Privacy policy

Summary in plain English

• We only collect what we need to run the service.
• We never sell your data or your customers' data.
• Customers leaving reviews share a name (optional), a phone number (optional, for rewards) and the answers they typed. That's it.
• We use analytics cookies (Google Analytics, Microsoft Clarity, Meta Pixel) only with your consent, to understand how visitors use our marketing site. You can opt out any time via the cookie banner.
• Data lives in India unless you specifically opt for a different region.

What we collect from you (the business owner)

• Email address and a hashed password for sign-in.
• Business name, category, address, phone, GSTIN (optional), country.
• Subscription metadata from Razorpay (status, plan, payment id) — never card numbers.
• Product usage events (page views inside the dashboard) for debugging.

What we collect from your customers (the reviewer)

• The answers they type in the 2–3 review questions.
• The language they pick.
• An optional name and phone number, only if they choose to claim a reward.
• A timestamp and the QR they scanned, so you can attribute the review to the right outlet.

We do not collect device fingerprints, GPS coordinates, or anything from the customer's social profiles.

Where your data lives

Production data is stored in India. Backups are encrypted at rest. Razorpay handles all card data — we never see or store payment instruments.

Third parties we use

• Razorpay — subscription billing & tax invoicing.
• OpenRouter / OpenAI — generates the review draft from the customer's answers. Prompts contain no personally identifying information beyond what the customer typed.
• Google Maps Places API — only used to validate the URL you paste; we resolve a Place ID once and store it.
• Google Analytics — marketing-site traffic and conversion analytics, governed by Google's Consent Mode v2.
• Microsoft Clarity — marketing-site session recordings and heatmaps, so we can see how visitors use the site and fix confusing pages.
• Meta (Facebook) Pixel — measures the performance of our ad campaigns on the marketing site, via both a browser pixel and a server-side Conversions API.

These analytics and advertising tools run only on our public marketing pages — never inside the dashboard, the review-collection flow, or any page where a customer submits a review.

Cookies

We use a small number of strictly-necessary cookies — your session, your language preference, and an onboarding draft — which are always on and require no consent.

On our public marketing pages, we also use analytics cookies (Google Analytics, Microsoft Clarity) and advertising cookies (Meta Pixel) to understand traffic and measure ad performance. If you're visiting from the EU, EEA, UK, or Switzerland, these are off by default and only load if you opt in via the cookie banner. Everywhere else, they're on by default and you can opt out any time via the cookie banner's "Customise" option. Rejecting them has no effect on using the product.

Your rights

You have the following rights under GDPR and applicable data protection law. Most can be exercised directly from your account — no email required.

• Access & portability. Download a full copy of your account data — business profile, subscription history, and customer contacts — from Settings → Data & Privacy → Export data. Alternatively, email [email protected] and we'll send the file within 7 business days.
• Deletion (right to be forgotten). Request permanent deletion of your account and all associated data from Settings → Data & Privacy → Delete my account. We'll process the request and confirm by email within 30 days, including removal from any backups.
• Rectification. Most fields (business name, category, contact details, country) are editable directly in your dashboard. For anything you can't change yourself, email us.
• Restriction & objection. If you wish to restrict how we process your data, or object to processing, email [email protected].
• Complaint. You have the right to lodge a complaint with a supervisory authority. For EU/EEA residents, contact your local data protection authority. For Indian residents, the applicable authority is the Data Protection Board of India (once operational).

Children

Saint Aura is not directed at anyone under 18 and we do not knowingly collect data from children.

Changes to this policy

We'll notify account holders by email at least 14 days before any material change.

Data controller

Saint Aura is operated by KraftPixel Digital Solutions Pvt Ltd (416, Dattani Prism 1, Vasai West, Mumbai, Maharashtra 401202). The data controller for all personal data processed through this service is KraftPixel Digital Solutions Pvt Ltd.

Contact

For privacy questions, data subject requests, or GDPR-related enquiries, email [email protected]. You can also use the self-service controls in Settings → Data & Privacy.