Privacy Policy

1. Who we are

Vagasko is a discovery and booking marketplace for venues, spas, barbers, beauty, wellness, and related services. We operate platform software for accounts, listings, bookings, prepaid payments, wallets, notifications, trust scoring, and support — we do not ourselves perform the in-person service at the venue.

2. Data we collect

2.1 Account & profile

• Name, mobile number, optional email, profile photo
• OTP verification records used for login / phone change
• Referral code used (if any), registration code, account status, last login time
• Saved address / location fields you choose to store on your profile

2.2 Booking & visit data

• Services selected, date/time, amounts, prepaid / due amounts, booking status
• Notes you add, cancellation reasons, reschedule history, status logs
• Visit start OTP / start-code records needed to begin the service securely
• Per-booking chat messages between you and the venue

2.3 Payments & wallet

• Payment status, amounts, timestamps, Razorpay order / payment / refund identifiers
• Checkout platform fee and prepaid records linked to the booking
• Wallet / cashback / referral / refund-balance ledgers and transaction history
• We do not store full card numbers, CVV, or sensitive UPI PINs on Vagasko servers — those stay with the payment gateway

2.4 Engagement & content

• Wishlists, reviews/ratings (and optional review images)
• In-app notifications about bookings, refunds, wallet, chat, and offers
• Loyalty / cashback / referral program activity where you participate

2.5 Technical data

• API auth tokens (Sanctum) for your logged-in sessions
• For website sessions: IP address, user agent, and session data as stored by the platform
• Basic usage needed to keep the product secure and working (errors, request logs where enabled)

3. How we use data

• Create and secure your account (OTP login, session tokens)
• Show nearby / filtered listings and let you book, reschedule, cancel, or complete visits
• Process prepaid payments, refunds, wallet credits, and related notifications
• Enable booking chat and share the minimum contact details needed once a booking is accepted
• Compute Trust Score and detect fraud, abuse, chargeback risk, or policy misuse
• Provide support, improve product reliability, and meet legal / accounting obligations
• Send transactional alerts (booking status, refunds, OTP-related security). Marketing messages, if any, are optional where consent/settings allow

4. Bookings, OTP & chat

• When you book, the venue receives the booking details needed to accept or reject the visit.
• Your phone number is generally masked until the booking is accepted; after accept / during an ongoing visit, the venue may see contact details required to serve you.
• Start OTPs are generated so the venue can verify you at the chair / desk. Do not share OTPs with anyone other than authorised venue staff for that booking.
• Chat messages are stored against the booking so both sides can coordinate that visit.

5. Payments & wallets

• Prepaid checkout and refunds are processed through payment partners such as Razorpay.
• We keep gateway references and amounts so we can confirm payment, settle refunds, and handle disputes.
• Cashback, referral, and refund-wallet balances are stored as ledger entries on your account.
• Promotional credits are usually for platform use and follow program rules — they may not be cash-withdrawable.

6. Location & discovery

• If you allow location (or save a city / address), we use it to show nearby venues, distance-based explore results, and relevant offers.
• Map / place search may use partners such as Google Maps (and similar geocoding tools). Queries you type into map search can be processed by those partners.
• Disabling location may limit nearby discovery accuracy; you can still browse and book with manual search.

7. Trust score & history

Vagasko may calculate a Trust Score from your booking history (for example completions, late cancellations, no-shows, and on-time starts). This score is derived from records we already hold — it is used for reputation / risk signals inside the product and is separate from refund money outcomes.

8. Sharing & third parties

Vagasko does not sell your personal information. We may share data only as needed with:

• Venues — to fulfil your booking (services, slot, notes, and contact details when the booking state allows)
• Payment gateways — to collect prepaid amounts and process refunds
• Map / cloud / hosting / support tools — to run and secure the product
• Authorities / advisors — when required by law, court order, or to defend legal claims
• Business transfers — if Vagasko is involved in a merger, acquisition, or restructuring, with appropriate safeguards

9. Security & retention

• We use commercially reasonable safeguards (access control, authenticated APIs, encrypted transport where applicable, role-based admin access).
• No online system is perfectly secure; please protect your phone and OTP access.
• We retain account, booking, payment, wallet, and support records for as long as needed to operate the service, prevent fraud, meet tax/legal duties, and resolve disputes.
• If an account is blocked or closed, some records may still be kept where law or fraud prevention requires it.

