This policy explains what information The Seven Steps Studio collects through the Client Portal — our Android app and the website at tssstudioclientportal.in — how we use it, and the choices you have.
The Client Portal is private. It is only for clients who have an existing booking agreement with the studio. There is no public sign-up: your account is created by us when your booking is confirmed.
Who is responsible for your information
01Information we collect
a. Information already held under your booking
When your booking is confirmed, the studio records details from your agreement. The portal shows this information back to you; it does not collect it from your phone. It includes:
- Your agreement number and the client name on the booking
- Event type, dates, venue and package
- Payment status, amounts paid and balance due
- The email address and phone number you gave the studio
- The photographs and video we deliver to you, through Google Drive folders shared by link. These folders are not listed or searchable, but anyone who has the link can open them, so please share the links only with people you trust.
b. Information you enter into the portal
c. Information collected automatically
- Sign-in record. Each time you sign in we record the date and time, how you signed in, and a short description of your device — for example "Samsung Android · Android 14 · Chrome". This is a security record so you and we can spot a sign-in you did not make. We do not record your precise location.
- Activity record. Our system notes which part of the portal was used and when — for example viewing your booking, opening a gallery folder or photograph, or submitting a form — against your agreement number. We use it to keep the portal secure and to help you when you contact us.
- Notification identifier. If you allow notifications, our notification provider issues your device a random subscription ID, which we link to your agreement number so we can send you updates about your booking only. To deliver notifications, the provider also receives basic device details such as device model, operating system, language and time zone.
- Standard web request data. Like any website, our hosting provider and the services listed in section 4 receive your IP address and browser type as part of delivering the page.
02What we do not collect
The Client Portal app does not ask for access to your location, contacts, camera, microphone, call logs or messages. It uses only the standard Android permissions needed to connect to the internet, show notifications and save files you choose to download. We do not:
- Access your location, contacts, call logs, messages, microphone or files — except a photograph you choose to add yourself
- Use an advertising identifier, show ads, or run advertising or analytics trackers
- Sell or rent your information to anyone, ever
- Use your information to build a profile for marketing by third parties
Photographs you add yourself
- Countdown card. A photograph you add is used only on your screen to build the card. It is not saved and never uploaded, and it is gone when you leave the countdown — unless you share or download the finished card yourself.
- Invitations. A photograph you add is uploaded to the studio's server when the invitation is saved or shared, as described in section 1(b), so it can appear on your invitation page.
03How we use your information
- To show you your own booking, payment status, event details and gallery
- To sign you in, and to send a one-time code by email when you sign in for the first time or on a new device
- To plan and deliver your event using the details you submit in the event form
- To receive your photo selections and reply to your messages
- To show your invitation page to the guests you send it to, and pass their replies to you
- To send you notifications about your booking, if you have allowed them
- To apply referral credits and to improve our service using your feedback
- To keep the portal secure and investigate suspicious access
We do not use your information for automated decision-making.
04Services we rely on
We use a small number of providers to run the portal. They process information on our behalf, under their own security commitments.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
05Your invitation guests
If you share an invitation with RSVP, guests who reply give their name and, if they choose, their phone number, whether they will attend, the number of guests and a message. We store these replies with your invitation so you can see them, and the reply also opens WhatsApp to the number you set on the invitation. Guests do not have an account, and invitation pages are not listed by search engines.
To stop automated abuse, we keep a scrambled form of a guest's IP address for a short time. A guest can ask you, or us, to delete their reply. If you share your invitation, please let your guests know that their replies come to you.
06Where your information is held
The studio operates from Kolkata, India. The providers above operate servers outside India, so your information may be stored or processed outside the country. We only use providers that commit to appropriate safeguards for that transfer.
07Notifications
Notifications are optional. In the app, Android 13 and later asks your permission before any notification is sent, and on any Android version you can turn them off in your phone's Settings, under Apps → The Seven Steps Studio → Notifications. On the website, your browser asks first, and you can turn them off in your browser's site settings. Turning them off does not affect anything else in the portal.
08Information stored on your device
The portal saves a small amount of information in your phone's or browser's local storage:
- A sign-in record that keeps you signed in for up to 30 days, if you choose to be remembered
- A random device identifier, so we can tell a familiar device from a new one and ask for a one-time code when it is new
- A short-term copy of your referral details, kept for up to 30 minutes so the page opens quickly
- Your countdown card choices, such as the names and style, and your drafts in the invitation designer
Signing out removes your sign-in record and the referral copy. The device identifier and your design drafts stay, so this device is recognised next time and your work is not lost. Clearing the app's storage in Android Settings, or your browser's data for this site, removes all of it.
09How long we keep your information
- Your signed agreement and payment records are kept permanently as part of the studio's business records, so we can honour reprint orders and meet our accounting and tax obligations.
- Your event form, photo selections, messages, reviews and referrals are kept with your booking until you ask us to delete them (section 11).
- Sign-in and activity records are kept for 24 months.
- Saved invitations and their RSVP replies are kept for 12 months after your event.
- Your online gallery is removed once your final delivery is complete, unless you have chosen a paid storage add-on, in which case it is kept for the period you paid for.
10Keeping your information safe
All traffic between your device and our servers is encrypted in transit using HTTPS; the app does not allow unencrypted connections. Access to our booking records is limited to studio staff who need it. Your account is protected by a password, and by a one-time code sent to your registered email whenever you sign in on a new device. Repeated wrong passwords or codes pause sign-in for that account for 15 minutes.
No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authority as the law requires.
11Your rights, and how to delete your account
Under India's Digital Personal Data Protection Act, 2023, you may ask us to:
- Give you a summary, or a copy, of the information we hold about you and how we use it
- Correct anything that is wrong or out of date, or complete anything that is missing
- Delete your account and your personal information
- Withdraw a consent you previously gave
- Nominate someone to exercise these rights for you if you die or become unable to
Deleting your account and your data
To delete your Client Portal account and the personal information held with it, contact us by either route:
- Email thesevenstepsstudio@gmail.com with the subject "Delete my account"
- Or message us on WhatsApp at +91 92301 97004
Tell us your agreement number so we can identify your record. We will confirm the request with you, and complete it within 30 days.
What is deleted: your portal sign-in, your event form entries, your photo selections and messages, your reviews and referral records, your saved invitations with their photographs, music, video and guests' RSVP replies, your sign-in and activity records, and your notification subscription.
What we may keep: your signed agreement, invoices and payment records, which we are required to retain for accounting and tax purposes, and photographs covered by your booking contract. Tell us if you also want your photographs deleted and we will confirm what your contract allows.
To exercise any other right, write to us at the contact details at the top of this policy. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Grievances
If you have a concern about how we handle your information, contact the studio directly. We will acknowledge it promptly and aim to resolve it within 30 days.
12Children
The Client Portal is intended for adults who hold a booking agreement with the studio. It is not directed at children, and we do not knowingly collect information from anyone under 18.
13Changes to this policy
If we change this policy we will update the date at the top of this page, and tell you through the portal or by email if the change is significant.
14Contact us
Questions about this policy or about your information: thesevenstepsstudio@gmail.com, or WhatsApp +91 92301 97004.