Privacy Policy

Doloyal is a SaaS platform that helps local businesses manage customer relationships, bookings, loyalty, rewards, memberships, marketing, customer retention, reviews, workflows, analytics, AI-powered insights, and related business operations.

Doloyal may process information relating to two primary groups:

• Business Users — businesses, business owners, employees, staff, administrators, and other authorised users who use Doloyal.
• Customers — individuals who interact with a business through a Doloyal-powered Client Page or other customer-facing functionality.

For customer information provided by a business, the relevant business may determine the purposes for which that information is collected and used. Depending on the applicable law and circumstances, that business may act as the controller/data fiduciary and Doloyal may act as a processor/service provider. Under the GDPR, these roles depend on who determines the purposes and means of processing.

We collect information you provide directly, information generated through your use of the Services, and information received from connected services.

Account Information

When you create or manage an account, we may collect:

• Name
• Email address
• Phone number
• Password or authentication credentials
• Profile information
• Account preferences
• Login and account activity

Where available, you may also sign in using third-party authentication services such as Google.

Business Information

Business Users may provide:

• Business name
• Business category
• Business address
• Business phone number
• Business email
• Website
• Business hours
• Business description
• Business logo and branding assets
• Social links
• Services and products
• Prices
• Loyalty programs
• Rewards
• Membership plans
• Referral settings
• Booking settings
• Marketing preferences
• Business policies
• Registration or tax information where applicable

Customer Information

A business may use Doloyal to manage customer information such as:

• Name
• Email
• Phone number
• Customer profile
• Booking history
• Purchase/order information
• Loyalty points
• Rewards
• Memberships
• Referrals
• Reviews and ratings
• Campaign activity
• Communication history
• Customer preferences
• Customer status
• Other information voluntarily entered by the business or customer

Booking, Order, and Transaction Information

Depending on the features used, Doloyal may process:

• Appointments
• Booking dates and times
• Services booked
• Staff information
• Booking status
• Orders
• Invoices
• Membership purchases
• Reward redemptions
• Transaction-related records

Payment information may be processed by third-party payment providers, such as Stripe or Razorpay, rather than being stored directly by Doloyal. Their own terms and privacy policies apply to their processing.

Reviews and Feedback

If you submit a review, rating, feedback, or similar content through a Doloyal-powered Client Page, we may collect:

• Name
• Rating
• Review text
• Date and time
• Business associated with the review
• Related customer/account information

Where a business connects supported review platforms, information may also be received from those third-party services.

Communications

We may process information relating to:

• Email communications
• SMS
• WhatsApp communications
• Notifications
• Marketing campaigns
• Automated messages
• Support requests
• Customer reviews
• Other communications sent through the Services

Technical and Usage Information

We may automatically collect information such as:

• IP address
• Browser type
• Device type
• Operating system
• Session information
• Login timestamps
• Pages and features accessed
• Application events
• Error logs
• Performance information
• Referrer information
• Security and diagnostic information

You or a Business User may connect Doloyal to third-party services.

Depending on the integration and permissions granted, Doloyal may receive information from services such as:

• Google
• Google Business Profile
• Google Calendar
• Stripe
• Razorpay
• Resend
• Meta / WhatsApp
• Other supported integrations

The information we receive depends on the permissions granted and the functionality enabled.

Third-party services may independently process information according to their own privacy policies.

We use information to operate, provide, maintain, secure, and improve the Services.

This may include:

Providing the Services

To:

• Create and manage accounts
• Manage businesses and customers
• Provide CRM functionality
• Provide bookings and appointments
• Manage loyalty and rewards
• Manage memberships and referrals
• Provide Client Pages
• Provide reviews functionality
• Run campaigns and workflows
• Provide analytics
• Provide customer-retention tools
• Process integrations
• Provide support

Personalization

To personalise dashboards, Client Pages, recommendations, workflows, campaigns, and other features based on available information.

AI-Powered Features

Doloyal may process information to provide:

• Business insights
• Customer-retention insights
• Customer segmentation
• Recommendations
• Campaign suggestions
• Automated workflows
• Summaries
• Other AI-generated outputs

AI-generated outputs may contain errors and should be reviewed before important decisions are made.

Security

To:

• Detect and prevent fraud
• Protect accounts
• Detect suspicious activity
• Prevent abuse
• Investigate security incidents
• Enforce our policies
• Protect our Services and users

Communications

To send:

• Account-related communications
• Security alerts
• Booking and service notifications
• Support communications
• Product updates
• Marketing communications where permitted by law and applicable preferences/consent requirements

Legal Compliance

To comply with applicable laws and lawful requests, protect our rights, resolve disputes, and establish or defend legal claims.

Where applicable, we may process personal information based on:

• Performance of a contract
• Compliance with legal obligations
• Legitimate interests
• Consent
• Other lawful grounds permitted under applicable law

Where consent is required, we will seek it in an appropriate manner and provide mechanisms to withdraw consent where required.

Doloyal provides businesses with tools to manage their own customer information.

A Business User may determine:

• What information is collected
• How it is used
• Who receives it
• How long it is retained
• Which customer communications are sent

Where Doloyal processes such information on behalf of a business, the business may remain responsible for its own privacy obligations toward its customers.

Customers with questions about their information held by a particular business should generally contact that business first.

Where appropriate, Doloyal may assist the business in responding to a privacy request.

We do not sell personal information as a standalone commercial product.

We may share information with:

Service Providers

Third-party providers that help us operate the Services, including providers for:

• Hosting and cloud infrastructure
• Databases
• Authentication
• Payments
• Email
• SMS
• WhatsApp
• Analytics
• AI functionality
• Security
• Monitoring
• Customer support

Businesses

When you interact with a business using Doloyal, information you provide may be made available to that business as necessary to provide the relevant services.

