Privacy notice

Upscale is run by Upspace Software LLP, [registered address] (“we”, “us”). For the personal data described here we are the Data Fiduciary: we decide why and how it is used.

Each salon also uses your data to serve you. Your visit history at a salon belongs to that salon’s records; we hold it for them and never sell it or share it with other salons.

When you open a salon’s page (for example by scanning its QR code):

• a random visitor id in a cookie, so the salon can offer “your usual” next time. It is not a login, and it is kept on your phone for up to 400 days;
• which of the salon’s codes you scanned (counter, door, mirror or online) and when;
• if you join in the browser, your visit’s link in a second cookie for one day, so the salon’s page can take you back to your place.

Your location, only if you allow it, once, to check that you are at the salon (within about 150 metres) so you can be marked “here”. We store that one reading (latitude, longitude and accuracy) with the result of the check. We never track your location over time. If you say no, everything still works.

When you join a queue or book: the services and stylist you chose, your token (like SZ-4821), the times of your visit and what happened (for example checked in, done, cancelled or missed), and the name you give, if any.

If you use WhatsApp: your phone number and WhatsApp profile name, which WhatsApp shares with us when you send the message, and the messages between you and the salon.

If you use the app: your phone number, name, an optional photo, your language, your choices about messages, and a notification token for your phone.

Missed turns: how many times you missed your turn in the last 30 days. After two, joining from home pauses for a while; walk-ins stay welcome.

Salon owners and staff: name, phone number, role, working hours and leave, the salon’s business details, and billing records. Payments are handled by Razorpay; we never see or store your card or UPI PIN.

• to put you in the queue, show your place and wait, and alert you before your turn;
• to let the salon call you by name, see your past visits there and offer “your usual”;
• to estimate waiting times better, using visit times across the salon (in totals, not about you personally);
• to keep the queue fair, for example the pause after repeated missed turns;
• to run salon accounts, subscriptions and invoices;
• to keep the service secure, fix problems and meet our legal duties.

We do not sell your data, and we do not show you ads.

We ask separately, and you can say no to each without losing the queue:

• WhatsApp updates about your visit (your place, your turn, a review link afterwards);
• offers from salons you have visited (off unless you turn them on);
• your location for the “at the salon” check;
• any photo the salon would like to share on Google.

You can withdraw consent at any time: in the app’s settings, by replying STOP on WhatsApp, or by writing to us (below). Withdrawing is as easy as giving consent, and it does not affect what was done before.

• The salon you visit sees your name, phone number (if you gave it) and your visits at that salon. Other salons do not.
• Other customers only ever see your initials as a dot in the queue, never your name or number.
• Companies that help us run the service, under contract and only for this purpose: Supabase (our database, in its Mumbai region), Cloudflare (serves the web pages and stores encrypted backups), Meta (WhatsApp messages), Google Firebase (app notifications), Razorpay (salon payments) and, only if a salon connects it, Google Business Profile.
• Government authorities, only when the law requires it.

Customer data is stored in India, in Supabase’s Mumbai region. Encrypted nightly backups are kept on Cloudflare for 30 days. [Confirm the backup storage region before launch.]

• Your account and visit history: while you use the service. Data that has been inactive for 2 years is deleted.
• The visitor id cookie: up to 400 days on your phone. The visit link cookie: one day.
• Location check readings: [retention to confirm, proposed 30 days].
• Backups: 30 days, then overwritten.
• Invoices and payment records: as long as tax law requires (currently 8 years).

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and who we shared it with;
• have it corrected, completed or updated;
• have it erased, unless the law requires us to keep it;
• raise a grievance with us, and then with the Data Protection Board of India;
• nominate someone to use these rights for you if you die or cannot act yourself.

In the app, use Download my data or Delete account in your profile. Without the app, write to our Grievance Officer. We reply within 90 days at most, and usually much sooner.

Parents and guardians can book services for children. We do not knowingly let anyone under 18 create an account, and we do not track or target children.

Data is encrypted in transit, access is limited by role (a salon only sees its own customers), and every access by our team is logged with a reason. If a breach affects your data, we will tell you and the Data Protection Board as the DPDP Rules require.

[Name], Grievance Officer, Upscale
Email: [grievance email]
Address: [postal address]

If we change how we use your data, we will update this page and, for important changes, tell you in the app or on WhatsApp before they apply.