LEGAL

Privacy Policy

Last updated: [FOUNDER: set effective date]

Before publishing this for real: fill in the bracketed placeholders below (legal entity name, registered address, grievance officer) and have someone review it against India's DPDP Act and Razorpay's merchant requirements. This is a solid first draft, not a substitute for legal advice.

1. Who we are

SETU ("SETU", "we", "us") is a website and booking platform for local businesses, operated by [FOUNDER: legal entity name — e.g. "Xenon's Armory" as a registered proprietorship/company, or your name if unregistered], [FOUNDER: registered address, state]. This policy explains what we collect, why, and what rights you have — whether you're a business running your workspace on SETU, or a customer booking with one of those businesses.

2. What we collect

If you create a SETU account (a business owner or staff member):

  • Email address and authentication credentials (handled by Supabase Auth; if you sign in with Google, we receive your Google account email and name).
  • Business details you provide: business name, phone number, address, category, description, logo and other images you upload.
  • Services, staff, working hours, products, and other content you add to run your workspace.
  • Billing details tied to your subscription plan and payment status (we do not store your card or UPI details — Razorpay processes and holds those directly).

If you book an appointment or place an order with a business on SETU:

  • Your name and phone number, and the appointment or order details you submit.
  • If the business you're booking with has notifications enabled, your phone number and email may be used to send you a booking confirmation via email or WhatsApp.

Automatically, for anyone visiting a SETU-hosted site:

  • A page-view count against the business or portfolio you visited — used for the public Showcase ranking and the business's own dashboard stats. We don't run third-party analytics or advertising trackers.
  • Items added to a shopping cart on a storefront-type business are stored only in your browser's local storage — never sent to our servers until you check out.

3. How we use it

  • To run your workspace: authenticate you, save your business content, and enforce your plan's limits.
  • To operate the booking/ordering flow between a business and its customers.
  • To process subscription and order payments through Razorpay.
  • To send transactional messages you or a business you booked with triggered — booking confirmations and reminders, via email (Resend) or WhatsApp (Meta's WhatsApp Business Platform).
  • To keep the service secure and working as intended.

We do not sell your personal data.

4. Who we share it with

We use the following processors to run SETU. Each only receives what it needs to do its job:

  • Supabase — database, authentication, and file storage for logos, cover images, and galleries.
  • Razorpay — payment processing for subscriptions and, where a business sells products through its storefront, for those orders.
  • Resend — delivery of transactional emails (booking confirmations, etc.).
  • Meta / WhatsApp Business Platform — delivery of WhatsApp booking messages, where a business has enabled them.
  • Vercel — application hosting.

If you book with a business on SETU, that business can see the booking details you submit (name, phone, service, date) — the same as booking with them directly. We don't share your data with anyone beyond the processors above and the business you're interacting with.

5. Cookies and local storage

We use a session cookie to keep you signed in (set by Supabase Auth via secure, httpOnly cookies). Shopping cart contents are stored in your browser's local storage and never leave your device until checkout. We don't use advertising or cross-site tracking cookies.

6. Your rights

You can access, correct, or delete the data in your SETU account at any time from your dashboard, or by emailing us. If you're a customer who booked with a business on SETU and want your booking data removed, contact that business directly, or reach us and we'll forward the request.

7. Data retention

We retain account and business data for as long as your account is active, and booking records for as long as the business you booked with keeps them. You can request deletion at any time.

8. Grievance officer

As required under Indian law, grievances regarding this policy can be directed to: [FOUNDER: grievance officer name], [FOUNDER: designation], reachable at xenonsarmory.setu@gmail.com.

9. Changes to this policy

We'll update this page if how we handle data changes, and update the "last updated" date above.

10. Contact us

Questions about this policy? Email xenonsarmory.setu@gmail.com.