Third-Party Integrations

Information may be exchanged with connected third-party services according to the permissions and functionality enabled by the user or business.

Legal and Safety Purposes

We may disclose information where reasonably necessary to:

• Comply with law
• Respond to lawful requests
• Prevent fraud or abuse
• Protect users
• Protect Doloyal and its property
• Investigate security incidents

Business Transfers

Information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable law.

Doloyal may use cookies, local storage, pixels, SDKs, and similar technologies for purposes including:

• Authentication
• Session management
• Security
• Remembering preferences
• Product functionality
• Analytics
• Performance monitoring
• Improving the Services

Where required by law, we will provide appropriate consent or preference mechanisms for non-essential technologies.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• Provide the Services
• Maintain accounts and records
• Meet legal obligations
• Resolve disputes
• Prevent fraud and abuse
• Maintain security
• Enforce agreements

Retention periods may vary depending on the type of information and applicable legal requirements.

When information is no longer required, we may delete, anonymise, or securely dispose of it, subject to lawful retention requirements.

This follows the general principle of retaining personal data no longer than necessary for its purpose.

We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

Depending on the system, safeguards may include:

• Encryption in transit
• Access controls
• Authentication mechanisms
• Role-based access
• Business/tenant isolation
• Secure credential handling
• Logging and monitoring
• Backups and recovery procedures
• Infrastructure protections

However, no internet-based service can be guaranteed to be completely secure.

Doloyal is designed as a multi-business SaaS platform.

Business and customer information is intended to remain associated with the appropriate business account.

A customer using one business's Client Page should not be given access to another business's customer information unless properly authorised.

We use technical and access-control measures designed to prevent unauthorised cross-business access.

Doloyal and its service providers may process or store information in countries outside the country where you live.

Where applicable law requires safeguards for international transfers, we will use appropriate measures required by that law.

Depending on your jurisdiction, you may have rights relating to your personal information, including:

• Access
• Correction
• Deletion
• Restriction of processing
• Objection to certain processing
• Data portability
• Withdrawal of consent where applicable
• Information about how your data is processed
• Rights relating to certain automated decision-making or profiling

The exact rights available to you depend on the law applicable to your circumstances. GDPR, for example, provides rights including access, rectification, erasure, restriction, portability, objection, and certain rights regarding automated decision-making.

To submit a privacy request, contact:

Privacy: hello@doloyal.com

You may request access, correction, deletion, or other privacy assistance.

We may request reasonable information to verify your identity before fulfilling certain requests.

Where the information is controlled by a Business User, we may direct you to the relevant business where appropriate.

You may request deletion of personal information by contacting:

hello@doloyal.com

Depending on the applicable circumstances, deletion may include:

• Deleting an account
• Removing profile information
• Removing personal information from active systems
• Anonymising information where appropriate

Certain information may need to be retained for legal, security, fraud-prevention, accounting, dispute-resolution, or other lawful purposes.

For detailed instructions, see our Data Deletion Policy.

Where permitted, Doloyal or a Business User may send communications through email, SMS, WhatsApp, or other supported channels.

You may opt out of promotional communications using the unsubscribe mechanism provided.

Transactional, security, account, booking, and service-related communications may continue where reasonably necessary.

Businesses using Doloyal are responsible for ensuring that marketing communications sent to their customers comply with applicable laws and consent requirements.

Doloyal may contain links to third-party services or websites.

We do not control and are not responsible for the privacy practices of third parties that operate independently from Doloyal.

Your use of those services may be governed by their own privacy policies and terms.

When you connect Google, Google Business Profile, Google Calendar, or another supported service, Doloyal may access information according to the permissions you grant.

You may disconnect supported integrations through Doloyal where that functionality is available.

Disconnecting an integration may prevent future synchronisation but may not automatically remove information that was previously imported or stored.

Doloyal uses AI and automation for certain features, including business insights, customer-retention analysis, campaign recommendations, workflow suggestions, summaries, and other functionality.

AI outputs are generated based on available information and may not always be accurate or complete.

Business Users remain responsible for reviewing AI-generated outputs before taking important business actions.

Doloyal AI is not intended to provide legal, financial, medical, or other regulated professional advice.

The Services are intended for businesses and their customers and are not directed toward children.

We do not knowingly seek to collect personal information from children where prohibited by applicable law.

If you believe that a child has provided personal information to Doloyal inappropriately, contact:

hello@doloyal.com

Users may submit information such as:

• Reviews
• Ratings
• Images
• Logos
• Business descriptions
• Service information
• Messages
• Marketing content

You are responsible for ensuring that you have the necessary rights and permissions to submit such content.

We may restrict, suspend, or terminate access where reasonably necessary to:

• Prevent abuse
• Address security issues
• Prevent fraud
• Protect users
• Comply with law
• Enforce our Terms

Information may be retained where necessary for security, legal, or compliance purposes.

We may update this Privacy Policy from time to time to reflect:

• New features
• Changes to our Services
• Changes to our data practices
• Legal or regulatory requirements
• Security improvements

Where required, we may notify users of material changes through the Services, website, or email.

The latest version will always show the current Last Updated date.

For questions, requests, or concerns regarding this Privacy Policy or your personal information:

Doloyal

Website: https://doloyal.com

Privacy: hello@doloyal.com

Support: hello@doloyal.com

Legal Notice

This Privacy Policy is intended to describe Doloyal's privacy practices in a clear and transparent manner. It is not a substitute for legal advice. Doloyal should review this policy against its actual technical architecture, contracts, subprocessors, data retention practices, and applicable laws before publication.

For India, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are relevant to the handling of digital personal data, with the Rules providing the detailed framework and phased commencement provisions.