Privacy Policy

Effective date: 1 June 2026 · Last updated: 1 June 2026

This Privacy Policy explains how Social Avatar (“we”, “us”, “Appointiqa”) collects, uses, and protects personal data in connection with the Appointiqa platform. We are committed to compliance with India’s Digital Personal Data Protection Act 2023 (DPDP Act).

1. Who this policy applies to

This policy covers two categories of people:

Tenants — businesses and individuals who register for an Appointiqa account.
End Customers — people who book appointments through a Tenant’s Booking Page. For End Customers, Appointiqa processes data on behalf of the Tenant. The Tenant is the data fiduciary; Appointiqa is the data processor.

2. What data we collect

Category	Data collected	From whom
Tenant account	Business name, subdomain, owner name, email address, phone number, state, city, password (hashed)	Tenant at signup
Tenant business profile	Logo, cover photo, tagline, about text, highlights, contact details	Tenant in settings
Booking records	Customer name, email, phone number, booking date, service, notes, custom field answers, payment status	End Customer at booking
Payment data	Razorpay order ID and payment ID only. We never collect or store card numbers, bank details, or UPI credentials.	Razorpay (payment processor)
Usage data	IP address, browser type, pages visited, timestamps — collected automatically for security and analytics	All users
WhatsApp verification	Phone number, OTP hash (not the OTP itself)	Tenant at signup; End Customer if WhatsApp opted in

3. How we use your data

Tenant data is used to operate your account, send you platform notifications, process your subscription, and improve the Platform.
End Customer data is used solely to facilitate bookings on behalf of the Tenant. We do not use End Customer data for marketing, profiling, or any purpose beyond booking management.
IP addresses are logged for security purposes (e.g. detecting fraud, rate-limiting) and for audit trails (Terms of Service acceptance).
We do not sell personal data to any third party.

4. Third parties we share data with

Third party	What is shared	Purpose
Razorpay	Order amount, currency, customer name for prefill	Payment processing
Meta (WhatsApp Business API)	Customer phone number	Sending booking confirmations via WhatsApp (only if customer opted in)
Google (Sheets, Fonts)	Booking data (if tenant enables Google Sheets sync); no personal data sent to Google Fonts	Tenant-configured data export; font rendering
Email (SMTP)	Customer name, email, booking details	Sending booking confirmation emails

We require all third-party processors to protect personal data in accordance with applicable law.

5. Data retention

Tenant account data is retained for the duration of the subscription and for 90 days after account termination.
Booking records are retained for 3 years from the date of the booking to support business records and dispute resolution.
OTP records are deleted or expire automatically within 24 hours.
You may request deletion of your data by contacting us at legal@appointiqa.com. Note that some data may be retained where required by law.

6. Your rights under the DPDP Act 2023

As a Data Principal under India’s Digital Personal Data Protection Act 2023, you have the right to:

Access the personal data we hold about you.
Correct inaccurate personal data.
Request erasure of your personal data (subject to legal retention requirements).
Withdraw consent to data processing (which may result in account termination).
Nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at legal@appointiqa.com. We will respond within 30 days.

7. Security

We implement industry-standard security measures including encrypted data transmission (HTTPS/TLS), hashed password storage, WhatsApp two-factor authentication for admin logins, rate limiting, and regular backups. No system is completely secure; we cannot guarantee absolute security but we take reasonable precautions.

8. Cookies

We use session cookies to keep you logged in to your admin dashboard. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Disabling cookies will prevent you from logging in to your account.

9. Children’s privacy

The Appointiqa Platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email. The effective date at the top of this page will always reflect the most recent version.

11. Contact

For any privacy-related queries or to exercise your rights: legal@appointiqa.com
Social Avatar, Thiruvananthapuram, Kerala, India.