Privacy Policy
Last Updated: October 6, 2026 • Effective Date: October 6, 2026
Ruqeva ("we", "our", or "us") provides an all-in-one software platform enabling service-based businesses, studios, specialists, and wellness centers ("Businesses") to manage online appointment bookings, client communication, and staff scheduling. This Privacy Policy details how we collect, process, store, and protect personal data in compliance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and relevant international data protection regulations.
1Data Fiduciary & Scope of Processing
Under the DPDP Act, Ruqeva acts as a Data Fiduciary regarding the personal data of Business Owners who register accounts with us, and acts as a Data Processor / Fiduciary regarding the appointment booking data of clients who book services through our platform.
This policy applies to all users of Ruqeva, including:
- Business Owners & Staff: Representatives of businesses who create and operate workspaces on Ruqeva.
- Clients & Customers: Individuals who view public storefronts and book appointments online.
- Website Visitors: Individuals visiting our marketing site.
2Data We Collect (Strict Data Minimization)
We adhere strictly to the principle of data minimization—collecting only what is strictly necessary to fulfill your appointment scheduling and business management requests:
A. For Business Owners
- Full Name and Contact Email
- Mobile Phone Number (for account security & OTP)
- Business Details: Name, Category, Address, City
- Service Menu, Pricing & Staff Profiles
- Hashed passwords (we never store plain-text passwords)
B. For Clients Booking Appointments
- Full Name
- Mobile Phone Number (for WhatsApp booking tickets & OTP)
- Optional Email Address
- Appointment details: Date, Time, Service requested
- Client-submitted reviews and ratings (if provided)
Security & Anti-Abuse Telemetry:
To prevent automated booking spam, denial-of-service, and fraudulent OTP abuse, we log temporary IP addresses and device fingerprints with strict time-to-live expiration. We do not sell, rent, or trade your telemetry or personal information to third-party data brokers.
3Purposes & Lawful Basis of Processing
We process personal data solely for specified, lawful, and explicit purposes:
- Contract Fulfillment: Facilitating automated 24/7 appointment scheduling between clients and businesses.
- Security & Authentication: Validating phone numbers via One-Time Passwords (OTP) to prevent fake appointments.
- Transactional Notifications: Sending automated booking confirmation tickets, rescheduling notices, and cancellation links via WhatsApp or email.
- Quality & Reviews: Allowing verified clients to rate their experience after appointment completion.
- Subscription Management: Managing 14-day free trials and paid memberships for business workspaces.
4WhatsApp Messaging & Notification Consent
By entering your mobile phone number when booking an appointment or creating an account, you provide express affirmative consent to receive transactional notifications (e.g., booking confirmation tickets, appointment reminders, cancellation links, and post-appointment review invitations) via WhatsApp.
You can opt out of non-essential communications at any time by contacting our support team or the business where you booked your service.
5Third-Party Sub-Processors
We partner only with vetted, enterprise-grade service providers who comply with industry security standards:
- Meta / WhatsApp Cloud API: For delivering real-time appointment confirmation tickets and review invites.
- SendGrid (Twilio): For account verification and transactional emails.
- Google Cloud (Gemini API): For generating automated AI summaries of public customer reviews. No client personal identifiable information (PII) is shared or used to train public AI models.
- Cloud Infrastructure: Secured database and server hosts located in compliant data centers with encryption at rest and in transit (SSL/TLS).
6Your Rights as a Data Principal (DPDP Act 2023)
Under Chapter III of the DPDP Act 2023, you have the following enforceable statutory rights:
Right to Access Information
You may request a summary of the personal data we process about you and the identities of data processors involved.
Right to Correction & Erasure
You have the right to request correction of inaccurate data or complete erasure of your personal data when no longer needed.
Right of Grievance Redressal
You have the right to readily accessible grievance resolution directly with our designated Grievance Officer.
Right to Nominate
You have the right to nominate another individual to exercise your rights in the event of death or incapacity.
7Data Retention & Security Safeguards
We implement robust technical and organizational safeguards including HTTPS/TLS encryption in transit, AES-256 database encryption at rest, rate-limiting against automated brute-force attacks, and scoped authorization tokens.
Personal data is retained only for as long as necessary to fulfill the operational purpose for which it was collected, or as required by statutory accounting, tax, or legal obligations. When an account is terminated, data is securely sanitized or deleted upon request.
Grievance Redressal Officer (DPDP Act, India)
In compliance with Section 10(2) of the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are provided below. Any queries, concerns, or requests regarding your personal data will be resolved within the statutory timelines:
Designation: Data Protection & Grievance Redressal Officer
Entity: Ruqeva Technologies
Email Address: grievance@ruqeva.com
General Inquiries: support@ruqeva.com
Jurisdiction & Location: Indore, Madhya Pradesh, India
We may periodically update this Privacy Policy to reflect technical enhancements or regulatory changes under the DPDP Act. Any updates will be published on this page with an updated "Last Updated" timestamp.