Draft — under legal review before launch.
1. Who is responsible
[Registered company name], [Registered office address] (“Baarivo”) runs Baarivo. For the queue, bookings and messages of a salon, the salon decides why your data is used and Baarivo processes it for the salon. For your login, your WhatsApp choices across salons and the Baarivo service itself, Baarivo decides.
2. What we collect
- Phone number and name, and your language. Your number is your identity: there is no password.
- Visits and bookings with each salon: services, staff, times, prices paid, discounts, reward points, ratings and comments, and notes the salon adds.
- Your WhatsApp choices: whether you agreed to offers, and STOP/START replies.
- Birthday, only if you give it (for a birthday offer).
- Payments: amount, status and refunds, Razorpay’s payment ids and a short method label (for example “UPI · name@bank”). We never see or store card numbers or UPI PINs.
- Location, only when you report “Salon is closed” and allow it: used to check you are near the salon; we keep the distance, not your location.
- Devices: a login cookie and the browser name, so you stay logged in and can see and log out your devices.
- Salon owners: business details, staff names and PINs (stored as a hash), GSTIN and billing history.
3. Why we use it
- To run the queue and bookings and show your status (to provide the service).
- To send visit updates and reminders on WhatsApp or SMS, and login codes.
- To send offers, only with your consent; you can withdraw it any time with STOP.
- To take payments and refunds, issue invoices and meet tax and legal duties.
- To prevent fraud and abuse (for example false “closed” reports).
- To improve Baarivo, using usage counts without phone numbers or names, and error reports with personal data removed.
4. Who sees it
Each salon sees only its own customers and visits. One salon never sees your visits to another. Staff on the queue screen see names and the queue only.
We use these service providers, under contract, only to run Baarivo:
- Supabase (database) and Vercel (hosting);
- Gupshup and Meta (WhatsApp), MSG91 (SMS);
- Razorpay (payments, refunds and payouts);
- Sentry (error reports) and PostHog (product usage, without phone numbers).
Some of these may process data outside India, with safeguards. We do not sell personal data. We share it with authorities only when the law requires.
5. How long we keep it
Visit, booking and customer data are kept while the salon uses Baarivo and you are its customer, and deleted or anonymised after the salon leaves or when you ask, unless the law requires us to keep it. Invoices and payment records are kept as long as tax law requires. Login codes expire in minutes; device logins end when unused.
6. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- ask what data we hold about you, and get a summary;
- correct or update it;
- ask us to delete it, where we are not required to keep it;
- withdraw consent (reply STOP for WhatsApp);
- nominate someone to act for you;
- complain to us, and then to the Data Protection Board of India.
Write to [support email] from, or mentioning, the phone number concerned. We answer within 30 days.
7. Security, children and changes
Data is encrypted in transit, each salon’s data is separated in the database, and codes and PINs are stored only as hashes. If a breach affects you, we will tell you and the Board as the law requires.
Salon accounts are for adults (18+). We do not knowingly collect data of children except as a parent or guardian provides it for a visit.
We will post changes here and update the date and version above. Grievance Officer: [Grievance Officer name], [grievance email].