This Privacy Policy explains how Aasure Company Private Limited ("Aasure", "we", "us" or "our") collects, uses, shares and protects personal data when you use the Aasure platform, our booking pages, the websites we host for businesses, our emails and aasure.app (together, "the Service").
Aasure is a software platform for service businesses such as salons, studios, clinics and trainers. Some of the personal data in the Service belongs to us, and some of it belongs to the businesses that use us. Section 3 explains the difference, and it matters for who you should contact about your data.
1.Who we are
Aasure Company Private Limited is a company incorporated in India (CIN U62010HR2026PTC143405) with its registered office at HN 683-3, Thanesar, Sector 3 U E KKR, Thanesar, Kurukshetra 136118, Haryana, India.
For any privacy question or request, email contact@aasure.app. Our Grievance Officer is named in section 15.
2.Who this policy covers
- Business users: owners, admins and team members who sign up for and use the Aasure studio app.
- Staff: people a business adds to Aasure so they can be booked, even if they never log in.
- Clients of businesses: people who book an appointment, join a waitlist, subscribe to emails or are otherwise added to a business's client list through Aasure.
- Website visitors: people who visit aasure.app or a website a business publishes with Aasure.
3.Businesses control their clients' data
When a business uses Aasure to manage its clients, bookings, emails and records of payments, that business decides what data to collect and why. For that data, the business is the data controller (in India, the "data fiduciary") and Aasure is its data processor: we store and process the data on the business's behalf and on its instructions, under our Data Processing Agreement.
If you are a client of a business and want to access, correct or delete your data, please contact that business first. If you contact us instead, we will pass your request to the business and help it respond. The business's own privacy notice governs how it uses your data.
Aasure is the data controller for the data of business users, for visitors to aasure.app, and for data we use to run, secure and bill for the Service.
4.Data we collect
Data you give us
- Account data: your name, email address, password (stored only as a one-way hash), profile photo and optional profile details.
- Business data: business name, contact email, phone number, address, branding, services, prices, opening hours and settings.
- Staff data: name, email, phone, photo, bio, working hours and availability, as entered by the business.
- Client data entered by businesses or clients: name, email, phone, address, date of birth, notes, booking history, answers to booking questions, waitlist entries, marketing preferences and records of payments the business enters.
- Email subscriber data: email address, name, how consent was given, and unsubscribe history.
- Content: files, images, website pages, email campaigns and messages you create or upload.
- AI assistant conversations: messages you send to the Aasure assistant and its replies, and short notes it saves to remember your preferences (you can delete these).
- Communications: messages you send us through our contact forms, waitlist or email.
Data collected automatically
- Sign-in and security data: IP address, browser and device details, and sign-in times, stored with your session.
- Error and performance data: when something breaks in the studio app, we capture technical details of the error. For some errors we record a short replay of the screen with all text masked and all images and media blocked, so we can see what went wrong without seeing your content.
- Email engagement: for marketing emails sent through Aasure, whether an email was delivered, opened or bounced and which links were clicked.
- Website analytics: see section 12.
Data from connected accounts — see section 5.
Health information. Aasure is not designed to store medical records or other health information, and our Acceptable Use Policy asks businesses not to use it for that.
5.Data from connected accounts
A business can choose to connect other services to Aasure. We only access these accounts after an authorised user signs in to the other service and approves access, and only for the purposes below. We store the access credentials encrypted, and we never use data from connected accounts for advertising, never sell it, and never use it to train AI models.
Google Calendar. Connecting a Google Calendar is not available yet. When it is, we will read the list of your calendars and your busy/free times so clients cannot book you when you are already busy, and, if you enable it, create, update and delete events for Aasure bookings in the calendar you choose. We will not read event details beyond what is needed to know when you are busy, and we will not share this data with third parties except the service providers that host Aasure.
Aasure's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft Outlook Calendar. We read your calendars and busy times and, if you enable it, write Aasure bookings to your calendar, so clients cannot book you when you are already busy. We do not read event details beyond what is needed to know when you are busy. We also read your basic Microsoft profile (name and email) to show which account is connected.
Disconnecting. You can disconnect any of these accounts at any time in Aasure. When you do, we ask the provider to revoke our access and we delete the stored access credentials. You can also remove our access directly at the provider:
- Google: myaccount.google.com/connections
- Microsoft: account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work accounts)
How to delete data we received from these accounts is described on our Data Deletion page.
6.How we use data and why
- To provide the Service — accounts, bookings, calendars, emails, websites, records of payments and the AI assistant. Basis: contract.
- To keep the Service secure — preventing fraud, spam and abuse, and investigating errors. Basis: legitimate interests and legal obligation.
- To bill businesses for their subscription. Basis: contract and legal obligation.
- To send service messages — sign-in, security, billing and important changes. Basis: contract.
- To send product news to business users, which you can unsubscribe from at any time. Basis: consent or legitimate interests, as the law requires.
