Privacy Policy

Last updated: 22 Jul 2026 · Owned by Bharath Kiran Lokanadham

Effective: 22 Jul 2026 Contact: hello@biostudio.in

This Privacy Policy explains how Bio Studio ("we", "us", "our") collects, uses, discloses & safeguards your information when you use our website and services (collectively, the "Service"). Please read this policy carefully. By using the Service, you consent to the practices described here.

TL;DR: We collect only what's needed to run your account and ship your orders. We never sell your personal data. You can export or delete your data anytime.

1. Information We Collect

1.1 Information you provide

  • Account info — name, email, username, password (hashed), phone, WhatsApp number, avatar, bio, social handles.
  • Business info — account type, company name, GSTIN, address (if you choose to provide it for invoices).
  • Payment info — Razorpay API keys & UPI VPA (stored encrypted in your account; we never see your bank login or card numbers).
  • Store & product info — product names, descriptions, prices, images, delivery settings.
  • Customer data — buyer name, email, phone, address (only when a buyer places an order on your store).

1.2 Information collected automatically

  • IP address, browser type, device info, referring URL (for analytics & fraud prevention).
  • Page visits, link clicks, and product views (aggregated, anonymized in reports).
  • Cookies & local storage (see section 3 below).

2. How We Use Your Information

  • To create & maintain your account and authenticate you.
  • To display your bio page and process orders placed by your buyers.
  • To send you order notifications, OTPs, and important account updates via email/WhatsApp.
  • To generate invoices, calculate taxes, and comply with Indian tax regulations.
  • To provide analytics about your store performance.
  • To prevent fraud, abuse, and unauthorized access.
  • To improve our Service, develop new features, and fix bugs.
  • To respond to your support requests and feedback.

3. Cookies & Local Storage

We use a minimal set of cookies and local storage to keep you logged in (session cookie bio_session), remember your preferences, and gather aggregate analytics. We do not use third-party advertising cookies. You can disable cookies in your browser; some features (like staying logged in) will stop working.

4. Payments & Financial Data

Bio Studio does not directly process payments. When a buyer pays via UPI, the transaction happens directly between the buyer and your UPI app — Bio Studio only generates the UPI deep link. When a buyer pays via Razorpay, the payment is processed by Razorpay on your behalf (using your Razorpay keys); we never see or store card numbers, net-banking credentials, or UPI PINs. We store the Razorpay order ID and payment ID for record-keeping and reconciliation.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only in these limited cases:

  • Service providers — hosting (Hostinger), payment processors (Razorpay), email/WhatsApp delivery, who process data on our behalf under strict contracts.
  • Delivery partners — when you assign an order to a delivery partner, we share the buyer's name, address, and phone with that partner to fulfill the delivery.
  • Legal compliance — when required by Indian law, court order, or government authority; or to protect our rights, property, or safety.
  • Business transfers — in the event of a merger, acquisition, or asset sale, user data may be transferred; we'll notify you 30 days before.

6. Data Security

We use industry-standard measures to protect your data: TLS encryption in transit, bcrypt-hashed passwords, prepared SQL statements (no SQL injection), input sanitization, role-based access controls, and regular security reviews. Razorpay secrets are stored only in your account and never returned to the frontend. Despite our efforts, no system is 100% secure — we'll notify affected users within 72 hours of any confirmed breach.

7. Data Retention

We retain your account data for as long as your account is active. Order records, invoices, and tax-related data are retained for 7 years (as required by Indian tax law) even after account deletion. You can request export or deletion of your data anytime (see section 8).

8. Your Rights

Under Indian law (DPDP Act 2023) and GDPR (for EU users), you have the right to:

  • Access — request a copy of your personal data.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion of your account and data (subject to legal retention).
  • Portability — receive your data in a machine-readable format.
  • Objection — object to certain processing activities.
  • Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email hello@biostudio.in with the subject "Privacy Request". We respond within 30 days.

9. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us and we will promptly delete it.

10. International Data Transfers

Your data is stored primarily on servers located in India. Some service providers (e.g., analytics, error monitoring) may process data outside India; we ensure such transfers comply with applicable Indian data protection laws.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We'll notify you of material changes via email and/or an in-app banner at least 14 days before they take effect. The "Last updated" date at the top reflects the latest revision.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: