Skip to main content
Hypershots AI

Privacy Policy

Last updated: 23 October 2026

In short: we hold your shop's details, the photos you send us and the customer records you ask us to digitise. We use them to make and publish your marketing, and for nothing else. We never sell personal data. Your customers' phone numbers are stored encrypted and are never sent to an AI model. You can ask us to delete everything at any time.

1. Who we are

Hypershots provides Hypershots Jewellery AI, a marketing service for jewellery shops that is operated through WhatsApp. In this notice “we” and “us” mean Hypershots, and “you” means the jewellery shop and the people who use the service on its behalf.

2. Who is responsible for which data

This matters, so it is worth being precise about it.

  • Your shop's own data — your business details, your login, your photos, your billing records. We decide how this is handled in order to give you the service, so we are the data fiduciary for it and this notice describes what we do.
  • Your customers' data — the names, phone numbers, purchases and dates from your register and your enquiries. Your shop is the data fiduciary for this. We are a data processor acting on your instructions, under a written agreement with you. We do not use your customer data for our own purposes, and we never share it with another shop.

3. What we collect

From you, the shop owner

  • Your name, your shop's name and address, your WhatsApp number, your email address and, where you give it, your GSTIN.
  • Everything you send us in the chat: photos and videos of your jewellery, voice notes, documents, your logo, your brand colours and the tone you want.
  • The settings you choose, including which actions you have allowed to run without an approval tap.
  • Payment records: the plan you bought, the amount, the date and the invoice. Your card, UPI or netbanking details go directly to Razorpay and never reach us.

About your customers, when you ask us to hold it

  • Names, phone numbers, and the purchase, scheme or exchange entries you ask us to digitise from your register.
  • Birthdays and anniversaries, where you record them, so we can prepare the campaigns you approve.
  • Whether each customer has consented to receive marketing messages, when that consent was recorded and when it was withdrawn.
  • The content of enquiries customers send to your shop, once the Enquiry Desk module is available to you.

From the platforms you connect

  • Your Facebook Page and Instagram professional account identifiers, and the access tokens that let us publish on your behalf. Tokens are stored encrypted and are never written to our logs.
  • Performance figures for your posts and your page — reach, views, engagement, follower counts — and, if you run ads, campaign spend and results.
  • Your Google Business Profile data, only if you enable that module.

Automatically

Ordinary server logs for this website and the service: the pages requested, timestamps, and technical information such as browser type. We deliberately do not put phone numbers or access tokens in logs, in URLs or in analytics.

4. Why we use it, and on what basis

  • To provide what you paid for — making creatives, writing captions, publishing posts, producing reports and taking payment. This is necessary to perform our contract with you.
  • To send marketing messages to your customers — only to customers who have given consent, only for campaigns you have approved, and with an opt-out in every message. Consent is the basis, and it can be withdrawn at any time.
  • To keep the service working safely — preventing abuse, debugging failures, and keeping records of what each agent did on your account.
  • To meet legal duties — tax, accounting and record-keeping obligations under Indian law.

We do not sell personal data, and we do not use your photos or your customer data to train AI models.

5. How AI models are used

Captions, campaign plans and replies are drafted by AI models. Two rules apply to every one of those calls:

  • Phone numbers and email addresses are removed from the text before it leaves our systems, so a customer's number is never sent to a model provider.
  • Creatives for a piece you are selling keep the real piece from your photo; only the background and the lighting are changed. Where we create a design that does not exist yet, the image is labelled as a concept created using AI.

6. Who we share data with

We share only what each provider needs to do its job, and only with the providers below. We do not sell or rent personal data to anyone.

Meta Platforms
WhatsApp Business messaging, publishing to Instagram and Facebook, reading post and page insights, and running advertising campaigns on your own ad account.
Razorpay
Taking plan payments and issuing receipts. Razorpay handles your card, UPI and netbanking details directly; we never see or store them.
Supabase
The database and file storage holding your shop profile, photos, creatives and customer records.
Vercel
Hosting this website and the application that runs the service.
Trigger.dev
Running the background jobs that generate creatives, publish posts and send reports.
OpenRouter and Anthropic
The AI models that write captions, plan campaigns and interpret your messages. Phone numbers and email addresses are stripped out before anything is sent to a model.
fal.ai
Generating and editing images and video from the photos you send us.
Google
Google Business Profile posts, reviews and performance data. Only if you turn this module on, and only once Google approves our access.

We will also disclose data where the law requires it, or to establish or defend a legal claim.

7. Where your data is held

Some of the providers above process data on servers outside India. Where that happens, we rely on the provider's contractual data protection terms, and we keep the amount of personal data that leaves our own database to a minimum — which is why phone numbers and email addresses are stripped before any AI call.

8. How we protect it

  • Customer phone numbers are stored encrypted. The encryption key is held separately from the database.
  • Every shop's data is isolated at the database level, so one shop's queries cannot reach another shop's rows.
  • Platform access tokens are encrypted, held by reference and never written to logs.
  • Phone numbers and tokens never appear in URLs, logs or analytics.
  • Access to production data is limited to the people who need it to operate the service.

No system is perfectly secure. If a breach affects your data we will tell you and the Data Protection Board as the law requires.

9. How long we keep it

  • Your shop profile, photos, creatives and customer records: while your account is active, and until you ask us to delete them.
  • Platform access tokens: until you disconnect the platform or close your account, whichever is first.
  • Invoices and payment records: for as long as Indian tax and accounting law requires us to keep them, even after you close your account.
  • Consent records: for as long as we hold the customer data they relate to, because they are the evidence that a message was allowed.

10. Your rights

Under India's Digital Personal Data Protection Act you can:

  • ask what personal data we hold about you and how we use it;
  • ask us to correct or complete anything that is wrong;
  • ask us to erase it, where we are not required to keep it;
  • withdraw a consent you gave, as easily as you gave it;
  • nominate someone to exercise these rights if you cannot; and
  • complain to us, and then to the Data Protection Board of India.

To exercise any of these, message us on WhatsApp or email us. We will acknowledge within 72 hours and respond within 30 days. To delete everything, follow the Data Deletion Instructions.

If you are a customer of a jewellery shop that uses our service and you want your details removed, you can contact us directly and we will act on it, and we will also tell the shop, because the data is theirs.

11. Grievance officer

If you are unhappy with how we have handled your data, contact our grievance officer. We will acknowledge your complaint within 72 hours and resolve it within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India.

12. Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect children's personal data. If you believe we have, tell us and we will delete it.

13. Languages

This notice is written in English. If you would rather we explain it in Marathi or Hindi, message us on WhatsApp and we will go through it with you.

14. Changes to this notice

If we change this notice we will update the date at the top, and we will tell you in your WhatsApp chat before any change that materially affects you takes effect.