How we handle your data

This Privacy Policy explains how Studio Smart One ("we", "our", "the studio") handles information you share with us when you visit studiosmartone.in, book a session, contact us, register an account, attend an academy program, or correspond with the team. We operate from Vesu, Surat, Gujarat, India and comply with applicable Indian privacy law including the Information Technology Act, 2000 and related rules, as well as the Digital Personal Data Protection Act, 2023 where applicable to our processing.

By using the website or any of our services you agree to the practices described here. If you do not agree, please do not use the site or share information with us.

We collect only what we need to deliver studio services, respond to inquiries, and operate the website.

• Identity & contact data: name, email address, phone or WhatsApp number, and (for invoiced sessions) GSTIN.
• Booking-request data: service type, requested slot, project notes, and reschedule history.
• Account data: a hashed password (bcrypt, salted) and optional avatar if you sign up for an account.
• Communications: contact-form messages, WhatsApp threads initiated through our number, and email correspondence.
• Technical data: IP address, browser type, device type, referring page, and session cookie identifiers — used for fraud prevention, server logs, and high-level analytics.

The website does not collect any payment information. No card numbers, UPI handles, CVVs, or transaction references are processed or stored online. All payments happen offline at the studio. We do not knowingly collect biometric data, government identifiers, financial account numbers, or sensitive personal data unless you choose to share them in a project brief.

We use your information for clearly defined operational purposes:

• To process bookings, hold slots, and send confirmations, reminders, reschedule alerts, and post-session receipts.
• To verify identity at the studio for ticketed sessions and academy programs.
• To respond to your inquiries on the contact form, WhatsApp, phone, or email.
• To deliver academy programs, including grading, certificates, and alumni references.
• To prevent fraud, abuse, and unauthorized account access.
• To comply with tax, accounting, and statutory obligations under Indian law.
• To improve the website, services, and academy curriculum based on aggregate, anonymized usage patterns.

We do not use your data for advertising profiling, automated decision-making with legal effect, or behavioral remarketing.

When you submit a booking request we store your booking reference, the slot you picked, your name, email, phone, and any project notes you choose to share. This data is used only to confirm your session, communicate scheduling, and keep your booking history.

The website does not collect, process, or store any payment information. All payments are settled offline at the studio and are recorded only in our offline accounting if you ask us to issue a GST invoice.

Booking-request records are retained for up to seven (7) years to satisfy accounting and tax obligations under Indian law. After that retention window, records are anonymised or deleted.

We use a small number of cookies and similar technologies:

• Session cookies (required): keep you logged in, protect forms with CSRF tokens, and remember booking-flow state. These expire when you close the browser or log out.
• Functional cookies (optional): remember preferences such as preferred service category. You can clear them at any time from your browser.
• Analytics (aggregate only): we use server-side request logs and may use a privacy-respecting analytics tool to count page views, identify broken links, and improve site speed. We do not enable third-party advertising trackers, fingerprinting scripts, or cross-site tracking pixels.

You can disable cookies in your browser. Required session cookies cannot be disabled if you wish to log in or complete a booking.

We send only the emails and messages necessary to operate your bookings:

• Booking confirmations, reschedules, and cancellation receipts.
• Session reminders and post-session feedback prompts.
• Password reset and account-security alerts.
• Replies to inquiries you initiate.

We do not run newsletters, marketing campaigns, or promotional drip sequences. We do not share email addresses or phone numbers with third parties for marketing.

You can request to stop transactional reminders at any time, but doing so means you may miss important booking-related communication.

We rely on a small set of carefully selected third-party providers to operate the site:

• Hosting and email (transactional) — managed servers in India, with TLS-encrypted email delivery for booking notifications.
• Google Maps — embedded location iframe on the contact page. Loading the iframe may set Google cookies on your browser.
• Material Symbols (Google Fonts) — icon library; Google may log the IP making the request.

We do not use payment gateways, advertising pixels, remarketing tags, or social-platform tracking SDKs.

We do not sell, rent, or trade your personal data. We share information only when one of the following applies:

• With service providers who help us operate the studio (payment processor, hosting, transactional email) under contractual confidentiality.
• With government, law enforcement, or courts when legally compelled by valid Indian process.
• To protect rights and safety if we reasonably believe disclosure is necessary to investigate fraud, prevent harm, or enforce our terms.
• In a corporate transaction such as a sale, merger, or restructuring — in which case the receiving party will be bound by this policy or a substantially similar one, and you will be notified in advance.

We keep personal data only as long as it serves a legitimate business or legal purpose:

• Booking and payment records: up to 7 years (statutory accounting retention).
• Account profile data: until you request deletion or for up to 3 years after your last activity, whichever is sooner.
• Inquiry/contact-form messages: up to 2 years, then archived or deleted.
• Server access logs: up to 90 days, used only for security and reliability.
• Marketing preferences: not applicable — we do not run marketing programs.

Anonymised, aggregated statistics that cannot be linked to you may be retained indefinitely.

We protect data with industry-standard measures:

• HTTPS (TLS 1.2+) on every page.
• Bcrypt password hashing with cost factor 12.
• CSRF tokens on every state-changing form.
• Server-side input validation and parameterised database queries.
• Restricted admin access behind authentication and IP-aware logging.
• Regular software patching and dependency review.

No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you and the relevant authorities as required by Indian law without unnecessary delay.

Subject to applicable law you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — fix inaccuracies or update outdated details.
• Delete — request erasure where retention is no longer required by law.
• Restrict — ask us to pause specific uses of your data while a query is being resolved.
• Port — receive a structured copy of data you provided directly.
• Object — challenge processing you believe is unjustified.
• Withdraw consent — for any processing that relies on consent.

To exercise any of these, write to info@studiosmartone.in. We will respond within 30 days. We may verify your identity before fulfilling sensitive requests.

Our services are intended for users aged 16 and above. Academy admission for under-18 learners requires explicit consent from a parent or legal guardian, who is then treated as the primary contact for all booking and payment communications.

If you believe a child under 16 has shared personal data with us without parental consent, contact us and we will delete it on confirmation.

We may revise this policy from time to time. Material changes will be highlighted at the top of this page and, where you have an account, communicated by email at least 14 days before they take effect. The version number and last-updated date at the top of this page always reflect the current revision.

Older versions are kept on file and available on request.

For privacy questions, requests, or complaints write to:

If we cannot resolve your concern, you may approach the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.