Privacy Policy — DetailFlow

Last updated: [DATE] Effective from: [DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("DetailFlow", "we", "us") collects and handles personal data through the DetailFlow platform (the "Service"), and describes your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law.

This policy applies to two groups:

• Studio users — the studio owner, managers, and staff who log into DetailFlow. We act as the Data Fiduciary for their data.
• End customers of studios — the vehicle owners whose data is entered into DetailFlow by a studio. For this data, the studio is the Data Fiduciary and DetailFlow acts as a Data Processor on the studio's instructions. Questions about this data should be raised with the studio; we will assist the studio in responding.

1. Data We Collect

1.1. Account and studio user data (we are Data Fiduciary)

• Name, email, phone number, role in studio
• Login credentials (password stored as a salted hash — we never see it in the clear)
• Studio name, address, GSTIN (if provided), UPI ID (if provided)
• Billing details (name, address, tax IDs, invoice history)
• Device, browser, IP address, timestamps of use
• Support communications you send us

1.2. End-customer and job data (studio is Data Fiduciary; we process)

• End-customer name, phone number, vehicle registration, vehicle details
• Job records, photos (before/after, walkarounds), notes
• Timestamps and staff assignments
• Payment status flags (we do not store card numbers or CVV)

1.3. Automatically collected data

• Cookies and similar technologies strictly needed to keep you signed in and to remember preferences. We do not use third-party advertising or cross-site tracking cookies.
• Server logs (IP, user agent, request path, response code) retained for security and debugging.

1.4. We do not knowingly collect

• Children's personal data (users under 18). The Service is for use by business owners and their staff.
• Sensitive personal data such as financial account numbers, health data, biometric data, caste, religion, or political affiliation. Do not enter such data into the Service.

2. How We Use Data

We process personal data only for the following purposes:

• (a) providing and operating the Service;
• (b) authenticating users and preventing fraud or abuse;
• (c) billing, invoicing, and tax compliance;
• (d) responding to support requests;
• (e) improving reliability and performance, using aggregated or de-identified data where possible;
• (f) complying with legal obligations;
• (g) sending service-related messages (billing, security, changes to terms). We do not send marketing to studio staff without a separate consent.

3. Legal Basis (DPDP Act)

We process personal data based on:

• Consent — you provide it at signup and at points where it is required.
• Legitimate uses as defined under Sec 7 of the DPDP Act — including performance of the contract with you, compliance with law, and responding to medical or safety emergencies where applicable.

You may withdraw consent at any time, subject to the operational and legal consequences described below (e.g., we cannot provide the Service without processing basic account data).

4. Sharing and Sub-Processors

We do not sell personal data.

We share personal data only with:

• Cloud infrastructure providers — Supabase (database, auth, storage), Vercel (application hosting). Data may be stored on servers located outside India (e.g., Singapore, US).
• Payment processors — Razorpay (or equivalent) for subscription billing and for optional customer-payment features. Payment card data is handled directly by them; we do not receive it.
• Communication providers — Meta/WhatsApp (when the WhatsApp Business feature is enabled) and email delivery providers, only to send messages you or the studio have triggered.
• Professional advisors — lawyers, auditors, accountants, under confidentiality.
• Authorities — where required by valid legal process, subject to challenge where appropriate.
• Successor entity — in the event of a merger, acquisition, or sale of assets, subject to equivalent protections.

Cross-border transfers are made only to jurisdictions permitted by the Central Government under the DPDP Act, and under contractual safeguards.

Current list of sub-processors: [LINK TO SUB-PROCESSOR PAGE].

5. Retention

• Studio user data: kept while your account is active and for up to 24 months after termination for legal and tax records (GST records must be retained for 6 years under Indian law — those specific records are kept for that period).
• End-customer and job data: retained on the studio's instructions. Default retention for photos is [90 days / studio-configurable]. When a studio deletes a record, it is soft-deleted for 30 days and then permanently purged.
• Backups: rolling backups are retained for up to 30 days.

6. Security

We use industry-standard measures including TLS in transit, encryption at rest for stored data, salted password hashes, row-level security in the database, access control, and audit logs. No system is perfectly secure. You are responsible for keeping your credentials confidential.

Breach notification. In the event of a personal data breach, we will notify the Data Protection Board of India and affected persons as required by the DPDP Act and applicable rules.

7. Your Rights (DPDP Act)

Subject to the DPDP Act, you have the right to:

• access the personal data we hold about you;
• correct or update inaccurate or incomplete data;
• erase data no longer necessary for the purpose for which it was collected;
• nominate another individual to exercise your rights in the event of death or incapacity;
• withdraw consent at any time (this will not affect processing done before withdrawal);
• grievance redressal through our Grievance Officer, and thereafter to the Data Protection Board.

To exercise rights, contact privacy@detailflow.cloud. We will respond within the time required by law. If you are an end customer of a studio, please raise the request with the studio first; the studio controls this data.

8. Cookies

We use only strictly necessary cookies (session, CSRF, preferences). We do not use advertising or cross-site tracking cookies. Analytics, if used, is privacy-preserving and aggregated.

9. Children

The Service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child's data has been submitted, contact us and we will delete it.

10. Third-Party Links

The Service may contain links to third-party sites. We are not responsible for their privacy practices. Review their policies separately.

11. Changes to This Policy

We may update this policy. Material changes will be notified by email or in-app at least 15 days in advance. The "Last updated" date at the top reflects the current version.

12. Contact and Grievance Officer

Grievance Officer / Data Protection Contact: [NAME] Email: grievance@detailflow.cloud (grievances) / privacy@detailflow.cloud (data requests) Postal address: [ADDRESS] Response time: Acknowledgement within 24 hours; substantive response within 15 days (or the timeline required by law).

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India as constituted under the DPDP Act.

[This document is a skeleton for legal review. It is not legal advice. Do not rely on this template without review by a qualified Indian lawyer.]