Legal
Privacy Policy
Last updated: 9 October 2026
This Privacy Policy explains how WebSetGo ("we", "us" or "our") collects, uses, stores, shares and protects personal data in connection with Vestiqa and the website vestiqa.in (together, the "Service"). It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them. Capitalised terms not defined here have the meanings given in our Terms of Service.
1. Our Role
1.1 Account data. For personal data relating to salon owners, Authorised Users and visitors to our website, WebSetGo is the Data Fiduciary and determines the purposes and means of processing.
1.2 Customer Data. For personal data of Clients and staff that a salon enters into the Service, the salon is the Data Fiduciary and WebSetGo acts as its Data Processor. We process that data only on the salon's instructions and only to provide the Service. A Client who wishes to exercise any right in respect of their data should contact the salon directly, and we will assist the salon in responding.
2. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, email address, mobile number, salon name and address, GSTIN, password (stored only in hashed form) | You, at sign-up and in Settings |
| Authorised Users | Name, email address, assigned role | The salon owner |
| Customer Data | Client names, mobile numbers, visit history, invoices, preferences, notes and allergy information; staff names and commission details | Entered by the salon |
| Payment | Plan, amount, transaction reference and payment status (we never receive card numbers, UPI PINs or bank credentials) | Razorpay |
| Support | Messages, salon name, the page in use and basic technical details | You, through Help, WhatsApp or email |
| Technical | IP address, device and browser type, sign-in times, error reports | Collected automatically |
| Website analytics | Pages visited, approximate location, device type and referring source, only with your consent | Google Analytics cookies |
| Visit statistics | Page visited, referring link or campaign, device type, a random session identifier; no IP address or contact details | Our own cookieless records |
3. Purposes of Processing
3.1 We process personal data only for the following purposes:
(a) creating and administering Accounts and authenticating users;
(b) providing the features of the Service, including billing, appointments, reminders, reports and data export;
(c) processing payments, issuing receipts and preventing misuse of free trials and offers;
(d) responding to support requests and complaints;
(e) sending service communications such as email confirmation, password resets, billing notices and notices of material changes;
(f) securing the Service, detecting and preventing fraud and abuse, and diagnosing errors;
(g) understanding how our website is used and which marketing channels are effective; and
(h) complying with legal obligations and enforcing our Terms of Service.
3.2 We process personal data on the basis of the consent you give when you register and accept this Policy, and for the legitimate uses permitted under the DPDP Act, including compliance with law. We do not send marketing messages without your consent.
4. Sensitive Information
4.1 Allergy and other health-related notes about Clients may be sensitive. The Service allows salons to record them solely to alert staff before a treatment. Salons should record such information only with the Client's consent.
4.2 Passwords are stored only in hashed form, and no one at WebSetGo can view them.
5. Sharing and Service Providers
5.1 We do not sell, rent or trade personal data. We share personal data only with the service providers listed below, solely to operate the Service and under obligations of confidentiality and security.
| Service provider | Purpose | Data location |
|---|---|---|
| Supabase | Database, authentication and storage | India (Mumbai) |
| Netlify | Hosting and delivery of the website and application | Global content delivery network |
| Razorpay | Payment processing | India |
| Resend | Delivery of account emails | United States |
| Sentry | Error monitoring, excluding Client data and invoices | European Union |
| Google sign-in (if you choose it) and website analytics (with consent) | Global |
5.2 We may also disclose personal data: (a) where required by law, court order or a request from a competent government authority; (b) to protect the rights, property or safety of WebSetGo, our users or the public; and (c) to a successor entity in connection with a reorganisation, the incorporation of our business, a merger or a sale of business, which will remain bound by this Policy.
5.3 WhatsApp messages created by the Service are opened in the salon's own WhatsApp application and sent by the salon. Their handling by WhatsApp is governed by WhatsApp's own terms and privacy policy.
6. Cross-Border Transfers
The primary database of the Service is located in India. Some service providers listed in clause 5 process limited personal data outside India for email delivery, error monitoring, analytics and content delivery. Such transfers are made in accordance with the DPDP Act and are not made to any country or territory restricted by the Central Government.
7. Cookies, Local Storage and Visit Statistics
7.1 The dashboard uses only essential storage: to keep you signed in, and to hold a copy of your salon's data in your browser so that billing continues without an internet connection.
7.2 Our public website uses Google Analytics cookies only after you select "Accept" on the cookie banner. You may change your choice at any time through "Cookie settings" at the bottom of every page. Analytics does not run inside the dashboard.
7.3 We also maintain our own anonymous visit statistics for the public website, without cookies. We record only the page visited, the link or campaign that referred the visit, the device type (phone, tablet or computer) and a random identifier that lasts for one browser session. No IP address, name or contact detail is stored. When you create an Account, we record which of these sources referred you, so that we can measure which of our marketing channels are effective.
8. Data Retention
8.1 Account data and Customer Data are retained while the Account is active.
8.2 After an Account is closed, its data is retained for 30 days to allow export or reactivation, and is then permanently deleted from our active systems. Residual copies in system backups, where they exist, are deleted in the normal backup cycle.
8.3 Payment records and receipts are retained for the period required by applicable tax and accounting laws. Technical and security logs are retained for a limited period necessary for security and troubleshooting.
9. Security
9.1 We implement reasonable security practices and procedures, including encryption in transit (HTTPS) and at rest, database-level access rules that isolate each salon's data, role-based permissions for Authorised Users, multi-factor authentication for administrative access, hashed passwords, signature verification of payments, and access to personal data limited to what is necessary.
9.2 No method of transmission or storage is completely secure. You are responsible for keeping your credentials confidential and for the devices on which you use the Service.
10. Personal Data Breach
If we become aware of a personal data breach affecting data we hold, we will take prompt steps to contain it and will notify the affected salons and the Data Protection Board of India in the manner and within the time required by the DPDP Act and the rules made under it.
11. Your Rights
11.1 Subject to the DPDP Act, you have the right to: (a) obtain a summary of the personal data we process about you and the processing activities; (b) request correction, completion or updating of your personal data; (c) request erasure of personal data that is no longer necessary; (d) withdraw consent at any time; (e) nominate another person to exercise your rights in the event of your death or incapacity; and (f) seek redressal of grievances.
11.2 Many of these rights can be exercised directly in the Service, including through Settings > Backup & data. Otherwise, contact our Grievance Officer. We will respond within the time required by law, and in any event within 30 days.
11.3 Withdrawal of consent does not affect processing carried out before the withdrawal, and may mean that we can no longer provide the Service to you.
11.4 Clients of a salon should direct their requests to the salon, which is the Data Fiduciary for their data.
12. Children
The Service is not intended for persons under 18 years of age. Where a salon records the personal data of a Client under 18, the salon is responsible for obtaining the verifiable consent of the Client's parent or lawful guardian as required by the DPDP Act.
13. Changes to This Policy
We may update this Policy from time to time. The revised Policy will be published on this page with a new "Last updated" date, and we will notify you of material changes by email or within the Service before they take effect.
14. Grievance Officer and Contact
For any question, request or complaint about this Policy or your personal data, contact our Grievance Officer:
- Name: Aayush Nitin Jadhav
- Address: WebSetGo, Vartak Nagar, Thane, Maharashtra 400606, India
- Email: websetgo102324@gmail.com
- WhatsApp: +91 89285 08823
- Working days: Monday to Saturday
We acknowledge every complaint within 24 hours and resolve it within 15 days of receipt.
If you are not satisfied with our response, you may approach the Data Protection Board of India.