Privacy policy

The short version

We store what you type into your invitation, so we can show it at your link. We keep it on servers in India. We run no analytics, no advertising trackers and no third-party scripts, and we set no tracking cookies. We do not sell your data to anyone, for any purpose.

Who is responsible

TODO_LEGAL_NAME, trading as Mangala, is the Data Fiduciary for this information under the Digital Personal Data Protection Act, 2023. Contact details are on the contact page.

What we collect

• Your account. Email address, an optional name, and a password we never see in readable form.
• Your invitation. Everything you enter — the couple's and families' names, the date, venue and map link, your blessing, event details, photographs, any music you upload, and the WhatsApp number and contact people you list for guests to reach.
• Your payment. A reference and the amount. Card and UPI details go straight to our payment gateway and never reach our servers.
• Ordinary server logs. IP address and browser, kept briefly for security and debugging.

Other people's details

Some of what you enter is about other people — your parents, the relatives you list as contacts, the friends in your photographs. By entering it you confirm you are entitled to, and that they would not object. If someone asks us to remove their name, photograph or number from an invitation, we will tell you and, if we must, remove it.

Your guests

Guests do not sign in and we do not track them. When a guest taps RSVP, their reply is composed as a WhatsApp message and sent directly to the number you provided — it does not pass through us and we never see it. The “add to calendar” file is built inside the guest's own browser.

If we later add RSVP tracking inside the product, this page will be updated before it ships and you will be told.

Where it is stored

On Supabase, in their Mumbai region — so your data stays in India. Access is enforced at the database level, meaning one account is technically incapable of reading another's drafts, rather than merely discouraged from it.

Who else touches it

We use a small number of providers, each only for what it does:

• Supabase — database, file storage and sign-in.
• Our payment gateway — taking payment, and refunding it.
• Our hosting provider — serving the pages.
• Our email provider — sending your link, receipts and expiry reminders.

They act on our instructions and may not use your information for their own purposes. We may also disclose information where the law requires it.

Cookies and browser storage

We set no advertising or analytics cookies, because we run neither. Your browser stores a sign-in token so you stay logged in, a draft invitation if you have not made an account yet, and whether you switched the music off. That last group never leaves your device.

Search engines

Published invitations are not listed in search engines. Anyone with the link can open it, so treat the link as the key.

How long we keep it

• Published invitations — 12 months, then deleted.
• Drafts — until you delete them or close your account.
• Payment records — as long as tax law requires us to keep them.
• Server logs — a few weeks.

What you can ask for

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

• tell you what we hold about you, and who we have shared it with;
• correct anything wrong or incomplete;
• delete it — you can delete an invitation yourself at any time from your account;
• nominate someone to exercise these rights if you die or become incapacitated.

Email TODO_SUPPORT_EMAIL and we will respond within 30 days. If you are not satisfied, write to our Grievance Officer (see the contact page); you may then complain to the Data Protection Board of India.

Children

This service is for adults arranging a wedding. We do not knowingly collect information from anyone under 18 as a user. Children may of course appear in the photographs you choose to upload, and you are responsible for having their parents' agreement.

Security, honestly stated

Data is encrypted in transit and at rest, access is enforced per-account in the database, and we keep the number of people and services touching it small. No service can promise perfect security. If a breach ever affects your data, we will tell you and the Data Protection Board without delay.

Changes

If we change this policy, the date at the top changes. If the change materially affects how we treat information we already hold, we will email you rather than rely on you re-reading this page.