Shapzo

document: privacy-notice title: Privacy Notice version: 1.0.2 effectiveDate: 2026-10-12 status: published

Privacy Notice

Who this notice is from: Adhishva Tech, a sole proprietorship registered as a micro, small or medium enterprise (MSME) in India and based in Ahmedabad, Gujarat. It is not an incorporated company, so it has no CIN, and it is not currently registered for GST. Adhishva Tech operates the Shapzo platform for appointment-led businesses such as salons, spas, studios and clinics ("Shapzo", "we", "us").

Contact: [email protected] Grievance Officer (DPDP s.8(9), s.13): Darshan Chavda, [email protected]

1. Read the section that applies to you

This notice covers two different groups of people, whose relationship to us is genuinely different. Please read the section for your situation — mixing them up is the most common way a privacy notice misleads.

| You are… | We are… | Read | |---|---|---| | A salon owner, manager or staff member with a Shapzo login | The Data Fiduciary / controller of your login and account data. Your employer is the Data Fiduciary for the employment, attendance and payroll records it keeps about you, which we process on its instructions | Sections 3–9 | | A customer of a salon that uses Shapzo | A Data Processor acting for that salon, which is the Data Fiduciary / controller | Sections 10–14 |

The distinction matters for your rights. If you are a salon's customer, the salon decides what is recorded about you and for how long; we only hold it on their instructions. Section 12 explains how to exercise your rights in that case.

2. The short version

  • We are an Indian business. The database, file storage and cache that hold your data run in Bangalore, India.
  • Some things we send out — SMS, email, push notifications, and the optional AI features — travel to providers in the United States. Section 7 lists exactly which and why.
  • We do not sell personal data, and we do not use salon customers' data to advertise to them.
  • The optional AI assistant and receipt scanning can be switched off per salon in Settings. They are the only features that send content to a US provider that is not needed to deliver the core product.

For salon owners and staff (account holders)

This section is our notice to you under DPDP Act 2023 s.5 and GDPR Art. 13, where we are the Data Fiduciary / controller of your account. For the employment, attendance and payroll records your employer keeps in the Platform, your employer is the Data Fiduciary and we are its processor; the Data Processing Agreement governs that processing, and the rows below say so where it applies.

3. What we collect, why, and on what basis

| What | Why we need it | Our basis | |---|---|---| | Name, email address, phone number, password (stored only as a bcrypt hash) | To create and secure your login | Performance of our contract with you / your employer; DPDP s.7(a) | | Phone verification status and one-time codes sent by SMS | To prove a number belongs to you before it can be used as a second factor | Contract; security | | Two-factor authentication secret (encrypted), backup codes (hashed) | To protect your account | Legitimate interests in account security; DPDP s.7(a) | | Business details: salon name, address, GSTIN, logo, working hours, financial year | To run the product and to print compliant tax invoices | Contract; legal obligation (GST) | | Business location pin (latitude / longitude), chosen on a map | To show where the business is and to fill in its address | Contract | | Your device's location — mobile app only, read once, only while the app is open on the business-location screen, and only after you tap "Use current location" and allow the system prompt. It is used to place the pin above and is not stored separately, never tracked in the background, and typing the address works just as well | To place the business pin without typing | Consent (the OS prompt); you can withdraw it at any time in your phone's Settings | | Role and permissions | To decide what you can see and do | Contract | | Attendance and punch-clock records, shifts, leave requests and balances | To run rosters, attendance and leave for your employer | Your employer's instructions as Data Fiduciary, and its legal obligation under the applicable Shops & Establishments and wage legislation | | Payroll data: salary, pay runs, advances, commissions, tips | To calculate and record pay | Your employer's instructions as Data Fiduciary, and its legal obligation | | Statutory identifiers — Aadhaar, PAN, UAN, ESIC, bank account details (encrypted at rest with AES-256-GCM) | Statutory payroll filings and salary payment | Your employer's instructions as Data Fiduciary, and its legal obligation | | Blood group, where entered on a staff profile | Workplace safety, at your employer's discretion | See section 6 — this is health data and its basis is under review | | Audit log entries: who did what, when, from which IP | Security, and to answer "who changed this?" | Legitimate interests; SOC 2 / DPDP s.8(5) safeguards | | Login IP address and browser user-agent at the moment you accept our terms | To evidence that agreement, as GDPR Art. 7(1) requires us to be able to do | Legal obligation / legitimate interests | | Language, date-format and time-zone preferences | To show the product the way you set it | Contract | | Support correspondence | To answer you | Contract; legitimate interests |

Nothing here is optional to the point of being a dark pattern: if you do not want an account, do not create one. But the AI features (section 7) are genuinely optional and can be turned off without losing anything else.

