Privacy Policy

Effective 13 October 2026

This policy explains what personal data ProtaLine collects, why, who sees it and what you can do about it. It is written for two groups: people who book at a salon or barbershop (customers) and the people who work there (shop staff).

Who we are

ProtaLine is run by Dave Fenil Hiteshbhai, trading as Bhramaa Technologies, a sole proprietorship in Rajkot, Gujarat, India (GSTIN 24FRHPD8765E1ZN). Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for your ProtaLine account. Our address is at the foot of this page.

Each shop that uses ProtaLine also keeps its own record of its customers. For that record, the shop decides what it does with your data, and we process it on the shop's behalf.

What we collect from customers

Phone number. We use it to sign you in with a one-time code (OTP) and to send booking messages.
Sign in with Google or Apple, if you choose it. We receive an account identifier, your name and, if provided, your profile photo. We do not receive your password.
Your name, so the shop knows who is coming.
Bookings. The shop, branch, services, artist, time, queue position and visit status, including cancellations and no-shows.
Notes you write to the shop when you book.
Your answers to the shop's offers, such as "come early" or "move to a new time".
Ratings and tips you leave after a visit, where the shop offers them.
Family members you book for, such as a child's name, when you use family booking.
Device push token, if you use the ProtaLine app and allow notifications. It lets us send booking updates to your phone.
Approximate location, only when you search for shops near you. It is used on your device to sort results. It does not leave your device unless you choose to share it with a search. Your recent searches are also kept only on your device.
Payment details for a booking fee. If a shop asks for a booking fee, you approve a UPI mandate in your own UPI app. We see the amount, the status and a reference from the payment gateway. We never see your UPI PIN, card number or bank login.

What we collect from shop staff

Login details: name, email or mobile number, and a password (stored only as a one-way hash).
Staff phone number, held on the shop's record, used to send a one-time code if you reset your password.
Work activity: your role, branch, hours, time off, the bookings you served, services, ratings and tips linked to you.
The shop owner's business details: business name, branches, address, GSTIN (optional), billing history and the details the payment gateway needs to onboard the shop.

Cookies and similar storage

On the web, we use a small number of cookies that the service needs to work:

a session cookie that keeps you signed in, and
a cookie that remembers the last shop you booked with, so the next booking is faster.

We also use Vercel Web Analytics on the website to count page visits. It does not set cookies and does not track you across other sites.

We do not use advertising cookies or ad trackers, and we do not sell your data.

Why we use your data

To create and manage bookings and the live queue.
To send booking confirmations, reminders, queue updates and changes, by app notification, WhatsApp or SMS.
To sign you in and keep your account secure.
To process booking fees, refunds and the shop's settlement through the payment gateway.
To bill shops for their ProtaLine subscription and issue GST invoices.
To find and fix faults, and to prevent misuse.
To meet legal duties, such as tax records.

We rely on your consent, which you give when you book or sign in, and on the legitimate uses the DPDP Act allows, such as providing a service you asked for and meeting legal obligations.

Who sees your data

The shop you book with

When you book, the shop receives your name, phone number, booking details and any note you write. Each shop sees only its own customers. A shop never sees your bookings at another shop. Shop staff see only what their role allows.

Service providers

We use these providers to run ProtaLine. They process data only on our instructions.

Hosting and database: Vercel (the web app) and Supabase, with the database in Mumbai, India (AWS ap-south-1). Shop and profile photos are stored with Vercel and may be served from outside India.
Messaging: a TRAI-registered SMS and WhatsApp provider, which delivers booking messages.
Payments: an RBI-licensed payment gateway that handles booking fees, shop settlements and subscription payments.
App notifications: Expo's push service, which passes notifications to Google (Android) and Apple (iOS).
Maps: Google Maps geocoding, used only to place a shop's address on the map. Your address and location are not sent to it. Google Places supplies public business details for shop listings.
Error reports: Sentry, which receives crash reports from the app.
Website analytics: Vercel Web Analytics, which counts page visits without cookies.

We may also share data when the law requires it, for example on a valid order from a court or government authority.

Bank account details

When a shop adds a bank account for payouts, the account number and IFSC are passed straight to the payment gateway for verification. We never store them and never log them. We keep only the bank name, the last four digits and the verified account holder's name, so the shop can recognise its account.

ProtaLine has two separate payment flows that never mix. Money a customer pays to a shop goes to the shop through the gateway. Subscription fees a shop pays to us go to us.

Where your data is stored

Our main database is in Mumbai, India. Some providers above may process data outside India, for example to deliver an app notification. We only use providers that protect data to a standard we consider appropriate, and we follow any transfer limits set by the Government of India under the DPDP Act.

How long we keep data

Your ProtaLine account stays until you delete it.
One-time sign-in codes expire within minutes and are not reused.
Sign-in sessions and push tokens are removed when you sign out, delete your account, or stop using the device.
A shop's records of your visits (bookings, payments, ratings) are the shop's business records. The shop keeps them for its own accounts and legal duties, even after you delete your ProtaLine account.
Payment, invoice and settlement records are kept for 8 years, as Indian tax law requires.
Shop accounts that cancel keep their data for 90 days, so the shop can come back. After that we delete it, except the financial records above.

Deleting your account

In the ProtaLine app, go to Profile → Delete account and confirm. Sign-in stops straight away: this signs you out on every device and removes your push tokens. Your ProtaLineaccount, its bookings and your links to shops are removed within 30 days.

You can also email support@bhramaatechnologies.com and include the phone number on your account. We complete email requests within 30 days.

Deleting your ProtaLine account does not delete the visit records each shop holds about you. To ask a shop to delete those, contact the shop, or write to us and we will pass your request on.

Your rights

Under the DPDP Act you have the right to:

Access a summary of the personal data we hold about you and who we shared it with.
Correct or update data that is wrong or out of date.
Erase data we no longer need, and withdraw consent at any time.
Nominate someone to use these rights for you if you die or cannot act.
Raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

To use any right, email support@bhramaatechnologies.com. We may ask you to confirm your phone number first.

Grievance officer

Fenil Dave
Email: support@bhramaatechnologies.com
Address: as shown at the foot of this page.

We acknowledge a grievance within 48 hours and aim to resolve it within 30 days.

Children

ProtaLine is not meant for anyone under 18 to use on their own. A parent or guardian may book for a child and manage that booking. If you think a child has given us data without a guardian, email us and we will delete it.

Security

We encrypt data in transit and at rest. Each shop's data is kept apart from every other shop's at the database level. Passwords are stored only as one-way hashes. Staff access is limited by role. No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Board as the law requires.

Changes to this policy

We may update this policy. We will change the date at the top, and tell you in the app or by message if a change is significant.

Contact

Privacy questions: support@bhramaatechnologies.com. Anything else: support@bhramaatechnologies.com. See also our Terms and Support page.