1. Introduction

This Privacy Policy ("Policy") explains how Tiona, a sole proprietorship operated by Devi Preetham Kumar Adimulam, having its registered address at Sierra-I-701, Rajapushpa Atria, Kokapet, Hyderabad, Telangana — 500075, India ("we," "us," "our," "Company," or "Tiona"), collects, uses, stores, shares, discloses, protects, and disposes of your personal data when you access or use the Tiona platform and related services (collectively, the "Service" or "Platform").

The Tiona Platform consists of:

• Tiona Business App — a mobile application (iOS and Android) for tailors, boutique owners, fashion designers, and garment professionals to manage customers, leads, orders, measurements, payments, in-app communications (including voice, images, and documents), portfolio showcases, meetings, reports, GST-compliant invoicing, staff and multi-branch operations, in-store point-of-sale (POS), and data backup/export.
• Tiona Customer App — a mobile application (iOS and Android) for end customers to track orders, make or view payments, communicate with their tailor, view portfolios, book meetings, scan body measurements, and discover nearby tailoring businesses.
• Tiona Website (tiona.fit) — our marketing site and associated web pages, including legal documents, support resources, pricing, and invitation/deep-link landing pages.
• Tiona Public Storefronts — individual public websites (hosted by Tiona on behalf of enrolled Business Users) that display the Business User's portfolio, products, services, and checkout workflows to prospective customers on the open internet.
• Tiona Admin & Support Panel — an internal web application used by authorised Tiona personnel to provide customer support, resolve grievances, investigate security incidents, and moderate content in accordance with applicable law.
• Tiona Developer API & Data Portability Services — optional APIs, export tools, and backup integrations (including a Google Sheets/Drive backup) that enable Business Users to access, port, and integrate their own data with third-party tools.

This Policy applies to all users of the Platform — whether you are a Business User (an enrolled business account holder), a Staff User (an employee, partner, or tailor invited by a Business User), a Customer User (an end-customer using the Customer App), a Website Visitor (any person who browses tiona.fit), or a Storefront Visitor (any person who browses or purchases from a Tiona-hosted public storefront).

This Policy is published and complies with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), as and when notified and brought into force by the Central Government.
• The Information Technology Act, 2000 ("IT Act").
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021").
• The Consumer Protection Act, 2019, and the Consumer Protection (E-Commerce) Rules, 2020 ("CP E-Commerce Rules").
• The Reserve Bank of India ("RBI") directions applicable to payment aggregators and payment gateways (to the extent our payment partners are bound by them).
• Applicable tax laws, including the Income Tax Act, 1961 and the Central Goods and Services Tax Act, 2017 ("GST Act").

Under the DPDP Act, you are a Data Principal (the individual whose personal data is being processed). Tiona acts as a Data Fiduciary (the entity that determines the purpose and means of processing) for data we collect directly from you, and as a Data Processor (processing on behalf of another Data Fiduciary) when we process customer or staff data entered by a Business User.

By accessing or using any part of the Platform, you acknowledge that you have read, understood, and accept this Policy. If you do not agree with any part of this Policy, you must not access or use the Platform.

This Policy should be read together with our Terms of Service.

2. Definitions

Capitalised terms used but not defined in this Policy shall have the meaning ascribed to them under the DPDP Act, the IT Act, the SPDI Rules, IT Rules 2021, or the Consumer Protection Act, 2019, as applicable. In addition:

• "AI Features" means any functionality powered by artificial intelligence or machine learning, including but not limited to AI measurement extraction, AI reply suggestions, AI design suggestions, AI virtual try-on, AI portfolio description generation, AI ghost-mannequin background removal, and AI 3D product visualisation.
• "Business User" means a tailor, boutique, fashion designer, or similar business entity (sole proprietor, partnership, LLP, or company) registered on the Tiona Business App.
• "Customer User" means an end customer registered on the Tiona Customer App.
• "Data Principal", "Data Fiduciary", "Data Processor", "Personal Data", "Processing", and "Significant Data Fiduciary" have the meanings ascribed under the DPDP Act.
• "SPDI" (Sensitive Personal Data or Information) has the meaning ascribed under the SPDI Rules.
• "Staff User" means a staff member, partner, or employee invited by a Business User to access the Business App (including tailors, receptionists, and branch managers).
• "Storefront Visitor" means any individual who visits or transacts on a Tiona-hosted public storefront operated by a Business User.
• "Website Visitor" means any individual who accesses tiona.fit or associated subdomains.

3. Information We Collect

We collect information across the categories listed below. Each category lists the specific data points collected and the primary purpose. Where a category is optional, we indicate that clearly.

3.1 Identity & Profile Information (Business Users)

3.2 Identity & Profile Information (Customer Users)

3.3 Customer Data (Entered by Business Users)

Business Users enter the following data about their customers into the Platform. Tiona processes this data on behalf of the Business User and in accordance with Section 23 (Business/Staff/Customer Relationships).

3.4 Staff User Data (Entered by Business Users)

3.5 Order, Billing, and Financial Data

3.6 Communication & Call Data

We do not record, store, or transcribe the audio content of VoIP calls. Call audio is transmitted peer-to-peer via WebRTC and only signalling metadata (IP addresses, network candidates through Google STUN servers, call duration) traverses our infrastructure.

3.7 Public Storefront & Web Visitor Data

When you visit tiona.fit or any Tiona-hosted public storefront (including subdomains like {slug}.tiona.fit or custom domains pointed to Tiona), we or our hosting infrastructure may collect:

3.8 Device, Technical, and Usage Data

We do not collect the Android Advertising ID ("AAID"). The com.google.android.gms.permission.AD_ID permission is explicitly removed in our Android manifest.

3.9 AI-Processed Data

When you actively invoke an AI Feature, the following data is transmitted to our AI processing partners for the sole purpose of generating the AI output you requested:

Details on AI processing, data handling, retention, opt-in controls, and human-in-the-loop safety gates are in Section 8.

3.10 Security & Integrity Data

3.11 Data About Other People That You Provide

If you import contacts, add customer records, invite staff, share referral phone numbers, or otherwise provide personal data about individuals other than yourself, you must have the lawful authority to do so. Tiona relies on your representations and, where applicable, processes such data as a Data Processor. See Section 23 for details.

4. How We Collect Information

4.1 Direct Collection

Most data is provided by you when you:

• Create or update an account and complete profile details
• Add or edit customer, staff, order, measurement, meeting, or payment records
• Send messages, voice notes, images, or documents
• Record payments, generate payment links, or issue refunds
• Upload business logos, portfolio items, reference images, or other content
• Book, reschedule, or cancel meetings
• Enter walk-in sales in the In-Store POS
• Submit a grievance, feedback, or support request
• Purchase or renew a subscription
• Submit checkout details on a public storefront

4.2 Automated Collection

Certain data is collected automatically when you use the Platform:

• Device and technical data is collected upon app launch and during active sessions.
• Firebase Analytics automatically tracks screen views, session duration, and custom events (e.g., order_created, payment_recorded).
• Sentry automatically captures crash reports and error stack traces when errors occur.
• IP addresses and user-agents are logged by our backend (Supabase) and by our edge/CDN provider (Vercel, for the web tier) as part of normal server operation.
• GPS coordinates are collected only when you explicitly grant location permission and invoke a feature that requires it (address auto-fill, business discovery).
• Device integrity signals (root/jailbreak, emulator, tampering) are evaluated on-device via FreeRASP; selected threat fingerprints may be reported to Talsec's threat-intelligence service to maintain aggregate fraud detection.

4.3 Third-Party Sources

• Razorpay provides us with confirmation of subscription payments, payment IDs, order IDs, and payment status.
• MSG91 confirms delivery of OTPs and SMS. Meta confirms delivery of WhatsApp messages.
• Apple APNs, Firebase Cloud Messaging report push-notification delivery receipts.
• GitHub Secret Scanning Partner Program notifies us if a Tiona API token (e.g., tiona_live_sk_…) is detected in a public code repository; we automatically revoke affected tokens. GitHub → Tiona is a one-way inbound notification; we do not transmit your data to GitHub.
• Google OAuth 2.0 returns basic profile identifiers (email, sub-ID) and access/refresh tokens when you connect your Google account for the Google Sheets/Drive backup feature.
• Device contacts are accessed only when you explicitly use the contact-import feature and grant permission; no contacts are transmitted off-device without your action.

4.4 Cookies, Local Storage, and Similar Technologies (Web)

On tiona.fit and Tiona-hosted public storefronts, we use:

• Strictly necessary cookies / local storage — to maintain session state, store a shopping cart in your browser's localStorage, persist language preference, and ensure the site functions.
• Security cookies — for CSRF protection and abuse detection.
• Analytics cookies / events — via Firebase Analytics (deployed in the Phase 9 storefront release) to understand aggregate traffic patterns.

We do not use third-party advertising cookies, tracking pixels, cross-site tracking, retargeting pixels, or behavioural advertising networks (such as Meta Pixel, Google Ads conversion tracking, Adjust, AppsFlyer, Branch, Mixpanel, Amplitude, or Hotjar). A cookie/storage consent banner is presented on public storefronts where required by applicable law, allowing you to manage non-essential analytics.

4.5 AI Processing

When you actively invoke an AI Feature, specified data is transmitted to the relevant AI partner. AI Features are strictly opt-in: no data is transmitted to AI partners passively or in the background. See Section 8 for full details.

5. How We Use Your Information

We use your information only for the following defined purposes:

5.1 Service Delivery

• Authenticating you via OTP phone login
• Displaying your business profile to Customer Users and on the public storefront (if enabled)
• Enabling customer, staff, order, meeting, portfolio, payment, and measurement management
• Enabling real-time messaging, voice messaging, and VoIP audio calling
• Delivering push, SMS, WhatsApp, and email notifications
• Providing offline functionality via local caching
• Synchronising data between devices and our servers
• Enabling multi-branch and role-based staff operations
• Providing In-Store POS walk-in order capture

5.2 Payments, Billing, and Tax Compliance

• Processing your Tiona subscription payments through Razorpay
• Generating UPI deep links so your customers can pay you directly
• Maintaining your financial records, payment analytics, dashboards, and reports
• Issuing GST-compliant invoices for your Tiona subscription (where applicable)
• Enabling you to generate GST-compliant invoices for your own customers
• Complying with our own tax, accounting, and auditing obligations

5.3 AI-Powered Features (opt-in only)

• Extracting body measurements from photographs
• Generating contextual reply suggestions
• Creating design suggestions and virtual try-on previews
• Generating portfolio descriptions
• Ghost-mannequin background removal and 3D product visualisation

5.4 Analytics, Product Improvement & Research

• Analysing aggregate usage patterns to improve features and UX
• Identifying and resolving bugs and crashes via Sentry
• Monitoring app performance and stability
• Understanding feature adoption to guide the product roadmap

We use only aggregated or de-identified data for research and roadmap decisions; we do not conduct behavioural profiling of individuals for advertising purposes.

5.5 Safety, Security, and Compliance

• Detecting and preventing fraud, abuse, unauthorised access, credential stuffing, scraping, spam, or automated attacks
• Enforcing our Terms of Service, Acceptable Use Policy, and applicable law
• Responding to lawful requests from government authorities, courts, and regulators
• Maintaining audit logs for financial, operational, and security compliance
• Revoking API tokens that are detected as leaked through the GitHub Secret Scanning Partner Program
• Detecting and responding to tampered or compromised app installations

5.6 Communication Facilitation

• Delivering login codes (OTP) by SMS via MSG91 and on WhatsApp via Meta
• Delivering SMS notifications via MSG91, and WhatsApp notifications via Meta
• Delivering push notifications via Firebase Cloud Messaging and Apple APNs/PushKit
• Providing WebRTC connectivity via Google STUN servers

5.7 Location-Based Services (opt-in)

• Auto-filling addresses during profile or customer record creation
• Enabling "nearby business" discovery for Customer Users
• Displaying business location on maps

5.8 Data Portability and Backup

• Providing a one-tap "Download My Data" export (XLSX/CSV/JSON)
• Syncing your business data to your own Google Drive/Google Sheets account on a user-initiated, user-authorised basis (optional feature)
• Supporting developer API integrations where you have generated and authorised API tokens

5.9 Legal Obligations

• Maintaining books of accounts and financial records under the Income Tax Act, 1961 and the GST Act
• Retaining records required by the RBI / payment gateway regulations
• Responding to data breach notification obligations under the DPDP Act
• Cooperating with law enforcement under the IT Act and Cr.P.C.

5.10 Automated Decision-Making

Tiona does not use your personal data to make solely automated decisions that produce legal or similarly significant effects concerning you. AI Feature outputs are suggestions only; final decisions (e.g., accepting an AI-extracted measurement, sending an AI-suggested reply) remain under your control.

6. Legal Basis for Processing

Under the DPDP Act, 2023, we process personal data on one or more of the following lawful bases:

6.1 Consent

You provide consent when you:

• Create an account and accept this Policy
• Grant device permissions (camera, microphone, contacts, location, photos, speech recognition, notifications)
• Opt into AI Features
• Authorise Google OAuth for the Google Sheets backup
• Enable contact import
• Provide checkout data on a public storefront

You may withdraw consent at any time as described in Section 14. Withdrawal does not affect processing carried out before withdrawal, nor does it affect processing that has a separate lawful basis.