Cookies on shapzo.ai

shapzo.ai sets no cookies unless you accept analytics. If you do, Google Analytics sets _ga and _ga_<id> for 13 months to count returning visits. Your choice is kept in your browser's local storage under shapzo_analytics_consent. Change it at any time from Cookie settings in the site footer; declining deletes the Google Analytics cookies. Google signals and advertising features are off. Analytics never runs on a business's booking page (/book/...), in the portal or in the apps.

4. How long we keep it

Retention is set out in full in our data retention schedule. The headlines:

| Data | Kept for | |---|---| | Password reset tokens, email verification codes, 2FA codes | 24 hours past expiry, then deleted | | Audit log | 400 days (personal identifiers are redacted at the moment of writing) | | AI assistant conversations | 180 days | | Notification delivery records | 90 days (400 days for failures, so a broken channel can be diagnosed) | | Invoices, payments and the financial record | 8 years — a statutory floor under Companies Act 2013 s.128, GST rules and the Income Tax Act. We anonymise the identity attached to old records rather than deleting the money | | Payroll and attendance registers | 8 years, the same period as the financial record: our retention schedule keeps payroll registers for the longest statutory floor that can apply to them, rather than the shortest | | Your account | For as long as your salon's subscription is live, plus a wind-down period | | A business its owner deletes (Settings → Privacy & Data in the portal, or My Account in the app) | Closed to everyone at once, with 7 days for the owner to cancel. After that the customers' personal details, the logins that belong only to that business and the business profile are deleted or anonymised; the financial and payroll records above are kept, anonymised, for their statutory period |

Where a statutory floor applies we anonymise rather than delete: the amounts stay, the person stops being identifiable.

5. Your rights

Under the DPDP Act 2023 and, where it applies to you, the GDPR, you may:

  • Access the personal data we hold about you, and get a copy of it (DPDP s.11; GDPR Art. 15).
  • Correct, complete or update it (DPDP s.12; GDPR Art. 16).
  • Erase it, where no statutory retention floor requires us to keep it (DPDP s.12(3); GDPR Art. 17).
  • Withdraw consent, where consent is the basis, as easily as you gave it (DPDP s.6(4)–(6); GDPR Art. 7(3)).
  • Nominate another person to exercise your rights if you die or become incapacitated (DPDP s.14).
  • Complain, and have that grievance answered (DPDP s.13).
  • Where GDPR applies: object to processing based on legitimate interests (Art. 21), ask us to restrict processing (Art. 18), and receive your data in a portable format (Art. 20).

How to exercise them. Email the Grievance Officer at [email protected], or use Settings → Privacy & Data in the portal. We will respond within the period the applicable law requires — under GDPR that is one month; DPDP grievance-redressal periods will be prescribed by the Rules.

If we do not answer you properly, you may complain to the Data Protection Board of India (constituted under Chapter V of the DPDP Act 2023) once it is operational, at the route it publishes. You must ordinarily exhaust our grievance process first — DPDP s.13(3). The Platform is offered to businesses in India only. If the GDPR nonetheless applies to you, you may also complain to your national supervisory authority.

6. Special-category and sensitive data

Two fields need calling out honestly rather than burying:

  • bloodGroup on a staff profile. This is data concerning health. It is optional and entered by your employer.
  • Health notes about salon customers (see section 11).

Both are encrypted at rest and excluded from the audit log's recorded values and from bulk exports. The lawful basis for holding health data is under active review and is not yet settled — GDPR Art. 9(1) prohibits it absent an Art. 9(2) condition, and explicit consent collected by a receptionist on someone else's behalf is not obviously one. We are stating this rather than asserting a basis we have not established. No Data Protection Impact Assessment has yet been completed for it.

For salon customers

This section gives you the DPDP s.5 information about the processing we carry out for the salon and, where the GDPR applies, the information required by Art. 13 and Art. 14.

7. Who is responsible for your data

The salon is. When you visit a salon that uses Shapzo and a member of staff types your details into the system, the salon decides what to record and why. The salon is the Data Fiduciary (DPDP) and the controller (GDPR).

We are the processor. We hold and process it on the salon's documented instructions under a data processing agreement, and for nothing else. We do not decide what goes in your record, we do not market to you, and we do not sell your data.

8. What the salon records about you, and where it came from

Usually entered by the salon's staff when you visit or call. Where the salon offers online booking through Shapzo, you enter your own name, phone number and email address on its booking page, and the booking you make is recorded in the same way:

  • Name, phone number, email address, date of birth, gender
  • Address, where taken
  • Appointment and visit history, the services you had and who performed them
  • Invoices, payments, taxes charged, refunds
  • Memberships, packages, gift vouchers, loyalty points and their balances
  • Preferences and free-text notes staff make about you
  • Marketing consent state, and whether you have unsubscribed
  • Allergy and sensitivity notes — see section 11
  • Family/household links, tags and segments the salon assigns
  • A Razorpay customer reference, where the salon takes payment that way

Purposes: booking and delivering your appointments; billing you and issuing a GST-compliant invoice; running the salon's loyalty, membership and package schemes; reminding you of appointments; and — only if the salon has your consent — marketing.

