Privacy Policy

Oxi9 Essentials Private Limited

This Privacy Policy explains how Oxi9 Essentials Private Limited ("Oxi9", "we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you use our:

• Website: https://oxi9.in

• Android Mobile Application

• iOS Mobile Application

• Beauty Platform and Salon Management Software

• Appointment Booking System

• Online Shopping Services

• Loyalty Programs and CRM Features

By accessing or using any of our platforms or services, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use our platform.

This Privacy Policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable guidelines from Google Play and the Apple App Store.

1. INFORMATION WE COLLECT

We collect information that you provide directly, information generated automatically during your use of our platform, and information received from third-party services. The categories of information we collect are described below.

2. PERSONAL INFORMATION

We collect personal information that you voluntarily provide when you register an account, place an order, book an appointment, or contact us. This includes:

2.1 Identity Information:

- Full name

- Date of birth

- Gender

2.2 Contact Information:

- Email address

- Mobile phone number

- Delivery and billing address

- PIN code and city

2.3 Account Information:

- Username and password (stored in encrypted form)

- Profile photo (if uploaded)

- Saved addresses

2.4 Transaction Information:

- Order history and purchase details

- Return and refund requests

- Appointment bookings and service history

- Loyalty points and rewards balance

2.5 Business Information (for Salon & Business Users):

- Business name and address

- GST number (if applicable)

- Staff and service listing details

- Client management data entered into the platform

2.6 Communication Preferences:

- Notification settings

- Marketing opt-in or opt-out status

- Language preference

3. DEVICE INFORMATION

When you use our mobile applications (Android or iOS) or visit our website, we automatically collect certain device and technical information, including:

- Device type, model, and manufacturer

- Operating system and version (Android / iOS)

- Unique device identifiers (Device ID, Advertising ID)

- Mobile network and carrier information

- App version and install date

- Browser type and version (for website users)

- IP address

- Crash logs and error reports

This information is used to ensure the app functions correctly on your device, to diagnose technical issues, and to improve platform performance.

4. LOCATION INFORMATION

4.1 We may collect your approximate or precise location if you grant location permission through your device settings.

4.2 Location data is used for the following purposes:

- To show nearby salons, beauty professionals, or service providers

- To enable accurate delivery address selection

- To provide location-based offers and services

4.3 You may withdraw location permission at any time through your device settings (Settings > Apps > Oxi9 > Permissions > Location on Android; Settings > Oxi9 > Location on iOS). Withdrawing location permission may limit certain features of the app.

4.4 We do not share your precise location with third parties for advertising purposes without your explicit consent.

5. COOKIES AND TRACKING TECHNOLOGIES

5.1 Our website https://oxi9.in uses cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage) to enhance your browsing experience and analyse platform usage.

5.2 Types of cookies we use:

a) Essential Cookies: Required for the platform to function, including session management and login authentication. These cannot be disabled.

b) Functional Cookies: Remember your preferences such as language, saved address, and cart contents.

c) Analytics Cookies: Help us understand how users navigate our website, which pages are most visited, and where errors occur.

d) Marketing Cookies: Used to deliver relevant promotional content and track the effectiveness of our campaigns.

5.3 You may decline non-essential cookies through your browser settings or through the cookie preference centre on our website. Disabling cookies may affect your ability to use certain features of our platform.

6. ANALYTICS

6.1 We use analytics tools to understand how users interact with our website and mobile applications. This includes tracking page views, session duration, feature usage, conversion rates, and user journeys.

6.2 Analytics data is aggregated and anonymised where possible. We use this data to improve our platform, identify bugs, and enhance the overall user experience.

6.3 Analytics tools we may use include:

- Google Analytics

- Firebase Analytics (see Section 7)

- Internal analytics dashboards

7. FIREBASE SERVICES

7.1 We use Google Firebase, a mobile and web application development platform, to power various features of our Android and iOS apps. Firebase services we use may include:

a) Firebase Analytics: To track app usage events, screen views, and user behaviour.

b) Firebase Crashlytics: To receive real-time crash reports and error logs to improve app stability.

c) Firebase Cloud Messaging (FCM): To send push notifications to your device.

d) Firebase Authentication: To manage secure login via OTP, email, and social sign-in.

e) Firebase Remote Config: To remotely update app content and configuration without requiring an app update.

f) Firebase Performance Monitoring: To identify and address app performance issues.

7.2 Data collected through Firebase is governed by Google's Privacy Policy, available at https://policies.google.com/privacy. Firebase data is processed in compliance with applicable data protection laws.

