Privacy Policy

Introduction

Aro ("we", "our", "us") is committed to protecting your personal information. This policy explains how we collect, use, store and share your data when you use the Aro Customer App or Studio Portal.

Information We Collect

We may collect:

• Personal details such as name, email, phone number.
• Booking history and payment confirmations.
• Studio profile information for Studio Portal users.
• Device and usage data for analytics and security.
• Device tokens for push notifications (which can be removed upon account deletion).

How We Use Your Information

We use your information to:

• Create and manage user accounts.
• Facilitate bookings and payments.
• Display bookings and class histories.
• Help Studios manage attendance, bookings, and customer engagement.
• Send essential notifications (booking reminders, schedule changes).
• Improve our platform and services.
• Delete user accounts and associated data upon request.

How We Share Information

We may share necessary information with:

• Studios you choose to engage with.
• Payment processors such as PayHere for secure transactions.
• Service providers who support hosting, analytics or communication.
• Device token providers (FCM/APNs) for delivering push notifications — these are removed when you delete your account.

We never sell your personal information.

Payment Information

All card and payment data is processed securely by PayHere according to PCI-DSS standards. Aro does not store or access your card details.

Data Retention

• We store your information only as long as required for service delivery or legal compliance.
• Your information may be stored or processed using secure cloud infrastructure and service providers located inside or outside Sri Lanka, in compliance with applicable data protection standards.
• When you delete your account, your personal information is anonymised and your device tokens and active sessions are revoked immediately. Anonymised records may be retained for legal or audit compliance.

Security

• We use industry-standard technical and organisational measures to protect your data.
• The Aro platform is intended for users aged 18 and above. Users under 18 may only use the platform with parental or guardian consent.

Your Rights

You may request access, correction or deletion of your personal information by contacting info@itsaro.com. You can also delete your account directly through the Aro Customer App settings, which will immediately anonymise your personal data, revoke all active sessions, and remove your device from push notification lists.

Updates to This Policy

We may update this Privacy Policy periodically. Continued use of the platform indicates acceptance of the updated policy.