Privacy Policy

Effective date: 2 October 2026

This Privacy Policy explains what personal information is collected through Salonkarts®, why it is collected, who receives it, how long it is kept and what choices you have. It covers the Salonkarts app for salon owners (Android application ID com.salonkartsb2b.onlineapp, and iOS), the website https://salonkarts.com, the Salonkarts delivery partner app (Android application ID com.salonkarts.deliverypartner) and the app and panel used by sellers. It forms part of our Terms and Conditions.

1. Who is responsible for your information

1.1 Salonkarts is operated by SKS B2B PRODUCTS PRIVATE LIMITED (Corporate Identity Number U20237MH2025PTC443139), registered office G-2, D Wing, Spring Leaf Bldg, Lokhandwala Township, Kandivali East, Mumbai, Maharashtra 400101, India. This company collects and keeps the information described in this policy. “We”, “us” and “our” mean this company.

1.2 Privacy contact: e-mail support@salonkarts.com, phone +91 98218 88863. Section 17 explains how to make a request or raise a privacy complaint.

1.3 On Google Play and the Apple App Store the Salonkarts apps appear under the developer account of CapriTech Global Services Private Limited. SKS B2B PRODUCTS PRIVATE LIMITED operates the Salonkarts service and is responsible for the information described in this policy.

2. Who this policy applies to

2.1 Sections 3 to 13 describe the information of salon owners and other buyers, and of visitors to the website. Section 14 describes the additional information of delivery partners and sellers. The remaining sections apply to everyone.

2.2 Salonkarts is a business platform for persons aged 18 or above. See section 15.

3. Information we collect from salon owners

3.1 Account and login

• Your mobile number with country code.
• Your name and the name of your salon or business, which we ask for the first time you log in.
• A referral code, if you enter one (optional).
• An e-mail address, if you add one in Profile (optional). We do not verify it. It appears on your invoices.
• Your language choice.

The app does not use a password or any social login for salon owners. Each time you log in, our server creates a 6-digit one-time password (OTP) and sends it to you by SMS. The OTP is valid for 10 minutes, can be used once, and is deleted when it is verified, when it expires or when you ask for a new one.

3.2 Billing and GST details

Business name, GSTIN, billing address, city, state and pincode, saved under Menu, then Billing & GST. The GSTIN is also saved on each order and printed on the invoice together with your name, mobile number, e-mail address (if given) and delivery address.

3.3 Delivery addresses

You can save several addresses. Each one holds: flat or shop number, floor, address, area, city, state, pincode, a contact name and contact mobile number, the address type, the address shown on the map and its GPS coordinates. If the contact person is someone else, please make sure that person agrees. When you delete an address it is hidden from your account but stays in our records.

3.4 Orders, wallet and reviews

• Order details: products, quantities, prices, taxes, coupon, wallet amount used, delivery charge, platform fee, tip, delivery method, date and time slot, delivery instructions, the 4-digit delivery code, payment method and transaction reference, order status history, cancellation note, and return requests with their reasons.
• Your wallet balance and wallet transaction history.
• Referral records showing who referred whom.
• Ratings and reviews you give to products.
• Product requests (“Request a product”): the product name, brand, quantity, unit and notes you enter, the photos you attach (up to the limit shown in the app), the request number, its status history and our replies, and a copy of your business name and of the city and area of your latest delivery address taken when you submit the request.

Restock reminders. Restock reminders are off unless you switch on “Remind me to restock” in the app. When you do, we keep your choice (on or off, how often: every 1, 2, 3, 4 or 6 weeks, the day you prefer and when the next reminder is due) and a record of each reminder we send: when it was sent, the past order it suggested, whether it reached you as a push notification or only in the app, and whether you placed an order within 7 days afterwards. We use this only to send the reminder you switched on (at most one per period, and not when you have ordered recently) and to pause reminders you do not use. It is kept while your account exists and deleted when you delete your account. You can switch reminders off at any time in the app under Menu, then Restock reminders.

3.5 Device and technical information

• A push-notification token from Google Firebase Cloud Messaging, stored against your account so that we can send order and return updates. The Firebase software in the app also sends Google an installation identifier, the app version and basic device information (such as operating system version, device model and brand; on iOS also the Apple push token, language and time zone).
• Your IP address, which our server receives with each request. Together with your mobile number it is used to limit OTP requests and wrong attempts.
• A random guest identifier created on your device (or in your browser) so that you can keep a cart before logging in. It is linked to your account when you log in.
• Kept on your phone by the app: a login token that contains your mobile number, your last chosen location, your language and your theme. The login token does not expire on its own, so you stay logged in on that phone until you log out.
• The app package also contains software components of the online payment providers Cashfree Payments and Paystack. They are used only if you choose online payment at checkout; they are not used when you pay cash on delivery.

