exercise, or defence of legal claims

When personal data is no longer reasonably required, it may be deleted or anonymized in accordance with applicable law.

Users may request account closure or deletion of eligible personal data by contacting:

info@onlycarat.ai

Only Carat may verify the identity of the requester before processing a request.

14. Children's Personal Data

Only Carat is a B2B diamond marketplace intended for eligible business users and adults and is not intended for children.

Users must be legally eligible to create and operate an Only Carat account.

Only Carat does not knowingly seek to process children's personal data through standard Buyer or Supplier accounts.

If we become aware that children's personal data has been collected contrary to applicable law, we may restrict or close the relevant account and take appropriate steps regarding the data.

Where children's personal data is lawfully processed, Only Carat will comply with applicable parental/lawful-guardian consent and other legal requirements.

15. User and Data Principal Rights

Subject to applicable law, Users may have the right to:

Access information concerning their personal data and its processing

Request correction, completion, or updating of inaccurate/incomplete personal data

Request erasure of eligible personal data

Withdraw consent where processing is based on consent

Raise a grievance regarding processing of personal data

Nominate another individual to exercise applicable rights in the event of death or incapacity

Exercise other rights available under applicable data protection law

Requests may be submitted to:

info@onlycarat.ai

Only Carat may verify the identity of the requester and may retain information where required or permitted by applicable law.

16. User Responsibilities

Users must use Only Carat and personal data obtained through the Platform responsibly and in accordance with applicable law.

Users must not impersonate another person, knowingly provide materially false information, misuse another User's personal data, submit fraudulent privacy requests, or use Buyer/Supplier information for unlawful purposes.

Users should provide authentic information when requesting correction or erasure and cooperate with reasonable identity-verification requirements.

17. International Data Processing

Only Carat operates a global B2B marketplace and may use service providers or infrastructure located in different countries.

Accordingly, personal data may be processed or stored outside the User's country.

Where required by applicable law, Only Carat will take appropriate measures concerning international processing or transfer of personal data.

18. Marketing and Service Communications

Only Carat may send permitted communications relating to Platform services, product updates, Supplier opportunities, or promotions.

Where applicable, Users may opt out of promotional communications.

Opting out does not prevent necessary communications such as OTPs, authentication/security alerts, KYC communications, account notices, Supplier subscription communications, service notifications, or legal/privacy notices.

19. Changes to This Privacy Policy

Only Carat may update this Privacy Policy to reflect changes in Platform functionality, data practices, technology, security, operations, or applicable law.

Where appropriate or required by law, material changes may be communicated through email, Platform notification, mobile application notification, or other reasonable electronic means.

The Last Updated date identifies the current version.

20. Grievance Redressal and Contact

Users may contact Only Carat regarding privacy questions, access requests, correction or deletion requests, withdrawal of consent, privacy complaints or grievances, or other concerns regarding personal data.

Email: info@onlycarat.ai

Platform Operator:

DK INFOWAY

Operating as / operating the Only Carat platform

Address:

502, City Center, Station Road

Lal Darwaja

Surat – 395003

Gujarat, India

Only Carat will review privacy grievances and respond within the timeframe required by applicable law.

Where applicable, a User who is not satisfied with the resolution may exercise further complaint or appeal rights available under applicable law.