- To improve the Service using aggregated or de-identified usage information. Basis: legitimate interests.
- To comply with the law and respond to lawful requests. Basis: legal obligation.
In India we process your personal data on the basis of your consent, given when you create an account or use the Service, or for the legitimate uses permitted by the Digital Personal Data Protection Act, 2023. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
7.AI features
The Aasure assistant uses large language models from third-party AI providers to answer your questions and carry out actions you ask for. When you use it, your messages and the business data needed to answer (for example, the client records you ask about) are sent to the AI provider selected for that conversation, only to generate the reply.
- We do not use your data, or your clients' data, to train AI models.
- We only use AI providers through their business APIs, under terms that do not allow them to train their models on the data we send.
- Data we receive from connected calendars is not sent to AI providers.
The AI providers we use are listed on our Subprocessors page.
8.Who we share data with
We do not sell personal data, and we do not share it for other companies' advertising. We share it only with:
- Service providers that host and run Aasure for us — cloud hosting, database, email delivery, error monitoring, billing and AI. They may only use the data to provide their service to us. The full list is on our Subprocessors page.
- The businesses you deal with — if you book with a business, it receives your booking details.
- Services you connect — for example, when you add a booking to your Outlook calendar.
- Authorities, when the law requires it or to protect the rights, safety and property of our users or of Aasure.
- A buyer or successor, if Aasure is involved in a merger or acquisition, who must keep protecting your data as this policy describes.
9.Where your data is stored
Aasure's database and servers are in the United States, and our hosting network processes requests at locations around the world. This means your data may be transferred out of India or the UK. Where the law requires it, we protect those transfers with appropriate safeguards, such as standard contractual clauses and the UK International Data Transfer Addendum with our service providers.
10.How long we keep data
- Sign-in sessions expire after 14 days of inactivity.
- Deleted items (such as clients, files or campaigns) can be restored for 30 days, then are permanently deleted.
- Deleted businesses: when a business is deleted, its data is kept for 30 days and then permanently deleted, except a minimal record that the business existed.
- Connected account credentials are deleted as soon as the account is disconnected.
- Website analytics for business websites are kept as daily totals for up to 400 days.
- Billing and tax records are kept for as long as Indian tax and company law requires.
Copies in our backups are overwritten on their normal backup cycle.
11.Security
We encrypt data in transit, encrypt connected-account credentials at the application level, hash passwords, limit staff access to what they need, and keep each business's data separate from every other business's. No system is perfectly secure. If a personal data breach happens, we will notify affected users and the relevant authorities as the law requires, including the Data Protection Board of India and, for UK users, the Information Commissioner's Office.
12.Cookies and analytics
The Aasure app and booking pages only use cookies and browser storage that are strictly necessary to keep you signed in, hold your booking while you finish it, and remember your display preferences.
On aasure.app we use Google Analytics only if you accept analytics cookies in our cookie banner. On websites businesses publish with Aasure we use Cloudflare Web Analytics, which counts visits without cookies.
The full list is in our Cookie Policy.
13.Your rights
Everyone. You can ask us for a copy of your personal data, ask us to correct or delete it, and unsubscribe from marketing emails at any time using the link in the email. Business users can view, correct and delete most of their data directly in the app. We will respond within 30 days and may need to verify your identity first.
India. Under the Digital Personal Data Protection Act, 2023 you have the right to access information about your personal data, to correct, complete, update and erase it, to withdraw consent, to nominate someone to exercise your rights if you die or become incapacitated, and to grievance redressal. Please contact our Grievance Officer (section 15) first. If you are not satisfied, you may complain to the Data Protection Board of India.
United Kingdom. Under the UK GDPR you also have the right to restrict or object to processing, including objecting to processing based on legitimate interests, and to data portability. You can complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to resolve your concern first.
United States. Depending on your state, you may have rights to know, access, correct and delete your personal data and to opt out of its sale or use for targeted advertising. We do not sell personal data or use it for targeted advertising. We will not discriminate against you for exercising any of these rights.
If you are a client of a business that uses Aasure, please make these requests to that business first (see section 3).
14.Children
You must be at least 18 to create an Aasure account. The Service is not directed at children, and we do not knowingly collect personal data from children except where a parent or guardian provides it, for example when booking an appointment for their child with a business. If you believe a child has given us personal data, contact us and we will delete it.
15.Grievance Officer and contact
In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:
- Suresh Neethimohan, Grievance Officer
- Email: contact@aasure.app
- Post: Aasure Company Private Limited, HN 683-3, Thanesar, Sector 3 U E KKR, Thanesar, Kurukshetra 136118, Haryana, India
We acknowledge grievances within 72 hours and aim to resolve them within 30 days. For anything else, email contact@aasure.app.
16.Changes to this policy
We will update this policy when our practices or the law change. If a change is significant, we will tell business users by email or in the app at least 14 days before it takes effect. The date at the top shows when it was last updated.