Privacy at Novaru

1. Who is responsible

Novaru is operated by Sornad Pinto (OPC) Private Limited, with its registered office at 204, 4th cross, 3rd Block, HRBR Layout, HRBR Layout, Bengaluru, Bengaluru Urban, Karnataka, 560043. In this notice, “Novaru”, “we” and “us” refer to that legal entity when it provides the Novaru service.

For a salon customer's booking, visit, bill, preferences and communications, the salon or other business named on the booking page, receipt or message decides why and how that data is used. That business is the primary data fiduciary (or controller). Novaru provides the software and processes that customer data on the business's documented instructions.

Where a salon and Novaru happen to be operated by the same legal entity, their roles remain purpose-specific: the named salon controls its customer relationship and communications, while the Novaru service provides the technology and security controls.

Novaru is independently responsible for the data it uses to administer subscriptions, secure the service, provide support, prevent misuse and meet its own legal obligations. Novaru does not own a salon's customer list and does not combine one salon's list with another salon's data.

2. Data we process

• Identity and contact details, such as name, mobile number, email and customer identifier.
• Appointment, service and preference details, including notes the customer or salon chooses to provide.
• Bills, payment status and payment references. Full card or UPI credentials are handled by the relevant payment provider, not stored by Novaru.
• Membership, package, cashback and visit history.
• Communication preferences, the notice shown, collection source, time, actor and message/delivery records.
• Salon staff, account, role, attendance and payroll data where the salon uses those features.
• Device, sign-in, diagnostic, audit and security information needed to operate and protect the service.

3. Why data is used

We process data to provide booking, billing, customer relationship, inventory, staff and reporting functions; maintain accurate records; support and secure the service; prevent fraud and misuse; comply with law; and carry out communications chosen by the salon and permitted by the customer.

We do not sell salon customer data. We do not use one tenant's customer data to market another tenant. Product analytics should use aggregate or de-identified information where practical.

4. WhatsApp choices and human control

WhatsApp choices are separated into:

• Transactions: bills, receipts, payment confirmations and appointment confirmations.
• Service info: appointment reminders and neutral membership or package-expiry notices.
• Marketing: discounts, offers, member promotions, reactivation, festive and seasonal campaigns.

A choice is optional and does not affect access to the salon's services. No category is enabled by silence or by an old general-purpose WhatsApp flag. A salon user must deliberately initiate and confirm a send; Novaru may suggest an audience or draft, but does not autonomously send it. A current affirmative choice is checked when a message is queued and again immediately before delivery.

During the initial pilot, the salon's preference link or QR code prepares a tenant-addressed WhatsApp declaration. The customer reviews and sends it, and the receptionist records the choice against that salon's customer profile; the public link does not change the database by itself. Customers can also ask the salon to change a choice. STOP/START automation will be enabled only when the production WhatsApp webhook is live. Withdrawal is as easy as giving the choice and applies prospectively; records already required for billing, security or legal compliance may remain.

5. Who receives data

Data is available to authorised people at the relevant salon according to their role. We also use service providers under contractual and security restrictions, including cloud hosting and database providers; Meta/WhatsApp only when WhatsApp communication is enabled; payment providers only when payments are enabled; and optional AI or support providers only for a feature the authorised salon user invokes. These providers may process data in India or other locations, subject to applicable transfer restrictions and safeguards.

We may disclose information where required by law, to protect people or the service, or during a business reorganisation with appropriate confidentiality and notice.

6. Retention and deletion

The salon sets retention for its customer and operational data, subject to legal requirements such as tax and accounting recordkeeping. Novaru keeps active-tenant data while needed to provide the service. An offboarding tenant has a 30-day export/offboarding window. Following an authorised deletion instruction, eligible production data is deleted within 30 days and expires from protected backups within 90 days, unless law, fraud prevention, a dispute or security requires a limited record for longer.

Consent and message evidence is normally retained for one year after the event so the salon and Novaru can demonstrate the choice that applied, investigate a complaint and prevent repeat messaging. A documented dispute, legal hold or legal requirement may extend that period. The current communication preference remains on the customer profile until changed or the profile is lawfully deleted.

7. Security and tenant separation

Novaru uses tenant-scoped storage, authenticated access, role permissions, server-authorised sensitive writes, audit trails, encryption provided by its cloud platform, secret management, backups and monitoring. A user's verified tenant identity—not a tenant identifier supplied by the browser—selects authenticated business data. Public booking forms validate the tenant and write through rate-limited server functions; the pilot communication-choice QR only prepares a message addressed to the selected tenant. No system is risk-free; suspected incidents should be reported promptly.

8. Your choices and rights

Depending on applicable law, a person may ask for access to a summary of their data, correction, erasure, withdrawal of consent and grievance redressal, and may nominate another person where the law provides. Salon customers should normally contact the salon first because it controls the customer relationship. Novaru will assist the salon and will respond directly where Novaru is responsible.

Requests can be sent to sornad.pinto@gmail.com. We may verify identity and authority before disclosing or deleting data. Instructions are also available on the data deletion page.

9. Children

Salons may serve minors. Marketing consent cannot be enabled for a customer known to be under 18. Necessary transaction and neutral service records may be retained and used only as permitted for providing the service and meeting legal obligations. The salon is responsible for any parent or lawful guardian authorisation required before entering or otherwise using a child's data. Novaru does not knowingly use children's salon records for behavioural monitoring or targeted advertising.

10. Changes and contact

We may update this notice as the service or law changes. Material changes will be identified by a new effective date and communicated to tenant administrators where appropriate. The responsible contact is the Director. Questions, grievances and security reports may be sent to sornad.pinto@gmail.com or by post to the registered address in section 1.