SHUTTERPHRASE

Privacy Policy

Effective date: 12 January 2025 · Last updated: June 2026

This Privacy Policy explains how ShutterPhrase.in Photography ("ShutterPhrase", "we", "us") collects, uses, stores, and protects your personal information when you visit our website or engage our services. It is issued in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and the Consumer Protection (E-Commerce) Rules 2020.

1. Who We Are

Business name: ShutterPhrase.in Photography
Type: Sole proprietorship · Micro Enterprise (MSME)
Udyam Registration: UDYAM-MH-18-0407099
Address: Mankhurd, Mumbai, Maharashtra – 400094
Email: abhishek@shutterphrase.in
Phone: +91 98671 13855

2. Data We Collect

When you use the Project Brief chatbot on our website, we collect the following information:

Identity data: Full name
Contact data: Email address, phone number
Project data: Service type, media type, client type, project duration, usage scope, complexity, location, add-ons selected
Financial data: Estimated budget range generated by the chatbot
Consent data: Your explicit yes/no response to WhatsApp and SMS communication

We also collect the following automatically when you visit our website:

Analytics data: Page views, session duration, browser type, device type, and approximate geographic region — collected via Google Analytics 4 (GA4). This data is anonymised and aggregated.
Cookie data: See Section 8 below.

We do not collect sensitive personal data as defined under the SPDI Rules 2011 (such as financial account numbers, passwords, health information, or biometric data).

3. Why We Collect It

Your personal data is collected and processed for the following specific purposes only:

To generate an accurate photography quote based on your project brief
To contact you with your quote details and proposal
To communicate about your project (scheduling, scope, deliverables)
To send WhatsApp or SMS updates — only if you explicitly consented during the chatbot flow
To maintain business records for accounting and tax compliance
To comply with applicable Indian law

We do not use your data for advertising, profiling, selling to third parties, or any purpose not listed above.

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the basis of your explicit consent, provided through the chatbot's submission flow. Consent is always specific, informed, and confirmed through a clear affirmative action.

For SMS and WhatsApp communications specifically, consent is collected as a separate, optional step. You may decline without affecting your quote or our ability to email you.

5. Where Your Data Is Stored

Your personal data is stored in Google Sheets, accessed through Google Workspace. Google acts as a data processor on our behalf. Data is stored on Google's servers and is subject to Google's Data Processing Amendment and privacy terms, available at policies.google.com/privacy.

Google Workspace is ISO 27001 certified and SOC 2 compliant. Access to your data is restricted to the business owner (Abhishek Ashok) only. Your data is not shared with any other third party.

Website analytics are processed by Google Analytics 4, also operated by Google. Analytics data is anonymised and does not identify you individually.

6. How Long We Keep Your Data

We retain personal data for the minimum period necessary:

Enquiries that did not convert to a booking: Deleted automatically 2 years after your initial enquiry date.
Completed client engagements: Personal identifiers (name, email, phone) are anonymised 2 years after the date of your last payment. Financial records (amounts, dates, service type) are retained for accounting and tax compliance as required by Indian law, but are no longer linked to your identity.
On-demand deletion: You may request deletion at any time, regardless of how recently you enquired. See Section 9.

This retention policy is enforced automatically on a monthly basis.

7. Cookies

Our website uses the following cookies:

Google Analytics 4 cookies (_ga, _ga_*): Used to measure website traffic and usage patterns. These cookies are set by Google and persist for up to 2 years. Data collected is anonymised.

We do not use advertising cookies, tracking pixels, or cross-site profiling. If you wish to opt out of GA4 analytics, you can install the Google Analytics opt-out browser add-on.

8. SMS and WhatsApp Communications

If you consented to WhatsApp or SMS communications during the chatbot flow, we may contact you via these channels for the following purposes only:

Sending your quote details or proposal link
Project updates directly related to your booking

We will not send promotional or marketing messages via SMS or WhatsApp without a separate, explicit opt-in. You may withdraw your consent at any time by emailing abhishek@shutterphrase.in with the subject line: WITHDRAW SMS CONSENT: youremail@address.com.

9. Your Rights

Under the DPDP Act 2023, you have the following rights in relation to your personal data:

Right to access: Request confirmation of what data we hold about you.
Right to correction: Request that inaccurate or incomplete data be corrected.
Right to erasure: Request deletion of all personal data we hold about you.
Right to withdraw consent: Withdraw consent for processing at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Right to grievance redressal: Lodge a complaint with our Grievance Officer (see Section 11).
Right to approach the Data Protection Board: If your grievance is not resolved, you may file a complaint with the Data Protection Board of India at meity.gov.in.

10. How to Request Data Deletion

Send an email to abhishek@shutterphrase.in with the subject line in the exact format below:

DATA DELETION REQUEST: youremail@address.com

Replace youremail@address.com with the email address you used when submitting your project brief. We will process your request and send a confirmation reply within 7 days. All personally identifiable information associated with your email address will be permanently erased from our records.

11. Security

We implement the following reasonable security measures as required under the IT (SPDI) Rules 2011:

Data is stored within Google Workspace, which maintains ISO 27001 and SOC 2 certifications
Access to the data sheet is restricted to the sole proprietor and protected by Google account two-factor authentication
No personal data is stored on the website itself — all data is transmitted directly to the secured Google Workspace environment
No credit card, bank account, or payment credentials are collected or stored by us at any point

12. Data Breach Notification

In the event of a data breach that is likely to result in harm to your interests, we will notify affected individuals and report the incident to the Indian Computer Emergency Response Team (CERT-In) in accordance with the CERT-In Directions 2022. Notifications will be sent to the email address you provided at the time of enquiry.

13. Grievance Officer

In accordance with the DPDP Act 2023 and the Consumer Protection (E-Commerce) Rules 2020, the designated Grievance Officer for ShutterPhrase is:

Abhishek Ashok
ShutterPhrase.in Photography
Mankhurd, Mumbai, Maharashtra – 400094
Email: abhishek@shutterphrase.in
Phone: +91 98671 13855

Grievances will be acknowledged within 48 hours and resolved within 30 days of receipt.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the website after changes are posted constitutes acceptance of the updated policy.

15. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising in relation to this policy shall be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.