8. PUSH NOTIFICATIONS

8.1 We may send push notifications to your mobile device to keep you informed about:

- Order status and delivery updates

- Appointment reminders and booking confirmations

- Loyalty points and reward notifications

- New product launches and promotions

- Important account and security alerts

8.2 Push notifications are enabled by default on installation of our app. You may manage notification preferences at any time through:

- The Oxi9 app settings (Profile > Notification Preferences)

- Your device notification settings (Settings > Notifications > Oxi9)

8.3 Disabling push notifications will not affect your ability to use the core features of the app, but you may miss important order and appointment updates.

9. OTP AUTHENTICATION

9.1 Oxi9 uses One-Time Password (OTP) authentication to verify your mobile number at the time of registration, login, or sensitive account actions.

9.2 OTPs are sent via SMS to the registered mobile number and are valid for a limited time only.

9.3 We use third-party SMS service providers to deliver OTPs. Your mobile number is shared with these providers solely for the purpose of OTP delivery and is not used for any other purpose.

9.4 You are responsible for keeping OTPs confidential. Oxi9 will never ask you to share an OTP via call, email, or chat. If you receive any such request, please report it immediately to care@oxi9.in.

10. PAYMENT INFORMATION

10.1 Oxi9 does not directly collect or store your full credit card number, debit card number, CVV, or bank account credentials on its servers.

10.2 All payment transactions on https://oxi9.in and the Oxi9 mobile applications are processed through secure, PCI-DSS compliant third-party payment gateways.

10.3 We may store the following limited payment-related information for transactional and accounting purposes:

- Partial card details (last 4 digits only, if saved for future use with your consent)

- Payment method type (UPI, credit card, net banking, wallet, etc.)

- Transaction reference number and payment status

- Invoice and billing records

11. RAZORPAY

11.1 We use Razorpay as our primary payment gateway for processing online payments on our platform. Razorpay is a PCI-DSS Level 1 certified payment processor operating under applicable RBI guidelines.

11.2 When you make a payment on Oxi9, your payment details are transmitted directly and securely to Razorpay. Oxi9 does not have access to your full payment credentials.

11.3 Razorpay's collection and use of your payment data is governed by Razorpay's Privacy Policy, available at https://razorpay.com/privacy.

11.4 In the event of payment disputes or chargebacks, Oxi9 may share relevant transaction details with Razorpay and your bank to facilitate resolution.

12. GOOGLE LOGIN

12.1 You may choose to sign in to your Oxi9 account using your Google account via Google Sign-In (OAuth 2.0).

12.2 When you use Google Login, we receive the following information from Google:

- Your name

- Email address linked to your Google account

- Profile photo (if publicly available)

- Google account identifier (used for authentication only)

12.3 We do not receive your Google password. Your use of Google Login is subject to Google's Terms of Service and Privacy Policy available at https://policies.google.com/privacy.

12.4 You may disconnect Google Login at any time through your Google account settings or by contacting us at care@oxi9.in.

13. APPLE LOGIN

13.1 You may choose to sign in to your Oxi9 account using Sign in with Apple, available on iOS devices.

13.2 When you use Apple Login, we receive:

- Your name (as shared by you during sign-in)

- An email address (either your real address or Apple's private relay email address, based on your preference)

- A unique Apple identifier (used for authentication only)

13.3 Apple Login gives you the option to hide your real email address. If you choose this option, Apple will forward emails from Oxi9 to your actual inbox through a private relay address.

13.4 Your use of Sign in with Apple is subject to Apple's Privacy Policy available at https://www.apple.com/legal/privacy.

14. META (FACEBOOK) LOGIN

14.1 You may choose to sign in to your Oxi9 account using your Facebook (Meta) account via Facebook Login.

14.2 When you use Meta Login, we receive the following information with your permission:

- Your name

- Email address linked to your Facebook account

- Profile photo (if publicly available)

- Facebook account identifier (used for authentication only)

14.3 We do not receive access to your friends list, posts, or other Facebook data unless explicitly authorised by you.

14.4 Your use of Facebook Login is subject to Meta's Data Policy available at https://www.facebook.com/privacy/policy.

14.5 You may revoke Oxi9's access to your Facebook account at any time through Facebook Settings > Apps and Websites.

15. WHATSAPP INTEGRATION

15.1 Oxi9 may use WhatsApp Business API to communicate with you regarding:

- Order confirmations and tracking updates

- Appointment booking confirmations and reminders

- Customer support and grievance resolution

- Important promotional offers (with your consent)

15.2 WhatsApp communications are sent only to the mobile number registered on your Oxi9 account and only where you have not opted out of WhatsApp notifications.

