Privacy Policy

1. What we collect

From partners and painters:

• Account details: name, business name, mobile number, email address and a password, stored only in scrambled form.
• Promotion channels: the channels you choose and the website, page, handle or number you give for each.
• KYC and tax details: PAN, GSTIN if you give one, and your UPI ID or bank account (holder name, account number, IFSC and bank).
• Activity in the portal: links you create, referrals, commissions, withdrawals and payouts.
• Link clicks: for each click on your link, the date, the type of device (mobile, tablet or desktop) and the source label in the link. We do not store the visitor's IP address or identity.

From customers: the name, phone number, location or address and requirement entered on a referral form or at checkout. See section 7.

2. Why we use it

• To create and secure your account, including sending one-time sign-in and confirmation codes.
• To credit referrals to the right partner, calculate commission and show it in your portal.
• To verify your identity and payout details, deduct TDS and meet our tax obligations under the Income Tax Act.
• To pay withdrawals to your UPI ID or bank account.
• To contact customers about the products and services they asked about.
• To prevent fraud, such as fake or self-made referrals, and to enforce the Partner Terms.

We do not sell your personal data, and we do not use it for advertising by other companies.

3. Who we share it with

We share data only with the service providers we need to run the portal, and only what each one needs:

• Fly.io hosts the portal and its database.
• Twilio SendGrid sends emails, such as sign-in codes. It receives your email address and the message.
• Razorpay (RazorpayX) makes payouts and checks bank and UPI details. It receives your name, contact details and payout details. Customer payments, when enabled, also go through Razorpay.
• Twilio, if SMS or WhatsApp codes are switched on, receives your mobile number and the code.
• Tax authorities receive PAN and TDS details as the law requires.

We may also share data when the law requires it, or to protect against fraud.

4. Where it is stored

The portal's database is stored on servers in Singapore, with encrypted backups. Our service providers may process data in other countries. We only use providers with security practices suitable for financial and identity data.

5. How long we keep it

• Account, referral and commission records are kept while your account is open.
• After you close your account, we keep the records needed for tax and accounting, such as commission, TDS and payout records, for as long as the law requires, usually up to 8 years. Other data is deleted or anonymised.
• One-time codes expire within minutes. Database backups are kept for about 14 days.

6. Your rights

You can:

• See and correct most of your details yourself, under Profile and KYC & Tax in your portal.
• Ask for a summary of the personal data we hold about you and who we have shared it with.
• Ask us to correct, complete or delete your data. We may keep records the law requires us to keep.
• Withdraw your consent by closing your account. This stops further processing, but does not affect what was done before.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, contact us as shown in section 10. We will reply within 30 days.

7. Customers referred to us

• If a partner refers you, or you fill in a form through a partner's link, we receive your name, phone number, location and requirement.
• We use these details only to contact you about what you asked for, and to credit the partner who referred you. The partner who referred you sees the status of your request, not your contact details. If a painter is assigned to your job, they see your name, phone number and address so they can contact you.
• Partners must have your permission before giving us your details.
• To have your details removed, contact us as shown in section 10.

8. Cookies

• Sign-in cookie: keeps you signed in. It is needed for the portal to work.
• Referral cookies: when you open a partner's link, we remember that partner's code and link for up to the partner's attribution window, usually 30 days. This lets us credit the right partner. We also set a short cookie so repeat clicks within 30 minutes count once.
• We do not use advertising or third-party tracking cookies.

9. Security

The portal uses HTTPS for all connections. Passwords and one-time codes are stored only in scrambled form. Access to partner data is limited to the partner and authorised StarShield Paints staff. API keys are kept in an encrypted secret store. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.

10. Contact and grievances

For questions, requests or complaints about your personal data, contact our grievance officer at support@starshieldpaints.com. Please include your registered mobile number or email so we can find your account.

We may update this policy. The current version is always on this page.