Privacy Policy

1. Introduction

Boutique Manager Technologies ("Boutique Manager", "we", "us", or "our") provides cloud-based Software-as-a-Service (SaaS) management solutions for boutiques, tailoring ateliers, alteration shops, and designer fashion studios. This Privacy Policy outlines how we collect, process, store, and safeguard personal and business data when you visit our marketing website (https://boutiqmanager.com) or subscribe to our cloud software applications.

2. Scope & Applicability

This Privacy Policy complies with applicable data protection laws, including:

• The Digital Personal Data Protection (DPDP) Act, 2023 (India)
• The Information Technology Act, 2000 and SPDI Rules (India)
• The General Data Protection Regulation (GDPR) (EU/UK) for international subscribers
• Payment Card Industry Data Security Standards (PCI-DSS)

3. Information We Collect

We collect information strictly necessary to provide and invoice our SaaS service:

A. Account Registration & Billing Data

• Account Profile: Name, boutique/studio name, registered business address, business email, and phone/WhatsApp contact.
• Tax & Billing Details: GSTIN (for Indian enterprises), business registration numbers, and invoicing billing address.
• Payment Information: We do NOT store payment card numbers, CVVs, or NetBanking passwords. Payment processing is tokenized through our certified payment gateway (Razorpay for Indian & International payments).

B. Boutique Operational Data (Stored on Your Behalf as Data Processor)

• Customer Records: Client names, phone numbers, delivery addresses, and anniversary/birthday markers entered by your boutique.
• Measurement Vault Records: Body measurements, garment templates, versioning revisions, and custom fitting notes.
• Order Tickets: Garment descriptions, turnaround deadlines, fabric intake photos, style sketches, and workshop notes.
• Invoices & Payments: Service prices, advance payments, balance receipts, and discounts recorded in your workspace.

4. How We Use Your Information

We process collected data solely for the following legitimate business purposes:

• To provision, authenticate, and maintain your boutique's cloud workspace.
• To calculate turnaround estimates, organize atelier production queues, and generate itemized client orders and billing summaries.
• To process subscription billing and issue tax-compliant invoices.
• To provide customer support and troubleshoot technical issues with your permission.
• To detect and prevent fraudulent account access or unauthorized usage.

5. Customer & Measurement Data Ownership

You own 100% of your data. All customer contacts, measurement histories, and workshop photos entered into your Boutique Manager instance remain the sole intellectual property of your boutique. We act strictly as a "Data Processor" / "Data Fiduciary Agent". We do not cross-market to your customers, contact them, or use your measurement records for algorithmic profiling.

6. Third-Party Sub-Processors

We partner only with industry-leading infrastructure and payment partners that maintain strict compliance standards:

• Razorpay Software Pvt. Ltd.: Secure payment gateway for Indian & International transactions, including UPI, NetBanking, Cards, and global multi-currency subscriptions (PCI-DSS Level 1).
• Cloud Infrastructure: High-availability cloud servers located in Tier-4 data centers with automated daily encrypted backups.
• Email Delivery Infrastructure: Enterprise transactional email delivery services for sending workspace password resets and billing tax receipts.

7. Data Security Measures

We implement comprehensive security controls to protect your studio data:

• Encryption in Transit: 256-bit TLS/SSL encryption for all data exchanged between your devices and our servers.
• Encryption at Rest: AES-256 encrypted database storage and automated daily disaster recovery backups.
• Role-Based Access Control (RBAC): Granular staff permissions preventing workshop tailors from viewing business revenues or exporting client contact lists.
• Super Admin Access Controls: Support personnel cannot access your boutique data without a time-limited authorization token granted by the owner.

8. Data Retention & Your Rights

You have the right to access, rectify, export, or delete your boutique records at any time:

• Data Export: Export your full customer directory, measurement versions, and order records to CSV/Excel at any time from your settings panel.
• Data Deletion: Upon subscription cancellation or account closure, you may request permanent purging of your workspace data. Unsubscribed accounts are queued for permanent deletion after 60 days.

9. Cookies & Analytical Technologies

Our marketing website and SaaS application use essential cookies required for authentication, security, session continuity, and core product operation.

We use Google Analytics 4 to understand aggregated website and product usage, including page views, sign-in and sign-up completion, onboarding completion, subscription checkout steps, plan and billing-cycle interest, coupon performance, and broad feature adoption. These analytics help us improve product experience, pricing decisions, and growth campaigns.

We do not send customer names, phone numbers, WhatsApp numbers, email addresses, postal addresses, invoice/order/customer identifiers, measurement values, style notes, payment card details, Razorpay payment identifiers, webhook secrets, passwords, or other customer-entered boutique records to Google Analytics.

Analytics events are limited to privacy-safe business and product context, such as country/currency, plan type, billing cycle, discount/tax totals, checkout status, and whether a feature was used. We do not use third-party behavioral advertising cookies that track your browsing across unrelated external websites.

10. Grievance Officer & Contact Information

In compliance with the Information Technology Act, 2000 and DPDP Act, 2023, if you have any questions or complaints regarding our data protection practices, please contact our designated Grievance Officer:

11. Updates to this Policy

We may update this Privacy Policy periodically to reflect technological improvements or regulatory revisions. Active subscribers will be notified via email or dashboard notification at least 15 days prior to any material modifications.