Legal basis (GDPR, decided by the salon): performance of your contract for services; the salon's legal obligation to issue and retain tax invoices; its legitimate interests in running its business; and consent for marketing. Under DPDP, the salon must have your consent or a legitimate use under s.7.

9. Marketing, and how to stop it

Every marketing message we send on a salon's behalf carries an unsubscribe link. It is a one-click, signed link that needs no login, and it works immediately. You can re-subscribe from the same link if you unsubscribe by mistake. Transactional messages — an appointment reminder, an invoice — are not marketing and continue.

10. Automated decision-making

There is none. Nothing in the product makes a decision about you with legal or similarly significant effects without a human involved. The AI assistant answers salon staff's questions about their own data; it does not decide anything about you.

11. Allergy and health notes

Salons record allergies and sensitivities so that a product that would harm you is not put on you. That is a genuine and good reason to hold it.

It is also data concerning health, which GDPR Art. 9(1) prohibits processing without a specific condition, and which DPDP s.8(5) requires proportionately stronger safeguards for. Today a staff member types it in and you perform no act at all — which is not explicit consent. We are telling you this plainly because it is true, and it is being worked on. What is already in place: the field is encrypted at rest, its value never reaches the audit log, and it is excluded from bulk customer exports.

12. Your rights, and how to use them

Your rights are the same as those listed in section 5. Because the salon is the controller, ask the salon first — they can see, correct, export and erase your record from within the product, and they are the ones obliged to answer you.

If you cannot reach the salon, or they do not respond, contact our Grievance Officer at [email protected] and we will route your request to them and assist. We cannot unilaterally change or delete a salon's records, because they are not ours.

You may complain to the Data Protection Board of India or, if the GDPR applies to you, to your national supervisory authority.

Note that erasure is not always total: where an invoice must be kept for 8 years under Companies Act 2013 s.128 and GST rules, we anonymise your identity on it and keep the financial record. That is the law, not a preference.

Applies to everyone

13. Who else your data reaches (sub-processors)

This list is derived from the code, not from a template. Each row names the file that makes the call, so it can be checked.

| Provider | What reaches them | Where they process it | Reached from | |---|---|---|---| | DigitalOcean | Everything — the managed MySQL database, Spaces object storage (logos, avatars, product images, report exports), and Redis | Bangalore, India (blr1) | src/config/database.js, src/utils/objectStorage.js, src/services/reports/reportStorage.js, src/config/redis.js | | MSG91 | Phone numbers and SMS message bodies, including one-time passcodes | India | src/services/notifications/channels/msg91.js | | Twilio | Phone numbers and message bodies for WhatsApp, and for SMS only as an emergency fallback | United States | src/services/notifications/channels/twilio.js, channels/whatsapp.js, channels/sms.js | | Google — Gmail SMTP | Email addresses and message bodies | United States | src/utils/email.js (nodemailer) | | Google — Firebase Cloud Messaging | Device push tokens and notification payloads | United States | src/services/notifications/channels/push.js, portal src/lib/push.js | | Google Maps | Addresses typed into the portal by salon staff (this call is made by your browser). In the Android app, the map tiles for the business-location pin, and the coordinates of that pin for address lookup through Google Play services on the phone | United States | portal, VITE_GOOGLE_MAPS_API_KEY; Android app, GOOGLE_MAPS_ANDROID_API_KEY | | Apple Maps | iOS app only. The map tiles for the business-location pin, and the coordinates of that pin for address lookup — both calls are made by your iPhone, not by our servers | United States | iOS app (MapKit / CLGeocoder via react-native-maps and expo-location) | | OpenAI | Optional. Receipt and menu images submitted for scanning, and AI assistant questions plus the bounded rows its read-only tools return | United States | src/utils/openaiClient.js, src/services/ai/, src/services/expenses/receiptOcr.js | | Razorpay | Subscription billing details; a Razorpay customer reference is stored on the customer row | India | src/utils/razorpayService.js | | Sentry (Functional Software, Inc.) | Error and crash reports from the API, the portal, the admin panel and the mobile apps: the error message and stack trace, the screen or API route (no query string), device, browser and app version, and the ids of the signed-in user and business. Phone-like numbers and email addresses are masked before sending. No request bodies, cookies, IP addresses, screenshots or session recordings | Frankfurt, Germany (EU) | src/config/sentry.js; portal and admin src/lib/sentry.js; mobile app src/lib/sentry.js | | Google Analytics | shapzo.ai only, and only after you accept analytics cookies there. Pages visited (path only), the referring site, device and browser type, approximate location Google derives from your IP address, and clicks on the sign-up, log-in and contact links. Never on a business's booking page (/book/...), in the portal or in the apps | United States | shapzo-website src/lib/analytics.js |

We will give tenants notice before adding or replacing a sub-processor, so that the objection right in the data processing agreement is real.

