Optocore

Privacy policy

Last updated 16 September 2026

This policy explains what Spectrum Enterprises (“we”, “us”), a sole proprietorship of Mrs. Shaila Bhavsar, registered at Flat No. 1201, J Wing, ParkSyde Homes, Near Bali Mandir, Hanuman Nagar, Panchavati, Nashik, Maharashtra 422003, India, GSTIN 27BDXPB5801K2Z7 collects when you use Optocore, why, and what you can ask us to do about it.

The short version. We hold two kinds of information: yours as our customer, and your shop's records about its own customers. The second kind is yours — we process it only to run the Service for you, and never for our own purposes.

1. Information we collect about you

  • Account: your name, business name, email, phone, GSTIN and business address.
  • Billing: subscription and invoice records. Card details are handled entirely by Razorpay — we never see or store them.
  • Usage: logins, IP address, device and browser, and an audit trail of actions taken in your account, which exists so you can see who did what.
  • Support: what you write to us when you ask for help.

2. Information your shop stores about its customers

You enter records about the people who shop with you — name, phone, address, purchase history and prescriptions. A prescription is health information, and we treat it accordingly: it is encrypted in transit and at rest, access is restricted to the staff logins you create, and it is never used for anything other than showing it back to you.

For that data you are the controller and we are the processor. You are responsible for having a lawful basis to hold it and for telling your customers what you do with it.

3. Why we process it

  • To provide the Service you subscribed to.
  • To take payment and issue GST invoices.
  • To provide support when you ask for it.
  • To keep the Service secure and detect misuse.
  • To meet legal obligations, including retaining tax records.

4. Who else sees it

We share data only with the providers needed to run the Service, and only what each needs:

  • Razorpay — payment processing for your subscription. They receive your billing details, not your shop records. Card, UPI and bank details are entered on Razorpay's own pages and are never seen or stored by us. Razorpay's handling of them is described in its own privacy policy.
  • Meta / WhatsApp — when you send a message, the recipient's number and the message content pass through WhatsApp under Meta's terms.
  • Google and Meta advertising platforms — only if you choose to connect an advertising account. What is shared, and how to disconnect, is set out in section 4A below.
  • Our hosting provider — servers located in India.

We do not sell personal information, and we do not share it for advertising of our own. Advertising you run through the Service is yours, billed to your own account with Google or Meta, and directed by you.

4A. Connected advertising accounts (Google Ads, Meta)

The Service can run adverts for your shop on Google and on Facebook and Instagram. This is optional. Nothing below applies until you press Connect and grant access from your own Google or Facebook login.

What we access. With your permission we read and write only what the advert needs: your advertising account and its campaigns, the daily budget, and performance figures (spend, impressions, clicks, calls, direction requests and conversations started). On Google, if you give us your Business Profile link, we store the location identifier so the advert can point at your Profile. On Meta, we read the Facebook Page, Instagram account and ad account you choose, so the advert is published from them. We do not read your personal profile, friends, posts or messages, and we do not ask for permissions we do not use.

How it is stored. The access token Google or Meta issues is encrypted at rest with a key held separately from the database, is readable only by the part of the Service that talks to that platform, and is never shown on any screen. Each business's token is isolated from every other business's.

What we send back. Every campaign we create starts paused; nothing is spent until you switch it on. If you switch on sales matching, we send Google a hashed (irreversible) form of the phone number or email of customers who bought from you and who have given your shop marketing consent, together with the bill amount and date, so Google can tell you which adverts led to sales. Customers without that consent are never included, and you can switch this off at any time. Meta receives nothing about your customers.

Google API Services. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide and improve the advertising features you see in the Service, never for our own advertising, never to sell, and never transferred to others except as needed to provide those features, for security, or to comply with law.

Meta Platform. Our use of information received from Meta's platform is governed by Meta's Platform Terms and Developer Policies. We use it only to create, manage and report on the adverts you ask for.

Disconnecting and deleting. Press Disconnect on the Ads page and the token is destroyed at once and, where the platform allows, revoked with the platform too. You can also remove the Service yourself from your Google account permissions or from Facebook's Settings → Business integrations; either way, the Service loses access immediately. Full instructions are on our data deletion page. Campaign records we keep after disconnection are the campaign name, budget and status only — no token, and nothing about the people who saw or clicked the advert.

5. Where it is held, and for how long

Data is stored on servers in India. Your shop's records are kept for as long as your account is active. After cancellation they remain exportable for ninety (90) days and are then deleted. Invoices and tax records are retained for eight (8) years as Indian law requires.

6. Security

  • Traffic is encrypted with TLS; backups are encrypted at rest.
  • Each business's data is isolated at the database level, enforced by the database itself rather than by application code alone.
  • Access is by named login with role-based permissions that you control.
  • Every change to a record is written to an audit trail.

No system is perfectly secure. If a breach affects your data we will tell you without undue delay and explain what happened.

7. Your rights

You may ask us to give you a copy of your data, correct it, delete it, or stop processing it. Export is built into the Service and needs no request. For anything else, email hello@optocore.in and we will respond within thirty (30) days.

If a customer of your shop asks you to delete their record, you can do that yourself inside the Service.

To delete data the Service obtained from Google or Meta about your advertising account, follow the steps on our data deletion page; it takes effect at once for the token and within thirty (30) days for anything else.

8. Cookies

We use cookies that are necessary to keep you signed in and to keep the Service secure. We do not use advertising or cross-site tracking cookies.

9. Children

The Service is for businesses and is not directed at children. A shop may hold a prescription for a minor as part of its ordinary records; that data is treated with the same protection as any other prescription.

10. Changes and contact

We will post any update here and notify you by email if the change is material.

Spectrum Enterprises, Flat No. 1201, J Wing, ParkSyde Homes, Near Bali Mandir, Hanuman Nagar, Panchavati, Nashik, Maharashtra 422003, India.
Email hello@optocore.in · Phone +91 99222 27902