Privacy policy

Who we are. Eventos Hub is run by Eventos Innovations Private Limited (CIN U92490RJ2019PTC065894) ("we", "us"). Registered address: D 102, Meera Marg, Banipark Jaipur 302016, India. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the data fiduciary for the data described here. Questions: +91-9521115800 · hello@eventoshub.com.

The short version

• We use your data to run your celebration page and nothing else. We do not sell it and we show no ads.
• "Find your photos" uses face matching. It is off until the host turns it on, a guest's selfie is used only after they agree, and all face data is deleted 90 days after the celebration.
• Our database and photo storage are in the United States today.
• You can see, correct or delete your data. Write to our Grievance Officer (details at the end) and we reply within 15 days.

Who this policy covers

Hosts and co-hosts who create or run a celebration, guests who open a celebration page, RSVP, upload photos or leave wishes (usually without an account), and visitors to our website. Money guests send to a host as digital shagun goes straight from the guest's UPI app to the host's bank. We never see or hold it.

What we collect

• Your account: name, email address or mobile number, profile photo if you add one, and the sign-in details needed to keep you signed in.
• What hosts add: celebration details, functions, venues, schedules, guest lists, and chat messages between hosts and co-hosts. A guest entry can hold a guest's name, phone, email, side or group, food preference, and travel and stay details.
• What guests add: RSVP answers, wishes, photos and videos, and a selfie if you use Find my photos. Guests who upload or RSVP may be signed in with a phone number or a temporary guest sign-in.
• Reports and blocks: when you report a photo, wish or update, we keep what you reported, the reason you give and your account, so the hosts and our team can review it. People you block are kept on your account so their posts stay hidden for you.
• Device and usage data: IP address, device and browser type, approximate location from the IP address, pages and screens used, and error logs.
• Payments: When you purchase a plan, our payment partner processes the transaction; we store order references, amounts, and receipt identifiers needed for your account. Eventos Innovations Private Limited is not registered under GST; receipts are payment records only and do not show GST. We do not store your full card or UPI credentials.

How we use it

To run the service you ask for: show the celebration page, collect RSVPs, share photos, send the invites and reminders a host asks us to send, sign you in, take payments and send receipts, keep the service secure, fix errors, and meet our legal duties. We rely on your consent (for example for face matching) or on uses the DPDP Act allows without separate consent, such as a service you have asked for.

Face matching ("Find your photos")

Faces are biometric data, so here is exactly what happens.

• It starts with the host: face matching is off for every celebration until the host turns it on. Guests see a notice explaining it before they use it, signed in or not.
• Children's celebrations: for celebrations centred on a child (for example a child's birthday, naming ceremony or mundan), the host can turn face matching on only after confirming that the parents or guardians of the children who appear in the photos have agreed. We record that confirmation.
• Photos in the gallery: once it is on, our servers find the faces in each gallery photo and save a face signature for each one: a list of numbers that describes the face. It is not a photo. This includes people in the photos who never use the feature.
• Your selfie: nothing happens until you tick the consent box and upload a selfie. Our servers make a face signature from it and compare it with the photo signatures, then show you the photos you are likely in. We record when you agreed.
• What we store: your selfie and its signature, so you do not have to upload it again, and the signatures for gallery photos. They are stored with the celebration on Google Cloud in the United States. Face signatures are never sent to anyone's phone or browser: only our servers can read them. Only you can see your selfie, and you only see photos you could already open on that celebration's page.
• What we never do: use faces to find out who someone is by name, share them outside the celebration, use them for ads, or use them to train software.
• How long we keep it: all face data for a celebration (photo signatures, selfies and their signatures) is deleted 90 days after the celebration's last day, when its hosting ends, or when the host turns face matching off, whichever comes first. Before that, your selfie goes when you tap "Remove me from face search" or delete your account, and a photo's signatures go when the photo is deleted.
• Remove me: "Remove me from face search" deletes your selfie and also takes your face out of that celebration's photo signatures, so no one can find those photos by your face. If you never used a selfie and do not want to be matched, tap "Don't include me in face search" on the celebration's photos: it tells the hosts, who remove or leave out photos of you, or turn face matching off. You can also write to our Grievance Officer with the celebration link and the photos. We delete the face signatures for those photos and work with the host to take the photos down, within 15 days.
• Guests under 18 should not upload a selfie themselves. A parent or guardian can do it for them.

