Privacy Policy
Version v1-2026-07 · Last updated 12 July 2026
1. Scope
This Privacy Policy explains how Studio CRM ("we", "us") collects, uses, stores and protects personal data when you use the Service. For data your studio enters about its own customers and staff, your studio is the data "fiduciary"/controller and we act as a processor on your behalf, handling that data only to provide the Service.
2. Data we collect
Account data: your name, email, studio name and login credentials (passwords are stored only as salted hashes). Studio data you enter: customers, leads, quotations, bookings, invoices, payments, team records and any files you upload (which may include identity documents you choose to store). Technical data: IP address, device/browser information and activity logs needed to operate and secure the Service.
3. How we use data
We use data to: provide and maintain the Service; authenticate you and secure your account; process payments; send operational notifications; provide support; detect, prevent and investigate abuse or security incidents; and comply with legal obligations. We do not sell your personal data, and we do not use the studio data you enter for advertising.
4. Legal basis
We process personal data to perform our contract with you, on the basis of your (or your customers') consent where required, to pursue our legitimate interest in operating and securing the Service, and to meet legal obligations, consistent with India's Digital Personal Data Protection Act, 2023 and other applicable law.
5. Where data is stored
Application data is stored on a self-managed server. Uploaded files and images are stored on Cloudflare R2 object storage. Sensitive documents (for example government-ID scans and attendance photos) are held in a separate, non-public storage bucket and served only through short-lived signed links to authorised users — they are not publicly accessible.
6. Sharing & processors
We share personal data only with the service providers needed to run the Service, under appropriate confidentiality and data-protection terms — for example Razorpay (payments) and our email, SMS and WhatsApp messaging providers (notifications). We may disclose data where required by law or to protect our rights, users or the Service.
7. Retention
We retain personal data for as long as your account is active and as needed to provide the Service, then for any period required to comply with legal, tax or accounting obligations or to resolve disputes. On account closure you may request export or deletion of Your Data, subject to those obligations.
8. Security
We use technical and organisational measures to protect data, including encrypted transport, hashed passwords, encryption of sensitive stored secrets, tenant isolation, access controls and regular backups. No system is perfectly secure, but we work to protect your data and to respond promptly to incidents.
9. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and may withdraw consent where processing is based on it. For data your studio holds about its customers or staff, please direct requests to that studio (the controller); we will assist them as their processor. To exercise your rights or raise a grievance, contact us using the details below.
10. Cookies
We use strictly necessary cookies to keep you signed in and to operate the Service. We do not use third-party advertising cookies.
11. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children except where a studio records it as part of its own customer data, for which that studio is responsible.
12. Changes
We may update this Policy from time to time. Material changes bump the version above and take effect when posted. Continued use of the Service after a change means you accept the updated Policy.
13. Contact & grievances
Privacy questions and data-rights or grievance requests: support@studiocrm.in. We aim to acknowledge and address requests within the timelines required by applicable law.
This document is provided for general use and is not legal advice. Consider having it reviewed against your specific business and jurisdiction.