Privacy policy
Last updated: 11 October 2026
This policy explains what personal data GlowStack collects, why, and what you can ask us to do with it. GlowStack is operated by [Legal entity name] (“GlowStack”, “we”, “us”). It is written to meet India’s Digital Personal Data Protection Act, 2023 and the rules made under it.
Two roles we play
- For salon owners and their staff, and for visitors to this website, we decide how your data is used. We are the data fiduciary.
- For a salon’s customers, the salon decides what it records about you, such as your bookings, bills and visit history. The salon is the data fiduciary and we process that data for it under our Terms of Service. To see, correct or delete that data, contact the salon first. We will help them respond. The salon can give you a copy of what it holds about you, record which marketing messages you agree to on WhatsApp, SMS and email, and erase your personal details; it keeps its bills and payment records where the law requires.
What we collect
From businesses that use GlowStack
- Account details: names, phone numbers, email addresses and passwords (stored only as a hash) of owners and staff.
- Business details: salon name, branches, address, GST number and settings.
- Records you create in the app: appointments, bills, payments, stock, expenses, attendance, commissions and payroll.
- Images you upload, such as a logo or staff photos.
About a salon’s customers
- Name, phone number and gender, and optionally an email address and notes the salon adds.
- Bookings, visits, bills, payments, memberships, wallet balance and reviews.
- Whether you agreed to receive WhatsApp messages.
- When you sign in on a salon’s booking site, a one-time code sent to your phone.
From this website
- What you enter in the demo request form: name, business name, phone, and optionally email, city, number of branches and a message.
Technical data
- Sign-in sessions, IP addresses and request logs, kept to run the service and keep it secure.
- Error reports. These carry internal ids and technical details only. We strip request bodies and mask long numbers so they do not contain customer data.
This website does not use advertising or tracking cookies. The app stores your sign-in session and working data in your browser so it can work offline.
Why we use it
- To provide GlowStack: bookings, billing, messages, reports and payroll for the salon.
- To send messages the salon asks for: confirmations, reminders, bills and sign-in codes.
- To reply to demo requests and support questions.
- To keep the service secure, prevent misuse and fix problems.
- To meet legal duties, such as keeping tax records.
Owners can see anonymous benchmarks that compare their salon with similar ones. These use totals from several salons. No business is named, and no customer data is shared between salons.
We do not sell personal data and we do not use it for advertising.
Who we share it with
We use these service providers to run GlowStack, each only for its part of the work:
- Hosting and databases: [hosting providers, e.g. Vercel, Railway]
- File storage for uploaded images: [storage provider]
- Email: Resend. SMS: Twilio. WhatsApp: Meta (WhatsApp Business Platform), where a salon turns it on.
- Online payments: Razorpay, using the salon’s own Razorpay account. GlowStack does not receive or store card or UPI details.
- Error monitoring: Sentry.
- AI assist: Anthropic (Claude), which receives only what a draft needs, such as customers’ first names, services and report figures. Phone numbers, email addresses and payment details are not sent.
Some of these providers may process data outside India. We will share data with authorities only when the law requires it.
How long we keep it
We keep a salon’s data while its account is active. When a salon closes its account, we delete or anonymise its data within [90] days, except records we must keep by law (for example, tax and invoice records). The content of sign-in codes and login details we send is removed from our message records once delivered. Demo requests are kept for [12 months].
How we protect it
Each business’s data is kept apart with database row-level security, so one salon cannot read another’s records. Connections are encrypted, passwords are hashed, and staff can only open the screens their role allows.
Your rights
Under the DPDP Act you can ask to see a summary of your data, correct or complete it, have it erased, and withdraw consent you gave. You can also nominate someone to act for you if you are unable to. Customers of a salon should ask the salon first. For anything else, write to us using the details below. We will reply within [30] days.
Children
GlowStack is meant for businesses. A salon that records customers under 18 is responsible for getting a parent’s or guardian’s consent.
Grievance officer
[Name], Grievance Officer
Email: [grievance email]
If you are not satisfied with our reply, you can complain to the Data Protection Board of India.
Changes
If we change this policy, we will update the date at the top and tell salon owners about significant changes in the app or by email.
Contact
[Legal entity name]
[Registered address]
Email: info@glowstack.in