Privacy Policy

2. Personal Data We Collect

We collect only what is necessary to operate the Platform and provide you with a reliable booking and payment experience.

2.1 Identity Information

• Full name (required) – displayed on your profile and in bookings.
• Mobile number (required) – E.164 format; used for OTP login and booking notifications.
• Email address (optional at signup) – used for receipts, password reset, and account verification.
• Date of birth (optional) – used for age verification (minimum 13 years).
• Gender (optional) – male, female, other, or prefer not to say.
• Profile photo (optional) – stored in AWS S3 (ap-south-1 Mumbai) or local server storage.

2.2 Location Data

• What we collect: GPS coordinates (latitude and longitude) and a geocoded area name.
• How: Through device permissions ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION on mobile apps.
• When:On-demand only – we read your location when you open the Home tab to show nearby services. We do not track your location continuously or in the background.

2.3 Financial Information

For Customers: Payment transactions are processed entirely by Razorpay (UPI, credit/debit cards, net banking, wallets). 360 Service Hub does not store your card numbers, bank account details, UPI IDs, or CVVs. Razorpay is PCI-DSS compliant. We store only your in-app wallet balance to support prepaid bookings and refunds.

For Businesses: Bank account number, IFSC code, and PAN number are required for identity verification (KYC) and settlement payouts. These details are encrypted at rest using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256) and are decrypted only at the moment a payout is initiated. They are never exposed in logs or API responses.

2.4 Booking and Service Data

• Services booked, date/time, assigned staff member, booking status history (with a full audit trail), customer notes, and cancellation reasons.
• Reviews: a rating (1 to 5) and an optional comment (up to 2,000 characters), limited to one review per completed booking.

2.5 Business KYC Documents

Business users upload identity and compliance documents during onboarding: PAN card image, identity proof (front and back), business proof (trade license, GST certificate, etc.), and a selfie for liveness verification. These documents are stored in AWS S3 (ap-south-1) or local server storage and are accessible only to authorised operations staff for verification.

2.6 Device and Technical Data

• Push notification tokens: Firebase Cloud Messaging (FCM) device tokens, used solely to deliver notifications you have opted into.
• Device platform: iOS, Android, or Web – used to format notifications correctly.
• IP address: Logged for rate-limiting and abuse prevention. Not used for advertising or user profiling.

2.7 Usage Data

• Search history: Stored locally on your device only (SharedPreferences on Android, equivalent on iOS), capped at 10 recent items. This data never leaves your device.
• Notification preferences: Your choices for new-booking alerts, reminders, marketing messages, and push enable/disable – stored on our servers.

2.8 Images

Profile photos, business images, service images, and staff photos uploaded to the Platform are stored in AWS S3 (ap-south-1 Mumbai region) or on our local server storage.

3. How We Use Your Data

We process your personal data on the basis of your consent (provided when you create an account and accept this policy) and for legitimate uses permitted under the DPDP Act, 2023:

• Create and manage your account
• Verify your identity via OTP
• Show nearby services based on your location
• Process bookings, payments, and refunds
• Settle payouts to Businesses (using encrypted bank details)
• Send booking confirmations, reminders, and notifications you have opted into
• Display and moderate reviews
• Verify Business identity through KYC
• Prevent fraud and abuse (IP-based rate limiting, OTP attempt monitoring)
• Diagnose errors and crashes via Sentry (PII sending disabled)
• Comply with legal obligations (financial record-keeping for RBI and tax authorities)

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Cookies and Local Storage

Website (360servicehub.com)

We store your theme preference (sh-theme) in your browser's localStorage. This is not a tracking cookie – it simply remembers whether you chose light or dark mode. We do not use third-party advertising or analytics cookies on our website.

Mobile Apps

Our mobile apps do not use cookies. Authentication tokens are stored in FlutterSecureStorage, which uses the device's encrypted keychain (iOS) or encrypted shared preferences (Android).

5. Who We Share Your Data With

We never sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:

5.1 Service Providers You Book

When you make a booking, the Business receives your name, booking time, service details, and any notes you add. This is necessary to fulfil your appointment.

5.2 Third-Party Data Processors

We use the following third-party services that process data on our behalf, under contractual data-processing agreements:

• Razorpay (India) – Payment processing, PCI-DSS compliant. Receives transaction amount, order ID, and payment method metadata.
• 2Factor.in (India) – Primary SMS OTP delivery. Receives mobile number and OTP code.
• MSG91 (India) – Fallback SMS OTP delivery. Receives mobile number and OTP code.
• Twilio (USA) – Last-resort SMS OTP delivery. Receives mobile number and OTP code.
• Firebase / Google (USA) – Push notifications (FCM) and app configuration. Receives FCM device token and notification payload.
• AWS S3(India, ap-south-1) – File and image storage. Stores uploaded images and KYC documents.
• Sentry (USA) – Error tracking and crash reporting. Receives error context and stack traces. PII sending is disabled (send_default_pii=False).
• SMTP Provider – Transactional email (booking confirmations, password resets). Receives email address and message content.