10. Your choices & rights

• Update profile details from your account settings where available.
• Control device location permissions in your phone / browser settings.
• Subject to applicable Indian law, you may request access, correction, or deletion of personal data we hold about you.
• We may verify your identity before acting, and may refuse requests that are unlawful, abusive, or conflict with mandatory retention (for example payment / dispute records).

11. Children & changes

• Vagasko is intended for users who can enter a valid binding arrangement under applicable law. We do not knowingly collect data from children in violation of law.
• We may update this Privacy Policy when features, law, or operations change. The “Last updated” date will change; continued use means you accept the revised policy to the extent permitted by law.
• External websites / apps linked from Vagasko (maps, payment pages, social links) have their own privacy practices — review those separately.

12. Contact

1. Business data we collect

• Vendor account: name, phone, OTP login records, registration / referral codes, account status
• Business profile: business name, owner details, email/phones, categories, description, experience, pricing ranges, opening hours, capacity / slot settings
• Location: address lines, area, city/state, pin, map coordinates used for discovery and distance search
• Operational: services & variants, deals, bookings, status logs, chat messages, notifications, analytics summaries
• Staff tools: Sanctum API tokens for vendor dashboard / app sessions

2. Public listing data

After approval, certain business information is shown publicly for discovery and booking, including business name, services, prices you publish, hours, address / area, gallery, portfolio, approved reels, ratings/reviews, and other listing content you upload.

• You must only upload content you have rights to use, and that is accurate and lawful.
• Vagasko may review, reject, unpublish, or remove listing content that violates policy or law.
• Only businesses with an approved profile status appear in public explore / discovery feeds.

3. Customer data you receive

• When a customer books you, you receive booking essentials: services, slot, amounts, notes, and status.
• Customer phone / contact details are typically revealed after the booking is accepted (or during an ongoing visit), so you can serve the appointment.
• Use customer personal data only to fulfil that booking and related lawful service needs — not for unrelated marketing spam or sale to third parties.
• Booking chat and start-OTP verification exist to coordinate and start the visit securely.

4. Offline CRM

If you use offline customer tools on Vagasko, you may store walk-in customer name, phone, gender, address, notes, and visit history. That data is for your venue CRM / analytics and is hosted on the platform database under your account scope. It is not the same as a customer’s own Vagasko user account unless they separately register.

5. Payments, KYC & wallet

• We store settlement and wallet ledgers (for example prepaid settlement, top-ups, cashback received, coupons, referral earnings).
• For withdrawals / payouts you may submit bank account details, IFSC, UPI ID, PAN, and payment QR images — used for settlement operations and admin payout processing.
• Gateway partners (for example Razorpay) process top-ups, featured / campaign payments, and related payment metadata.
• We do not need your customers’ full card numbers for prepaid bookings; gateway references and amounts are enough for platform reconciliation.

6. Media & reels

• Logo, cover, gallery, portfolio, banners, and reels (video / thumbnail / captions / effects metadata) may be stored and moderated.
• Reels generally require admin approval before public display; rejected or removed media may still be retained for audit.
• Do not upload illegal, infringing, or harmful content.

7. Sharing & processors

• Customers see your public listing and booking-related communications
• Payment / maps / hosting partners process data needed to run payouts, maps, and infrastructure
• Admins may access business, booking, wallet, and media records for approval, support, fraud review, and payouts
• Legal authorities when required by law or to protect Vagasko, customers, or partners

8. Your responsibilities

• Keep listing and payout details accurate; you are responsible for content you publish.
• Protect staff access to the vendor dashboard; do not share OTP / tokens.
• Handle customer personal data lawfully; do not misuse phones obtained through bookings.
• Do not fabricate no-shows, manipulate OTPs, or commit payment / settlement fraud.

9. Security, retention & rights

• We apply commercially reasonable security for vendor accounts, wallets, and media storage.
• Business, booking, wallet, KYC, and media records are retained for operations, settlements, tax/audit, and dispute / fraud defense.
• You may request access or correction of your business account data, subject to verification and lawful retention needs.
• Blocking or suspension of a business account may limit login and payouts while preserving necessary records.

10. Contact