15.3 You may opt out of WhatsApp communications at any time by:

- Sending "STOP" to our WhatsApp business number

- Updating your notification preferences in the Oxi9 app

- Contacting us at care@oxi9.in

15.4 Your use of WhatsApp is subject to Meta's Privacy Policy. Oxi9 does not store your WhatsApp conversation history beyond what is required for customer support purposes.

16. THIRD PARTY SERVICES

16.1 Our platform integrates with various third-party services to deliver a complete user experience. These third parties may collect and process data in accordance with their own privacy policies. Third-party services we use may include:

- Payment Processing: Razorpay

- Cloud Infrastructure: Google Cloud / Firebase

- SMS and OTP Services: Third-party SMS gateway providers

- Maps and Location: Google Maps API

- Analytics: Google Analytics, Firebase Analytics

- Social Login: Google, Apple, Meta (Facebook)

- Communication: WhatsApp Business API

- Logistics Partners: Third-party delivery services

16.2 Oxi9 is not responsible for the data practices of third-party service providers. We encourage you to review the privacy policies of any third-party service you interact with through our platform.

16.3 We share your data with third parties only to the extent necessary to provide our services and never sell your personal information to third parties for commercial purposes.

17. PURPOSE OF DATA COLLECTION

We collect and process your personal information for the following purposes:

17.1 Account Management: To create, maintain, and secure your Oxi9 account.

17.2 Order Processing: To process your purchases, manage payment, arrange delivery, and handle returns and refunds.

17.3 Appointment Booking: To schedule, confirm, reschedule, or cancel appointments with beauty professionals and salons.

17.4 Customer Support: To respond to your queries, complaints, and feedback.

17.5 Personalization: To personalise your experience, including product recommendations, offers, and content relevant to your preferences and history.

17.6 Loyalty Programs: To manage loyalty points, rewards, and customer benefits.

17.7 Marketing Communications: To send you promotional offers, newsletters, and updates (with your consent).

17.8 Platform Improvement: To analyse usage patterns and improve our website, mobile apps, and service offerings.

17.9 Legal Compliance: To comply with applicable Indian laws, regulations, and government orders.

17.10 Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities.

18. DATA SHARING

18.1 Oxi9 does not sell your personal information to third parties.

18.2 We may share your personal information with:

a) Service Providers: Third-party vendors who assist us in delivering our services (e.g., payment processors, logistics partners, cloud hosting, analytics providers). These vendors are bound by contractual obligations to protect your data.

b) Beauty Service Providers: When you book a service through our platform, relevant booking details (name, appointment time, contact number) are shared with the Service Provider to facilitate the appointment.

c) Legal Authorities: Where required by applicable law, court order, or government authority.

d) Business Transfers: In the event of a merger, acquisition, restructuring, or sale of business assets, your information may be transferred to the acquiring entity, with appropriate notice provided to you.

18.3 Where we share your data with third-party processors, we require them to process your data only as instructed by us and in accordance with applicable data protection laws.

19. DATA RETENTION

19.1 We retain your personal information for as long as your account is active, or as required to fulfil the purposes described in this Privacy Policy, or as required by applicable Indian law.

19.2 Specific retention guidelines:

- Account data: Retained for the duration of account activity and up to 3 years after account deletion, where required for legal or compliance purposes.

- Transaction records: Retained for a minimum of 7 years in accordance with applicable Indian tax and accounting laws.

- Marketing data: Retained until you unsubscribe or withdraw consent.

- Analytics and log data: Typically retained for 12-24 months.

19.3 When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention policy.

20. SECURITY MEASURES

20.1 Oxi9 implements technical, physical, and organisational security measures to protect your personal information against unauthorised access, loss, alteration, or disclosure.

20.2 Security measures we employ include:

a) Technical Measures: SSL/TLS encryption for data transmission, encrypted storage of passwords and sensitive data, firewalls, intrusion detection systems, and regular security audits.

b) Physical Measures: Restricted access to data centres and server infrastructure.

c) Organisational Controls: Access control policies, employee confidentiality agreements, role-based data access, and regular privacy and security training.

d) Payment Security: PCI-DSS compliant payment processing via certified third-party payment gateways.

20.3 While we take reasonable precautions, no system is completely secure. In the event of a data breach that is likely to affect your rights, we will notify you in accordance with applicable Indian law.

20.4 You are responsible for maintaining the confidentiality of your Oxi9 account password. Please use a strong, unique password and do not share it with anyone.

