Privacy Policy

This Privacy Policy explains how MG OS (“MG OS”, “we”, “us”, “our”) collects, uses, and protects information in connection with the MG OS business operating system for studios and service businesses, and this website at sevenos.app. MG OS is operated by Seven Os.

1. Who this applies to

This Privacy Policy applies to MG OS user accounts, the studios and businesses (“studios”) that use MG OS, and the customers and leads a studio manages within MG OS.

2. Information We Collect

Account information

When you create an MG OS account, we collect your full name, email address, and password.

Studio/business information

A studio's own business name, legal name, logo, phone number, email address, physical address, currency, tax configuration, and operating hours, as entered by the studio in its account settings.

Customer and lead information

Contact details and other information a studio enters into MG OS about its own customers and leads (for example, names, phone numbers, email addresses, and project or booking details).

Business records

Quotations, invoices, payments, accounting entries, and project records that a studio creates and manages within MG OS.

Communications

WhatsApp messages sent and received through a studio's connected WhatsApp integration, including message text, message type, delivery status, and timestamps, associated with the relevant lead or customer record.

Staff/user information

The names, roles, and permissions of the people a studio adds as users of its own MG OS account.

Integration configuration

Identifiers needed to operate a studio's connected integrations, such as a WhatsApp Business Account ID, phone number ID, and connection status.

Audit information

A record of certain actions taken within a studio's MG OS account, kept for accountability and security purposes.

3. Information Received Through Third-Party Integrations

Meta / Facebook / WhatsApp

When a studio chooses to connect its WhatsApp Business Account to MG OS using Meta's Embedded Signup (Facebook Login for Business) flow, MG OS receives the information needed to establish that connection: an authorization code, the WhatsApp Business Account (WABA) ID, and a phone number ID. MG OS exchanges the authorization code for an access token through a server-side request to Meta — this exchange happens only on our servers, never in your browser. MG OS does not receive or store your Facebook login credentials or password.

Once a WhatsApp connection is established, MG OS receives, through Meta's WhatsApp Cloud API, the information needed to operate WhatsApp messaging on the studio's behalf: the WhatsApp phone number and (where provided) display name of the customer or lead the studio is messaging, the content and type of each message, message delivery status (sent, delivered, read, or failed), and associated timestamps.

WhatChimp

A studio may instead choose to connect its WhatsApp Business number through WhatChimp, an alternative WhatsApp messaging provider. In that case, MG OS receives comparable information — sender phone number, message content, and delivery status — through WhatChimp rather than through Meta. A studio uses one WhatsApp provider at a time; WhatChimp and Meta's WhatsApp Cloud API are not both active for the same studio simultaneously.

4. How We Use Information

• To provide, operate, and maintain the MG OS platform for each studio.
• To let a studio manage its own leads, customers, quotations, invoices, payments, projects, and staff.
• To send and receive WhatsApp messages on a studio's behalf, and to match inbound messages to the correct lead or customer record.
• To authenticate users and maintain account security.
• To maintain an audit trail of actions taken within a studio's account.
• To respond to support requests, including data-deletion requests.
• To maintain the security, integrity, and tenant isolation of the platform — each studio's data is kept separate from every other studio's.

5. Meta / Facebook / WhatsApp Integrations

MG OS allows a studio to connect its own WhatsApp Business Account so it can message its own customers and leads from within MG OS. This connection is authorized by the studio itself, through Meta's own Embedded Signup flow — MG OS never sees or stores the studio's Facebook login.

As described in Section 3, MG OS receives the WhatsApp Business Account identifiers and access token needed to send and receive messages, and, for messages actually exchanged, the sender's WhatsApp number, display name, message content, and delivery status. This information is used solely to operate WhatsApp messaging for the connecting studio and to associate messages with the correct lead or customer record in that studio's own account.

The Meta access token and other sensitive integration credentials are stored using our server-side secret storage mechanism, encrypted, and are never exposed to the browser.

A studio can disconnect its Meta WhatsApp connection at any time from its account settings. See Section 9 for what disconnecting does and does not do, and how to request deletion of related data.

6. How We Share Information

MG OS does not sell personal information. Information is shared only:

• With the third-party service providers described in Section 10, to the extent necessary for them to provide their service to MG OS (for example, Meta's WhatsApp Cloud API or WhatChimp to send and receive WhatsApp messages a studio initiates, or Supabase to host and secure the underlying database and authentication).
• Within a studio's own account, where MG OS's role-based permissions determine which of that studio's own users can view which records — this is the studio's own internal access control, not sharing with an outside party.
• Where required by law, or to protect the rights, property, or safety of MG OS, our users, or others.

MG OS does not share one studio's data with another studio; database-enforced tenant isolation restricts this technically, not only as a policy.

7. Data Storage and Security

MG OS is built on Supabase, which provides the underlying database, authentication, and application data infrastructure. Sensitive integration credentials — including WhatsApp/Meta access tokens and API keys — are stored using our server-side secret storage mechanism, encrypted, and are never exposed to the browser or to any client-side code.

Access to a studio's data is restricted using database-enforced tenant isolation and role-based permissions, so that each studio's data is accessible only to that studio's own authorized users.

8. Data Retention

We retain information for as long as the relevant studio account remains active and the information is needed to provide MG OS's services. Following an account closure or a data-deletion request, we review the applicable information and delete it where appropriate. Some information may be retained for longer where reasonably necessary to comply with legal, accounting, security, fraud-prevention, or dispute-resolution obligations.

MG OS does not currently perform automatic, fixed-schedule deletion of data after account closure.

9. User Rights and Data Deletion

Data Deletion

You may request deletion of your personal information, or of a studio's data, by emailing hello@mgphotographyglobal.com. To protect your data, we may need to verify your identity or your ownership or administration of the relevant studio account before completing a deletion request. Deletion requests are currently reviewed and processed manually, and we will confirm with you once a request has been actioned.

Disconnecting a WhatsApp integration turns off further message processing for that connection, but does not, by itself, delete previously stored configuration or message history. To remove that data as well, submit a deletion request to the email address above.

10. Third-Party Services

MG OS relies on the following third-party service providers, depending on which features and integrations a studio uses. Not every studio uses every provider listed below — a studio uses at most one WhatsApp provider (Meta or WhatChimp) at a time.

• Supabase — provides the database, authentication, and application data infrastructure underlying MG OS.
• Meta Platforms, Inc. — provides the WhatsApp Cloud API and the Embedded Signup (Facebook Login for Business) flow, used when a studio connects its WhatsApp Business Account directly through Meta.
• WhatChimp — an alternative WhatsApp messaging provider a studio may choose to connect instead of Meta's WhatsApp Cloud API.

11. Cookies and Similar Technologies

MG OS uses a small number of strictly necessary cookies to keep you signed in, provided by our authentication provider. We do not use cookies for advertising or third-party tracking, and we do not currently use analytics cookies.

12. Children's Privacy

MG OS is a business tool intended for use by studios, businesses, and their staff, and is not directed to children. We do not knowingly collect personal information from children.

13. International Data Transfers

As a cloud-hosted platform, information may be processed and stored in data center locations operated by our infrastructure providers, including Supabase and, where a studio connects WhatsApp through Meta, Meta Platforms, Inc.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last Updated” date above. Continued use of MG OS after changes take effect constitutes acceptance of the revised policy.

15. Contact Us

For any questions about this Privacy Policy, or to make a data-deletion request, contact us at hello@mgphotographyglobal.com.

Seven Os
No. 1, RV Complex, Vairam Nagar
Thanjavur, Tamil Nadu 613005
India

This Privacy Policy is governed by the applicable laws of India.