What we collect, and why.

Less data, well-protected.

We collect the minimum personal data required to run Pamperazzi safely and legally. We never sell your data. We never share it with marketers. We never use it for purposes you didn't reasonably expect when you signed up. If you want your data deleted, write to privacy@pamperazzi.com and we will action it within 30 days.

From buyers.

When you buy a gift card we collect: your name, email address, phone number (E.164 format), payment method (via Razorpay; we never see full card numbers), the gift card design and amount, the recipient details you enter, and any message you write.

We also collect technical data your browser shares: IP address, browser version, device type, page-view timestamps. We use this for fraud prevention and to debug issues.

From recipients.

When a gift card is sent to you, we hold your name, phone number, and the message the sender wrote, in order to deliver the card and let the partner salon validate it on redemption.

We do not market to recipients. The only WhatsApp/email messages you'll receive from us are: (a) the gift card itself, (b) a redemption receipt after each visit, and (c) a one-time expiry reminder 60 days before the card expires.

From partner salons.

When a salon partners with us we hold the business name, address, owner contact details, GST number (where applicable), bank details (for payouts via Razorpay X1), and the staff phone numbers we authorise to log in to the partner portal.

We do not share salon banking or financial details with anyone outside Pamperazzi or our payment processor.

Retention.

Order and redemption records: 7 years (Indian tax/audit obligations). Account profile data: until you delete your account, then 30 days. Payment metadata held by Razorpay: per their retention policy.

You can ask us to delete your data earlier than these defaults — we will, except where retention is legally mandatory.

Sharing.

We share data only with: (a) the partner salon you redeem at — your name and the redemption amount only, never sender details, never marketing data; (b) Razorpay for payment processing; (c) Gupshup / Wati for WhatsApp delivery; (d) Resend for transactional email; (e) Sentry for crash reporting (no personal data, only error metadata); and (f) law enforcement when legally required.

We never sell your data. We never trade it. We never use it for advertising.

What we set in your browser.

We use first-party cookies for authentication (so you stay logged in) and basic analytics (Plausible — privacy-first, no cross-site tracking, no user-level identification).

We do not use marketing or advertising cookies. We do not use Google Analytics or Meta Pixel. There is no cookie banner because there is nothing to consent to beyond essentials.

What you can do.

You have the right to: access your data; correct inaccuracies; delete your account; receive a portable export; object to processing; or lodge a complaint with the relevant data protection authority.

Email privacy@pamperazzi.com. We respond within 30 days.

How we protect it.

Encryption at rest (AES-256) and in transit (TLS 1.3). Access to production data restricted to a small named team with two-factor authentication. Audit logs on every data read and write. Annual penetration test by an independent firm. Pamperazzi is hosted on Vercel + Supabase in the ap-south-1 region (Mumbai).

Under 18.

Pamperazzi is not intended for users under 18. We do not knowingly collect data from minors. Recipients of gift cards may be of any age, but only adults may purchase or interact with our services as buyers or partners.

Changes to this policy.

If we change this policy, the effective date at the top of this page will update. Material changes will be emailed to active users. Continued use of Pamperazzi after a change means you accept the updated policy.

Reaching us about privacy.

Email privacy@pamperazzi.com. Postal address: Pamperazzi Technologies Pvt. Ltd., Bengaluru, Karnataka, India.