5.3 Legal and Regulatory Disclosures

We may disclose your data if required by law, court order, or a government or regulatory authority in India. We may also disclose data to enforce our Terms of Service or protect the rights, property, or safety of our users.

5.4 Business Transfers

If 360 Service Hub undergoes a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you before your data becomes subject to a different privacy policy.

6. Cross-Border Data Transfers

Some of our third-party processors – Twilio, Firebase/Google, and Sentry – are based in the United States. When your data is processed by these services, it may be transferred outside India. We ensure such transfers are protected by:

• Data Processing Agreements (DPAs) with each processor
• Standard Contractual Clauses where applicable
• Compliance with the cross-border transfer provisions of the DPDP Act, 2023, once the Central Government notifies the list of restricted jurisdictions

We do not transfer data to any country that the Central Government has restricted under Section 16(1) of the DPDP Act.

7. How We Protect Your Data

Encryption

• All data in transit is protected by TLS (HTTPS).
• Business bank details (account number, IFSC, PAN) are encrypted at rest using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256).
• Authentication tokens on mobile devices are stored in FlutterSecureStorage (platform-encrypted keychain/keystore).

Authentication Security

• OTP-first authentication: 6-digit code with a 5-minute expiry, stored in Redis.
• JWT tokens signed with RS256 (RSA key pairs): access tokens expire after 8 hours, refresh tokens after 7 days.
• OTP rate limiting: maximum 10 requests per hour per IP address, maximum 1 request per minute per mobile number.

Logging and Redaction

• Sensitive fields are never logged: password, otp, token, refresh_token, card, cvv, secret.
• Request bodies for authentication, payment, and OTP endpoints are excluded from server logs.
• Sentry is configured with send_default_pii=False to prevent accidental PII capture in crash reports.

Infrastructure Security

• HTTP security headers enforced: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security (HSTS), Referrer-Policy, and Permissions-Policy.
• Razorpay webhook callbacks validated using HMAC-SHA256 signature verification to prevent tampering.

8. How Long We Keep Your Data

• Active account data: Retained while your account is active.
• OTP codes: Auto-expire in Redis after 5 minutes.
• Expired JWT tokens (blacklist): Purged daily at 3:00 AM IST.
• Booking audit logs: Retained indefinitely for financial compliance.
• Payment and transaction records: Minimum 8 years per RBI regulatory requirements.
• Data after account deletion: Personal data anonymised or deleted within 30 days. Financial records retained per regulatory requirements.

9. Your Rights Under the DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

Right to Access (Section 11)

You can request a summary of the personal data we hold about you and the processing activities we perform with it.

Right to Correction and Erasure (Section 12)

You can ask us to correct inaccurate data or delete personal data that is no longer necessary for the purpose it was collected. You can update most information directly in the app under Profile settings.

Right to Grievance Redressal (Section 13)

You have the right to file a complaint about how we handle your data. See Section 13 of this policy for Grievance Officer details.

Right to Nominate (Section 14)

You may nominate another person to exercise your data rights on your behalf in the event of your death or incapacity.

Right to Withdraw Consent

You may withdraw your consent at any time by:

• Adjusting notification preferences in-app (Settings > Notifications)
• Contacting us at privacy@360servicehub.com to request account deletion
• Deleting your account from the app (Profile > Delete Account)

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Some data (financial records, audit logs) must be retained regardless of consent withdrawal due to legal obligations.

How to Exercise Your Rights

Email us at privacy@360servicehub.com with the subject line "Data Rights Request." We will verify your identity (typically via OTP to your registered mobile number) and respond within 30 days.

10. Children's Privacy

360 Service Hub requires all users to be at least 13 years old. Our registration process enforces a minimum age of 13 through date-of-birth validation.

We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, please contact us at privacy@360servicehub.com and we will delete the account and associated data promptly.

For users between 13 and 18 years of age, we recommend parental or guardian supervision when using the Platform.

11. Third-Party Links and Services

The Platform may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policy of every website or service you interact with.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Effective Date" at the top of this page.
• We will notify you via push notification or email (if you have provided an email address).
• For changes that materially expand how we use your data, we will seek your consent again before applying the new terms to your existing data.

Your continued use of the Platform after the updated policy takes effect constitutes your acceptance of the changes.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer:

• Name: [To Be Appointed]
• Email: grievance@360servicehub.com
• Address: 360 Service Hub, Bangalore, Karnataka, India

We will acknowledge your grievance within 24 hours of receipt and resolve it within 15 days of acknowledgement.

If you are not satisfied with the resolution, you may file a complaint with the Data Protection Board of India established under the DPDP Act, 2023.

14. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data:

• Email: privacy@360servicehub.com
• Grievance Officer: grievance@360servicehub.com
• Website: 360servicehub.com
• Address: 360 Service Hub, Bangalore, Karnataka, India

15. Governing Law

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Consumer Protection Act, 2019. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts in Bangalore, Karnataka, India.