Who we are
Roshefy is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] (GSTIN [GSTIN]). Day-to-day contact: Plot No 2, Janaki Nagar, HMS Colony, Madurai 625016, Tamil Nadu, India; phone +91 93261 98485; email hello@rosheefy.com.
For shop owners and their customers using Roshefy, this policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the SPDI Rules, 2011.
What we collect
| Who | What |
|---|---|
| Shop owners and staff | Name, email, phone, password (stored scrambled, never in readable form), shop details, two-step login settings, and a record of important account actions (audit log). |
| Customers who send an enquiry or message | Name, phone, email and the message they write. |
| Customers who write a review | First name (optional), the answers they choose, the draft and final review text, language, and whether they chose to share it publicly or privately. |
| Loyalty card members | A card identifier and stamp history. Name, phone or email only if the customer chooses to add them. |
| Customer portal users | Email address for the sign-in link, saved reviews and cards. A mobile number, if given, is stored as well. |
| Everyone who visits | Technical data such as IP address, browser and device type, pages opened and error logs; cookies described in our cookie policy; and scan counts for QR codes (how many times a code was opened, not who scanned it). |
We do not knowingly collect more than each feature needs, and we do not buy personal data from others.
Why we use it, and our legal basis
- To run your account and the features you ask for. Basis: your consent and our agreement with you.
- To show a shop the enquiries, reviews and loyalty activity of its own customers. Basis: the customer's consent when they submit.
- To keep the service secure, stop spam and abuse, and fix faults. Basis: legitimate use under the DPDP Act and our duty to protect data.
- To meet legal duties such as tax and responding to lawful orders.
Where we rely on consent, you can withdraw it at any time (see the section on your rights). We do not sell personal data and we do not use it for advertising.
Who sees what
- Shop owners and permitted staff see the enquiries, reviews, loyalty activity and customer-book entries for their own shop only. They cannot see any other shop.
- A customer's portal mobile number is visible only to a small number of authorised Roshefy staff (the people who run and secure the service). It is not shown to shop owners.
- The public sees only what a shop publishes on its page, and public reviews only after the shop owner approves them.
Who we share data with
We use trusted service providers (called processors) who handle data only on our instructions:
- Hosting and storage providers to run the service and keep backups.
- Email delivery providers to send sign-in links and notifications.
- Anthropic, an AI provider, used to draft review text. Only the shop name and category and the customer's answers are sent (ratings, chosen qualities, any note they type, language and tone). Their phone number and email are never sent. Anything typed in a note is passed on, so customers should not type private details there. The customer always reviews and approves the draft.
We may also disclose data where the law requires it. Some providers may process data outside India. We choose providers who protect data to a high standard.
How long we keep data
We keep data only while it is needed for the purpose it was collected for, or as the law requires. Shop data is kept while the shop's account is active. When an account is closed, or you ask us to delete data, we delete or anonymise it within a reasonable period, except records we must keep for legal or tax reasons. [Confirm exact retention periods before launch]
How we protect data
- Two-step login for shop accounts.
- Each shop's data is kept separate from every other shop's.
- Encrypted connections (HTTPS) and protected cookies.
- An audit log of important actions.
- Limits on repeated requests to slow down abuse, and regular backups.
No system is perfectly secure, but we work to protect your data and review our measures regularly.
Your rights
Under the DPDP Act you may: get a summary of the personal data we hold about you and how it is used; ask us to correct or complete it; ask us to erase it; withdraw your consent at any time; nominate another person to exercise your rights if you die or cannot act for yourself; and complain if you are not satisfied. To use any right, see Your data rights or email hello@rosheefy.com.
Children
Roshefy is meant for adults. We do not knowingly collect personal data of anyone under 18 without verifiable consent from a parent or guardian. If you think a child has given us data, contact us and we will delete it.
Grievance officer
Grievance Officer: [Name]
Address: [Address]
Email: hello@rosheefy.com
We acknowledge complaints within 48 hours and aim to resolve them within 15 days.
If something goes wrong
If a data breach affects your personal data, we will tell you without undue delay and report it to the Data Protection Board of India and other authorities as the law requires, explaining what happened and what you can do.
Changes to this policy
We may update this policy. We will change the date at the top and, for important changes, tell you in the product or by email.