Privacy Policy

1. Whose data and what

Business owners and team members: mobile number, name, optional email, sign-in and security records (sessions, IP address, device type), billing details you give us (legal name, tax number, address).

A business's customers and visitors: when someone sends an enquiry or booking request on a business's website, the details they enter (name, phone, optional email, message, preferred time) are stored for that business. The business is the main controller of that data; OnMapo processes it on the business's behalf.

Website statistics: we count visits per day, per device type and source. We do not store visitor identifiers and we ignore bots.

Business listing data: public information about businesses from Google (name, address, rating, reviews, photos) used to build previews, reports and review tools. A business owner can ask us to remove a preview or report made from this information.

Home-page searches: when someone checks a business on our home page we keep the search text and a one-way hash of the visitor's network address for a short time, only to limit abuse and cost. We do not store the address itself.

Ownership checks: when you sign in to take over a business we compare the number you signed in with to the number the business lists publicly, and keep a record of who was approved and how.

2. Why we use it

To run the service you asked for: sign you in, show your inbox and customers, send the booking emails you switch on, publish your website, bill you, keep the product secure and fix problems, and answer your questions. We do not sell personal data and we do not use it for third-party advertising.

3. Who helps us (processors)

Firebase / Google (sign-in SMS and phone verification), Google Places (public business data), Resend (emails), WhatsApp / Meta (booking messages to your customers, sent from OnMapo's verified number), our payment partner (payments), AI providers (text you ask the assistant to draft — we send only the text needed for that request and do not store the prompt or the answer in our usage log), and our hosting provider. They may process data outside India; we choose providers with appropriate safeguards.

4. How long we keep it

Your account and business data are kept while your account exists. If you delete your account or ask us to, we delete or anonymise personal data within 30 days, except records we must keep by law (for example invoices, kept for the period tax law requires) and backups, which expire on their normal cycle (about 14 days locally; encrypted off-site copies on a rolling basis).

5. Cookies

We use one essential sign-in cookie for the owner area, and a short-lived cookie that stops the same offer click being counted twice. We do not use advertising or cross-site tracking cookies.

6. Security

Sign-in uses one-time codes; sessions are stored hashed and expire; data is encrypted in transit; access to each business's data is checked on the server for every request; backups are encrypted. No system is perfectly secure; if a breach affecting you occurs we will tell you and the authorities as the law requires.

7. Your rights

You can ask to see, correct, export or delete your personal data, withdraw consent, or complain. Owners can export their customers, enquiries and bookings from the product at any time. If you are a customer of a business that uses OnMapo, please contact that business first; we will also help.

Write to hello@onmapo.com. Registered address: 82, Krishna Bagh, Dayalbagh, Agra, Uttar Pradesh 282005. Grievance officer: [Grievance officer name and contact — to be added before launch]. We reply within 30 days. In India you may also complain to the Data Protection Board.

8. Children

OnMapo is for businesses and is not directed at children under 18.

9. Changes

We will update this page when our practices change; the date above shows the latest version.