3.6 Location

With your permission the app reads your precise location, only while you are using the app. It asks only when you open the delivery-location or address screens, never when you log in. Location is used to check whether we deliver to your area, to fill in your address and to show maps. The coordinates are sent to our server, kept on your phone, and sent directly from your phone to Google Maps (see section 7). The salon-owner app does not collect your location in the background. If you do not allow location, you can search for your area or street by typing it.

Delivery wait list. If you ask us to tell you when Salonkarts starts delivering at a place we do not serve yet, we keep the approximate location you chose (to about 100 metres), the area, PIN code, city and state you confirmed, the time and number of your requests, whether you used the app or the website and its version, an app-generated guest identifier or your account, and — so that we can reach you — your account’s mobile number and salon name (or the ones you typed; please do not enter someone else’s number) and your device’s push-notification token. We use this only to count where delivery is wanted and to send you one notification when delivery starts in that area. We do not sell it; the notification is delivered through Google Firebase Cloud Messaging, which receives the push token and the message. We keep a request for 18 months from your last request for that place, or until 6 months after we have notified you, and then delete it. You can remove yourself at any time with “Remove me from this list” on the same screen, from Menu → Delivery updates, or by writing to support@salonkarts.com; deleting your account removes your contact details from the list.

3.7 Camera, microphone, storage and notifications

• Camera: used to scan a QR code for product search, where that feature is available (scanning happens on your phone and nothing is uploaded), and to photograph a product you want to ask us for through “Request a product”. Only the photos you choose to attach to a request are uploaded.
• Microphone: used only for voice search, where that feature is available. A short voice clip is sent from your phone to Google Cloud Speech-to-Text to be turned into search text. Our own server does not receive the audio.
• Storage and photo library: used to save invoice PDFs that you download, and to let you pick a profile picture or photos for a product request. Only the pictures you select are uploaded.
• Notifications: used for order, return and product-request updates.

3.8 Website

The website collects the same account, billing, address and order information as the app, and uses the cookie and browser storage described in section 9. Where the website offers sign-in with an e-mail address and password or with a Google account, we also collect your e-mail address and a hashed form of your password, or the name and e-mail address from your Google profile.

3.9 What we do not collect

• The apps do not read your phone contacts.
• You can pay by cash on delivery or, when it is switched on, online through Cashfree Payments. We do not collect or store your card, UPI or bank details: you enter them on Cashfree’s payment page. We keep only the payment status, the order and transaction reference and the amount.
• We do not collect health information, biometric information or information about sexual orientation.
• The Salonkarts apps contain no advertising software and no crash-reporting software of our own; Firebase Analytics is switched off. The apps use Microsoft Clarity to measure how the app is used (which screens are opened and where people tap), as described in section 7. The Google Maps and Firebase push-notification components built into the apps may collect limited technical data (such as a device identifier and diagnostic information) to work and to stay secure, as described in section 7. We do not track you across other apps or websites.

4. Sensitive personal information

4.1 Indian law treats passwords, financial information (such as bank account or card details), health and medical information, sexual orientation and biometric information as sensitive personal data.

4.2 From salon owners using the app we collect none of these, apart from the short-lived login OTP described in section 3.1. If you sign in on the website with an e-mail address and password, the password is sensitive information and is stored only as a hash.

4.3 From delivery partners and sellers we collect passwords (stored only in hashed form) and bank account details for payouts. See section 14. We use this information only for the purpose for which it was given, and we do not publish it.

5. Why we use your information

5.1 We use the information in sections 3 and 14 only for these purposes:

• to create and manage your account and log you in;
• to show whether we deliver to you and to work out delivery charges;
• to take, pack, deliver and track your orders, including sharing delivery details with the delivery partner and the seller;
• to issue invoices with your business name and GSTIN and to keep tax and accounting records;
• to handle cancellations, returns, refunds, the wallet and referral rewards;
• to send you service notifications and OTPs;
• to answer questions and resolve complaints;
• to show approved reviews to other users;
• to prevent misuse and fraud and to keep the platform secure;
• to pay delivery partners and sellers and to verify their identity;
• to meet legal requirements and respond to lawful requests from authorities.