6.2 Legitimate Uses (Certain Lawful Uses under Section 7 DPDP Act)

We rely on "Certain Legitimate Uses" under Section 7 of the DPDP Act for:

• Processing necessary for responding to medical or operational emergencies (e.g., urgent security incident communications)
• Processing for employment-related purposes (when Business Users invite Staff Users)
• Processing for the performance of any function under Indian law, judgment, order, or decree

6.3 Contractual Necessity

Processing is necessary for the performance of our Terms of Service with you, including:

• Account creation and authentication
• Core service features (customer management, orders, payments, messaging, staff, storefront)
• Subscription billing
• Essential service notifications

6.4 Legitimate Interests (Non-DPDP Jurisdictions & Ancillary Uses)

Where permitted, we also process based on legitimate interests, balanced against your rights:

• Crash reporting and error tracking
• Aggregate analytics
• Security monitoring, fraud detection, and anti-tampering
• Network and infrastructure administration

6.5 Legal Obligation

We process data where required by law, including:

• Tax records under the Income Tax Act
• GST compliance
• Lawful requests from government or regulatory bodies
• Mandatory data breach reporting

7. Device Permissions

Tiona requests the following device permissions. Each permission is requested only when you attempt to use the associated feature; you may deny or revoke any permission through your device settings at any time. Denying a permission disables only the dependent feature; core Platform functionality remains available without any optional permission.

We explicitly do not request the Android Advertising ID (com.google.android.gms.permission.AD_ID) or any advertising/tracking-specific permissions. Background-location and call-handling permissions are not currently enabled.

8. AI-Powered Features and Data Processing

This Section provides in-depth disclosure of every AI Feature. All AI Features are strictly opt-in — no data is transmitted to any AI processor unless you actively invoke the feature.

8.1 AI Technology Partners

Tiona's AI Features are powered by the following partners:

We encourage you to review our partners' policies: Google (https://policies.google.com/privacy and https://ai.google.dev/terms), Replicate (https://replicate.com/privacy).

8.2 AI Assistant (Conversational, Multi-Turn AI)

The Tiona AI Assistant is a conversational AI available in both the Business App and the Customer App. It is a dedicated feature with its own safeguards, controls, and retention policies.

8.2.1 What the Assistant Does

The Assistant answers natural-language questions by accessing your own business data through Google Gemini's function-calling capability. A Business User can ask, for example, "What orders are due this week?" or "How much revenue did we make last month?" The Assistant retrieves the answer by calling pre-defined, least-privilege tools that read your data from our database.

Depending on release phase and your subscription tier, the Assistant may also:

• Read data: customers, orders, payments, measurements, portfolio items, staff, meetings, analytics. (Read tools only query data the calling user is already authorised to see.)
• Propose low-risk write actions (for example, scheduling a meeting, adding a customer, updating order status, sending a message to a customer, toggling a portfolio item) and execute them only after you explicitly confirm the action in a confirmation card.
• Propose high-risk write actions (for example, creating an order, recording a payment, processing a refund, changing a staff role) with an enhanced confirmation step that may include re-entry of key parameters such as the payment amount.

The Assistant is read-only by default; write tools are gated by your subscription tier and feature flags.

8.2.2 What Data Is Collected and Transmitted

When you send a message to the Assistant, the following is transmitted to Google Gemini over TLS:

• Your prompt text
• Up to the last 15 turns of your conversation history (prompts and model responses)
• Your business/branch context (business ID, branch ID, role, user ID) and your preferred language
• Tool definitions available to you (schema only)
• When Gemini calls a tool: the parameters of that tool call
• When a tool returns: the result rows (which may include customer names, phone numbers, addresses, order amounts, payment amounts, measurements, portfolio text, etc. — scoped to your own business)

Gemini's response (text, and/or further tool calls) is returned to our edge function, validated, and returned to you.

8.2.3 Data Isolation and Access Boundaries

• Every Assistant query is authenticated and scoped to the authenticated user's business and branch. The Assistant cannot access data belonging to another business.
• Tools enforce Supabase Row Level Security; the Assistant cannot bypass RLS.
• Customer Users' tools are strictly narrower than Business Users' tools and cannot access other customers' data.

8.2.4 Conversation Storage and Retention

• Conversation history is stored in an ai_conversations table on our servers for multi-turn continuity.
• You can delete any conversation from within the app; deletion removes the conversation and its messages.
• Conversations are automatically purged after 30 days of inactivity or upon account deletion.
• Query logs (pseudonymous, used for usage accounting, abuse detection, and regression testing) are retained for up to 180 days.

8.2.5 Tool-Result Caching

To reduce latency and cost, the Assistant may cache recent tool results for a short TTL (typically minutes). Cached results are stored server-side, isolated per user, and never used for training.

8.2.6 Guardrails and Safety Stack

The AI Assistant runs through a multi-layer guardrail stack before a response is returned to you:

1. Input validation — size caps, gibberish detection, repeat-message suppression.
2. Prompt-injection detection — patterns in your input that try to manipulate the Assistant or bypass safety rules are recognised and constrained; injection attempts do not override system instructions.
3. Off-topic / behavioural classification — the Assistant stays on-topic (tailoring business operations and order tracking). Inappropriate or unsafe inputs (self-harm, harassment, illegal activity) receive a fixed safety response rather than a generated reply.
4. System prompt hardening — behavioural rules prevent impersonation, legal/medical advice, and manipulation attempts.
5. Output validation — the model's response is scanned for personally identifiable information (PII) belonging to people other than those the user already has authorisation to see, and for action-language inconsistent with read-only scope.
6. DPDP consent — on first use, you are shown a consent notice; continued use confirms your informed consent to this processing.
7. Kill switch — Tiona can globally or per-tenant disable the Assistant if systemic abuse or a Gemini outage is detected.

8.2.7 Human-in-the-Loop for Write Actions

Write actions are never performed automatically. For every proposed write the Assistant generates:

• A confirmation card summarising what will be created or changed
• The precise parameters to be sent to the database
• An explicit Confirm / Cancel choice

Only after you tap Confirm does the action execute. For high-risk actions such as recording a payment or creating an order, you may be required to re-enter the amount or another key parameter. Concurrent-write protection prevents duplicate submissions.

8.2.8 Rate Limits, Quotas, and Cost Controls

To protect the service and enforce fair use, the Assistant is subject to:

• Per-plan hourly limits (for example, 30 queries/hour for Starter, 60 for Professional, 120 for Business; current values are displayed on the plan selection screen).
• Monthly usage caps metered against your subscription.
• A per-response token budget and a thinking-budget cap.
• Bounded tool-round-trip budgets per message.

When a limit is reached, the Assistant tells you and suggests upgrading or waiting.

8.2.9 Multi-Language Support

The Assistant responds in the language you write in (English, Hindi, Gujarati, Tamil, Telugu, Kannada, and Hinglish at present). Your language preference is transmitted to Gemini only as a parameter — Tiona does not use your linguistic content for any purpose other than generating the response.

8.2.10 Opt-Out

You may ignore the Assistant entirely; no data is sent to Gemini unless you open a chat and send a message. Business administrators can disable the Assistant for their workspace from Settings where this control is available.

