Who we are
Virtue Tailor India Private Limited ("VirtueTailor", "we") runs the VirtueTailor apps and website, used by tailors, boutiques and other stitching businesses to run orders, customers, billing and their team, and by people who find tailors and boutiques on VirtueTailor Discover.
For the accounts of business owners, their staff and Discover users, VirtueTailor is the Data Fiduciary. For the records a business keeps about its own customers (names, phone numbers, measurements, orders, bills), the business is the Data Fiduciary and VirtueTailor processes that data only on the business's instructions, as its Data Processor.
What we collect
- Account details: name, mobile number, email (optional), role in the business, profile photo (optional) and a password, which we store only as a one-way hash.
- Business details: name, address, GSTIN, location on the map, photos.
- Staff records a business keeps: date of joining, date of birth, employment type, salary, leave, attendance, and the phone's location at check-in and check-out (only at that moment, never tracked in the background).
- Customer records a business keeps: name, phone numbers, measurements, design choices, photos and voice notes for a garment, orders, bills and payments.
- Payment details: payments are taken by Razorpay. We receive a payment reference and amount; we never see or store card, UPI PIN or bank login details.
- Technical data: sign-in sessions, device type, IP address and an audit log of important actions, kept to secure the service and investigate misuse.
This section applies only if a business chooses to connect its Instagram professional account to VirtueTailor. Connecting is optional, and it is done by signing in with Facebook (Facebook Login for Business) and choosing the Instagram account, which must be linked to the business's Facebook Page, or with an access token the business gives us.
- What we receive from Meta: the Facebook ID of the person who signed in, which Facebook Page the Instagram account is linked to, and the Instagram account's ID, username, name, profile picture link, follower count and post count; for recent posts, the caption, format, date, link, picture link, and like and comment counts; and totals for the account and its posts, such as reach, views, interactions, saves, shares and profile link taps.
- What we keep: those details and the daily totals, and the access token, which is encrypted at rest. We never receive the Facebook or Instagram password.
- Posting: the owner or a manager of the business can post photos to its Instagram from VirtueTailor. We post only what they choose, when they press post; nothing is ever posted on our own. The photos are prepared on our server, offered to Meta at a private link that stops working within an hour, and deleted as soon as Instagram has answered. We keep the caption, the number of photos, who posted it and when, and the link to the post.
- What we do not do: we do not read or send direct messages, read the text of comments, or see which individual people viewed or liked a post.
- Why: only to show the business how its account is doing, and to post what it asks us to. We read it about once a day, and when the business asks. We do not sell this data, use it for advertising, or use it to train AI models.
- Who can see it: the owner and managers of that business, and VirtueTailor staff who support the service. Meta receives our requests for this data, as its own terms and privacy policy describe.
- How to remove it: the owner can press Disconnect on the Instagram page, remove VirtueTailor under Business integrations in Facebook's settings, or write to the Grievance Officer. The token and everything kept from Instagram are then deleted straight away from the live system, and from backups within 30 days. It is also erased if the business's account is closed, as described under How long we keep it.
Why we use it
- To provide the service you or your business signed up for: orders, the workroom board, billing, inventory, team and attendance.
- To send messages you ask for (for example a bill or an order update on WhatsApp).
- To bill businesses for their VirtueTailor plan and keep GST records.
- To keep the service secure, prevent fraud and meet our legal obligations.
We do not sell personal data, and we do not use a business's customer records for our own marketing.
Consent and legitimate uses
We rely on your consent, given when you create an account or accept this policy, and on the legitimate uses the DPDP Act allows, such as employment purposes for staff records and complying with law (for example GST record keeping).
You can withdraw consent at any time from the app (Me → Privacy & data) or by writing to the Grievance Officer. Withdrawing is as easy as giving it. It does not affect processing already done, and some records must still be kept where the law requires.
Children
Accounts are for adults only. Where a business records a customer under 18 (for example a child's garment), the business records the parent or guardian who consented. We do not track children or show them targeted advertising.
How long we keep it
- Account and business data: while the account is active, and up to 90 days after it is closed, then erased.
- Bills, invoices and payment records: 8 years, as required by GST law.
- Security and audit logs: at least 1 year, as required by the DPDP Rules.
- A customer's personal details are erased (or made anonymous) when the business or the customer asks, except what the law requires us to keep.
Sharing
We share personal data only with service providers who help us run VirtueTailor, under contract and only for that purpose: cloud hosting in India, Razorpay for payments, messaging providers when you send a message, and Meta when a business connects its Instagram. We disclose data to authorities only where the law requires.
Security
Data is encrypted in transit; passwords are hashed; payment keys, Instagram access tokens and issued passwords are encrypted at rest. Access inside a business follows the roles and permissions the owner sets, and important actions are logged.
If a personal data breach happens, we will inform the Data Protection Board of India and each affected person without delay, as the DPDP Act and Rules require.
Your rights
- Access: get a summary of your personal data and how it is used.
- Correction and erasure: correct, complete, update or erase your data.
- Grievance: complain to us, and if not satisfied, to the Data Protection Board of India.
- Nomination: name someone to exercise these rights if you die or cannot.
Use Me → Privacy & data in the app, or the request form on our website. We reply within 30 days at the latest (the law allows up to 90).
If you are a business's customer, you can ask the business directly or write to us; we will pass it to the business and help it respond.
Grievance Officer
Grievance Officer: Grievance Officer, VirtueTailor · Phone: +91 80191 21412 · Email: connect@virtutailor.in · Address: Plot No. 176, Laxmi Nilayam, Sri Puram Colony, Chengicherla, Near Nava Durga Real Estate & Constructions, Hyderabad, Telangana 500051 · We acknowledge complaints within 48 hours and resolve them within 30 days.
Changes
When we change this policy we raise its version and ask you to read and accept it again in the app. The version you accepted, and when, stays on record.