5.2 We do not sell your personal information. We do not use it for advertising by other companies. We will not use it for a new purpose without telling you first and, where the law requires, asking for your consent.

5.3 We collect information only when you give it to us, when you allow a phone permission or when it is needed to carry out an order you have placed. You can choose not to give information or not to allow a permission; we may then be unable to provide the feature or service that needs it (for example, we cannot deliver without an address).

6. Permissions and choices in the app

6.1 Each permission is asked for by your phone when the feature is first used, and you can change it at any time in your phone settings.

6.2 Location is optional. If you do not allow it, you can search for your area or street by typing.

6.3 Camera and microphone are optional. Without them you can still search by typing.

6.4 Notifications are optional. If you turn them off you will not receive order updates as notifications, but you can still use the app and see order status under Orders.

6.5 You can browse products without an account. We need your mobile number, name, business name and a delivery address only when you want to order.

7. Who receives your information

7.1 Delivery partners

The delivery partner assigned to your order receives the contact name and mobile number saved with your delivery address, the delivery address with its map location, your delivery instructions and the order details needed to deliver it and collect payment.

7.2 Sellers

The seller of the goods sees the items ordered and their amounts. A seller sees your name, mobile number, e-mail address and delivery address only where we have enabled this for that seller; it is switched off when a seller registers.

Product requests: the sellers who may be able to supply a product you have asked for see the request itself (product name, brand, quantity, notes and the photos you attached), the request number, your business name and the city and area of your latest delivery address. They do not see your name, mobile number, e-mail address or street address through a product request.

7.3 Other users

Reviews that we approve are shown to other users with your name and, if your account has one, your profile picture. For your own order, you are shown the delivery partner’s name, mobile number and live position.

7.4 Service providers

• MSG91 (SMS gateway): your mobile number and the OTP, to deliver the login SMS.
• Google Firebase Cloud Messaging: the push token and installation identifier, app version and basic device information, and the text of each notification, which contains your name and order number.
• Microsoft Clarity (app usage analytics): while you use the app, Clarity records which screens you open, where you tap, scroll or swipe, and a visual replay of those screens. All on-screen text is masked on your phone before anything is sent, so names, addresses, GSTIN, prices and anything you type are not uploaded. Clarity also uses a random identifier that is not linked to your account, your phone number or your name. Microsoft stores the data in its Azure cloud, we can see it for 30 days after it is recorded, and Microsoft does not sell it. Microsoft handles it under the Microsoft Privacy Statement. We use it only to understand and improve the app.
• Google Maps Platform: your device coordinates and the address text you type are sent directly from your phone or browser to Google for address lookup, maps and order tracking. Google also receives your IP address. Google uses this information under the Google Privacy Policy, and your use of the map features is subject to the Google Maps/Google Earth Additional Terms of Service.
• Google Cloud Speech-to-Text: the voice clip, when you use voice search.
• Amazon Web Services: hosting of our server and database, on a cloud server located in Mumbai, India.
• An e-mail delivery service, used to send registration codes and password-reset links to sellers.
• Payment providers: Cashfree Payments India Private Limited (Bengaluru, India), a payment aggregator, only when you choose online payment at checkout. Our server sends Cashfree the order amount, an order reference, your mobile number and a customer ID made from your name and account number. You enter your card, UPI or bank details with Cashfree, not with us. Cashfree may also collect technical information about your device and payment (such as IP address, device model, operating system and identifiers) under its own privacy policy.

7.5 Resources loaded by the website

When you open the website, your browser loads Google Maps, Google Fonts, the Firebase script for web notifications and script libraries from public content delivery networks (cdnjs, jsDelivr and Tailwind). These services receive your IP address and browser details in order to deliver the files. Google reCAPTCHA and the Tawk live-chat widget are loaded only if we have switched them on.

7.6 Authorities and legal reasons

We give information to a government agency that is lawfully authorised to ask for it, within 72 hours of receiving its written order, for verifying identity or for preventing, detecting, investigating or prosecuting offences or cyber-security incidents. We report cyber-security incidents to the Indian Computer Emergency Response Team (CERT-In) as required. We may also disclose information where needed to comply with a law or court order or to establish or defend legal claims.

7.7 Business transfer

If the Salonkarts business is merged with or transferred to another company, your information may be transferred to it. We will give notice before that happens.

