Privacy policy

Upscale is a brand of Upspace Software Technologies LLP, a limited liability partnership registered in Tamil Nadu, India (registered office: 4A, Pari Nagar, Lower Cananl Road, Ambattur, Chennai, Tamil Nadu 600053). We make software for local businesses, starting with Upscale Salon for salons. For the personal data described here we are the Data Fiduciary: we decide why and how it is used.

Each salon also uses your data to serve you. Your visit history at a salon belongs to that salon’s records; we hold it for them and never sell it or share it with other salons.

Our home page and these legal pages use no cookies, analytics or advertising trackers. A salon’s own pages use the small cookies described below. Our hosting provider, Cloudflare, processes basic request data (such as your IP address and browser type) to deliver the site and protect it from attacks.

• What we collect: business details that are publicly listed, such as the business name, address, phone number, website and public email address (for example from Google Maps or the business’s own website), and the messages we exchange with you.
• Why: to tell you about Upscale, answer your questions, and arrange demos you ask for.
• Opting out: reply “STOP” or “No” to any email or WhatsApp message, or write to us. We stop at once and keep your contact on a do-not-contact list so we never message you again.

We send WhatsApp messages through Meta’s WhatsApp Business Platform. When you message us, WhatsApp shares your phone number and profile name with us. We message salon owners only after they have agreed or replied to us. We message salons’ customers only about their own visits (login codes, booking confirmations, turn alerts and reminders), never marketing without separate consent. Meta processes these messages under WhatsApp’s privacy policy.

When you open a salon’s page (for example by scanning its QR code):

• a random visitor id in a cookie, so the salon can offer “your usual” next time. It is not a login, and it is kept on your phone for up to 400 days;
• which of the salon’s codes you scanned (counter, door, mirror or online) and when;
• if you join in the browser, your visit’s link in a second cookie for one day, so the salon’s page can take you back to your place.

Your location, only if you allow it, once, to check that you are at the salon (within about 150 metres) so you can be marked “here”. We store that one reading (latitude, longitude and accuracy) with the result of the check. We never track your location over time. If you say no, everything still works.

When you join a queue or book: the services and stylist you chose, your token (like SZ-4821), the times of your visit and what happened (for example checked in, done, cancelled or missed), and the name you give, if any.

If you use WhatsApp: your phone number and WhatsApp profile name, which WhatsApp shares with us when you send the message, and the messages between you and the salon.

If you use the app: your phone number, name, an optional photo, your language, your choices about messages, and a notification token for your phone.

Missed turns: how many times you missed your turn in the last 30 days. After two, joining from home pauses for a while; walk-ins stay welcome.

Salon owners and staff: name, phone number, role, working hours and leave, the salon’s business details, and billing records. Payments are handled by Razorpay; we never see or store your card or UPI PIN.

• to put you in the queue, show your place and wait, and alert you before your turn;
• to let the salon call you by name, see your past visits there and offer “your usual”;
• to estimate waiting times better, using visit times across the salon (in totals, not about you personally);
• to keep the queue fair, for example the pause after repeated missed turns;
• to run salon accounts, subscriptions and invoices;
• to keep the service secure, fix problems and meet our legal duties.

We do not sell your data, and we do not show you ads.

We ask separately, and you can say no to each without losing the queue:

• WhatsApp updates about your visit (your place, your turn, a review link afterwards);
• offers from salons you have visited (off unless you turn them on);
• your location for the “at the salon” check;
• any photo the salon would like to share on Google.

You can withdraw consent at any time: in the app’s settings, by replying STOP on WhatsApp, or by writing to us (below). Withdrawing is as easy as giving consent, and it does not affect what was done before.

• The salon you visit sees your name, phone number (if you gave it) and your visits at that salon. Other salons do not.
• Other customers only ever see your initials as a dot in the queue, never your name or number.
• Companies that help us run the service, under contract and only for this purpose: Supabase (our database, in its Mumbai region), Cloudflare (serves the web pages and stores encrypted backups), Meta (WhatsApp messages), Google (Firebase app notifications, Workspace email, and Maps business listings), Razorpay (salon payments) and, only if a salon connects it, Google Business Profile.
• Government authorities, only when the law requires it.

Customer data is stored in India, in Supabase’s Mumbai region. Encrypted nightly backups are kept on Cloudflare for 30 days.

• Your account and visit history: while you use the service. Data that has been inactive for 2 years is deleted.
• The visitor id cookie: up to 400 days on your phone. The visit link cookie: one day.
• Location check readings: 30 days, then deleted.
• Backups: 30 days, then overwritten.
• Invoices and payment records: as long as tax law requires (currently 8 years).
• Sales contacts and conversations with businesses: up to 2 years after our last conversation, unless you become a customer.
• The do-not-contact list: for as long as we contact businesses, so that we never message you again.
• Website request logs: as long as Cloudflare keeps them, normally a few days.

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and who we shared it with;
• have it corrected, completed or updated;
• have it erased, unless the law requires us to keep it;
• raise a grievance with us, and then with the Data Protection Board of India;
• nominate someone to use these rights for you if you die or cannot act yourself.

In the app, use Download my data or Delete account in your profile. Without the app, write to our Grievance Officer. We reply within 7 days, and always within the 90 days the law allows.

Parents and guardians can book services for children. We do not knowingly let anyone under 18 create an account, and we do not track or target children.

Data is encrypted in transit, access is limited by role (a salon only sees its own customers), our team signs in with two-step verification, and every access by our team is logged with a reason. If a breach affects your data, we will tell you and the Data Protection Board as the DPDP Rules require.

Ajay Kumar, Grievance Officer, Upspace Software Technologies LLP
Email: support@upscaleapp.in
Phone and WhatsApp: +91 70101 18749
Address: 4A, Pari Nagar, Lower Cananl Road, Ambattur, Chennai, Tamil Nadu 600053

If we change how we use your data, we will update the date at the top of this page and, for important changes, tell the people affected in the app, by email or on WhatsApp before they apply.