Privacy Policy

Effective date: [PLACEHOLDER — insert date before go-live]

This policy is written in accordance with India's Digital Personal Data Protection (DPDP) Act 2023. [PLACEHOLDER — have a qualified lawyer review before publishing.]

1. Who We Are (Data Fiduciary)

[PLACEHOLDER — Legal entity name, registered address, CIN/GSTIN, contact email for privacy queries.]

2. Data We Collect

  • Account data: name, email address, phone number (optional).
  • Shop owner data: business name, address, GSTIN, bank/UPI details (held by Razorpay — see Section 7).
  • Booking data: appointment date/time, service selected, notes provided.
  • Usage data: pages visited, device type, IP address, browser, referrer. [PLACEHOLDER — clarify if analytics cookies are used and list them.]
  • Communications: messages sent via the contact form.

3. Purpose & Legal Basis (DPDP Act 2023)

[PLACEHOLDER — Under the DPDP Act, processing requires "consent" or a "legitimate use". List each purpose and the applicable basis:]

  • Providing the booking service — consent / contract performance
  • Sending appointment confirmations and reminders — consent
  • Processing subscription payments via Razorpay — contract performance
  • Fraud prevention and platform security — legitimate use
  • Analytics to improve the platform — consent (cookie banner)

4. Data Retention

[PLACEHOLDER — Specify retention periods per data type, e.g.:]

  • Account data: retained until account deletion request + [X] months for legal/audit purposes.
  • Appointment records: [X] years for GST compliance.
  • Server logs: [X] days rolling.
  • Payment records: held by Razorpay per their retention policy.

5. Data Sharing

We share your data only as necessary:

  • Shop owners receive customer name and booking details for the services they provide.
  • Razorpay processes payment data under their own Privacy Policy. Razorpay does not share your card/UPI details with us.
  • Email provider ([PLACEHOLDER — Brevo/SES/etc.]): used to deliver transactional emails.
  • Error monitoring (Sentry): anonymised error traces; PII is not sent (send_default_pii=False).
  • We do not sell personal data to third parties.

6. Cross-Border Transfers

[PLACEHOLDER — State whether data is processed outside India (e.g. Sentry servers, CDN). DPDP Act 2023 restricts transfers to notified countries. Lawyer review required.]

7. Razorpay & Payment Data

Payment processing is handled entirely by Razorpay Software Private Limited. We do not store card numbers, CVVs, or full bank account details. Razorpay is PCI-DSS compliant. Please review Razorpay's Privacy Policy for details of how they handle payment data.

8. Your Rights (DPDP Act 2023)

[PLACEHOLDER — Under the DPDP Act, Data Principals (users) have the right to:]

  • Access information about personal data held.
  • Correct inaccurate personal data.
  • Erasure of personal data ("right to be forgotten") — subject to legal retention obligations.
  • Withdraw consent at any time.
  • Nominate a person to exercise rights on their behalf.
  • Grievance redressal via our Data Protection Officer.

To exercise these rights, contact us or email [PLACEHOLDER — dpo@yourdomain.com].

9. Cookies

[PLACEHOLDER — List cookies used: session cookie (necessary), CSRF cookie (necessary), analytics cookies (consent-gated). Reference the cookie banner on the site.]

10. Security

[PLACEHOLDER — Describe technical and organisational measures: HTTPS-only, encrypted DB passwords, access controls, Sentry for error monitoring.]

11. Changes to This Policy

[PLACEHOLDER — We will notify users of material changes via email and by updating the effective date above. Continued use constitutes acceptance.]

12. Contact & Grievance Officer

[PLACEHOLDER — Name and contact details of Data Protection Officer / Grievance Officer as required by DPDP Act 2023 rules.]

For privacy queries: Contact form or email [PLACEHOLDER — dpo@yourdomain.com].