8.3 One-Shot AI Features

The following AI Features are invoked one request at a time (no ongoing conversation state):

8.4 Portfolio Staging (Image AI)

Portfolio staging transforms a raw product photograph into a studio-style e-commerce image. Staging has four modes; you select a mode per invocation:

Before staging, an image-analysis step may classify the garment (garment type, fabric, embroidery, neckline, sleeves, colours, key details) via Google Gemini so that the staging pipeline can choose parameters appropriate to the garment.

Your portfolio/product images are transmitted to the relevant partner solely to produce the staged output. The staged output is uploaded to your Supabase Storage bucket and associated with the portfolio item.

8.5 How We Handle AI Inputs and Outputs

• All AI API calls occur over TLS 1.2 or higher, authenticated through our own edge functions. API keys are stored only in Supabase Vault and never exposed to the client.
• AI partners may retain inputs for a short abuse-monitoring window (typically up to 30 days for Google Gemini; similar for Replicate) after which data is deleted per their policies.
• AI partners do not use your data to train their foundation models under our paid/API-tier agreements.
• We do not retain AI inputs separately from the underlying record — e.g., a measurement photo is stored in your customer record and deleted when you delete the record or your account; a staged portfolio image replaces or augments the portfolio item you staged.

8.6 Biometric-Adjacent Data

Body photographs used for AI measurement extraction or virtual try-on may reveal physical characteristics. We treat these with heightened care:

• Photographs are sent solely to extract numerical measurements or generate a try-on visualisation. We do not use them for biometric identification, facial recognition, or identity verification.
• Extracted measurements are stored as numerical fields in the customer record.
• You can delete photographs and measurements at any time from within the app.
• You have the right to refuse any AI feature and enter measurements manually.

8.7 Image Privacy Safeguards

Before uploading any image from the mobile apps (to chat, portfolio, profile, business logo, customer photo, reference image, or AI feature), the app automatically:

• Strips EXIF and GPS metadata from the file. Your device camera's location, timestamp, serial number, and lens data are removed so they are not stored on our servers or transmitted to any AI partner.
• Downsizes the image to a maximum long-edge of 1024–1280 pixels and re-encodes at JPEG Q80 (or equivalent) to minimise payload size and reduce the risk of incidental data exposure.

These safeguards are applied in the app's image-compressor utility on iOS and Android. Where platform capability prevents metadata stripping (for example, certain non-JPEG formats on older OS versions), we will compress and otherwise minimise the file; you may choose not to upload in that case.

Uploaded images are stored on Supabase Storage (region: Tokyo, Japan). Supabase Storage is encrypted at rest (AES-256) and access is gated by RLS policies tied to your business and role.

8.8 Accuracy Disclaimer

AI outputs — conversational answers, measurements, design suggestions, try-on visualisations, reply suggestions, descriptions, staged images, and 3D renderings — are estimates and suggestions only and may contain inaccuracies ("hallucinations"). Business Users must verify AI-extracted measurements manually before using them for garment construction. The Assistant's answers may be incomplete or out-of-date. Tiona does not guarantee the accuracy, appropriateness, or fitness of any AI-generated content.

8.9 Opt-In Controls

• You can use Tiona's full non-AI feature set without ever triggering an AI call.
• You can choose, per invocation, whether to send a given image, text, or query to an AI partner.
• You can disable AI Features at the account level through Settings where surfaced, and you can avoid the AI Assistant by simply not opening its chat screen.
• AI Feature usage caps apply per subscription tier and reset each billing cycle.

8.10 What We Never Do with AI

• We never use your data, AI inputs, or AI outputs to train foundation models of Google, Replicate, or any other AI vendor.
• We never sell AI-processed data.
• We never use the AI Assistant to target advertising, score you, or make solely automated decisions with legal or similarly significant effects (see Section 5.10).
• We never send data about other Users that you cannot already see — the Assistant is scoped to data you are already authorised to access.

9. Data Sharing and Third-Party Sub-Processors

We share your data only with the following third parties, for the purposes stated, under contractual safeguards (data processing agreements with confidentiality, security, and sub-processing terms). We do not sell your personal data to any third party. We do not share your data with advertising networks, data brokers, or marketing companies.

We may also share your data:

• With law enforcement or government authorities when compelled by law, valid court order, or other legal process
• To protect the rights, property, or safety of Tiona, our users, or the public
• In connection with a merger, acquisition, corporate reorganisation, or sale of assets, subject to the acquiring party being bound by commitments at least as protective as this Policy, and with prior notice to Data Principals where required by law
• With your explicit consent for any other purpose

We do not permit our sub-processors to use your data for any purpose other than providing the stated service to us, and they are contractually obliged to implement appropriate security safeguards.

10. Cross-Border Data Transfers

Your personal data is processed and stored on servers located within and outside India. The following cross-border transfers occur:

Legal basis for transfers: Cross-border transfers are conducted in accordance with Section 16 of the DPDP Act, 2023 and any rules notified thereunder. We transfer data only to countries that have not been restricted by notification of the Central Government. We have executed data processing agreements, which include standard contractual clauses where applicable, with all international sub-processors. We will update this Policy and restrict transfers if the Central Government notifies a list of restricted territories.

Transfers of financial records of Indian residents are kept in compliance with the applicable RBI guidelines via Razorpay. Supabase data is stored in Tokyo, Japan.

11. Data Retention

We retain your data only for as long as necessary for the purposes described in this Policy, or as required by law.

When a shop is deleted (Section 15), every record in this table that belongs to that shop is deleted at the same time, except the locked sign-up record in the last row, including order, payment, GST invoice, subscription and audit records. Tiona keeps no copy of them, apart from our database provider's daily backups, which expire within 7 days. If you need those records, for example for your tax filings, download them before deleting.

After the retention period expires, data is permanently deleted or irreversibly anonymised within 30 days, except where preservation is required by law, a valid court or regulatory order, or is reasonably necessary to establish, exercise, or defend legal claims.

12. Data Security

We implement reasonable and appropriate technical, organisational, and administrative safeguards to protect your data, consistent with the "reasonable security practices and procedures" under Section 43A of the IT Act and the SPDI Rules (aligned with the ISO/IEC 27001 international standard or an equivalent framework).

12.1 Encryption

• In transit: TLS 1.2 or higher for all network traffic; HTTPS-only API endpoints; HSTS on web tiers where applicable.
• At rest: AES-256 at rest on Supabase database and Supabase Storage; OAuth refresh tokens and other secrets are stored in Supabase Vault (envelope encryption).
• On device: Sensitive local data in Hive is stored in the device's sandboxed storage; secrets (tokens) use flutter_secure_storage which leverages Keychain (iOS) / Keystore (Android).

12.2 Access Controls

• Row Level Security (RLS): Supabase RLS policies enforce per-business, per-staff-role, and per-user access boundaries at the database layer.
• Role-Based Access Control (RBAC): Staff Users inherit permissions from their assigned role (owner, partner, manager, tailor, staff, receptionist) and branch.
• Authentication: Phone-based OTP authentication backed by Supabase Auth; short-lived access tokens with rotating refresh tokens; automatic token revocation on logout or suspicious activity.
• Rate limiting: Applied per endpoint, per user, and per IP to prevent brute force, abuse, and enumeration.
• Administrative access: Only a small number of authorised Tiona staff can access production data, and only when needed to run, support or secure the service.

