Privacy Policy

1. Scope of this policy

This Privacy Policy explains how ApniBaari Technologies Pvt. Ltd. ("we", "us", "our") handles personal information when you use the ApniBaari website, progressive web app and related services (the "Platform") — whether you book as a guest, hold a registered account, work as a Specialist, or run a Business listed with us.

2. Who we are

ApniBaari Technologies Pvt. Ltd. is the controller of the personal information described in this policy.

shilp colony, Jaipur, Rajasthan, 302012, India
Email: apnibaari.support@gmail.com

Note that each listed Business is a separate, independent controller of the customer records it maintains in its own systems and premises. This policy covers what we do; a Business's own practices are its responsibility.

3. Information we collect

3.1 Information you give us

• To make a booking: your name and phone number where the Business asks for them, and your email address if you choose to add one. Some Businesses do not ask for any details at all, in which case the booking is held against your device alone.
• To hold an account: your name, email address, phone number and password (stored only as a cryptographic hash).
• To list a business: the owner's name, business name, category, address and coordinates, contact number, working hours, service prices and fees, photographs, staff details, and payout details such as a UPI ID.
• Reviews and photographs you choose to publish about a Business, together with the name and, where you enter one, the phone number you attach to the review. A review may be posted anonymously; a review verified through a third-party sign-in also carries the name and email address on that account.
• Messages you send us through the contact form or by email, including anything you include in them.

3.2 Information collected automatically

• Device and log data: IP address, browser and device type, operating system, referring page, pages viewed, and the date and time of your requests.
• Session and security data: session identifiers, CSRF tokens and rate-limiting counters used to keep the Platform working and to block abuse.
• Push notification tokens issued by your browser or device when you allow notifications, so we can alert you when your turn approaches.
• Location information — see section 6.

3.3 Information from third parties

• Payment status from our payment gateway — whether a payment succeeded, failed or was refunded, together with a transaction reference. We never receive your full card number, CVV, UPI PIN or banking password.
• Verified identity for reviews: if you choose to sign in with a third-party identity provider to leave a verified review, we receive the name and email address associated with that account.
• Place names from mapping services when converting coordinates into a readable locality.

4. Why we use your information

• To create and manage bookings — issue your token, hold your position, show you the queue, and let you cancel. This is the core of the service and cannot be provided without your name and phone number.
• To keep you informed — booking confirmations, turn alerts, skips, cancellations and shop closures.
• To verify identity — one-time passwords sent to your phone or email, and checks against duplicate or fraudulent bookings.
• To take and settle payments — process online payments, issue refunds, and settle amounts collected on a Business's behalf.
• To support you — investigate and answer your enquiries and complaints.
• To keep the Platform safe — detect and prevent spam bookings, fake reviews, scraping, abuse and fraud, and enforce our Terms and Conditions.
• To improve the service — understand which features are used and where the experience breaks, using aggregated and, where practical, de-identified data.
• To provide business reporting — give each Business the booking records and exports it needs to run and account for its own operations.
• To meet legal obligations — tax, accounting, and responding to lawful requests from authorities.

We rely on the performance of our contract with you, your consent (for location and push notifications), our legitimate interests in operating a safe and functioning platform, and compliance with legal obligations, as the basis for these uses.

5. Notifications and push messages

When you allow notifications, your browser or device issues us a token that lets us deliver a message to that specific installation. We store the token against your device or account and use it only to send booking-related alerts. Revoking notification permission in your browser or device settings stops these immediately; you may also continue to receive booking updates by SMS or email where those channels are configured.

6. Location information

Location is used for one purpose: showing you businesses near you and ordering them by distance.

• Precise location (GPS coordinates) is read only after you explicitly allow it in the browser prompt. It is stored in cookies on your own device and sent with your requests so results can be sorted by distance. Your browser also sends those coordinates directly to the third-party geocoding services we use, so the area name can be shown back to you — see section 8.
• Approximate location may be inferred from a city or area you select manually.
• We do not build a location history, track your movements between sessions, or share your coordinates with Businesses.

You can withdraw location access at any time through your browser's site settings, and clear the stored preference by clearing this site's cookies.

7. Cookies and similar technologies

We use cookies and local storage for:

• Essential functions — your session, sign-in state and CSRF protection. The Platform cannot work without these.
• Booking identity — remembering the phone number a booking was made with, together with a random identifier we generate for the device itself, so "My Bookings" works without an account and still works where the Business asks for no details at all.
• Preferences — your chosen location, and whether you have already answered the location or notification prompts, so you are not asked repeatedly.

We do not use advertising or cross-site tracking cookies on the Platform. Blocking essential cookies will prevent bookings from working.

8. Who we share information with

• The business you booked with — your name, phone number, token details, and any additional details that Business asked for. This is necessary for it to serve you, and is limited to the Business you actually booked with, together with the Specialist assigned to you.
• Service providers that operate parts of the Platform under contract — hosting and infrastructure, the payment gateway, messaging and push-notification delivery, and email delivery. They may process personal information only on our instructions.
• Geocoding and mapping services — where you allow location, your browser sends your coordinates directly to the mapping providers we use so they can return the name of the area you are in. Those providers receive that request from your device under their own privacy policies rather than on our instructions, and we do not send them your name, phone number or booking details.
• Professional advisers — auditors, accountants and lawyers, where necessary and under a duty of confidentiality.
• Authorities — where we are legally required to disclose information, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the safety of any person.
• A successor entity — if the business is reorganised, merged or acquired, information may transfer as part of that transaction, subject to this policy.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

9. What businesses can see

A Business's dashboard shows it the bookings placed with that Business: the customer's name and phone number, the email address where one was given, token and timing details, the outcome of the visit, and its own historical reports — which it can download as a spreadsheet where its plan allows. A Business does not see your bookings with any other Business, your location coordinates, or your account password.

Businesses are contractually required to use these details only to serve bookings and to comply with applicable data protection law. If you believe a Business has misused your details — for example by sending you marketing you never asked for — please report it to us.

10. How long we keep information

• Booking records — kept while the booking is live and afterwards as part of the Business's operational and reporting history, and to resolve disputes.
• Account information — kept while your account is active, and for a reasonable period afterwards.
• Payment and settlement records — kept as long as tax and accounting law requires.
• Reviews — kept while published; removed reviews are deleted from public view.
• Contact enquiries — kept for as long as needed to handle your query and to keep a record of the outcome.
• Logs and security data — kept for a short period for troubleshooting and abuse prevention.

When information is no longer needed, we delete it or de-identify it so it can no longer be linked to you.

11. How we protect information

We use industry-standard measures appropriate to the sensitivity of the data, including encrypted transport (HTTPS), password hashing, protection against cross-site request forgery, rate limiting and throttling on sensitive endpoints such as login and OTP verification, role-based access controls that restrict each account to its own data, and restricted administrative access.

No system is perfectly secure. Please help by keeping your password private and unique, and by telling us promptly at apnibaari.support@gmail.com if you suspect unauthorised access. Where a breach is likely to affect you, we will notify you and the relevant authority as the law requires.

12. Your rights and choices

Subject to applicable law, you may ask us to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or out of date;
• Delete information we no longer have a lawful reason to keep;
• Restrict or object to certain processing;
• Withdraw consent you previously gave — for example for location or push notifications — without affecting processing already carried out;
• Receive a copy of information you provided to us, in a portable format.

To exercise any of these, write to apnibaari.support@gmail.com or use the contact form. We may need to verify your identity — usually by confirming control of the phone number or email address on the record — before we act, and we will respond within the period the law allows.

Some information cannot be deleted on request where we must keep it: for example, transaction and tax records, and details of a booking that is still live or is subject to a dispute.

13. Children

The Platform is not directed at children under 18, and we do not knowingly collect their personal information for account registration. A parent or guardian may book an appointment for a child, in which case the details provided are treated as the guardian's submission. If you believe a child has provided us information directly, contact us and we will delete it.

14. Storage and international transfers

Information is stored on servers operated by our hosting and infrastructure providers. Some of our service providers may process data outside your country. Where that happens, we take reasonable steps to ensure a comparable level of protection through contractual safeguards with those providers.

15. Third-party links

The Platform may link to external sites — a Business's own website, a social media profile, or a payment page. Those destinations have their own privacy policies, and we are not responsible for their practices. Please read their policies before sharing information with them.

16. Changes to this policy

We update this policy as the Platform develops or the law changes. The effective date at the top of this page always reflects the current version, and material changes will be signposted on the Platform or notified by email where we hold one for you.

17. Grievance officer and contact

For any privacy question, request or complaint — including a grievance under applicable Indian data protection and intermediary rules — contact:

If you are not satisfied with our response, you may escalate the matter to the data protection authority with jurisdiction over you.