Privacy Policy

Last Updated: September 23, 2026

1. Who Operates Smorio

Smorio is currently operated by its founder, Joy Maity. This Policy applies to the public website, Studio Dashboard, Smart Print creation, QR scanning, Memory Playback, support, billing records, lifecycle processing, and related service operations. Current operator and consumer-grievance contact details are published on the Contact Support page.

2. Information We Process

2.1 Account and Studio Profile

Depending on the fields you complete, Smorio may process your studio name, owner or contact name, email address, location, profile photo or logo, description, website, plan, account status, security settings, and public-profile consent. Studio Brand & Profile does not require a customer phone number.

Studio accounts are intended for adults who are legally able to manage the account or act for the studio or business they represent.

2.2 Uploaded Photos and Videos

Studios upload photos and videos to create Smart Prints. Smorio stores and processes those files, thumbnails, technical media information, and the folder or memory settings needed to provide playback.

The studio is responsible for having the permissions and client consent required to upload, host, and share the media. Where uploaded media includes a child or another person whose consent must be provided by a parent, guardian, representative, or rights holder, the studio is responsible for obtaining that permission or other lawful basis where required. Smorio does not use uploaded client media to train a general-purpose AI model and does not sell that media.

2.3 Payment and Billing Records

Where paid checkout is enabled, payment is processed through Razorpay in INR. Smorio keeps a limited merchant-side billing ledger needed to verify purchases, activate entitlements, issue its own invoice or receipt, handle refunds or payment support, and maintain accounting or dispute records. This may include the Razorpay order ID and payment ID, Smorio invoice ID or number, amount, currency, payment status, payment method category, selected product, refund or failure status, and relevant timestamps.

Smorio does not ask you to provide or store your full card number, CVV, card PIN, UPI PIN, payment OTP, or bank password. Sensitive payment authentication and credentials are handled by the payment provider and the applicable banking or payment network. Razorpay may retain payment-system records under its own legal and regulatory obligations; Smorio does not rely on Razorpay as the sole copy of Smorio's merchant invoice and transaction ledger.

For paid purchases Smorio may also collect a billing address (address line, city, state, PIN code, and optionally GSTIN). This is used to issue invoices or receipts, provide payment support, and record place of supply for billing records. Billing address is retained with related invoice and transaction records as described in this Policy. Smorio does not charge GST on invoices while the operator is not GST-registered.

2.4 Technical, Scan, Support, and Lifecycle Records

Smorio may process IP address, browser or device information, timestamps, security-token status, error records, scan and playback events, estimated different-viewer counts, support requests, feedback, account activity, scheduled plan-warning records, deletion-job status, and purge-audit records needed to operate, secure, diagnose, and improve the service.

Studio analytics are estimates and do not identify a viewer by name. Smorio does not show studios a viewer's private device identifiers, full IP address, or internet account details.

3. Why We Use This Information

• Create and maintain Studio accounts.
• Upload, prepare, store, and deliver Smart Print media.
• Validate signed QR and memory links.
• Process payments, invoices, plan limits, and support requests.
• Record billing address for invoices, payment support, and place of supply.
• Send transactional plan-expiry, retention, and deletion notices.
• Enforce trial and paid-plan lifecycle rules and record deletion attempts.
• Detect abuse, investigate errors, and protect accounts and service infrastructure.
• Meet billing, accounting, security, dispute, and legal obligations where they apply.

4. Service Providers and Data Location

Smorio uses third-party providers to operate the service. Relevant information may be processed by a licensed Indian payment gateway for payment processing; Google for Google Sign-In where used; a cloud infrastructure provider for configured application hosting, database, media storage, and backup; a DNS, security, and CDN provider for configured routing and edge services; and an email provider for verification and transactional service messages.