7.8 Protection by recipients

We require those who receive personal information from us to protect it to at least the standard described in this policy, to use it only for the purpose for which it was shared and not to disclose it further. Google processes the information it receives through Google Maps, Firebase and Speech-to-Text under its own terms and the Google Privacy Policy linked above. Microsoft processes what it receives through Clarity under the Microsoft Privacy Statement linked above.

8. Where your information is kept

8.1 Our own server and database are located in India (see section 7.4).

8.2 Google services (Firebase, Maps and Speech-to-Text) and Microsoft Clarity may process the information they receive on servers outside India, under Google’s own terms and privacy policy and the Microsoft Privacy Statement. We send personal information to another organisation, in India or abroad, only where it is needed to provide the service to you or you have agreed, and only where that organisation provides the same level of protection.

9. Cookies and browser storage on the website

9.1 The website sets one necessary session cookie (named ci_session). It lasts about 2 hours and keeps your login state, city and chosen location. It is sent only over secure connections and cannot be read by scripts.

9.2 The website also keeps the following in your browser’s local storage: the guest cart identifier, your location, your theme, your wallet and coupon choice at checkout, and your product filters.

9.3 Our own code sets no analytics or advertising cookies. The third-party resources listed in section 7.5 may set their own.

10. How we protect your information

• The apps and the website connect to our server only over encrypted HTTPS connections.
• Passwords of delivery partners, sellers and administrators are stored only as one-way hashes.
• Access to the apps’ data uses signed tokens issued separately for each type of user.
• OTP requests and wrong attempts are limited to prevent misuse.

10.1 No system is completely secure. Please tell us at once if you suspect misuse of your account.

10.2 If we learn of a security incident that affects your personal information, we will inform the affected users and the authorities as the law requires.

11. How long we keep information

• Login OTPs: deleted when verified, when they expire (10 minutes) or when a new one is requested.
• Website session: about 2 hours.
• Guest cart identifier and app settings on your device: until you log in, log out, clear the app data or uninstall the app.
• Account profile, billing details, addresses, saved items and review text: for as long as your account is open; erased when you delete the account.
• Product requests and their photos: kept (also after you cancel a request) until you delete your account or we delete the request; the request, its photos and its history are then removed together.
• Orders, invoices, payment and wallet records: kept, without your name or contact details after you delete the account, for as long as needed for tax and accounting records, to resolve disputes, to prevent fraud and to meet legal requirements. Our software does not delete these records automatically.
• Registration information: kept in a restricted store for 180 days after an account is closed and then deleted automatically, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require. Information that we remove for breaking our rules, and the records connected with it, are likewise preserved for 180 days, or longer if a court or authorised agency requires.
• App usage data (Microsoft Clarity): not linked to your account, so closing your account does not change it. Microsoft keeps it and makes it available to us for 30 days from the time of recording.
• Push tokens: the tokens stored on our server for your account are deleted when you close your account. They are not removed when you only log out; you can stop notifications at any time in your phone settings. Google keeps the Firebase installation identifier until it is deleted and, according to Firebase, then removes it from its systems within 180 days.
• Live location of a delivery partner: only the latest position for each order is kept, with the order record.
• Backup copies of our database can also contain your information.

12. Deleting your account and your data

12.1 How to ask. You can close your Salonkarts account in any of these ways:

• In the app: open Menu, tap Delete Account and confirm.
• On the website: log in, open your profile and choose to delete the account.
• Without the app: send an e-mail to support@salonkarts.com with the subject “Delete my Salonkarts account” and your registered mobile number, or call +91 98218 88863. We may contact you on that number to confirm that the request is yours.

12.2 What happens. Your account is closed at once and you can no longer log in with it. If your wallet has a balance, please use it before you close the account, because it is lost when the account is deleted. You may register again later with the same mobile number, as a new account.

12.3 What is erased and what is kept. When you confirm Delete Account, your name, e-mail address, photo, saved addresses (contact names, mobile numbers, address text and map positions), billing details and GSTIN, saved items, notifications, feedback and push tokens are erased or anonymised straight away and you can no longer log in with that account. The text of any reviews you wrote is erased. We keep: (a) orders, invoices, payment and wallet records, without your name or contact details, because tax, accounting and legal rules require them (see section 11); and (b) a restricted copy of your registration details (name, mobile number, e-mail address, business name and GSTIN) for 180 days after the account is closed, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require. That copy is used only to answer lawful requests from authorities and is then deleted automatically. You cannot delete the account while an order is in progress, and a wallet balance is not refunded when the account is deleted (see 12.2).

