Privacy Policy

Part I: How We Handle Your Data

1. Who We Are and Scope

1.1. "Ggloty", "we", "us" and "our" refer to [Afrodyte Pvt Ltd, as shown on your App Store and Google Play developer accounts], with its registered office at [N- Block, 19th street, Anna Nagar East, Chennai]. We operate the Ggloty website at www.ggloty.com and the Ggloty mobile apps (together, the "Platform").

1.2. This Privacy Policy explains what personal data we collect when you use the Platform, why we collect it, who receives it, how long we keep it, and the choices you have. It covers all personal and device data the Platform handles, whether you use it as a customer ("User") or as a beauty professional or other service provider ("Service Provider").

1.3. For privacy questions, requests or complaints, contact our Privacy Officer using the details in Section 12.

2. Data We Collect and Why

3. How We Use Your Data

We use your personal data only for the purposes listed in Section 2 and in Part II of this Policy: to create and administer accounts, facilitate bookings and communications, verify users and Service Providers, process payments and refunds, provide support, improve the Platform, detect fraud and keep the Platform secure, and comply with legal obligations. We will not use your data for a materially different purpose without telling you and, where required, asking for your consent again.

4. Sharing and Third Parties

4.1. We share personal data only as follows:

• With the other party to a booking: the details needed to complete the service.
• With service providers acting for us: payment processing (Razorpay), cloud hosting, messaging and OTP delivery, [analytics, crash reporting, push notifications, maps, identity verification, or other SDKs and vendors you use]. They may use your data only to provide their service to us.
• With authorities: where required by law, or to investigate fraud and protect the safety of users and the Platform.

4.2. We require our service providers to protect your data to a standard equal to that described in this Policy.

4.3. We do not sell your personal data. We do not use your personal data for advertising by third parties, and we do not track you across other companies' apps and websites. [CONFIRM both statements are true for your apps, including any SDKs, before publishing.]

4.4. We do not share your personal data with third-party artificial intelligence services. [CONFIRM. If you use any AI service that receives user data, state what is shared and why, and obtain explicit permission in the app.]

5. Device Permissions

5.1. Depending on the features you use, the app may ask for permission to access:

• Camera and photo library: to take or choose profile photos and portfolio content. We use only the photos you select.
• Location: to help you enter or confirm a service address. [State whether location is approximate or precise, and whether it is collected only while the app is open.]
• Notifications: to send booking updates and account alerts.

5.2. Each permission is optional and is requested when the related feature is first used, with a short explanation. You can say no or change your choice at any time in your device settings. If you decline, you can still use the Platform; for example, you can type your service address instead of using location. Paid or core features do not depend on you granting access to your data beyond what the feature itself needs.

6. Data Retention

6.1. We keep personal data only as long as needed for the purposes in this Policy, and for as long as the law requires.

• Account and profile data: while your account is active, and deleted after you delete your account as described below.
• Booking, invoice and payment records: [period, e.g. 8 years].
• Fraud-prevention and dispute records: [period].
• Technical and diagnostic logs: [period, e.g. 90 days].

6.2. When data is no longer needed it is deleted or irreversibly anonymized.

7. Children

The Platform is intended for people aged [18] and above and is not directed at children. We do not knowingly collect personal data of a child without the verifiable consent of a parent or lawful guardian.

8. Security and Data Transfer

We use reasonable technical and organizational safeguards, including encrypted transmission (HTTPS/TLS) and access controls on stored data. No digital system can guarantee absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required by law.

9. Your Choices and Rights

You can access, correct, update or delete your data, withdraw your consent, and make a complaint, as explained in Part II.

10. Where Your Data Is Stored

Your data is stored on servers located in [country or region of your hosting provider]. If we transfer personal data outside India, we do so only as permitted by the DPDP Act and with appropriate safeguards.

11. Changes to This Policy

We may update this Policy from time to time. We will change the "Last updated" date above and, for material changes, notify you in the app or by email before they take effect.

12. Contact Us

Privacy Officer — Ggloty
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]
Email: privacy@ggloty.com
Coverage: Tamil Nadu & Major Metro Centers across India

Deleting Your Account and Data

You can delete your Ggloty account and the personal data linked to it at any time. This is true deletion, not just deactivation or hiding your account.

Option 1: In the app

Open the Ggloty app and go to [Profile > Settings > Delete Account. CONFIRM the exact path in your app], then confirm. The same option is available on both iOS and Android.

Option 2: Without opening the app

If you can no longer use the app, or have uninstalled it, email privacy@ggloty.com with the subject "Ggloty account deletion request" from the email address or phone number linked to your account. We may ask you to verify your identity before we proceed. [Optional: add a link to a web form, e.g. https://www.ggloty.com/delete-account.html]

What happens next

• We delete your account and personal data from our systems within [number, e.g. 30] days of a verified request, and ask our service providers to delete their copies.
• Any upcoming bookings, pending refunds, payouts or subscriptions may need to be completed or cancelled first. We will tell you if this applies.
• Content you published, such as your profile, portfolio and reviews, is removed along with your account.

What we may keep

Where the law or a legitimate need requires it, we keep limited data after deletion, and only for as long as needed: transaction, invoice and tax records; records needed to prevent fraud or abuse; and records needed to resolve a dispute or enforce our agreements. Retention periods are listed in Section 6. This data is not used for any other purpose.

Part II: Digital Personal Data Protection (DPDP) Consent Notice

This Notice is provided in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Purpose of Collection

By creating an account or using Ggloty, you consent to the collection and processing of personal data necessary to:

• create and administer your account;
• facilitate bookings and communications;
• verify users and service providers;
• process payments and refunds;
• provide customer support;
• improve platform functionality;
• detect fraud and maintain platform security;
• comply with applicable legal obligations.

2. Categories of Personal Data

Depending upon your use of the Platform, Ggloty may collect your name, contact details, profile photograph, booking history, service address and location details, uploaded content, payment-related information (excluding complete payment card details where handled by regulated payment gateways), technical device information, diagnostic logs, and customer communications. See Part I, Section 2 for details.

3. Consent

By continuing to use the Platform, you provide your free, specific, informed, unconditional, and unambiguous consent for Ggloty to process your personal data for the purposes described in this Notice. Where consent is required for optional features, such as device permissions or promotional messages, Ggloty will request such consent separately, and you can use the Platform's core services without agreeing to optional ones.

4. Withdrawal of Consent

You may withdraw consent at any time, as easily as you gave it, by changing the relevant setting in the app or your device, by contacting Ggloty, or by deleting your account as described above. Withdrawal shall not affect processing already carried out or processing required under applicable law.

5. Rights of Data Principals

Subject to applicable law, you may:

• request access to your personal data;
• request correction or updating of inaccurate data;
• request deletion of personal data where legally permissible;
• nominate another person to exercise your rights in accordance with the DPDP Act, where applicable;
• submit grievances relating to data processing.

If you are not satisfied with our response to a grievance, you may approach the Data Protection Board of India as provided under the DPDP Act.

6. Security

Ggloty implements reasonable technical and organizational safeguards to protect personal data against unauthorized access, disclosure, alteration, or destruction. While every reasonable effort is made, no digital system can guarantee absolute security. See Part I, Section 8.

7. Contact for Privacy Matters

For questions, requests, or grievances relating to personal data, users may contact the Privacy Officer at privacy@ggloty.com. Ggloty shall endeavor to respond to privacy-related requests within a reasonable time and in accordance with applicable law.

Part III: Additional Data-Related Provisions

1. Payment Data

1.1. All online payments made through the Platform are processed by Razorpay or such other payment gateway as may be designated by Ggloty from time to time.

1.2. Ggloty does not collect, store, retain, process, or have access to Users' complete debit card, credit card, UPI PIN, internet banking credentials, CVV numbers, or other sensitive financial credentials. Such information is collected and processed exclusively by Razorpay in accordance with its applicable terms, privacy policy, security standards, and regulatory obligations.

1.3. Payment processing, transaction authentication, settlement timelines, chargeback investigations, fraud monitoring, PCI-DSS compliance, and financial data security are governed by Razorpay's policies and applicable laws. Other payment-related terms are set out in our Terms & Conditions.

2. Verification Information

2.1. Ggloty may request identity documents, business registrations, GST details, certifications, portfolio evidence, social media profiles, or other information from Service Providers for verification purposes.

2.2. Ggloty may revoke verification at any time upon discovering inaccurate, misleading, fraudulent, or outdated information

3. Confidentiality of Personal Information

3.1. Users and Service Providers shall not disclose confidential personal information obtained through the Platform except as necessary for completion of booked services or as required by law.

3.2. Contact details obtained through the Platform shall not be used for unsolicited marketing or unrelated commercial purposes.

3.3. Recording Service Providers without lawful consent, where required by applicable law, is prohibited.

4. Account Deletion and Retention

4.1. Users may request deletion of their account through the Platform or by contacting us, as described in Deleting Your Account and Data.

4.2. Ggloty may retain information where required by law, taxation requirements, fraud prevention, dispute resolution, contractual enforcement, or legitimate business interests, as described in Part I, Section 6.

5. Electronic Communications

5.1. Users consent to receiving transactional notifications, booking confirmations, OTPs, account updates, legal notices, security alerts, invoices, and service communications electronically.

5.2. Promotional communications shall be sent only in accordance with applicable law and may be opted out of where legally required.

6. Fraud Prevention

6.1. Ggloty reserves the right to investigate suspected fraud, payment abuse, account manipulation, fake bookings, fake reviews, referral abuse, promotional abuse, identity fraud, or any conduct detrimental to the integrity of the Platform, and to cooperate with law enforcement where appropriate.

7. Governing Law

This Privacy Policy shall be governed by the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023. Any dispute shall be resolved in accordance with the dispute resolution provisions of our Terms & Conditions.