Privacy Policy

01. Introduction

This Privacy Policy explains how Vaikron ("Vaikron", "we", "us", or "our") collects, processes, stores, and protects personal and business information when you use the Vaikron Rewards customer loyalty and rewards platform ("Platform" or "Service").

In providing Vaikron Rewards, we recognize the distinct roles established under the Digital Personal Data Protection Act, 2023 (DPDP Act). With respect to your merchant account and billing details, Vaikron acts as a Data Fiduciary. With respect to the end-customer records entered by you into your store tenant, your business acts as the Data Fiduciary, and Vaikron operates strictly as a Data Processor on your behalf.

02. Information We Collect

We collect only the minimum data required to deliver reliable loyalty software capabilities, authenticate users, facilitate double-entry point ledgers, and prevent multi-tenant security vulnerabilities.

03. Merchant Account & Registration Data

When you register for Vaikron Rewards, we collect:

• Business owner/manager full name.
• Official business email address.
• Telephone/mobile contact number.
• Bcrypt-hashed authentication passwords (we never store plain text passwords).
• Staff member names, roles (Manager/Cashier), and authorized staff email addresses.

04. Business Profile Information

To configure your store tenant and digital loyalty pass, we store:

• Store trading name, category (e.g. cafe, retail, salon), and store address.
• Unique URL identifier (business slug).
• Brand colour preferences, store logo assets, and custom greeting messages.
• Configured loyalty rules: point earning ratios, minimum spend, expiry horizons, and rewards catalog items.

05. Customer Information Entered by Business Users

Merchants enter customer details at the counter to track loyalty points. This data includes:

• Customer full name and normalized 10-digit Indian mobile number (+91).
• Auto-generated member sequence number and SHA-256 digital pass token.
• Optional customer birth date, email address, and marketing channel consent flags (WhatsApp/SMS).
• Retail purchase transactions: invoice amounts, receipt references, points awarded, points redeemed, and timestamps.

Merchant Obligation: Merchants warrant that they have provided notice to and collected lawful consent from store customers before recording their telephone numbers or entering their data into Vaikron Rewards.

06. Payment & Subscription-Related Information

When you subscribe to paid Vaikron Rewards plans (Starter ₹499/mo, Growth ₹999/mo, Business ₹1,999/mo), billing transactions are handled by RBI-authorized third-party payment gateways. Vaikron does not collect or store full credit/debit card numbers, CVVs, or net banking credentials. We receive only transaction identifiers, subscription status, and billing cycle records.

07. Technical Information, Device Logs & Telemetry

To protect against session hijacking, brute-force attacks, and unauthorized tenant access, our servers automatically record technical parameters:

• IP address, browser user-agent header, and operating system version.
• Cryptographic session fingerprints and CSRF verification tokens.
• Staff audit trails: timestamps of customer registration, billing, and reward redemptions.

08. How Information is Used

We process collected data exclusively for:

• Authenticating merchant and staff accounts.
• Maintaining accurate, immutable double-entry points ledgers for store patrons.
• Generating printable redemption receipts and secure digital QR loyalty passes.
• Enforcing subscription customer capacity limits (70, 120, or 300 customers).
• Defending against fraudulent transactions, session tampering, and cyber threats.

09. Platform Operation & Security

We employ industry-standard technical measures to safeguard customer and merchant records. These include parameterized PDO SQL queries against SQL injection, strict session fingerprint validation, constant-time token comparison via hash_equals, role-based access control, and tenant isolation guarantees preventing cross-business data access.

10. Data Retention & Archival

Merchant and customer records are retained for the duration of your active software subscription. In the event of account cancellation or non-renewal, records are preserved for thirty (30) days to allow for data export or account reactivation. Following the 30-day grace period, merchant data may be permanently purged from active production databases in accordance with Vaikron data hygiene policies.

11. Service Providers & Subprocessors

Vaikron engages trusted infrastructure partners to host and operate the platform (e.g. cloud server providers, database hosting, transactional email delivery). All subprocessors are subject to strict data confidentiality and security obligations consistent with this Privacy Policy.

We never sell, rent, monetize, or disclose your customer directories or store retail data to advertisers or third-party marketers.

12. Cookies & Session Storage

Vaikron Rewards uses strictly necessary first-party HTTP cookies (e.g. rl_session) to maintain secure administrative logins and prevent Cross-Site Request Forgery (CSRF). We do not deploy third-party advertising cookies, cross-site behavioural trackers, or surveillance pixels.

13. Data Security Practices

Vaikron Rewards implements multi-layered security controls:

• Password Hashing: Strong bcrypt key-derivation algorithms with unique salting.
• QR Token Security: SHA-256 hashed customer access tokens preventing URL enumeration.
• Transport Security: Strict HTTPS transport encryption (TLS 1.2/1.3) with HSTS headers.
• Access Protection: Public isolation of database initialization scripts and obscured administration endpoints.

14. Data Deletion & Account Closure Requests

Merchants may export their complete customer roster and points history in standard CSV format at any time directly from the Reports & Data Export hub. You may request complete account closure and tenant data deletion by submitting an official request to support@vaikron.com.

15. User Privacy Rights Under Indian Law

In accordance with the Digital Personal Data Protection Act, 2023, data principals are entitled to:

• The right to obtain confirmation and a summary of personal data being processed.
• The right to seek correction, completion, and updating of inaccurate personal data.
• The right to seek erasure of personal data that is no longer necessary for the specified purpose.
• The right to readily accessible grievance redressal mechanisms.

Store customers seeking to exercise these rights regarding their loyalty records should contact the respective store merchant directly, as the merchant is the primary Data Fiduciary.

16. Children's Personal Information Considerations

Vaikron Rewards is a commercial software platform designed for merchant operations and business-to-consumer store loyalty programmes. The service is not directed toward children under eighteen (18) years of age, and we do not knowingly solicit or collect personal information from minors.

17. Policy Updates

Vaikron may revise this Privacy Policy periodically to reflect technological advancements, legal developments under the DPDP Act, or operational updates. Changes will be posted to this page with an updated revision date. Material changes will be highlighted through in-app notifications.

18. Contact & Grievance Redressal Officer

In compliance with Indian information technology regulations, for inquiries, concerns, or grievances concerning personal data processing under Vaikron Rewards, you may contact: