1. Scope & Operating Entity
This Privacy Policy governs your use of the Glamourly salon discovery, price transparency, and appointment booking platform. Glamourly operates strictly within the geographical boundary of Mumbai, Maharashtra, India, serving clients and partner salon establishments across South Mumbai, Western Suburbs, and Central Suburbs (including Bandra, Juhu, Colaba, Worli, Andheri, and Powai).
The platform is operated by Glamourly Platform Operations (Mumbai, Maharashtra, India). For the purposes of applicable Indian data protection laws, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (DPDPA), Glamourly acts as a Data Fiduciary regarding the personal information you entrust to us when creating an account, reserving salon time slots, or listing a salon establishment.
2. Data Inventory: Information We Collect
Glamourly adheres to the statutory principle of data minimization. We only collect personal information that is strictly necessary to deliver appointment coordination and verified salon discovery:
A. Customer Account & Profile Data
Full name, verified email address, contact mobile number, optional gender preference, and city (defaulting to Mumbai). We never collect government IDs, Aadhaar numbers, or financial card numbers from customer accounts.
B. Appointment & Reservation Records
Chosen salon establishment, selected treatments/services, preferred stylist/specialist, scheduled appointment date, time slot, duration, customer booking notes, appointment status (e.g., confirmed, completed, cancelled, rescheduled), and payment method ("pay at salon").
C. Customer Preferences & Favorites
Salons saved to your personal favourites list, preferred Mumbai localities (e.g. Bandra West, Juhu, Colaba), preferred styling categories, and notification preferences.
D. Community Reviews & Ratings
Star ratings (1 to 5), written salon feedback, client display name, date of review, and helpfulness feedback.
E. Salon Provider & Partner Data
Business legal trade name, salon branding name, constitution (proprietorship, partnership, LLP, private limited), address, GPS coordinates, operating hours, service catalog, pricing, staff names/designations, and statutory compliance dossiers.
3. Location Information & Geolocation Boundaries
Glamourly provides an intelligent proximity search designed specifically for Mumbai neighborhoods. We handle location data with strict privacy controls:
- Explicit Browser Permission: We never access your device GPS coordinates automatically. Your browser will present an explicit prompt asking permission before any location data is shared.
- Transient Memory Processing: When granted, your latitude and longitude coordinates are used transiently in the active search session solely to calculate distance (in kilometers) to salons across Mumbai. We do not store, track, or maintain a historical log of your physical movements.
- Zero Continuous Background Tracking: Glamourly does not run background location listeners or monitor your whereabouts when you are not actively interacting with the Explore map.
- Manual Neighborhood Selection: If you decline browser location access, Glamourly functions completely through manual locality selection (e.g. Bandra West, Juhu, Colaba, Worli, Powai).
- Revocation: You can revoke location permissions at any time through your web browser or mobile operating system settings (Settings → Site Permissions → Location).
4. Authentication & Account Credentials
We employ state-of-the-art cryptographic safeguards to secure authentication credentials:
- Password Hashing: Passwords are never stored in plaintext. All account passwords undergo salted bcrypt hashing (cost factor 10) before database storage. Plaintext passwords cannot be read by Glamourly engineers or administrators.
- Google OAuth Integration: When signing in with Google, we authenticate identity using cryptographically signed Google ID tokens. We receive only your verified email, full name, and avatar image. We never receive or store your Google account password.
- Session Management: Sessions are tracked using randomly generated, high-entropy cryptographic tokens stored in an HttpOnly, SameSite=Lax cookie (
glamourly_session). Tokens are rotated upon sign-in and immediately invalidated on sign-out or account deletion. - Emergency Single-Use Recovery Codes: Users may generate single-use backup recovery codes. These codes are hashed before storage in the database, ensuring zero plain exposure.
5. Payment Architecture: Pay at Salon Model
Glamourly does NOT process online customer payments or collect credit card / debit card / UPI payment credentials for salon bookings.
All customer reservations made through Glamourly operate on an in-person "Pay at Salon" basis. Customers reserve appointment slots through the platform without upfront payment. Payment for services rendered is settled directly between the customer and the salon establishment at the salon counter, using the salon's own accepted payment methods (cash, UPI, debit/credit cards).
Consequently, Glamourly does not capture, store, or transmit your credit card numbers, CVVs, UPI PINs, or bank account credentials.
6. Third-Party Service Providers & Infrastructure
We partner with vetted, industry-leading cloud service providers strictly to deliver platform functionality. We do not sell or rent personal information to data brokers or advertising networks:
| Provider | Category | Data Processed | Data Region |
|---|---|---|---|
| MongoDB Atlas | Database & Cloud Storage | User profile details, appointment records, salon profiles, and compliance metadata. | AWS Asia-Pacific (Mumbai) Region |
| Vercel Inc. | Application Hosting & Edge Delivery | Transient HTTP request headers, IP addresses, and secure encrypted session cookies. | Global Edge Network with India presence |
| Google Identity Services | Authentication | Verified email address, full name, profile picture URL, and Google user ID. | Global |
| Cloudflare Turnstile | Bot Detection & Security | Client network telemetry and challenge solution tokens. No personal biometric or browsing history collected. | Global |
| OpenStreetMap & CartoDB Tile Services | Mapping & Geolocation | Tile coordinate requests (x, y, zoom). No individual user identity is passed to map tile servers. | Global |
8. Data Retention Framework
We retain personal data only for as long as necessary to fulfill the operational, statutory, and legal purposes outlined in this policy:
Retained for active account lifecycle plus 180 days post-deletion request for operational security audit, then permanently anonymized/purged.
