Privacy Policy

This policy explains what GlimmerDesk does with personal information. GlimmerDesk is operated by an independent proprietor based in Chandigarh, India. It is not currently incorporated as a company.

1. Two different kinds of information

GlimmerDesk touches personal data in two distinct roles, and they work differently.

• Your account. Your name, your business details and your email. We decide how this is used, so under India's Digital Personal Data Protection Act 2023 we are the Data Fiduciary for it.
• Your clients' records. The customers in your book. You decide what goes in and why, so you are the Data Fiduciary and we are your Data Processor. We handle that information only to run the service for you, and never for our own purposes.

2. What we collect about you

• Your name, email address and password (stored only as a secure hash, never as text).
• Your business name, address, phone and GST number if you enter one.
• Which plan you are on and what you have paid.
• Basic technical logs needed to keep the service running and secure.

3. What your workspace holds about your clients

You choose what to record. The app is built to hold names, phone numbers, email addresses, birthdays, visit and billing history, and free-text notes which may include allergies, patch test results, medical flags and personal preferences.

Some of that is sensitive. We do not read it, analyse it, share it, or use it to train anything. We store it, back it up, and show it back to you.

4. Why we hold it

• To provide the service you signed up for.
• To keep your workspace secure and to restore it if something breaks.
• To contact you about your account, billing or a problem.
• To meet a legal obligation where one applies.

We do not sell personal data. We do not rent it. We do not use it for advertising, and we do not build profiles of your customers.

5. Where it is stored

Your live workspace is stored in an encrypted database hosted in Mumbai, India, and the application is served from Mumbai too.

The nightly backup is held outside India. It is a compressed copy of the database kept as a private file in our GitHub account, on servers in the United States, encrypted at rest and deleted automatically after 90 days. Only we can open it. We keep it off-site on purpose: a backup stored beside the thing it is backing up is not a backup. India's DPDP Act permits this transfer, and we tell you plainly rather than leaving it out.

6. Who else can see it

We use a small number of service providers to run GlimmerDesk. They only process data to provide their part of the service:

• Supabase for the database and login, hosted in Mumbai, India.
• Vercel for hosting the application, served from Mumbai, India.
• Resend for sending email, such as your confirmation email and booking confirmations to your customers.
• Razorpay when online payment is used. Card and bank details are entered on Razorpay's own pages. We never see or store them.
• GitHub holds the nightly off-site backup described above, in the United States.

We share data with no one else, unless the law requires it or you ask us to. One salon can never see another salon's data: workspaces are isolated at the database level.

7. How long we keep it

• Deleting a client or an appointment moves it to a bin you can restore from. Anything left there is permanently removed after 30 days, and you can delete it for good sooner.
• If you close your account, you have 30 days to ask for an export. After that your workspace is deleted permanently.
• Backups roll off on a 90 day cycle.

8. Your rights

Under the DPDP Act 2023 you can ask us to:

• tell you what personal data of yours we hold,
• correct it if it is wrong,
• delete it,
• and you may withdraw consent or complain about how we have handled it.

Email support@glimmerdesk.com and we will respond within one business day and act within 30 days.

If you are the customer of a salon that uses GlimmerDesk, your record belongs to that salon, not to us. Please ask them directly. If you cannot reach them, write to us and we will pass your request on.

9. Security

Honestly stated, here is what we do and what we do not:

• Data is encrypted in transit and at rest.
• Every workspace is isolated by database level access rules, so one account physically cannot read another's rows.
• Passwords are stored as hashes and are never visible to us.
• The database is backed up every night.
• We are a small operation and we have not been through an external security audit or certification. We would rather say so than imply one.

10. Cookies

We use cookies only to keep you signed in and to remember your display preferences. There are no advertising cookies and no third party tracking pixels.

11. Children

GlimmerDesk is for businesses and is not intended for anyone under 18. If a salon records a child as a client, the salon is responsible for having the parent or guardian's consent.

12. Changes

If we change this policy in a way that matters, we will email you before it takes effect. The date at the top always shows the current version.

13. Contact and grievances

For any privacy question, request or complaint, write to us and mark it Privacy:

GlimmerDesk, Chandigarh, India
support@glimmerdesk.com
See our contact page.