Privacy Policy

EventSathi is built and operated by software professionals with 18 years of industry experience across financial technology, complex financial systems, and product development in global markets ("we," "us," "our"). For the personal data described in this policy, we are the "data fiduciary" (the controller) under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

This policy applies to the EventSathi mobile application and this website (together, the "Service"). By using the Service you acknowledge this policy. If you do not agree, please do not use the Service.

Information you provide

• Account: your name and mobile number (used to sign in with a one-time code), and an email address and profile photo if you choose to add them
• Events: event and function names, dates, venues, schedules, tasks, notes and documents
• Guests: guest names and phone numbers, RSVP status, and preferences or travel and accommodation details a host chooses to record
• Teams and vendors: names, contact details, roles, business and service information, and event-related messages
• Media: photographs, videos, albums and documents you upload, and their metadata
• Support: messages and feedback you send us

Information about other people

Hosts and planners often add details of guests, family members, team members and vendors, which may include children. If you add someone else's information, you confirm you have the right to do so (see our Terms). We use that information only to run the relevant event.

Collected automatically

• Device and app information (device type, operating system and app version)
• A push-notification token for your device, so we can deliver event notifications
• IP address, log information, and authentication and security events
• Crash and diagnostic information

We use a push-notification provider only to deliver notifications to your device. We do not currently use third-party analytics or advertising SDKs, and we do not track you across other companies' apps or websites. This website does not set advertising cookies.

We collect information we reasonably need for the features you use. We do not collect precise location or access your contacts, unless a feature that needs it is introduced, in which case we will ask for your permission first and update this policy.

• To create and maintain your account and authenticate you
• To provide event-management features: events, schedules, guest coordination, team and vendor collaboration, messaging and media
• To send event-related notifications and one-time passcodes by SMS, WhatsApp or email
• To protect accounts and events, and to prevent abuse, fraud and unauthorised access
• To provide support and diagnose technical problems
• To maintain reliability and improve the Service
• To comply with legal and regulatory obligations

We do not use private event information to build advertising profiles or for marketing unrelated to the event it was provided for. A guest's phone number added for an RSVP is not added to a marketing list. We send product or promotional messages only where you have agreed to receive them, and you can withdraw that agreement at any time.

We process personal data based on your consent and, where the DPDP Act permits, for "legitimate uses" such as providing a service you requested, complying with law, and responding to security incidents. You can withdraw consent at any time; withdrawal does not affect processing done before you withdrew, and may mean we can no longer provide some features.

We use technical and organisational measures appropriate to the data we hold, including:

• Encryption of data in transit using HTTPS/TLS
• Hosting on secure, professionally managed cloud infrastructure
• One-time-code sign-in with rate limiting on code requests
• Role-based and event-level access permissions
• Private media delivered through expiring links
• Access and audit logging
• Separation of development and production environments

We are also working on additional protections, including watermarking for private media and field-level encryption of especially sensitive fields. We will describe them as available only once they are live.

No system is completely secure and we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authorities as required by law. We draw on standards such as ISO/IEC 27001 as reference frameworks, but EventSathi is not currently certified under any ISO standard.

We keep personal data only for as long as needed for the purpose it was collected, while your account is active, and as required by law, for security and fraud prevention, and to resolve disputes.

• Account deletion: you can delete your account in the app at any time. Your personal data is deleted within 15 days of the request
• Exceptions: some records may be kept longer where the law requires, or where needed for security, fraud prevention or a dispute, and then only for that purpose and period
• Backups: residual copies in encrypted backups are overwritten in the normal backup cycle
• Content in shared events: content you shared with others in an event may remain visible to them until the host removes it, unless you delete it first

See how to delete your account, including if you no longer have the app installed.

Under the DPDP Act, and under other laws that apply to you, you can:

• Access a summary of the personal data we process about you and who we share it with
• Correct or update inaccurate or incomplete data (most of it directly in your profile)
• Erase your data by deleting your account
• Withdraw consent at any time
• Nominate another person to exercise your rights if you die or become incapacitated
• Complain to us, and then to the Data Protection Board of India if unresolved

To make a request, email privacyandsecurity@eventsathi.com from, or mentioning, your registered mobile number. We may verify your identity first. We aim to respond within 30 days.

Under the DPDP Act, a "child" is anyone under 18. EventSathi is intended for adults. Under-18s may use the Service only with the consent and supervision of a parent or legal guardian, and we do not offer the Service to children under 13.

• We do not use children's data for advertising, behavioural monitoring or targeted marketing
• We do not knowingly collect a child's date of birth
• If we learn we hold a child's data without the required parental consent, we will delete it. Parents and guardians can contact privacyandsecurity@eventsathi.com
• Hosts who add children's names or photographs to an event are responsible for having the parent or guardian's permission, and should avoid sensitive information about children

Uploading a photograph or video does not transfer ownership to us. We store and display it as needed to provide the Service, for example to show it to the people you invite. Access is controlled by sign-in, permissions and expiring links. Anyone who can legitimately view media may still copy, screenshot or record it, and we cannot prevent that.

We do not currently use AI features that send private event information to an external AI provider. If we introduce such features, before launch we will explain what information is processed and why, whether an outside provider is involved, whether the provider keeps it or uses it for model training, and what controls you have. We do not use private event information as unrestricted training data.

Some of our service providers, for example for hosting or push notifications, may process limited data on servers outside India. When personal data is transferred outside India, we will do so only as permitted by Indian law and with appropriate safeguards. Where laws such as the EU or UK GDPR apply to you, we will apply the additional rights and safeguards they require.

The app uses on-device storage needed to keep you signed in and for core functions. The website uses only essential storage and no advertising or cross-site tracking. If we add analytics, we will update this policy first.

The Service may link to other sites or services. This policy does not cover them; please read their policies.

Questions, requests and complaints about your personal data, and security concerns or responsible disclosure of vulnerabilities: privacyandsecurity@eventsathi.com.

Grievance Officer: Email: privacyandsecurity@eventsathi.com. We acknowledge grievances promptly and aim to resolve them within 15 days.

We may update this policy as our practices or the law change. We will update the date above and, for material changes, notify you in the app or by another suitable method. If our data practices change in a material way, such as how we use data or which providers process it, we will give you the notice and choices the law requires before the change takes effect.