12.4 Without the app. If you cannot use the app, write to us at the contact in section 1.2 from your registered mobile number or e-mail address and ask us to delete the account. We carry out the same erasure and reply within one month to confirm what has been erased or anonymised and what we must keep and why.

12.5 Delivery partners and sellers: see section 14.5.

13. Your rights and choices

13.1 See and correct. You can see and change your name and e-mail address in Profile, your business details in Billing & GST and your addresses in Address. You can ask us for a copy or summary of the personal information we hold about you and ask us to correct anything that is wrong.

13.2 Refuse or withdraw consent. You can choose not to give information, refuse a permission, or withdraw your consent later by writing to us or by closing your account. If you do, we may not be able to provide the service that needs that information. Withdrawal does not affect orders already placed or records we must keep by law.

13.3 Erasure. See section 12.

13.4 Complain. See section 17.

13.5 Rights under the Digital Personal Data Protection Act, 2023. The provisions of that Act on notice, consent and individual rights have been notified to come into force on 13 May 2027. From that date you will also have the rights it gives: to a summary of your personal data and how it is processed, and of the other parties it has been shared with; to correction, completion, updating and erasure; to readily available grievance redressal; and to nominate another person to exercise your rights if you die or become incapable. You will be able to complain to the Data Protection Board of India after first using our grievance process. To make any request, write to the contact in section 1.2 and quote your registered mobile number, which is the identifier we use to find your records.

14. Delivery partners and sellers

14.1 Delivery partners

We collect: name, mobile number, password (stored only as a hash), city, address, date of birth, bank account number, bank name, account holder name and IFSC, a profile photo, an identity card and a driving licence (uploaded by our team), the push-notification token, and records of orders delivered, earnings, cash collected and payouts. Delivery partners log in with their mobile number and password.

14.2 Delivery partner location

The delivery partner app reads the precise location of the phone while the tracking screen of an order is open and sends it to our server with the order number and direction of travel. We keep only the latest position for each order and show it to the customer of that order. The Android delivery app does not request background-location permission.

14.3 Sellers

We collect: name, e-mail address, mobile number, password (stored only as a hash), store name and address, map location, bank account number, IFSC, account name, branch and bank name, PAN, GST number, identity-proof and address-proof documents, logo and banner, the push-notification token, and records of commission, balance and payouts. Sellers log in with e-mail and password. Registration codes and password-reset links are sent to sellers by e-mail.

14.4 Use and sharing

This information is used to verify identity, run deliveries and sales, make payouts and meet legal requirements. A delivery partner’s name, mobile number and live position are shown to the customer of the order being delivered. A seller’s store name is shown on listings and invoices.

14.5 Closing a delivery partner or seller account

A delivery partner can close the account from the menu of the delivery app, and a seller can mark the seller account as deleted in the seller app; the records remain as described in section 12.3. To close a delivery partner or seller account, or to ask for erasure of personal information, write to support@salonkarts.com from, or quoting, your registered mobile number or e-mail address. Sections 12.3 and 12.4 apply in the same way. Payout, tax and identity records are kept for as long as the law requires.

15. Children

15.1 Salonkarts is only for persons aged 18 or above who act for a business. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, please tell us and we will remove it.

16. The laws we follow

16.1 Today this policy is governed by the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

16.2 The provisions of the Digital Personal Data Protection Act, 2023 on notice, consent, your rights, security, breach notification and retention come into force on 13 May 2027. We have written this policy with those provisions in mind and will update it before that date.

17. Privacy requests, complaints and Grievance Officer

17.1 To ask a question, make a request or complain about how your personal information is handled, write to support@salonkarts.com (please write “Privacy” or “Grievance” in the subject line) or call +91 98218 88863. Please give your registered mobile number. Complaints are handled by the Grievance Officer of SKS B2B PRODUCTS PRIVATE LIMITED, to whom letters can also be sent by post at the registered office address in section 1.1.

17.2 We will acknowledge your complaint within 24 hours and give you a reference number. We will resolve complaints about the platform’s handling of your information within 7 days, and requests that need more work (such as a copy of your data or erasure) as soon as we can and at the latest within one month of receipt.

17.3 Our general complaint process is in section 21 of the Terms and Conditions.

18. Changes to this policy

18.1 We may update this policy. The new version will be published here with a new effective date. We will tell users about this policy at least once a year and whenever it changes in an important way, by a notice in the app, on the website or by message.