Privacy Policy

Who we are

DMS TechLabs is the software division of the DMS Group, run by DMS Techlabs, 125/4, Cholambedu Road, Srinagar Colony, Thirumullaivoyal, Avadi, Chennai - 600 062, Tamil Nadu, India ("we", "us"). We build and operate business software, including the mobile applications listed on this site. For anything in this policy, reach us at dmsdiaan@gmail.com or on +91 70127 35868.

Miska. Miska, our jewellery brand, is also run by DMS Techlabs. Orders placed on miskafashion.com are covered by Miska's own privacy policy, which explains the order, delivery and payment details it collects.

Two different roles. For our own website and accounts we are the data controller. When a salon, gym, clinic or pharmacy uses our software to run their business, they are the controller of their customers' data and we are their processor — we hold that data on their instruction and do not decide what happens to it. If you are a customer of one of those businesses, direct your requests to them first; we will help them answer you.

What we collect

When you use one of our apps as a staff member or operator:

• Account details — name, email address, phone number, the business you belong to and your role within it.
• Authentication data — a credential handled by Firebase Authentication. We never see or store your password.
• Business records you enter — appointments, customers, invoices, stock, attendance and similar operational data.
• Device and diagnostic data — app version, operating system, device model, crash reports and error logs.

When you pay us:

• Payment records — your name, contact details, what you bought, the amount and the transaction reference. Card numbers, UPI PINs and bank logins are handled by the bank or payment provider; we never see or store them.

When a feature needs it, and only after you grant permission:

• Camera — to scan barcodes and attach photographs to a record.
• Photo library — to attach an existing image.
• Location — only in apps with field-visit check-in, only while the app is open, and only at the moment you check in. We do not track location in the background.
• Notifications — to deliver appointment and operational alerts.

We do not collect advertising identifiers, we do not build advertising profiles, and we do not sell or share personal data with data brokers.

Why we process it

• To provide the service — running the features you asked for. Lawful basis: performance of a contract.
• To keep it secure — authentication, abuse prevention, audit trails. Lawful basis: legitimate interests.
• To fix and improve it — crash reports and aggregate usage. Lawful basis: legitimate interests.
• To meet legal obligations — tax and invoicing records we are required to retain. Lawful basis: legal obligation.

Who we share it with

We use a small set of sub-processors and nobody else:

• Google Firebase (Google Ireland Ltd / Google LLC) — authentication, database, file storage, hosting and crash reporting.
• Supabase — database and edge functions for our messaging infrastructure.
• Payment providers — the banks, UPI apps and payment gateways that process a payment you make to us, and only the details needed to process it.
• Meta Platforms — only where a business has chosen to send WhatsApp messages through the official WhatsApp Business Cloud API, and only the message content and recipient number needed to deliver it.

We also disclose data where we are legally compelled to, and to a successor entity in the event of a merger or acquisition — in which case this policy continues to apply until you are told otherwise.

Where it is stored

Data is held in Google Cloud and Supabase regions, primarily in India and the European Union. Where data moves outside its region of origin, that transfer is covered by Standard Contractual Clauses.

How long we keep it

• Account data — for as long as the account is active, then 90 days.
• Business records — for as long as the business keeps its account, plus any statutory retention period that applies to invoices and tax records.
• Crash and diagnostic logs — 90 days.
• Backups — rolling 30 days, after which deleted data is gone from backups too.

Your rights

Subject to local law, you may request access to your data, correction of it, deletion of it, a portable copy, restriction of processing, or object to processing based on legitimate interests. You may also withdraw a permission at any time in your device settings.

Deleting your account. Both Apple and Google require an in-app route to account deletion. In our apps this is under Settings → Account → Delete account. You can also write to dmsdiaan@gmail.com from your registered address. We action deletion requests within 30 days. Where the business you work for is the controller, we pass the request to them and assist them in fulfilling it.

Children

Our apps are business tools and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

Security

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access is governed by role-based rules enforced at the database layer rather than in the client, so a modified app cannot read what its user is not entitled to. Administrative access is limited to named staff and is logged.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant supervisory authority as the law requires.

Changes

We will update this page when our practices change and revise the effective date at the top. Material changes are announced in-app before they take effect.

Contact and grievances

DMS Techlabs
125/4, Cholambedu Road,
Srinagar Colony, Thirumullaivoyal,
Avadi, Chennai - 600 062,
Tamil Nadu, India
Phone: +91 70127 35868 · WhatsApp: +91 70127 35868
Email: dmsdiaan@gmail.com

Grievance Officer: Grievance Officer, DMS Techlabs — dmsdiaan@gmail.com, +91 70127 35868. We acknowledge a complaint within 48 hours and resolve it within one month. If you are in the EU or UK and are not satisfied with our response, you may complain to your local data protection authority.