21. USER RIGHTS

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights in relation to your personal data:

21.1 Right to Access: You may request a summary of the personal data we hold about you and how it is being processed.

21.2 Right to Correction: You may request correction of inaccurate or incomplete personal data in your account.

21.3 Right to Erasure: You may request deletion of your personal data, subject to applicable legal obligations and legitimate business requirements.

21.4 Right to Grievance Redressal: You have the right to raise a complaint with our Grievance Officer regarding the processing of your personal data.

21.5 Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

21.6 Right to Nominate: In accordance with the DPDP Act, 2023, you may nominate an individual to exercise your data rights in the event of your death or incapacity.

To exercise any of these rights, please contact us at care@oxi9.in. We will respond to your request within 30 days.

22. DELETE ACCOUNT

22.1 You may request permanent deletion of your Oxi9 account and associated personal data at any time through the following methods:

- In-app: Go to Profile > Account Settings > Delete Account

- By email: Send a deletion request to care@oxi9.in with the subject line "Account Deletion Request"

22.2 Upon receiving your deletion request, we will:

- Deactivate your account within 7 business days

- Permanently delete your personal data within 30 days, except where retention is required by law

22.3 Please note that account deletion is irreversible. The following data may be retained even after account deletion:

- Transaction records and invoices (as required by Indian tax laws)

- Information necessary to resolve ongoing disputes or legal matters

- Anonymised analytics data that cannot be linked back to you

22.4 Any loyalty points, rewards, or unused credits in your account at the time of deletion will be forfeited and cannot be recovered.

23. MARKETING COMMUNICATION

23.1 With your consent, Oxi9 may send you promotional communications via:

- Email newsletters and offers

- SMS messages

- Push notifications

- WhatsApp messages

23.2 You may opt out of marketing communications at any time by:

a) Clicking the "Unsubscribe" link in any marketing email

b) Replying "STOP" to any marketing SMS

c) Updating notification preferences in the Oxi9 app (Profile > Notification Preferences)

d) Contacting us at care@oxi9.in

23.3 Please note that opting out of marketing communications will not affect transactional notifications related to your orders, appointments, or account security.

23.4 Please allow up to 7 business days for your opt-out request to take effect across all communication channels.

24. CHILDREN'S PRIVACY

24.1 Our platform is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13 years of age.

24.2 If you are between 13 and 17 years of age, you may use our platform only with the express consent and supervision of a parent or legal guardian.

24.3 If we become aware that we have inadvertently collected personal information from a child under 13, we will promptly delete such information from our systems. If you believe your child has provided personal information without your consent, please contact us at care@oxi9.in.

25. INTERNATIONAL DATA TRANSFERS

25.1 Oxi9 Essentials Private Limited is incorporated in India, and we primarily store and process your data within India.

25.2 Some of our third-party service providers (such as Google Firebase, Razorpay, and Meta) may process data on servers located outside India. In such cases, we take reasonable steps to ensure that your data is protected in accordance with applicable Indian data protection laws.

25.3 By using our platform, you acknowledge and consent to the transfer of your personal information to servers located outside India, where necessary for the provision of our services, subject to appropriate safeguards.

26. CHANGES TO THIS PRIVACY POLICY

26.1 Oxi9 reserves the right to update, modify, or revise this Privacy Policy at any time.

26.2 When we make material changes to this Privacy Policy, we will:

- Post the updated Privacy Policy on https://oxi9.in

- Update the "Last Updated" date at the top of this document

- Notify registered users via email or in-app notification where required

26.3 Your continued use of our platform after the revised Privacy Policy has been posted constitutes your acceptance of the changes.

26.4 If you do not agree with the revised Privacy Policy, you should discontinue using our platform and may request account deletion as described in Section 22.

27. CONTACT INFORMATION

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

Company Name: Oxi9 Essentials Private Limited

Website: https://oxi9.in

Email: care@oxi9.in

Phone: +91-7490009496

Customer Care Hours: Monday to Saturday, 9:00 AM to 6:00 PM (IST)

Grievance Officer:

In accordance with the Information Technology Act, 2000, the IT (SPDI) Rules, 2011, and the Digital Personal Data Protection Act, 2023, any privacy-related grievances may be addressed to our designated Grievance Officer at care@oxi9.in. We will acknowledge your grievance within 72 hours and endeavour to resolve it within 30 days.

If your concern is not resolved to your satisfaction, you may also approach the Data Protection Board of India (once established under the DPDP Act, 2023) for further redressal.

(c) 2026 Oxi9 Essentials Private Limited. All rights reserved.

https://oxi9.in