Privacy Policy

Trixel Pro is operated by Chharito Sewa PVT LTD, a multi-tenant SaaS that helps cosmetics dealers and salons manage daily sales, stock, credit, staff incentives, attendance, field visits, and customer history. This policy explains what we collect, why, how we protect it, and the rights you have over your data.

• Account data: name, email, phone, role, and authentication metadata.
• Business data: dealer/salon profile, products, prices, stock, sales, payments, expenses, targets, gifts/samples.
• Customer data (salon): customer name, phone, email, visit history, loyalty points, billing address, and outstanding credit.
• Staff data: attendance, GPS check-in/check-out, field visit logs, cash collection sheets, and daily sales reports.
• Uploaded files: payment proofs, receipts, invoices, and profile images, stored in a private encrypted bucket.
• Device & diagnostics: minimal logs needed to operate the service, error traces, and device type for support. No third-party advertising trackers.

We process data under the following lawful bases:

• Contract: to provide the Trixel Pro service you signed up for.
• Legitimate interest: fraud prevention, security, product improvement, and support.
• Legal obligation: tax, accounting, and regulatory record keeping.
• Consent: optional marketing or non-essential features (you can withdraw anytime).

Every record belongs to a single tenant — either a dealer or a salon. The database enforces this with row-level security (RLS) policies. Users can only read or write rows in their own tenant. Cross-tenant access is rejected at the database layer, not just in the application code.

Role-based access control (RBAC) further limits what each staff member can do inside a tenant (e.g., only accountants can approve collections, only dispatch staff can update delivery status).

• To run the features you use (sales, ledger, stock, gifts/samples, reports, attendance, field tracking).
• To authenticate you and protect your account (including password breach checks via Have I Been Pwned).
• To provide aggregated dashboards and profit/loss reports inside your own tenant.
• To send transactional notifications you trigger (e.g. invoices, low-stock alerts, payment reminders).
• To comply with tax, accounting, and legal obligations.

We do not sell your data, and we do not use it to train AI models.

• Lovable Cloud (Supabase) — managed Postgres database, authentication, and file storage.
• Google — optional social sign-in (we receive your email and profile name only).
• Cloudflare — DNS, CDN, DDoS protection, and TLS termination for custom domains.

We keep your business records for as long as your tenant is active. If your tenant is cancelled, transactional records may be retained for up to 12 months to comply with local tax and accounting rules, after which they are deleted or anonymised.

Audit logs and security event logs are retained for 90 days to support incident response and compliance.

• All traffic is encrypted in transit (HTTPS/TLS 1.2+).
• Data is encrypted at rest by our cloud provider.
• Passwords are hashed (bcrypt-equivalent), never stored in plaintext.
• Privileged actions (payment recording, stock writes, gifts, role changes) require role checks server-side.
• Stock changes and credit limits are enforced atomically at the database level to prevent oversell.
• Regular dependency scans and security patches are applied to the platform.

You may at any time:

• Access and export your tenant's data (CSV/PDF).
• Correct inaccurate records inside the app.
• Request deletion of your account and associated personal data.
• Withdraw consent for optional features.
• Object to certain processing based on legitimate interest.
• Request a copy of your data in a machine-readable format.

To exercise any right, contact us at info.xaritoo@gmail.com.

Trixel Pro uses essential cookies and local storage for authentication, session persistence, and UI preferences — these cannot be switched off without breaking sign-in. Optional analytics and marketing cookies are off until you opt in, and you can change your choice at any time.

The service is intended for businesses and is not directed at children under 16. We do not knowingly collect data from children.

If you discover a security vulnerability, please report it responsibly to info.xaritoo@gmail.com. Do not publicly disclose the issue before we have had a reasonable time to investigate and fix it.

We may update this policy as laws or our service evolves. Material changes will be announced in-app and the "Last updated" date will be revised. Continued use after changes means you accept the updated policy.

For privacy questions, data requests, account deletion, or vulnerability reports, contact: