Privacy Policy

This Privacy Policy ("Policy") describes how Ootsav Tech Solutions ("Ootsav", "we", "our", or "us") collects, uses, discloses, and safeguards personal information when you access or use our mobile application, website, platform, or services (collectively, the "Platform").

This Policy applies to all users of the Platform worldwide, including hosts, guests, collaborators, and visitors. By using the Platform, you consent to the data practices described in this Policy. If you do not agree, please discontinue your use of the Platform.

Where local data protection laws grant you additional rights beyond those described in this Policy, those rights apply to you. See Section 9 for jurisdiction-specific details.

1. Information We Collect

To provide a seamless event management experience, Ootsav collects certain types of information from users, guests, and collaborators.

a) Information You Provide:

• Account Information: Name, email address, mobile number, and any other details necessary to verify and create your account.
• Event Details and Guest Information: Event name, date, time, location, dress code, and guest-specific data such as names, contact details, RSVP responses, travel plans, accommodation preferences, and meal selections. When you provide guest information, you confirm that you have obtained the necessary consent or legal basis to share such data with Ootsav.
• Communication Data: If you use our communication tools (e.g., WhatsApp) to send invites, reminders, or updates, we collect message content, delivery reports, response logs, and interaction metadata.
• Media and Uploads: Photos and videos uploaded to shared event galleries, cover images, and invitation cards.
• Payment and Financial Information: For payment tracking features, we collect transaction-level data such as amounts paid and payment status. We do not store payment card numbers or sensitive financial credentials — these are handled by third-party payment processors.
• Support Communications: Details from your support inquiries, including issue type, timestamps, and attachments.

b) Information Collected Automatically:

• Usage Data: Pages viewed, features used, buttons clicked, time spent on screens, and referring URLs.
• Device and Technical Data: IP address, device type, browser name and version, operating system, screen resolution, and language/locale settings.
• Location Data: Approximate location derived from your IP address. We do not collect precise GPS location without your explicit consent.
• Third-Party Integration Data: Limited data from integrated services (e.g., WhatsApp delivery status, Firebase push notification tokens) necessary for those integrations to function.

2. Lawful Basis for Processing

We process personal data based on the following legal grounds, as applicable under the laws of your jurisdiction:

3. How We Use Your Information

4. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active accounts: Data is retained for the lifetime of your account.
• Inactive accounts: Accounts inactive for 24 or more months may be deactivated after advance notice. Event data associated with such accounts may be anonymised or deleted.
• Guest RSVP data: Retained for 12 months after the event date, after which it may be anonymised or deleted.
• Legal and compliance records: Retained as required by applicable law (typically 3-7 years for financial records).
• Backup copies: May persist in encrypted backups for up to 90 days after deletion from production systems.

You may request deletion at any time by emailing admin@ootsav.in. Once deleted, information cannot be restored.

5. How We Share Your Information

We do not sell your personal information. We limit sharing to what is necessary to provide our services:

• a) Internal Access: Authorised Ootsav team members under strict confidentiality obligations.
• b) Service Providers: Cloud hosting (Google Cloud Platform, AWS), messaging providers (Meta/WhatsApp), push notification services (Firebase), image processing services, and analytics tools — contractually bound to use data only for their designated services.
• c) Third-Party Integrations: Limited information shared with WhatsApp and similar services to enable platform features you choose to use.
• d) Legal Disclosures: To comply with laws, court orders, regulatory requirements, or to protect rights and safety.
• e) With Your Consent: When you explicitly direct us to share information.
• f) Business Transfers: In the event of merger, acquisition, or restructuring, with advance notice to affected users.

6. International Data Transfers

Ootsav is based in India. Your data is primarily stored on secure servers located in India (Google Cloud Platform, Mumbai region and AWS Asia Pacific, Mumbai region).

If you access the Platform from outside India, your data will be transferred to and processed in India. By using the Platform, you consent to this transfer. We ensure that such transfers are protected by appropriate safeguards:

• For EU/EEA/UK users: Transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms recognised under GDPR.
• For all users: We implement encryption in transit (TLS) and at rest, role-based access controls, and contractual data protection obligations with all service providers.

Our third-party service providers (Google Cloud, AWS, Meta/WhatsApp, Firebase) maintain their own data processing agreements and certifications. We require all providers to maintain security standards equivalent to our own.

7. Cookies and Tracking Technologies

Ootsav uses minimal cookies and tracking technologies:

• Essential cookies: Required for the Platform to function (e.g., session management, authentication tokens). These cannot be disabled.
• Analytics: We may use anonymised analytics to understand how the Platform is used. This data is aggregated and does not identify individual users.
• Third-party cookies: Some integrated services (e.g., Google Maps for venue display) may set their own cookies. These are governed by the respective provider's privacy policy.

We do not use advertising cookies or tracking pixels. We do not engage in behavioural advertising or sell data to advertisers. You can manage cookie preferences through your browser settings.

8. Storage and Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS 1.2+) and at rest;
• Role-based access controls with principle of least privilege;
• Regular security audits and vulnerability assessments;
• Automated monitoring and anomaly detection;
• Secure, encrypted backups with controlled access.

Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware (where required by GDPR) and notify affected users without undue delay, as required by applicable law.

While we implement strong security measures, no internet-based platform can guarantee absolute security.

9. Your Rights Under Indian Law (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access your personal data held by us;
• Request correction of inaccurate or incomplete data;
• Request erasure of your personal data;
• Data portability in a structured, commonly used format;
• Withdraw consent at any time;
• Nominate a representative to exercise rights on your behalf;
• File a grievance with our Grievance Officer or the Data Protection Board of India.

10. Rights for Users in Other Jurisdictions

a) European Union, European Economic Area, and United Kingdom (GDPR)

If you are located in the EU, EEA, or UK, the General Data Protection Regulation (GDPR) and UK GDPR provide you with the following rights:

• Right of access — Obtain a copy of your personal data and information about how it is processed.
• Right to rectification — Correct inaccurate or incomplete personal data.
• Right to erasure — Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restriction — Request restriction of processing in certain circumstances.
• Right to data portability — Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to object — Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to lodge a complaint — File a complaint with your local data protection supervisory authority.

We will respond to your request within 30 days. No fee is charged for the first request; excessive or repetitive requests may incur a reasonable fee.

Legal basis for processing: We process your data under Article 6(1) of the GDPR — consent (a), performance of a contract (b), legal obligation (c), and/or legitimate interests (f), as described in Section 2 above.

Cross-border transfers: Data is transferred to India under Standard Contractual Clauses. See Section 6.

b) California, United States (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to know — Request disclosure of the categories and specific pieces of personal information we have collected, the sources, purposes, and categories of third parties with whom we share it.
• Right to delete — Request deletion of your personal information, subject to certain exceptions.
• Right to correct — Request correction of inaccurate personal information.
• Right to opt out of sale or sharing — We do not sell or share your personal information for cross-context behavioural advertising. No opt-out is necessary.
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights.

Categories of personal information collected (as defined by the CCPA): Identifiers (name, email, phone number), internet or electronic network activity (usage data, device info), geolocation data (approximate, from IP address), audio/visual information (uploaded photos and videos), and inferences drawn from the above.

We do not sell personal information. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CCPA.

To exercise your rights, email admin@ootsav.in with the subject line "CCPA Request". We will verify your identity and respond within 45 days.

c) Brazil (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) grants you rights to: confirmation of processing, access, correction, anonymisation, portability, deletion of data processed with consent, information about sharing, and the right to revoke consent. Contact us to exercise these rights.

d) Canada (PIPEDA)

If you are located in Canada, you have the right to access your personal information, request corrections, and withdraw consent (subject to legal or contractual restrictions). We will respond to access requests within 30 days.

e) Other Jurisdictions

If you are located in any other jurisdiction with data protection laws (including but not limited to Australia, Singapore, Thailand, South Africa, Japan, and South Korea), we respect and will comply with your rights under applicable local law. Contact us at admin@ootsav.in to exercise your rights, and we will respond in accordance with the applicable legal timeframe.

11. How to Exercise Your Rights

Regardless of your location, you may exercise any applicable data protection right by:

• Emailing admin@ootsav.in with a description of your request and sufficient information for us to verify your identity.
• Using in-app account settings to update or delete your information where available.

We will acknowledge your request within 48 hours and provide a substantive response within the timeframe required by applicable law (typically 15-45 days depending on jurisdiction). We do not charge a fee for the first request in any 12-month period.

12. Children's Privacy

The Platform is not intended for children. We do not knowingly collect personal data from children under the age thresholds set by applicable law:

• India (DPDP Act): Under 18 years of age.
• EU/UK (GDPR): Under 16 years of age (or lower as set by individual member states, but not below 13).
• United States (COPPA): Under 13 years of age.
• Other jurisdictions: The applicable minimum age under local law.

If you believe we have inadvertently collected data from a child below the applicable age threshold, please contact admin@ootsav.in immediately. We will promptly delete such data.

Guest data submitted by an adult host (e.g., names of children attending an event) is processed under the host's consent and responsibility.

13. Third-Party Links and Services

The Platform may contain links to external websites or integrate with third-party services (Google Maps, WhatsApp, app stores) not operated by Ootsav. We are not responsible for their privacy practices. We encourage you to review their privacy policies before sharing any information.

14. Opting Out and Managing Preferences

• Marketing communications: Opt out via unsubscribe links in emails or by emailing admin@ootsav.in.
• Push notifications: Manage through your device settings (iOS Settings or Android App Settings).
• Cookies: Manage through your browser settings. Disabling essential cookies may affect Platform functionality.
• Account deletion: Request full account and data deletion by emailing admin@ootsav.in.

Even after opting out of marketing, you may still receive transactional communications related to your account or active events.

15. Responding to Legal Requests

We may access, preserve, and disclose personal information in response to lawful requests from government or regulatory authorities, to detect fraud, protect rights and safety, prevent harm, or comply with judicial proceedings. Where permitted by law, we will notify you of such requests.

16. Governing Law and Dispute Resolution

This Policy shall be governed by and construed in accordance with the laws of India. Disputes shall be subject to the exclusive jurisdiction of the courts of Udaipur, Rajasthan, India.

This clause does not override mandatory consumer protection or data protection rights in your jurisdiction. If you are an EU/EEA/UK resident, you retain the right to bring claims in your country of residence. If you are a California resident, your CCPA/CPRA rights are not waived by this clause. Your local statutory rights always prevail where they conflict with this section.

17. Grievance Officer and Contact

EU/UK residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

18. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email, in-app notifications, or on the Platform at least 30 days before they take effect. Your continued use after the effective date constitutes acceptance of the updated Policy.