12.3 Application Security

• Static and dynamic dependency scanning; security updates applied promptly.
• Runtime app-integrity checks via Talsec/FreeRASP to detect rooting, jailbreak, emulators, debuggers, hooking frameworks, and repackaged installations.
• API token leak detection via GitHub Secret Scanning Partner Program with automatic revocation.
• Server-side validation of all authenticated operations; our cloud accounts are open only to authorised Tiona staff, and the database checks every request against the signed-in person and their shop.
• Code review and CI-based security checks for all changes to the backend and client.

12.4 Infrastructure Security

• Supabase and our other sub-processors operate on enterprise-grade cloud platforms with SOC 2 Type II compliance or equivalent certifications.
• Network isolation, firewall rules, DDoS protection, and intrusion detection at the infrastructure layer.
• Regular patching of OS-level and platform-level components.
• Daily database backups, kept for 7 days in the same region (Tokyo).

12.5 Incident Response

We maintain a documented incident-response plan that includes:

1. Immediate containment and assessment of any suspected breach
2. Notification to affected Data Principals and the Data Protection Board within the timelines required by the DPDP Act (see Section 17)
3. Root cause analysis and remediation
4. Post-incident review, security improvement, and employee retraining where required

12.6 Your Role in Security

No system is fully immune. We depend on you to:

• Keep your device, OS, and app up to date
• Use a device passcode or biometric lock
• Keep your OTP and authentication codes confidential
• Log out of shared or lost devices
• Notify us immediately at security@tiona.fit if you suspect unauthorised access

12.7 Vulnerability Disclosure

If you believe you have found a security vulnerability in the Platform, please responsibly disclose it to security@tiona.fit. We do not pursue legal action against researchers who act in good faith, act within the scope of our responsible disclosure policy, and give us reasonable time to remediate before public disclosure.

13. Sensitive Personal Data or Information (SPDI)

Under the SPDI Rules, the following categories of data we handle are classified as SPDI:

13.1 Financial Information

• UPI payment identifiers (PhonePe, Google Pay, Paytm, BHIM, other VPAs)
• Payment transaction details and history
• Bank account and card details (card/bank details are handled directly by Razorpay and not stored on Tiona's systems)

13.2 Biometric and Physical Data (Treated with Heightened Care)

• Body measurements (chest, waist, hips, shoulder width, arm length, inseam, neck, height, weight, and category-specific measurements)
• Body photographs used for AI measurement extraction or virtual try-on

While strict "biometric" classification under the SPDI Rules is narrower, we apply equivalent safeguards to these data categories. Where AI features process such data, EXIF/GPS metadata is stripped from images before transmission (Section 8.7) and the photographs are not retained by AI partners beyond their short abuse-monitoring window.

13.3 Passwords and Authentication Material

• OTP tokens, session tokens, and refresh tokens are handled transiently and never stored in plaintext on our systems.

13.4 SPDI Handling Practices

We:

• Collect SPDI only with your informed, explicit consent and for a lawful purpose.
• Use SPDI only for the specific purpose for which it was collected.
• Do not retain SPDI longer than necessary for the stated purpose or required by law.
• Provide you the ability to review, correct, and withdraw consent for SPDI processing.
• Implement ISO/IEC 27001-aligned security practices.
• Do not disclose SPDI to any third party without your prior consent, except as required by law or as disclosed in this Policy.

14. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the rights below. You may exercise these rights by contacting us at privacy@tiona.fit or through Settings → Contact us in the app.

14.1 Right to Access and Confirmation

You may request a summary of the personal data we hold about you, the purposes of processing, the identities of third parties with whom the data has been shared, and other prescribed information.

Response timeline: acknowledgment within 72 hours, substantive response within 7 working days (or as prescribed by DPDP Rules).

14.2 Right to Correction, Completion, Updating, and Erasure

You may request correction of inaccurate or misleading data, completion of incomplete data, updating of outdated data, or erasure of data that is no longer necessary for the purpose of processing. Most data can be self-edited within the app; for the rest, email privacy@tiona.fit.

Response timeline: within 7 working days of verified request.

14.3 Right to Withdraw Consent

You may withdraw any consent previously given at any time by:

• Revoking device permissions in your device settings
• Disabling specific features (e.g., AI Features, Google Sheets backup) in the app
• Disconnecting integrations (e.g., revoking Google OAuth)
• Requesting account deletion (Section 15)
• Emailing privacy@tiona.fit

Withdrawal does not affect the lawfulness of earlier processing and may limit functionality that depends on the withdrawn consent.

14.4 Right to Data Portability

While the DPDP Act does not mandate full portability, Tiona voluntarily provides:

• A one-tap "Download My Data" export in the app (XLSX) covering your profile, customers, orders, payments, messages, measurements, portfolio, and meetings.
• An optional Google Sheets backup that continuously syncs your business data to your own Google Drive.
• On written request, a copy of your personal data in a structured, commonly used, machine-readable format (JSON or CSV), free of charge, within 14 working days.

14.5 Right to Grievance Redressal

You have the right to raise a grievance with our Grievance Officer (see Section 27) and receive a timely response. If you are dissatisfied with the resolution, you may escalate to the Data Protection Board of India under the DPDP Act.

14.6 Right to Nominate

You may nominate another individual to exercise your rights in the event of your death or incapacity. Email privacy@tiona.fit with a written nomination and the nominee's verified contact details.

14.7 Right to Not Be Subject to Solely Automated Decisions

As noted in Section 5.10, Tiona does not make solely automated decisions with legal or similarly significant effects concerning you.

14.8 Verification of Requests

To protect your data, we will verify your identity before acting on requests under this Section, typically by OTP challenge to your registered phone number. We may decline or defer a request that is manifestly unfounded, excessive, or repetitive, or where compliance would infringe on the rights of others (e.g., erasure that would delete another user's chat history).

15. Account Deletion

15.1 How to Delete Your Shop and Account

Shop owners can delete in the app:

1. Open the Tiona app and go to Settings → Delete Account. Only the shop owner sees this button.
2. The page shows anything still unfinished (orders not yet delivered, money your customers still owe you, a paid plan with time left), lists what will be deleted, and offers Download my data so you can keep a copy first.
3. Type DELETE and tap the red button.

Deletion happens immediately and permanently. There is no waiting period, and deleted data cannot be restored.

If you own more than one shop, only the shop you are signed in to is deleted. Your other shops are not touched.

Customer Users, Staff Users, and anyone who prefers email: write to privacy@tiona.fit from your registered contact. We verify your identity (Section 14.8) and act on a verified request within 90 days.

