Privacy Policy
The short version
- We collect only what is needed to run the service: your account details, and the business records your studio enters.
- We do not sell personal data, show ads, or use analytics or advertising trackers.
- The camera and photo library are used only when you choose to add a photo. We never collect your location or contacts.
- You can ask us to access, correct or delete your data at any time by writing to support@sanskar.studio.
1. Who we are
Sanskar Studio (“we”, “us”) provides software that tailoring and boutique studios use to manage their customers, measurements, orders, production workflow and staff. The service is available at app.sanskar.studio and through our Android and iOS apps (together, the “Service”).
This policy explains what personal data the Service handles, why, and the choices you have. If you have questions, contact us at support@sanskar.studio.
2. Our role and your studio's role
The Service is used by businesses. Who is responsible for a given piece of data depends on whose data it is:
- Studio staff accounts. For the account details of people who sign in to the Service (owners, managers and staff), Sanskar Studio decides how that data is used and is responsible for it.
- A studio's customer records. When a studio records information about its own customers (for example their measurements or orders), the studio decides what to collect and how to use it. We process that information on the studio's behalf and only to provide the Service to that studio. Each studio's records are kept separate from every other studio's.
3. Information we collect
Account information
When a studio invites you or your access request is approved, we store your name, email address, optional phone number, role and job function, the organization and branches you belong to, and your password (stored only as a one-way hash, never in readable form). If you turn on two-factor authentication, we store the setup secret and one-way hashes of your recovery codes.
Access requests
If you request access for a new studio, we collect the studio's name, the owner's name, email address and optional phone number, and any message you include. We use this to review the request and contact you about it.
Business records entered by studios
Studios use the Service to keep records that may include personal data about their customers:
- names, preferred names and gender (used to choose the right measurement set)
- email addresses, mobile numbers and postal addresses
- body measurements and their history
- photos of customers, garments and reference designs that staff choose to upload
- orders, garments, due dates, prices, advance payments recorded and notes
The Service records payment amounts only. It does not process payments or collect card or bank details.
Work and activity records
To run the studio, the Service records tasks assigned to staff, progress through workflow stages, and clock-in and clock-out times with optional notes. It does not record the location of a clock-in.
Security and technical information
When you use the Service, our servers record the IP address and device or browser details (user agent) of requests, sign-in times, failed sign-in attempts, and details of errors. We use these to keep accounts secure, prevent abuse and fix problems.
4. How we use information
- To provide the Service: signing you in, showing your studio's records to the right people, and storing photos and documents.
- To send messages the Service needs to send, such as invitations, access-request decisions and password-reset codes (by email, or by SMS to Indian mobile numbers).
- To protect the Service and its users, for example by limiting repeated sign-in attempts, locking accounts after failed attempts, and keeping audit records of access to sensitive data.
- To diagnose and fix errors.
- To meet legal obligations and enforce our terms.
We do not sell personal data, use it for advertising, or build profiles of you. Personal data is processed with your consent, to perform our contract with your studio, or for the legitimate interest of keeping the Service secure and working, as applicable law allows.
5. Device permissions
The mobile apps ask for only these permissions, and only at the moment you need them:
- Camera, to take a photo of a customer, garment or design when you choose to.
- Photos / media library, to pick an existing image to upload when you choose to.
Photos are uploaded only when you choose to add one. The apps do not access your location, contacts, microphone or other files, and they contain no advertising or analytics software.
6. Cookies and local storage
The web app uses one essential, secure cookie to keep you signed in. It also keeps a short-lived sign-in token, your basic profile, and your selected organization and branch in your browser's local storage so the app loads quickly. Signing out clears them. The mobile apps keep the same information in the device's secure storage. We do not use advertising or analytics cookies. This website (sanskar.studio) sets no cookies.
7. Who we share it with
Within your studio. Records are visible to people in the same organization according to the roles and permissions the studio assigns.
Service providers. We use a small number of providers to run the Service. They process data only on our instructions and only to provide their service to us:
| Provider | What they do |
|---|---|
| Render | Hosts our servers, database and websites |
| Cloudflare (R2) | Stores uploaded photos in private storage |
| Our email delivery provider | Delivers invitations, notifications and password-reset emails |
| MSG91 | Delivers password-reset codes by SMS to Indian mobile numbers |
| Apple and Google | Distribute the mobile apps through their app stores, under their own privacy policies |
Legal reasons. We may disclose information if required by law, or to protect the rights, safety or property of our users, the public or Sanskar Studio.
Business transfers. If Sanskar Studio is involved in a merger, acquisition or sale of assets, data may be transferred as part of that transaction, subject to this policy.
8. Where data is stored
Our servers and database run in Render's Singapore region. Photos are stored with Cloudflare R2, and messages are delivered through our email and SMS providers, which may process data in other countries. Wherever data is processed, we take steps to protect it as this policy describes.
9. How long we keep it
- Accounts and studio records are kept while the studio uses the Service. A studio can edit or remove records, and can ask us to delete its data when it stops using the Service.
- Access requests are kept so we have a record of each decision. You can ask us to delete yours.
- Security, audit and error logs are kept for up to 12 months for security and troubleshooting, then deleted.
- Backups made by our hosting provider are overwritten on a rolling basis. Deleted data disappears from them within 30 days.
We may keep some information longer where the law requires it.
10. Security
We protect data with encryption in transit (HTTPS) for all traffic, one-way hashing of passwords and recovery codes, optional two-factor authentication, account lockout after repeated failed sign-ins, rate limits on sensitive actions, role-based access controls, separation of each studio's data, private photo storage, and audit records of access to sensitive data. Our hosting and storage providers encrypt stored data at rest. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
11. Your rights
Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU/UK GDPR, you may have the right to:
- get a summary of the personal data we hold about you and how it is used
- have inaccurate or incomplete data corrected or updated
- have your data erased
- withdraw consent you have given, without affecting processing that already happened
- object to or restrict certain processing, and receive your data in a portable format
- nominate someone to exercise your rights if you die or become incapacitated
- complain to us, and then to the relevant data protection authority (in India, the Data Protection Board of India)
To exercise any of these rights, email support@sanskar.studio from the address linked to your account. We may need to verify your identity, and we will reply within 30 days. Questions and grievances about how we handle personal data can be sent to the same address.
12. If you are a studio's customer
If a studio holds your details in Sanskar Studio, that studio is responsible for them. Please contact the studio first to see, correct or delete your information. If you cannot reach the studio, write to us at support@sanskar.studio, name the studio, and we will pass on your request and help where we can.
13. Deleting your account
You can ask us to delete your account and the personal data linked to it at any time. You can start from Settings → Delete Account in the app or follow the steps on our account deletion page. If you own a studio, you can also ask us to delete the studio and all of its records.
14. Children
Studio staff accounts are for adults only, and the Service is not directed at children. A studio may record measurements for a child customer. Studios are responsible for getting a parent's or guardian's consent where the law requires it. If you believe we hold a child's data without proper consent, contact us and we will delete it.
15. Changes to this policy
We may update this policy as the Service changes. We will post the new version here with a new effective date. If the changes are significant, we will tell studio owners by email or in the app before they take effect.
16. Contact us
Sanskar Studio
Email: support@sanskar.studio
Website: sanskar.studio