Privacy policy

SmartBoutique is software for boutiques and clothing and fashion shops, run by QuantumBytes (GSTIN 03ITGPS1363P1Z3), H.No S-297, Village Ugoke, Tehsil Tapa, Barnala, Punjab 148108, India. In this policy, "boutique" means any shop or business that uses SmartBoutique. This policy explains how we handle personal data, in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and other Indian laws.

Our role depends on whose data it is:

• Your account data (the boutique owner and your team): we decide how it is used, so we are responsible for it (a "data fiduciary" under the DPDP Act).
• Data your boutique keeps about its own customers and shoppers (names, phone numbers, measurements, orders, addresses): your boutique decides how it is used and is responsible for it. We process it only on your instructions, to run the service for you (we are your "data processor").

When you sign up and sign in

• Boutique name, owner name, mobile number, email, city and address. Optional details such as GSTIN and logo.
• Your password, stored only as a secure one-way hash. Login codes sent on WhatsApp or email are also stored only as hashes and expire quickly.
• Sign-in records for security: date and time, IP address and device or browser type.

Your team

• Names, phone numbers and roles of co-owners, staff, tailors and helpers you add.
• If you use the staff features: attendance times, leave, salary and advances. If you switch on the location check for attendance, the staff member's phone location is used at punch-in only to check they are at the shop. We do not keep a location history.

Your boutique records

• Customers, measurements, design and cloth photos, orders, payments and khata, quotations, products and stock, expenses, and anything else you type or upload.

Online store shoppers

• If your boutique runs an online store: the shopper's name, phone number, delivery address, order details and payment status, and any enquiry they send. Shoppers do not need an account.

Payments

• For subscription and WhatsApp credit payments we keep the amount, plan, date, status and the gateway's payment reference, and any payment proof you send us. Card, UPI and bank details are entered on the payment gateway's page and are not stored by us.

WhatsApp messages

• For messages sent through SmartBoutique: the recipient's number, the message template and its delivery status.

Visitors to this website

• If you fill a form (for example contact, demo or partner): your name, phone, and any email, boutique name, city and message you give us.
• A simple count of clicks on WhatsApp buttons and form submissions, with the page they came from.
• If switched on, Google Analytics and Meta Pixel on our public website (see Cookies below).

• To run SmartBoutique for you: show your records, send bills and updates, run your online store, and keep your account secure.
• To send messages you or your settings ask for, such as login codes, order updates, payment receipts and reminders.
• To send service messages about your account, such as trial ending, renewal due, payment receipts, GST invoices and important changes.
• To answer your support requests and demo or contact requests.
• To stop fraud, spam and misuse, and to meet our legal and tax duties.
• To improve the product using overall usage patterns.

• We do not sell or rent personal data to anyone.
• We do not use your boutique's customer data for our own marketing, and we do not contact your customers for our own purposes.
• We do not put advertising or analytics trackers inside the logged-in app where your boutique records are shown.

We share data only with providers we need to run the service, and only what each one needs:

• Hosting: our servers are hosted in India (DigitalOcean). Website traffic passes through Cloudflare for speed and protection against attacks.
• WhatsApp: Meta Platforms (WhatsApp Business Platform / Cloud API) for messages from our official number. If you link your own number, messages are sent from your number through our WhatsApp gateway.
• Payments: payment gateways such as Razorpay, Cashfree, PayU, PhonePe or Paytm, for our subscription payments, and for your online store if you connect your own gateway account.
• Email: an email delivery provider, to send login codes, receipts and service emails.
• Website analytics (public website only, if switched on): Google (Analytics) and Meta (Pixel).

Some of these providers may process data outside India as part of their normal service. We may also share data when the law requires it, for example with tax authorities or on a valid order from a court or government agency.

Our support team can open your account to help you when you ask for help. These support sessions are time-limited and recorded.

Your data is stored on our servers hosted in India. Each boutique's data is kept separate and is visible only to that boutique's logins. Everything travels over HTTPS. Payment gateway keys and similar secrets are stored encrypted. The database and uploaded photos are backed up every day.

See our data security page for more detail. No system is 100% secure, but we take care to protect your data and will tell you and the authorities as the law requires if a breach affects you.

• While your account exists: we keep your records so you can use them. If your plan ends and you do not renew, your data stays in read-only mode so you can come back.
• When you delete your account (or ask us to): the boutique and its records are removed from our live database. Copies in our daily backups are removed as the backups roll over, within about 30 days.
• Payment and invoice records may be kept longer where tax or accounting laws require it.
• Website form details are kept while we are in touch with you, and deleted on request.

Under the DPDP Act you can:

• See and correct your data: most of it you can view and edit yourself in the app. For anything else, write to us.
• Get a copy: ask us and we will send you an export of your boutique's data. Some reports (such as sales and GST) can also be downloaded as CSV from inside the app.
• Delete: the owner can permanently delete the boutique and all its data from the SmartBoutique mobile app (Profile → Delete boutique & account). Staff can delete their own login the same way. You can also email us and we will do it for you.
• Withdraw consent for optional things, such as marketing messages, at any time.
• Raise a grievance with us (below), and if you are not satisfied, with the Data Protection Board of India.
• Nominate a person to use these rights for you in case of death or incapacity.

Customers and shoppers of a boutique: the boutique is responsible for your data. Please contact the boutique first. If you cannot reach them, write to us and we will help pass on your request.

• Essential cookies: a secure login cookie keeps you signed in, and a few small settings are stored in your browser (for example, an online store shopper's bag). The service does not work without these.
• Analytics cookies (public website only, if switched on): Google Analytics and Meta Pixel help us understand visits and measure our ads. You can block these with your browser settings or an ad blocker, and the site will still work.

SmartBoutique is a business tool for adults. Accounts are for people aged 18 or over. A boutique may record measurements for a child customer with the parent's or guardian's agreement; the boutique is responsible for getting that agreement.

We may update this policy as the product or the law changes. The date at the top shows the latest version. We will tell you about important changes in the app, on WhatsApp or by email.

For any privacy question, request or complaint, write to our grievance contact at support@quantumbytes.co.in (subject: "Privacy"), or WhatsApp / call +91 94782 10404. Post: QuantumBytes, H.No S-297, Village Ugoke, Tehsil Tapa, Barnala, Punjab 148108, India. We aim to reply within 7 working days.