15.2 What Happens When a Shop Is Deleted

• Files first: every photo, document, voice note and other file that belongs to the shop is deleted from our storage. If any file cannot be removed, nothing is deleted, the app tells you, and your shop stays exactly as it was.
• Then everything else, at once: the business profile, customers and their measurements, orders, invoices, payments, staff records and invitations, portfolio and storefront, conversations and messages, settings, API tokens, your Tiona plan and its payment records, and the shop's audit log.
• Your login: if this was your only shop and you use Tiona for nothing else, your Tiona login is deleted too, together with your notifications, and you are signed out on every phone and computer. If you still own or work at another shop, or also use the Customer App, your login stays; sign in again to continue.
• Nothing can be restored. Deleted data cannot be brought back. If you need your records (for example, bills for your tax filings), download them before you delete. Deleted data remains inside our database provider's daily backups for up to 7 days, until those backups expire; it is not used for anything else.
• What we keep, by law: Indian law (Information Technology Rules 2021, Rule 3(1)(h)) requires us to keep the details you signed up with — your name, phone number, email, shop name, and the dates the account was created and deleted — for 180 days after deletion. We keep them locked away, nobody at Tiona uses them, and we hand them over only on a lawful request from a government authority. They are erased automatically when the 180 days end. If any other law requires Tiona to keep a specific record, we keep only that record, only for as long as the law requires, and use it for nothing else.
• Third-party data: logs held by our sub-processors (Section 9) are removed on their own retention schedules (Section 11).
• Data on your device: data already stored on your phone or computer stays there until you uninstall the app or clear its data. We cannot delete it remotely.

15.3 Impact on Business Users

When you delete your shop:

• Customer Users linked to your shop lose their history with your shop in the Customer App.
• Staff Users lose access to your shop.
• Your public storefront and custom domain stop working.
• Your Tiona plan ends. If you pay for Tiona through the Apple App Store, also cancel the subscription in your Apple ID settings; deleting the shop does not stop Apple's billing. Refunds, if any, follow the Terms of Service.

15.4 Customer Users

To delete your Customer User account, email privacy@tiona.fit (in-app deletion is not yet available in the Customer App). We delete your Customer App profile. Shops you bought from keep their own records of your orders, measurements and invoices in their own accounts; Tiona processes those for the shop as a Data Processor. To have those deleted, ask the shop, or write to us and we will pass your request to the shop.

15.5 Staff Users

A shop owner can remove you from their shop, which ends your access to it. To delete your own staff login, email privacy@tiona.fit. While the shop exists, it may keep a record of the work you did (who did which task) as part of its own records.

16. Children's Data

Your Tiona account is for adults. You must be 18 years of age or older to create a Tiona account — in the Business App, the Customer App or as staff. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you believe a child has created an account, contact privacy@tiona.fit.

Children's details entered by shops. Shops use Tiona to keep records of their customers, and a customer can be a child — for example, when a parent orders a garment for a son or daughter. The shop decides what to record and must have the consent of the child's parent or lawful guardian before recording a child's details, as Section 9 of the DPDP Act requires. Tiona stores and processes these details only for the shop, as its Data Processor (Section 23.2).

Recording a parent's consent. To help the shop, Tiona lets it mark a customer as under 18 (and note the birth year) and keep a record of the parent's consent. The parent can agree in two ways:

• In person — the staff member records that the parent agreed at the shop.
• By a code — Tiona texts a 6-digit code to the phone number the shop holds for the parent. The message names the shop and the child. The parent reads the code out to the staff member, who enters it. The staff member never sees the code itself; we store it only in a scrambled (hashed) form, it expires after 10 minutes, and only a few tries are allowed.

The record shows the parent's name and relationship to the child, how the consent was given, who recorded it and when. Anyone at the shop who can open the child's profile can see it there. A parent can withdraw consent at any time through the shop; the withdrawn record is kept, with who withdrew it and when, so the shop can show what was agreed and when it ended. The records are deleted when the child's record or the shop is deleted (Section 11).

What we never do. We do not use children's data in any way likely to harm a child's well-being, and we do not track, behaviourally monitor or show targeted advertising to children.

17. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights:

17.1 Notification to the Data Protection Board

We will notify the Data Protection Board of India without undue delay and in the form and manner prescribed by the DPDP Act and rules.

17.2 Notification to Affected Data Principals

We will notify affected Data Principals without unreasonable delay via:

• Push notification within the app
• SMS to your registered phone number
• In-app banner on next login

17.3 Content of Notification

Notifications will include:

• The nature of the breach
• The categories and approximate number of Data Principals and records affected
• Likely consequences
• Measures taken or proposed to address the breach
• Contact details for further information (privacy@tiona.fit)

17.4 Our Response

On detection, we immediately contain the breach, secure affected systems, assess scope and severity, notify as described above, conduct root-cause analysis, remediate, and document. We maintain breach records for at least 5 years.

18. Cookies, Local Storage, and Tracking Technologies

18.1 Mobile App

The mobile apps do not use traditional HTTP cookies. We use:

• Firebase Analytics events: anonymised app-instance ID, screen views, custom events (e.g., order_created), device metadata (model, OS, app version).
• Sentry SDK: error reports, stack traces, breadcrumbs, device model, OS, app version, pseudonymous user ID.
• Device tokens: stored with FCM and/or Apple APNs for push delivery.
• Local Hive cache: app-data only, stored on device.

18.2 Web (tiona.fit and Public Storefronts)

We use only the categories described in Section 4.4. Specifically:

• We use session cookies for CSRF protection and authentication.
• We use localStorage for the shopping cart and UI preferences.
• We use Firebase Analytics events for aggregate usage understanding (Phase 9 rollout).
• We do not deploy advertising pixels, retargeting tags, cross-site tracking scripts, or behavioural marketing trackers.

18.3 Your Choices

• On mobile, revoke analytics consent via in-app Settings (where surfaced) or uninstall the app to end analytics ingestion.
• On web, the cookie banner lets you decline non-essential analytics where your jurisdiction requires an opt-in.
• You can request exclusion from non-essential crash reporting by emailing privacy@tiona.fit.

19. Public Storefront — Privacy for Storefront Visitors and Buyers

This Section applies to Storefront Visitors and buyers who transact on Tiona-hosted public storefronts.

19.1 What Data Is Collected

• Browsing: IP address, user-agent, device type, referrer, pages viewed, search queries (see Section 3.7).
• Cart: Stored in your browser's localStorage. Cart contents are not transmitted to our servers until checkout.
• Checkout: Name, phone, email, delivery address, and order contents are collected to fulfil your order.
• Payment: Processed by Razorpay. Tiona does not store your card or bank details.

19.2 With Whom Is Data Shared

• With the Business User operating the storefront, for order fulfilment, shipping, customer service, and legal record-keeping. The Business User is a separate Data Fiduciary for the order data.
• With Razorpay, as the payment aggregator.
• With Vercel, as the hosting/CDN provider (logs).
• With MSG91 for order-confirmation SMS, and Meta for WhatsApp messages (if enabled).