14. International transfers

The core of the product stays in India: database, object storage and cache all run in DigitalOcean's Bangalore region, and both SMS (MSG91) and payments (Razorpay) are Indian.

Transfers out of India, to the United States, happen for: email (Gmail SMTP), push notifications (Firebase), WhatsApp and fallback SMS (Twilio), address autocomplete (Google Maps), the map and address lookup in the mobile app (Google Maps on Android, Apple Maps on iOS — both called from the phone itself), the optional AI features (OpenAI), and website analytics on shapzo.ai, only with your consent (Google Analytics).

Error and crash reports go out of India, to Germany (EU) (Sentry).

  • Under DPDP s.16, transfers are permitted except to countries the Central Government restricts by notification. No such restriction currently applies to these.
  • The Platform is offered to businesses in India only, so the GDPR Chapter V transfer mechanisms are not relied on: we have not executed Standard Contractual Clauses with these providers and do not claim EU–US Data Privacy Framework coverage for them. A business that is itself subject to the GDPR should not put EU or UK residents' data into the Platform without first agreeing a transfer mechanism with us in writing.

The optional AI features are the transfer you have most control over. They can be disabled for an entire salon in the portal, at which point no content reaches OpenAI at all. Everything else in the product keeps working.

15. How we protect it

These are measures actually implemented in this codebase, not aspirations:

  • Passwords are stored as bcrypt hashes and never in plaintext; hashing happens in a model hook so no code path can bypass it.
  • Sessions use signed JWTs with a server-held secret.
  • Two-factor authentication via TOTP or a one-time code, with the TOTP secret encrypted (AES-256-GCM) under a key held separately from other secrets, and backup codes stored as HMAC hashes.
  • Role-based access control on every protected endpoint, with a scope hierarchy (all → tenant → branch → own), so a stylist cannot read the payroll.
  • Tenant isolation enforced in every query: one salon cannot read another's data.
  • Field-level encryption at rest (AES-256-GCM) for the highest-risk columns: staff Aadhaar, PAN, UAN, ESIC and bank details; supplier PAN and bank details; and customer health notes.
  • An audit log of sensitive and administrative actions, with personal data redacted at write time and a 400-day retention.
  • Rate limiting on every endpoint, with stricter tiers on login, OTP, password reset and other brute-forceable surfaces.
  • TLS in transit, terminated at the hosting platform.
  • AI payload minimisation: before anything reaches OpenAI, keys matching passwords, tokens, bank/IFSC/UPI details, Aadhaar/PAN, health notes, salary and card numbers are stripped recursively, rows are capped, and the tool list is filtered to the caller's own permissions — so the assistant can never send data the user could not already read.

No system is perfectly secure, and we do not claim otherwise.

16. Children

The product is a business tool for salons and is not directed at children. Salons should not create accounts for under-18s. DPDP s.9 requires verifiable parental consent before processing a child's personal data and prohibits tracking, behavioural monitoring and targeted advertising directed at children. A salon may record a minor as a customer only with the consent of a parent or lawful guardian, which the salon must obtain and be able to show. Shapzo provides no age-verification mechanism; the salon, as Data Fiduciary, is responsible for meeting s.9.

17. Changes to this notice

The current version is always shown at the top of this document and is served by the product itself. When we make a material change we will re-prompt account holders to accept the new version and record that acceptance against the new version number — we do not overwrite the old record, because "you agreed" is only meaningful alongside "to what".

18. Complaints and contact

  1. Grievance Officer: Darshan Chavda, [email protected] — this is the contact required by DPDP s.8(9) and the grievance route required by s.13.
  2. Support: [email protected]. Adhishva Tech is based in Ahmedabad, Gujarat, India. We do not publish a postal address; email is the route we answer.
  3. Data Protection Board of India — if we have not resolved your grievance.
  4. EU/UK representative: none. The Platform is offered in India only and no representative under GDPR Art. 27 has been appointed.
  5. Data Protection Officer: none appointed. Shapzo has not been notified as a Significant Data Fiduciary under DPDP s.10; the Grievance Officer is the contact for every data protection matter.

19. Availability in other languages

This notice is published in English. DPDP s.6(3) gives you the right to access it in English or any language in the Eighth Schedule to the Constitution. The customer-facing collection notice is already available in Hindi, Marathi, Gujarati, Tamil, Telugu, Kannada, Bengali and Punjabi in addition to English. This full notice has not yet been translated; if you need help understanding it in another Eighth Schedule language, write to the Grievance Officer and we will assist.