Privacy Policy

What we collect, why we collect it, and what you can ask us to do with it.

Last updated: 11 October 2026

Who we are

Sajeya is a marketplace that lets customers browse and book verified makeup, hair and mehendi artists. This policy covers the Sajeya website and any bookings made through it.

Sajeya is operated by AL-AUREZA LLP, which is the data fiduciary for the personal data described below. Its registered address is 7/C, Golam Jilani Khan Road, Topsia, South 24 Parganas, West Bengal 700039, India.

Questions about this policy, or a complaint about how your data has been handled, go to Irfan Khan (Grievance Officer, Sajeya (AL-AUREZA LLP)) at accounts@sajeya.in. We acknowledge within 48 hours and aim to resolve within one month.

What we collect

We collect only what a booking actually needs:

Account details — your name, email address, mobile number and, optionally, your city and a profile photo.
Booking details — the artist and package you chose, the date and time slot, any note you add, and the address where the service takes place.
Payment records — the amount, status and reference of each booking fee or balance payment. Card and UPI details are entered directly with our payment provider and are never stored by us.
Artist location on the day — when an artist marks their arrival, their device location is recorded once, with their permission, as a record of arrival. We do not track anyone in the background.
How the app and website are used — which screens are opened and which actions are taken (for example that an artist’s profile was viewed, a search was made, or a booking was started), so we can see where the product is failing people. We record the action and small details like which artist or which step — never what you typed, never the words of a search or a message. We do this ourselves; no analytics or advertising company receives it.
Where your account came from — if you sign up through a link that carries a tag (for example one from our Instagram) or another artist’s invite link, we record that tag and which artist invited you. The inviting artist sees only how many people joined through her link, never who.
Photographs — artists may add photos of their own work to their portfolio, and may take before and after photos of a completed service. See “Photographs of you” below, which is the most sensitive part of this policy.
Reviews — your rating, comments and any photos you choose to add after a completed booking.

Someone an artist asks us to tell — an artist may save one person’s name, mobile number and email, so that she can send them a link showing where she is working and tell them if something goes wrong. These are somebody else’s details, given to us by her, and we use them for that one purpose only. We never message that person for any other reason, and we never read anyone’s contacts.

Job links an artist shares — when an artist chooses to tell someone where she is, we create a private web link for that booking. Anyone holding the link can see the area, the expected finish time and whether she has finished. They cannot see the customer’s street address or phone number unless the artist taps to ask for help, at which point they are shown so that someone can reach her. The link stops working a few hours after the booking ends.

Photographs of you

Photos an artist takes of your service are stored privately. They are visible only to you, the artist, and our team — never publicly, and never to other customers.

A photo becomes public only if you explicitly agree. After a booking is completed we ask you, in your dashboard, whether the artist may show the photos on their profile. If you decline, they stay private. Your consent is recorded with the date you gave it, and you can ask us to withdraw it at any time.

How we use it

To create and secure your account, and to verify your email and mobile number.
To take bookings, collect our booking fee, and pass the details each side needs.
To protect both sides — the arrival record, settlement record and service photos are the evidence we rely on if something goes wrong and a refund or backup artist is needed.
To send you notifications about your own bookings.
To keep the marketplace honest — for example, only customers with a completed booking can leave a review.

We do not sell your personal information, and we do not use your photos for advertising without asking you first.

What the other side of a booking can see

Contact details are deliberately withheld until a booking is confirmed. Once your artist confirms, they can see your email address and the service address so they can reach you and arrive. Before confirmation, neither side sees the other’s contact details.

Where your information is held. Our database and files are hosted in India (Mumbai). Two of the providers above operate outside India: the website is served by Vercel from servers in several countries, and our email is sent through a provider in Japan. Some of your information is therefore processed outside India. We use providers who are contractually bound to protect it, and we send them only what each one needs to do its job.

Who we share it with

We use a small number of service providers, each for a specific job:

Supabase — hosts our database, accounts and file storage.
Razorpay — processes payments. Your card or UPI details go directly to them.
Our own team — we currently verify mobile numbers by calling them, so your number is not shared with any messaging provider for this purpose. If we adopt an automated code service, this page will name it before we start.
Google — only if you choose to sign in with your Google account.
Apple — only if you choose Sign in with Apple on an iPhone. Apple tells us your name and email address; if you ask Apple to hide your email, we receive a private Apple address that forwards our emails to you.
Vercel — serves the website.
Expo, Google (Firebase Cloud Messaging) and Apple (Push Notification service) — deliver notifications to the Sajeya app on your phone, only if you allow notifications. They receive the notification’s text and a device code, nothing else.

We may also disclose information where the law requires it. Otherwise we share nothing with anyone else.

How long we keep it

We keep different things for different lengths of time. Most of these periods are set by Indian tax and company law rather than by us — where the law does not require us to keep something, we delete it.

What	How long
Booking records, invoices and payment records	8 years from the end of the financial year
Records of a problem you reported and how it was resolved	3 years
The exact location captured when an artist marks her arrival	90 days, then replaced with whether she arrived on time
Your street address, outside the invoice record	90 days after the booking, then reduced to area and pincode
An artist’s trusted contact	Until she changes or removes it, or 90 days after her last booking
Links an artist shares showing where she is working	Expire hours after the booking; deleted within 30 days
Service photographs where you did not give permission to show them	Deleted within 30 days of the booking
Service photographs you did give permission for	Until you withdraw it, then deleted within 30 days
Security and access logs	12 months
Everything else, after you ask us to delete your account	Erased within 30 days, except the records above that law requires us to keep

The eight-year figure comes from the Limited Liability Partnership Act, which requires an LLP to preserve its books of account for eight years, and it also covers the six years GST law requires. The three-year figure matches the period in which a claim about a booking can be brought.

Your rights

The Digital Personal Data Protection Act, 2023 gives you these rights over your personal data, and we honour them:

to know what personal data we hold about you and how we use it;
to have it corrected, completed or updated;
to have it erased, except what the law requires us to keep (see the table above);
to withdraw any consent you have given, as easily as you gave it;
to nominate another person to exercise these rights for you if you die or become unable to;
to complain to us first (see “Who we are” above) and, if you are not satisfied with our answer, to the Data Protection Board of India.

To use any of them, write to accounts@sajeya.in. Most of them you can also do yourself, as the next section explains.

Your choices

You can view and correct your name, city and photo in your dashboard at any time.
You can decline, or later withdraw, permission for your photos to be shown publicly.
You can delete your account yourself, from the app or your dashboard — here is how, and exactly what is kept. You can also ask us for a copy of your information via the contact page. Some records, such as completed payments, must be retained for legal reasons.

Security

Accounts are protected by a password or a one-time code, and sensitive actions run on our servers rather than in your browser. Service photographs are held in private storage and served through short-lived links. No system is perfect, but we have designed this one so that neither party to a booking can quietly change money records or publish your photos.

Children

Sajeya is intended for adults. Please do not create an account if you are under 18.

Changes to this policy

If we change how we handle your information we will update this page and change the date above.

Questions about any of this? Get in touch.