Retained for 3 years to maintain statutory tax records, auditability, and salon financial reconciliation, with client personal identifiers redacted upon deletion.
Retained for active partner listing duration plus 5 years for statutory municipal/tax compliance verification.
Retained for 5 years to prove compliance with statutory digital privacy and contractual acceptance requirements.
9. Your Rights: Export, Deletion & Rectification
Under the Digital Personal Data Protection Act, 2023, you have clear statutory rights regarding your personal information. Glamourly makes these rights directly accessible via self-service controls in your account dashboard:
Right to Data Portability (Download My Data)
You can download a complete, structured JSON archive of your personal profile, past appointments, community reviews, saved salons, and consent logs at any time via Account → Security & Privacy → Download My Data.
Right to Erasure (Delete Account & Anonymization)
You can permanently delete your customer account via Account → Security & Privacy → Delete My Account. Upon deletion, all your sessions are revoked, favorites and notification records purged, and your name and contact identifiers on historic salon appointments are permanently anonymized to preserve operational and tax record integrity.
Right to Rectification & Profile Updates
You may correct your name, mobile phone number, gender, and appointment styling preferences at any time in Account → Personal Profile.
10. Email & In-App Notifications
We strictly distinguish between mandatory transactional notifications and optional marketing communications:
- Transactional Communications (Essential): Appointment booking confirmations, rescheduling updates, salon cancellation notices, and password reset OTPs. These are necessary to fulfill the reservation and cannot be disabled while maintaining an active booking.
- Marketing & Curated Insights (Opt-in Only): Special salon discounts, seasonal beauty trends in Mumbai, and new salon openings. We only send marketing updates if you have explicitly checked the promotional consent box during signup or in your Account Preferences. You may opt out anytime without affecting your appointment booking capabilities.
11. AI Beauty Concierge & Data Processing
Glamourly provides an intelligent conversational assistant to help you discover salon services and explore hair and skincare treatments across Mumbai. Regarding your AI chat interactions:
- Conversational queries submitted to the AI Concierge are processed in real-time solely to return relevant salon recommendations and treatment insights.
- We do NOT sell, license, or provide your conversational inquiries or appointment records to third-party advertising networks.
- Please refrain from sharing sensitive financial information, passwords, or government identification numbers in conversational chat windows.
12. Customer Reviews & Public Visibility
When you submit a salon review or rating on Glamourly:
- Your review text, rating (1–5 stars), and first name/display name will be publicly visible on the salon's profile page to assist the Mumbai community in evaluating service quality.
- Your phone number, email address, and home address are NEVER displayed with public reviews.
- Reviews undergo automated community moderation to filter hate speech, commercial spam, and profanity.
- If you delete your customer account, your submitted reviews remain as anonymous community feedback, but your identity is permanently detached and replaced with "Former Client".
13. Salon Provider Verification Dossiers & Statutory Confidentiality
To maintain marketplace integrity and consumer safety, all salon partner establishments undergo statutory compliance screening before public listing:
- Collected Compliance Documents: Permanent Account Number (PAN), Municipal Shop & Establishment Gumasta license, GSTIN registration certificate, trade/health licenses, premises lease deeds or proof of ownership, and identity proofs of authorized representatives.
- Strict Non-Public Storage: Statutory compliance dossiers, tax registration documents, and lease contracts uploaded during provider onboarding are strictly confidential. They are NEVER published on public salon profiles or shared with customer accounts.
- Restricted Administrative Access: Access to provider verification documents is restricted solely to authorized Glamourly platform audit personnel and legal compliance officers.
14. Security Safeguards & Encryption Standards
Glamourly implements robust technical and organizational security measures to protect user data against unauthorized access, loss, or alteration:
- Encryption in Transit: 100% of data transmitted between client browsers and Glamourly servers is encrypted using modern TLS (HTTPS) with strong cipher suites.
- Cryptographic Password Protection: Account passwords are salted and hashed using bcrypt before database storage. Plaintext passwords never touch disk storage.
- Session Isolation: Secure HttpOnly, SameSite cookies protect against XSS and session hijacking.
- Database Firewalls: Persistent database clusters are hosted in secure AWS Asia-Pacific (Mumbai) virtual private clouds with IP allowlisting and network segmentation.
15. Security Incident & Breach Response Protocol
In the event of a confirmed security incident affecting personal data:
- Our security team will immediately take containment measures to isolate affected services, revoke compromised sessions, and patch vulnerabilities.
- We will investigate the nature, scope, and impact of the incident in accordance with applicable Indian cyber law guidelines.
- Where mandated under the Digital Personal Data Protection Act, 2023, and Indian Computer Emergency Response Team (CERT-In) guidelines, we will notify affected users and the Data Protection Board without unreasonable delay, providing actionable guidance on protective steps.
16. Minimum Age & Children's Privacy
Glamourly is intended for use by individuals who are at least 18 years of age (the age of majority in India). We do not knowingly solicit, collect, or store personal information from minors under 18 years without verified parental or legal guardian consent. If we discover that an account has been created by an unsupervised minor, we will promptly deactivate the account and delete associated personal data.
Document Version History
Initial production release of comprehensive privacy framework, location data boundaries, pay-at-salon disclosure, data export, and self-service account deletion.
Grievance Redressal & Statutory Contact
In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the contact details of the Grievance Officer are published below:
Designation: Grievance & Data Protection Officer
Email: care@glamourly.in
Address: Glamourly Grievance Cell, Mumbai, Maharashtra 400050, India
Response Timeline: Within 24 to 48 business hours acknowledgement; resolution within 15 calendar days