For the India launch, Smorio's controlled primary application database and enabled first-party customer object storage are configured in an India-based data centre region. Deployed readiness is designed to fail closed if those primary stores drift to a non-India region. This is a primary-storage safeguard, not a promise that every network hop, recipient email system, authentication provider, CDN/security processor, payment processor, or other third-party processing operation is physically located only in India.

A provider is listed here because Smorio currently uses or may invoke that provider for the stated service function. Providers receive the information reasonably needed for their role. Cross-border processing, if any, remains subject to applicable Indian law and any notified restrictions or stricter sector-specific requirements. Smorio does not sell personal data to advertisers.

5. QR Links, Sharing, and Playback Privacy

Smorio checks signed access tokens and rejects invalid or expired tokens. Client videos are not offered through a public Smorio browsing directory.

A valid QR code or memory link is not identity verification. A person who receives it may be able to forward it, and a viewer may record the screen or camera output. Studios must distribute QR codes and links carefully and should not promise clients that browser delivery prevents every form of copying.

6. Security

Smorio applies access controls and technical and operational safeguards intended to reduce unauthorized access, disclosure, alteration, or loss. No online service can guarantee absolute security, uninterrupted availability, or recovery from every failure.

Studios must protect account passwords and authenticator access, sign out on shared devices, and never send passwords, OTPs, UPI PINs, CVVs, or bank-login details through support forms.

7. Retention and Plan Expiry

Smorio keeps information while it is needed to provide the service and may keep limited billing, invoice, security, fraud-prevention, dispute, or legal records for longer where required or reasonably necessary. Limited policy-acceptance, support, deletion-audit, and similar operational records may also be retained where needed for those purposes. Removing hosted media or closing an account therefore does not necessarily erase a transaction or invoice record that must remain for accounting, payment reconciliation, dispute handling, or an applicable legal retention requirement.

The Free Trial lasts for exactly 10 days from activation and has no grace period. Smorio may send reminders approximately 3 days, 1 day, and 6 hours before expiry. A verified paid upgrade completed before expiry preserves trial-created content. At expiry, access and playback for trial content stop and hosted trial content is queued for permanent deletion at the beginning of the 11th trial day. A paid plan purchased after deletion processing begins starts with an empty workspace and does not restore deleted trial content.

When an annual paid plan expires without renewal, new uploads and Smart Print creation stop. Existing published playback remains available during the current 23-day paid-plan grace period. Content may remain retained but inaccessible through day 60 for verified renewal. Without a verified renewal before the deadline, hosted content and related playback records are queued for permanent deletion on day 60.

Permanent deletion cannot be reversed. Studios are responsible for retaining their original photos and videos outside Smorio. Residual copies may remain temporarily in backups, caches, logs, or provider systems until their normal overwrite or deletion cycle completes.

8. Your Requests

Studio Account Settings provides a Download My Data action for available account metadata and an account-deletion request process. The export does not include passwords, secret keys, payment credentials, or raw bulk media downloads.

You may also use Studio Support for a verified request to access, correct, delete, or ask questions about your account information. Smorio may need to verify account ownership before acting. Where applicable law prescribes a response, acknowledgement, correction, erasure, grievance, or other deadline, that legal deadline controls over any general support wording.

9. Applicable Privacy Law

Privacy rights and obligations depend on the law that applies to the user, studio, processing activity, and date. Indian digital-personal-data requirements have a phased commencement. The Digital Personal Data Protection Act does not create a blanket rule that every category of personal data must always remain physically in India; notified transfer restrictions and any other Indian law that imposes a higher degree of protection or localisation continue to apply. Smorio will handle verified requests and update this Policy as applicable requirements take effect; this Policy does not claim certification or universal compliance with every privacy law worldwide.

10. Changes and Contact

Smorio may update this Policy when the product, providers, or applicable requirements change. Material changes may require studios to review and accept an updated version before continuing with affected features.

For privacy questions, sign in and open a Privacy & Data Request from Studio Support. If you cannot access the account, use the operator contact on the Contact Support page. Do not include passwords or financial credentials.