WhatsApp messages

A host can share their page link from their own WhatsApp. We are not part of that. A host can also ask us to send guests an invite from our official Eventos Hub WhatsApp number. For that, we send Meta (the WhatsApp Business Platform) the guest's phone number, the celebration name and the page link. After the celebration, if the host chooses, we also send the guests who said they were coming, or were checked in, one thank-you message with the link to the photos, in the same way. Meta delivers the message under its own terms and may process it outside India. If you reply, Meta passes your reply to us: we act on STOP, and we may show other replies to the host of that celebration.

To stop these messages, reply STOP to any of them. We record your number and send you no more messages from our number, for any celebration. Hosts must only message guests who expect to hear from them.

Emails

We send account emails (welcome, your page is live, hosting renewal reminders, your gallery after the celebration) and the email invites a host asks us to send. ZeptoMail, an email service run by Zoho Corporation, delivers them from Zoho's data centre in the United States. To stop invites for a celebration, ask the host. To stop account emails, write to us.

Payments

Website purchases are paid through Razorpay. Purchases in the Android app go through Google Play and in the iPhone app through the Apple App Store. They handle your card, UPI or bank details under their own privacy policies. We receive the order number, plan, amount and status, never your full card or UPI details. See our Refund policy.

Analytics and error reports

We use Google Analytics for Firebase on the website and in the app to count visits and see which features are used (pages and screens viewed, buttons tapped, device type, approximate location, an app ID). In the app you can turn this off under Account, Privacy, Usage analytics. Firebase Crashlytics records app crashes and Sentry records website errors, so we can fix them. We do not use this data for advertising.

Where your data is stored

Eventos Hub runs on Google Cloud and Firebase. Today our database and photo storage are in the United States, and our server code runs in Mumbai. So your data is transferred outside India, which the DPDP Act allows except to countries the Government of India restricts. We will update this page if we move data to India.

Who we share it with

We do not sell personal data. We share it only with:

• the hosts and co-hosts of a celebration you are part of;
• other guests, for what a host puts on the celebration page. On a public page, anyone with the link can see the schedule, the photo gallery and the wishes the host approved. Hosts can make a page private or protect it with a code or password;
• the service providers below, who process data only on our instructions;
• authorities, when the law requires it.

How long we keep it

• Your account: until you delete it. Deleting it removes your profile, your celebrations, your guest entries in other hosts' celebrations, your selfies, and your name, email and phone number on your receipts.
• A celebration (guest list, RSVPs, photos, wishes, chat): until the host deletes the celebration or their account.
• Face data for Find your photos (selfies and face signatures): at most 90 days after the celebration's last day, and sooner if you remove it, the host turns the feature off, or the celebration is deleted.
• A WhatsApp STOP: kept, so we keep honouring it.
• Payment records: in your account until you delete it. After that, the amount, plan, date, receipt number and payment reference of each payment are kept for 8 years, as Indian accounting law requires, without your name, email or phone number. Razorpay, Google and Apple keep their own records as the law requires them to.
• Backups and server logs: deleted data can stay in backups and logs for up to 30 days.
• Analytics and error reports: up to 14 months for analytics and 90 days for error reports.

Your rights under the DPDP Act

• Access: ask for a summary of your data and who we shared it with.
• Correction: ask us to correct, complete or update it.
• Erasure: delete your account in the app (Account, Privacy, Delete account) or through Delete account, remove your selfie in Find your photos, or ask us.
• Withdraw consent: as easily as you gave it, for example by removing your selfie.
• Nominate: name someone who can use these rights for you if you die or cannot act yourself.
• Complain: write to our Grievance Officer. If you are not happy with our answer, you can complain to the Data Protection Board of India.

Guests: a host controls their guest list, so you can ask the host to change or remove your entry, or ask us. We may need to check that a request really comes from you.

Children

Hosts must be 18 or older. Guests under 18 need a parent or guardian to agree before they RSVP, upload photos or use Find your photos. Photos of children in a gallery are added by the host or guests, who are responsible for having the family's permission. A parent or guardian can ask us to remove a child's data or photos. We do not track children or show them ads.

Security

Data is encrypted in transit, access is limited by celebration and role, and our team gets only the access it needs. No system is completely secure. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Cookies and local storage

We use cookies and your browser's storage to keep you signed in, remember choices such as language, and run analytics. You can clear them in your browser; some features may then stop working.

Changes

When we change this policy we update it here and change the "Last updated" date. For important changes we also tell you by email or in the app.

Grievance Officer

For any privacy question, a request about your data, or a complaint about content on Eventos Hub, contact:

Related: Terms of service, Refund policy, Cancellation policy, Shipping & delivery, Delete account.