Privacy Policy - DressingSchool

Effective Date: 07 December 2025

Welcome to DressingSchool (“we,” “our,” or “us”). This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website (www.dressingschool.com), our DressingSchool mobile app, and our WhatsApp Bot platform.

We comply with India's Digital Personal Data Protection Act, 2023 (DPDPA 2023) and process your data only for the purposes described below.

1. Information We Collect

1.1 From DressingSchool customers (ebooks / digital products)

Email address — when you contact us or make a purchase.
Phone number — for payment confirmation and customer verification.
Payment information — processed securely through Razorpay. We do not store full card details.

We use a third-party analytics provider to understand app performance and improve user experience.

1.2 From WhatsApp Bot platform users

Account data — name, email, hashed password (bcrypt), creation date.
Bot configuration — bot name, personality, knowledge base text, reply settings, business hours, welcome messages.
WhatsApp session — when you scan a QR code to link a WhatsApp number, we store an authentication token on our server that lets the bot read and send messages from that number. We do not store your WhatsApp password.
Conversations and contacts — messages your bot receives and the replies it sends, plus contact phone numbers, display names, and auto-classified lead categories (for plans that include lead scoring).
Payment records — plan purchases, add-ons, transaction IDs from Razorpay. Full card details are never stored by us.
Usage telemetry — AI token consumption, reply latency, error logs. Used for billing and debugging.

2. How We Use Your Information

To process your purchase and grant access to digital products or bot plans.
To operate your WhatsApp bot — receiving messages, generating AI replies, tracking contacts and conversations.
To provide analytics and usage dashboards within your account.
To send you service emails (welcome, password reset, low-credit warning, scheduled-downgrade notice).
To improve our services and detect abuse or policy violations.
To comply with legal obligations and enforce our Terms.

3. How We Share Your Information

We do not sell, rent, or trade your data. We share limited data only with the third-party services required to run the platform:

Razorpay — to process payments (name, email, phone, transaction metadata).
AI providers — third-party large-language-model providers that generate your bot's replies. We send the relevant conversation context, your bot's personality, and knowledge base so they can craft a reply. These providers have their own data-processing policies; we use them under standard commercial terms.
Meta / WhatsApp — all bot messages pass through WhatsApp's infrastructure because that's how WhatsApp works. We do not control or have visibility into what Meta does with that data.
Managed database provider — our database is hosted in Indian data centres by a third-party managed-database provider.
Transactional email provider — to send service emails (welcome, password reset, alerts).
Analytics provider — ebook app usage analytics only.
Error monitoring provider — anonymised stack traces, no message content.

We may also disclose data if required by law, court order, or to protect our rights and the safety of our users.

4. Data Retention

Account data — retained while your account is active and for up to 12 months after deletion, for audit and compliance.
Chat logs — visible in your dashboard for 7 / 30 / 60 days depending on your plan tier. Stored in our database for a limited additional period for backup purposes.
Payment records — retained for the period required by Indian tax and financial laws (typically 7 years).
WhatsApp session tokens — retained only while the bot is actively connected. Revoked immediately when you disconnect or delete a bot.

You can request deletion of your data anytime by contacting us (see §10).

5. Your Rights Under DPDPA 2023

If you are an Indian resident, you have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Erase your personal data (except where retention is legally required — e.g. tax records).
Withdraw consent previously given, at any time.
Grievance redressal — escalate unresolved issues to our Data Protection Officer (see §10).

6. Data Security

All transactions are SSL/TLS encrypted (HTTPS). Payment processing is handled entirely by Razorpay using PCI-DSS compliant infrastructure — we never see your full card number.

Passwords are stored using bcrypt one-way hashing. WhatsApp session tokens are stored encrypted on our servers with filesystem-level access controls. Servers run in Indian data centres with firewalling, rate limiting, and security headers (HSTS, CSP, X-Frame-Options) in place.

Despite our best efforts, no method of transmission or storage is 100% secure. In the event of a confirmed breach affecting your personal data, we will notify you and the Data Protection Board as required by DPDPA 2023.

7. Cookies

Our website uses cookies for authentication sessions (NextAuth) and basic analytics. You can disable cookies in your browser settings, but the bot dashboard will not work without session cookies.

8. Children's Privacy

Our app and website are not designed for children under 18. We do not knowingly collect data from minors. If you believe we have collected data from a minor, please contact us and we will delete it.

9. Third-Party Links

We may include external links (e.g., product or fashion references in ebooks, or AI provider documentation). We are not responsible for the privacy practices of those third-party sites.

10. Contact Us / Data Protection Officer

For any privacy-related questions, data access, correction, deletion, or grievance requests:

Email: dressingschool@gmail.com
Phone: +91 8600574836
Location: Mumbai, India
Website: www.dressingschool.com

11. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be reflected on this page with an updated effective date. Material changes will be communicated via email to active users.