19.3 Tiona's Role

Tiona acts as:

• Data Fiduciary for web analytics, infrastructure security, and platform-wide fraud prevention.
• Data Processor on behalf of the Business User for the order and buyer data the Business User receives and uses for fulfilment.

19.4 Buyer Rights

Buyers have the same rights as other Data Principals (access, correction, erasure, grievance redressal). Requests that concern the Business User's processing of your order data may be forwarded to the Business User for direct response; Tiona will assist in facilitating the exercise of your rights.

19.5 Shipping, Delivery, and Returns

Fulfilment, shipping, returns, and refunds are the responsibility of the Business User operating the storefront. The Business User's own policies (linked on the storefront) apply in addition to this Policy. Tiona does not take title to, warehouse, or ship goods sold by Business Users.

19.6 Buyer Notice & Consent

At checkout, Buyers are presented with a consent notice linking to this Policy and the Terms of Service. Proceeding with a purchase constitutes consent to the processing described in this Section.

20. In-Store Point-of-Sale (POS) — Walk-In Customers

When a Business User or Staff User records a walk-in sale using the In-Store POS:

• The Business User may record the walk-in customer's name and (optionally) phone number, email, or notes for invoice generation and follow-up.
• Payment is recorded (cash, UPI, card, bank transfer, or other).
• If the customer pays via UPI deep link generated by the app, the UPI transaction occurs directly between the customer's UPI app and the Business User's UPI account; Tiona does not handle the funds.
• The Business User is the Data Fiduciary for walk-in customer data; Tiona acts as Data Processor.
• Walk-in order and payment records are retained for 7 years for tax compliance.

Where a walk-in customer is not registered on the Customer App, the Business User is responsible for providing the customer with notice and obtaining any required consent before entering their personal data into Tiona.

21. Staff, Workforce, and Multi-Branch Operations

Business Users may invite Staff Users to join their business workspace. When they do:

• Business Users are the Data Fiduciary for Staff User data (name, phone, email, role, branch, permissions, activity logs). Tiona acts as Data Processor.
• Staff Users are required to accept a brief onboarding disclosure confirming that the Business User is their employer/engager and that their activity within the workspace is visible to the Business User and any higher-role users (owner/partner).
• Staff User activity (logins, records accessed, operations performed) is logged for security and audit.
• Staff attendance (Business plan only). In a shop on the Business plan, staff members, kaarigars and branch managers check in and check out in the app. For each check-in and check-out we record:
• the time, the branch, who marked it, and how many minutes late it was;
• a selfie, taken inside the app. It is required whenever a person marks their own attendance or uses the shop's shared kiosk device. Selfies are not saved to the phone's gallery, and Tiona does not use them for face recognition or face matching;
• the phone's precise location — latitude and longitude, how accurate the reading was, a short place label (such as the area name), whether the phone reported the location as simulated, and whether it was inside the shop's boundary;
• if the phone is connected to (or, on Android, near) a Wi-Fi router the shop has registered, that router's hardware address. Only addresses that match the shop's registered routers leave the phone, never the list of other networks the phone can see. When a manager registers a router, its network name is stored too.
• When the location is read. On the phones of staff members, kaarigars and branch managers of a Business shop, the app keeps the location ready on every screen while Tiona is open, so that check-in is quick. It is held on the phone and saved only at check-in or check-out, or when a check-in is refused (below). It is never read in the background; Tiona does not ask for background-location permission.
• The shop's boundary. The shop sets its location on a map, a boundary radius (100 to 2,000 metres) and what happens outside it: record only, warn, or refuse. A phone connected to a registered shop router counts as inside. If a check-in or check-out is refused — outside the boundary, with no location and no shop Wi-Fi, or with a simulated location — the attempt is kept in the shop's security log: where the phone said it was and how accurate that was, the shop's location, radius and the distance between them, how many satellites and Wi-Fi networks the phone saw, and the phone's platform. Only the shop's owners and partners can read that log. A summary without any location or name (distance, radius, accuracy, ids, app version and device) is also sent to our crash-reporting service, Sentry (Section 9).
• The shop's shared kiosk device. Staff check in on a kiosk by tapping their own name and taking a selfie. The location used is the kiosk device's, taken once when kiosk mode is set up (or the shop's saved location) — not the staff member's phone. The boundary check is not applied to kiosk marks.
• Marked by a manager. An owner or manager can mark a staff member's attendance directly; no selfie or location is recorded for that mark.
• Who can see it. The shop's owners, partners and branch managers can see attendance records, including selfies, locations and shop-Wi-Fi matches; branch managers can see every branch's records. Each staff member can see their own. Selfies are kept in a private storage area and shown through links that expire after 10 minutes. Owners and managers can delete a selfie.
• How long it is kept. Attendance records and selfies stay when a staff member is removed (for payroll and history) and are deleted when the shop is deleted (Section 11).
• On deactivation, Staff User access is revoked immediately; the Business User retains the audit log for legitimate compliance purposes.

Staff Users have Data Principal rights (Section 14) directed (i) to their Business User for workspace-specific data, and (ii) to Tiona for account-level identity data.

22. Admin and Support Access

A small number of authorised Tiona personnel may access user data strictly to:

• Resolve grievances raised under Section 27
• Investigate suspected fraud, security incidents, abuse, or violations of the Terms of Service
• Moderate content reported under Section 24
• Perform technical debugging with explicit or implicit authorisation (for example, a support ticket you opened asking us to inspect your account)
• Comply with lawful orders

All administrative access is logged, audited, and reviewed. Admin write operations are subject to a change log retained for 3 years. Admin personnel are subject to confidentiality obligations surviving termination of their engagement. We do not permit admins to export user data except as required to deliver support or comply with law.

23. Business/Staff/Customer Relationships

23.1 Tiona as Data Fiduciary

For data Tiona collects directly from you — account and profile data, authentication data, device and technical data, analytics, crash reporting — Tiona is the Data Fiduciary.

23.2 Tiona as Data Processor

For customer, staff, storefront-buyer, and walk-in-customer data entered by a Business User into Tiona, the Business User is the Data Fiduciary and Tiona acts as Data Processor. In this capacity, Tiona:

• Processes data only on documented instructions from the Business User (including the choices expressed by accepting the Terms of Service and this Policy)
• Applies contractually agreed security safeguards
• Assists Business Users with fulfilling Data Principal requests
• Notifies Business Users of breaches affecting their data without undue delay

23.3 Business User Obligations

Business Users acknowledge and agree that:

• They obtain all consents required by applicable law before entering personal data into Tiona about their customers, staff, or other individuals
• They do not enter personal data of minors (under 18) without verifiable parental consent where required
• They comply with their obligations as Data Fiduciary under the DPDP Act and the SPDI Rules
• They respond to their own customers' access, correction, and erasure requests in a timely manner
• They indemnify Tiona against claims arising from their non-compliance (see Terms of Service)

23.4 Dual Fiduciary Scenarios

In scenarios where a Customer User interacts with a Business User on the Platform (for example, the Customer App is linked to a Business User), both Tiona and the Business User are Data Fiduciaries for different layers of processing. Rights can be exercised with either party; we will co-ordinate to resolve them.

