Privacy Policy

This Privacy Policy applies to all users of the Studiotag platform, including Service Providers (studio owners and their team members), Customers (end users who book sessions), and visitors to our website. It covers personal data processed in connection with the creation of accounts, use of platform features, payment processing, and communications we send.

This policy does not apply to third-party websites or services linked from within the platform. We encourage you to review the privacy policies of any third-party services you access through or alongside Studiotag.

We process your personal data on the following legal bases under applicable data protection laws (including the General Data Protection Regulation, or GDPR, for users in the European Economic Area and the United Kingdom):

• Performance of a Contract: Processing your account information, business data, and payment details is necessary to provide the Service you have contracted with us to receive. Without this, we cannot operate your account.
• Legitimate Interests: We process certain data (such as usage analytics, server logs, and security monitoring) for our legitimate interests in operating, improving, and securing the platform, provided these interests are not overridden by your rights.
• Legal Obligation: We may process or retain certain data (such as payment and tax records) to comply with applicable laws, court orders, or regulatory requirements.
• Consent: Where we rely on your consent (for example, for certain marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. See Section 5 for details on email preferences.

We use the information we collect to:

• Provide, operate, maintain, and improve the Studiotag platform and its features.
• Create and manage your account, workspace, and team members.
• Process payments, manage subscription billing, and handle Razorpay webhooks.
• Send transactional emails necessary for the Service: email verification, password resets, booking confirmations, OTP codes, booking notifications, and payment receipts.
• Send appointment reminders to your customers on your behalf, but only when you have configured and triggered this feature within the platform.
• Generate AI-powered business insights using anonymized, aggregated data from your account (see Section 2.3).
• Detect country of origin to present correct currency and pricing.
• Monitor platform health, detect errors, investigate security incidents, and prevent fraud or abuse.
• Enforce our Terms of Service and this Privacy Policy.
• Respond to your support requests, inquiries, and legal requests.
• Comply with applicable laws and fulfill legal obligations.

We do notsell, rent, or trade your personal data or your customers' data to any third party for advertising, marketing, or any other commercial purpose.

From time to time, we may send you product updates, feature announcements, tips, and other marketing communications about Studiotag. We will only send such emails to Service Providers who have registered for an account.

Your right to opt out:You can unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link included in the footer of every marketing email we send, or by visiting studiotag.org/unsubscribe. Opting out will not affect transactional emails that are necessary for the operation of your account (such as booking confirmations, password resets, email verification, and payment receipts).

We record your unsubscribe preference in our system and honor it promptly. If you continue to receive emails after opting out, please allow a few business days for processing and contact us at hello@studiotag.org.

Studiotag is a multi-tenant platform. Each Service Provider's data is strictly isolated. Every database query is scoped to your unique Service Provider ID — it is architecturally enforced at the API layer that one Service Provider cannot access another Service Provider's data. This isolation applies to customers, appointments, staff, invoices, services, and all other business data.

Team members (staff and admins) you invite to your workspace can only access your workspace. They cannot access any other Service Provider's data. Role-based access control (RBAC) governs which features each team member can access within your workspace.

We share your information only in the following circumstances:

Studiotag is operated from India. Our infrastructure (Vercel, MongoDB Atlas, Cloudflare R2) may store and process data in servers located in various countries, including the United States and the European Union. If you are accessing the Service from outside India, your data may be transferred to and processed in countries that may have different data protection standards than your country of residence.

For users in the European Economic Area (EEA) or the United Kingdom, such transfers are carried out under appropriate safeguards, including Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms established by the applicable data protection authority. By using the Service, you consent to such international transfers where applicable.

If you have questions about the safeguards we use for international data transfers, please contact us at hello@studiotag.org.

We retain your account and business data for as long as your account remains active or as needed to provide the Service and support legitimate business operations.

• Active Accounts: Data is retained indefinitely while your account is active.
• Account Deletion: If you request deletion of your account, we will delete or anonymize your Service Provider data within 30 days of your request, except where retention is required by law.
• Financial Records: Payment transaction records, invoices, and related financial data may be retained for up to 7 years to comply with Indian tax and accounting regulations (GST, Income Tax Act).
• Email Verification and Password Reset Tokens: These expire automatically (24 hours and 1 hour, respectively) and are deleted upon use or expiry.
• Session Tokens: JWT session tokens expire within 24 hours. There are no persistent long-lived refresh tokens.
• Server Logs: Application and access logs are retained for up to 90 days for security and debugging purposes.
• Unsubscribe Records: Email unsubscribe preferences are retained indefinitely to honor your opt-out preference.

We implement industry-standard and defense-in-depth security measures, including:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS 1.2 or higher.
• Encryption at Rest: Data stored in MongoDB Atlas is encrypted at rest using AES-256.
• Password Hashing: Passwords are hashed using bcrypt with a cost factor of 10 before storage. Plaintext passwords are never stored or logged.
• Authentication Tokens: JWT session tokens are short-lived, signed with a strong secret, and transmitted via HTTP-only secure cookies to mitigate XSS risks.
• Multi-Tenant Data Isolation: Every API endpoint enforces Service Provider ID scoping to prevent cross-tenant data access at the application layer.
• Rate Limiting: API endpoints, particularly authentication routes (login, registration, password reset), are rate-limited per IP address to prevent brute-force attacks.
• Access Control: Role-based access control (RBAC) ensures team members can only access the features and data their role permits within a workspace.
• Dependency Security: We regularly review and update third-party dependencies to address known security vulnerabilities.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and notifying us immediately if you suspect unauthorized access.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by applicable law (e.g., GDPR Article 33).
• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, describing the nature of the breach, the data categories affected, the likely consequences, and the measures we have taken or propose to take.

We maintain an internal incident response process to detect, contain, and remediate security incidents. If you believe your account has been compromised, please contact us immediately at hello@studiotag.org.

Studiotag is a professional business management platform intended for use by adults (18 years or older) operating businesses. We do not knowingly collect, process, or store personal information from children under the age of 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take prompt steps to delete that information. If you believe a child has provided us with personal information, please contact us at hello@studiotag.org immediately.

The platform may contain links to third-party websites, integrations, or services. This Privacy Policy does not apply to those third-party sites. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any third-party services you use in connection with Studiotag.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an email notification to registered Service Providers at least 14 days before the changes take effect.
• Display a prominent notice within the platform dashboard.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should discontinue use of the Service and may request account deletion by contacting us.

Studiotag is the data controller for personal data processed in connection with your account and use of the Service. If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Mobile Number: +91 80976 90137
• Email: hello@studiotag.org
• Website: https://www.studiotag.org
• Subject Line:"Privacy Request" or "Data Protection" for faster routing.

We aim to respond to all privacy-related inquiries within 10 business days. For verifiable consumer requests under GDPR or CCPA, response time is within 30 days.