Privacy Policy

Introduction

Aro ("we", "our", "us") is committed to protecting your personal information. This policy explains how we collect, use, store and share your data when you use the Aro Customer App or Studio Portal.

The Aro Customer App is for customers only. Customers can sign in with email and password or with supported single sign-on (SSO) providers such as Google, Apple, and Facebook. The Studio Portal is for studio owners and staff and uses separate sign-in credentials.

Information We Collect

We may collect:

• Personal details such as name, email, phone number.
• Account and sign-in information, including passwords (if you use email sign-in) and identifiers from SSO providers when you choose Google, Apple, or Facebook sign-in on the Customer App.
• Booking history and payment confirmations.
• Studio profile information for Studio Portal users.
• Device and usage data for analytics and security.
• Device tokens for push notifications (which can be removed upon account deletion).

Sign-In with Third-Party Accounts (SSO)

On the Aro Customer App, customers may sign in or create an account using supported SSO providers (such as Google, Apple, or Facebook) instead of email and password.

When you use SSO, we may receive from the provider:

• Your name and email address (where the provider makes them available).
• A unique provider identifier used to authenticate your account and link it securely to Aro.
• Whether the provider has verified your email address, where applicable.

We use this information only to authenticate you, create or link your customer account, and provide app functionality. We do not receive your third-party account password.

If you sign in with Apple and choose Hide My Email, Apple may provide a private relay address. That relay address is treated as your account email for sign-in and communication purposes.

SSO sign-in on the Customer App is available to customer accounts only. Studio owner and staff accounts must use the Studio Portal with their designated credentials; those accounts cannot be used to sign in to the Customer App.

Each SSO provider processes your data under its own privacy policy. We recommend reviewing:

• Google Privacy Policy
• Apple Privacy Policy
• Meta (Facebook) Privacy Policy

How We Use Your Information

We use your information to:

• Create and manage user accounts, including SSO-linked customer accounts.
• Facilitate bookings and payments.
• Display bookings and event histories.
• Help Studios manage attendance, bookings, and customer engagement.
• Send essential notifications (booking reminders, schedule changes).
• Improve our platform and services.
• Delete user accounts and associated data upon request.

How We Share Information

We may share necessary information with:

• Studios you choose to engage with.
• Payment processors such as PayHere for secure transactions.
• Service providers who support hosting, analytics or communication.
• SSO providers (Google, Apple, Facebook) when you choose to sign in with them on the Customer App — limited to what is needed to verify your identity and complete sign-in.
• Device token providers (FCM/APNs) for delivering push notifications — these are removed when you delete your account.

We never sell your personal information.

Payment Information

All card and payment data is processed securely by PayHere according to PCI-DSS standards. Aro does not store or access your card details.

Data Retention

• We store your information only as long as required for service delivery or legal compliance.
• Your information may be stored or processed using secure cloud infrastructure and service providers located inside or outside Sri Lanka, in compliance with applicable data protection standards.
• When you delete your account, your personal information is anonymised and your device tokens and active sessions are revoked immediately. Anonymised records may be retained for legal or audit compliance.

Security

• We use industry-standard technical and organisational measures to protect your data.
• The Aro platform is intended for users aged 18 and above. Users under 18 may only use the platform with parental or guardian consent.

Your Rights

You may request access, correction or deletion of your personal information by contacting info@itsaro.com. You can also delete your account directly through the Aro Customer App settings, which will immediately anonymise your personal data, revoke all active sessions, and remove your device from push notification lists.

Updates to This Policy

We may update this Privacy Policy periodically. Continued use of the platform indicates acceptance of the updated policy.