24. Content Moderation, Takedown, and Intermediary Status

Tiona is an "intermediary" within the meaning of Section 2(1)(w) of the IT Act and the IT Rules 2021. Our safe-harbour status under Section 79 of the IT Act is conditional on fulfilling the due-diligence requirements of IT Rules 2021. In furtherance of that:

24.1 Prohibited Content

You must not post, upload, share, or transmit content that falls within Rule 3(1)(b) of IT Rules 2021, including content that is unlawful, defamatory, obscene, invasive of another's privacy, hateful, harmful to children, infringes intellectual property, impersonates another person, contains viruses, violates any law, or is patently false or misleading.

24.2 How to Report Content

If you believe content on Tiona (including a storefront, portfolio, message, or profile) violates this Policy, our Terms of Service, or the law, please email grievance@tiona.fit or reach us through Settings → Contact us in the app, providing:

• A description of the content and its location (URL, message ID, user handle)
• A description of the violation
• Any supporting evidence
• Your name and contact details
• A statement (and, if applicable, oath) affirming the factual basis of your report

24.3 Takedown Process

• Acknowledgment within 24 hours of receipt (Rule 3(2)(a) IT Rules 2021).
• Action on the complaint within 15 days. For content exposing children, sexually offensive content, or impersonation-by-morphing, we act within 24 hours (Rule 3(2)(b)).
• Preservation of takedown records for at least 180 days for removed content, and 3 years for decisions and counter-notices.
• Appeal — if you disagree with our decision, you may appeal to the Grievance Officer (Section 27) and, if still unsatisfied, to the Grievance Appellate Committee under Rule 3A of IT Rules 2021.

24.4 Counter-Notification

A user whose content is removed may file a counter-notice with supporting information. We will evaluate counter-notices fairly and restore content if appropriate, notifying the original complainant.

24.5 Lawful Requests

We respond to lawful requests from authorised government agencies under Section 79(3)(b) and Rule 3(1)(j) IT Rules 2021 and retain information of users whose accounts are removed for at least 180 days for investigation purposes, or longer if required by the requesting authority or court.

25. Developer API and Data Access Tokens (Optional)

Business Users may generate API tokens to integrate their Tiona data with third-party tools (ERP, accounting, marketing software, etc.) under a separate developer programme.

• Tokens are scoped to the issuing business account and to the permissions the Business User selected at issuance.
• Tokens are presented once at generation (prefix tiona_live_sk_…) and stored as hashes in our database. The plaintext token is never re-shown.
• Tokens expire after a configurable period and are automatically rotated on a schedule. Reminder emails are sent before expiry.
• Leaked tokens detected via GitHub Secret Scanning Partner Program are automatically revoked; the Business User is notified.
• Actions taken using an API token are logged under the token's identity.
• You are responsible for the security of your tokens and for any actions performed using them; treat them like passwords.

The Developer API is subject to rate limits, fair-use terms, and our Developer Terms (where separately published).

26. Offline Data Storage

26.1 Local Database (Hive)

The Business App caches the following data locally to enable offline functionality:

• Customer, staff, order, payment, meeting, and measurement records
• Draft messages
• Profile and business profile data
• App settings and preferences

26.2 Synchronisation

• Local data syncs with Supabase whenever a connection is available.
• Offline edits are queued and replayed on reconnection.
• Conflicts are resolved using a "last-write-wins with timestamp" rule.
• Local data is a cache — the authoritative store is Supabase.

26.3 Local Data Security

• Stored in the app's sandboxed storage, isolated from other apps by the OS.
• Protected by device-level encryption where supported by the OS.
• Deleted when you uninstall the app or clear the app's data from your phone's settings.

26.4 Your Device

If your device is lost, stolen, or compromised, locally cached data may be accessible. We strongly recommend device passcodes, biometric locks, and enabling remote-wipe features through your device manufacturer.

27. Grievance Redressal and Grievance Officer

27.1 Grievance Officer (IT Rules 2021 Rule 3(2) & DPDP Act)

Name: Devi Preetham Kumar Adimulam Designation: Proprietor and Grievance Officer Email: grievance@tiona.fit Postal address: Sierra-I-701, Rajapushpa Atria, Kokapet, Hyderabad, Telangana — 500075, India Office hours: Monday–Friday, 10:00–18:00 IST (excluding public holidays)

27.2 How to File a Grievance

Submit your grievance via any of:

• Email to grievance@tiona.fit with subject line "Privacy Grievance" or "Content Grievance" (as applicable)
• Settings → Contact us in the app (call or WhatsApp)
• Written post to the address above

Please include:

• Your full name and registered phone number or email
• A detailed description of the grievance
• Relevant attachments (screenshots, URLs, correspondence)
• The resolution you seek

27.3 Response Timelines

27.4 Escalation

If you are not satisfied with the Grievance Officer's resolution, you may:

• Escalate to the Grievance Appellate Committee established under Rule 3A of IT Rules 2021.
• Approach the Data Protection Board of India under the DPDP Act.
• File a complaint with the appropriate Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019.
• Pursue dispute resolution as described in our Terms of Service.

27.5 Privacy-Specific Contacts

• Privacy Officer / DPO (functional): privacy@tiona.fit
• Grievance Officer: grievance@tiona.fit
• Security Team: security@tiona.fit

28. Changes to This Policy

28.1 Notification of Changes

• Material changes (i.e., changes to the categories of data collected, purposes of processing, sub-processors with significantly different risk profile, cross-border transfers, or Data Principal rights): at least 30 days' advance notice via:
• In-app notification / banner
• Prominent notice on tiona.fit/privacy
• Minor changes (formatting, clarifications that do not alter meaning, updates to sub-processor contact URLs): reflected by updating the "Last Updated" date.
• Changes required by law, and corrections that bring this Policy in line with what the Platform already does, take effect when published. We still tell you in the app when this happens.

28.2 Acceptance

Your continued use of the Platform after the notice period constitutes acceptance of the updated Policy. If you do not agree, you should discontinue use and delete your account.

28.3 Version History

We maintain a version history of this Policy. Previous versions are available at privacy@tiona.fit upon request.

29. Regulatory Compliance Map

30. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Privacy Inquiries: privacy@tiona.fit
• Grievances: grievance@tiona.fit
• Security Disclosures: security@tiona.fit
• General Support: support@tiona.fit
• Website: https://tiona.fit
• In-App: Settings → Contact us
• Postal Address: Tiona (Devi Preetham Kumar Adimulam, Proprietor), Sierra-I-701, Rajapushpa Atria, Kokapet, Hyderabad, Telangana — 500075, India

We aim to respond to all inquiries within 72 hours.

By using the Tiona Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, processing, and transfer of your personal data as described herein.

This document constitutes a legally binding privacy policy under Indian law. In the event of any conflict between this document and applicable law, the applicable law shall prevail.