Privacy policy

1. Who we are and scope

Pupchu Tech Private Limited, registered in Delhi, India, operates Wedding Riwaaz and is the data fiduciary for personal data processed to provide the platform, except where a property or third-party provider independently determines its own purposes and means of processing.

This policy applies to visitors, customers, property-partner personnel and other users of our websites, portals, communications and related services.

2. Personal data we collect

The data collected depends on how you use the platform. We seek to collect only what is reasonably necessary for the stated purpose.

• Identity and contact data: name, mobile number, email, city, account role and authentication records.
• Wedding requirements: dates, destinations, guest and room counts, budget, event preferences, accessibility or dietary requirements and notes you choose to provide.
• Consent and lead data: OTP status, trusted-session expiry, consent text/version, recipient properties, number reveals, calls, copies, WhatsApp clicks and callback requests.
• Service records: messages, proposals, site visits, support requests, complaints, privacy requests and booking outcomes voluntarily reported to us.
• Partner data: business and team details, property information, public sales contacts, availability blocks, verification documents, media rights, subscriptions and billing records.
• Technical and security data: device/browser information, IP-derived security signals, logs, timestamps, cookies, fraud indicators and audit records.
• Payment data: transaction references and status from our payment provider; we do not intend to store complete card or banking credentials.

3. How we obtain data

We obtain data directly from you, from authorised family or organisational representatives, from participating properties, automatically through your use of the platform, and from service providers that support verification, communications, payments, security and analytics. All published property profiles are participating partner profiles; we do not publish separate unclaimed profiles.

4. Why we process personal data

We process personal data for specified lawful purposes and, where required, on the basis of clear consent. We may also process data for uses permitted without consent under applicable law.

• Create and secure accounts, verify mobile control and maintain trusted sessions.
• Run search, matching, cost estimation, saved properties and comparisons.
• Show proposed recipients, capture consent and share wedding details with the selected or exact-match properties.
• Create unique property leads, send notifications, prevent duplicates and measure separate intent and outcome events.
• Operate partner, customer, concierge and admin workflows, including proposals, site visits, complaints and support.
• Process subscriptions and payments, reconcile transactions and prevent fraud.
• Moderate reviews and media, enforce rights, maintain audit records and comply with legal obligations.
• Improve performance and analytics using minimised data; send optional marketing only where the required choice or consent exists.

5. Sharing with properties

For a direct property contact, we share saved wedding and contact details only after property-specific consent. For a full brief, we first display every exact-match recipient and collect one explicit consent covering that displayed list. Each recipient property then acts as an independent data fiduciary or controller for its subsequent handling of the enquiry.

Properties may use enquiry data only for responding to that wedding requirement unless you separately agree to marketing. We do not treat a number reveal, click or callback request as proof of a connected call or booking.

6. Other disclosures

We may disclose necessary data to contracted processors supporting hosting, database, authentication, OTP, communications, analytics, payments, support, security and professional advice. They are expected to process data under appropriate instructions and safeguards.

We may also disclose data when required by law, lawful order or rights-protection need; to investigate fraud or security incidents; or as part of a merger, financing, reorganisation or sale subject to appropriate confidentiality and notice requirements.

7. Matching and automated tools

Automated rules may assist with matching, ranking, duplicate prevention, spam detection, qualification and moderation. These tools can make mistakes. Material property decisions and contracts remain with customers and properties. You may contact us to question a material platform outcome or correct inaccurate underlying data.

8. Retention

We retain personal data only for as long as necessary for the stated purpose, security, dispute handling, fraud prevention, audit and legal obligations. Active account and enquiry data is retained while the service relationship or wedding requirement remains active. Consent, lead, transaction, complaint and security records may be retained longer where needed to establish compliance or legal rights.

Before launch, the company must approve and document a category-specific retention schedule aligned with the Digital Personal Data Protection Act, 2023 and rules as in force. Data will be deleted or anonymised when the purpose and applicable retention need end, subject to lawful exceptions.

9. Security and incident response

We use role-based access, row-level database controls, encryption in transit, secure authentication, audit logs, provider isolation and other reasonable safeguards proportionate to the data and risk. No system is completely secure. Users must protect devices and credentials and report suspected compromise promptly.

We maintain procedures to assess and respond to personal-data breaches and will notify affected individuals and authorities where required by applicable law.

10. Your privacy rights

Subject to applicable law, you may request a summary of personal data and processing, correction or completion, erasure, grievance redressal and nomination of another individual to exercise rights in specified circumstances. You may withdraw consent as easily as it was given; withdrawal does not invalidate earlier lawful processing and may prevent the relevant service from continuing.

Use the account privacy tools or Contact page. We may verify the request and may retain limited information where legally required or necessary to establish, exercise or defend claims.

11. Communications and marketing

Operational messages about OTP, security, enquiries, proposals, service updates and policy changes are distinct from marketing. Platform marketing and property marketing require the applicable separate choice or consent. You may opt out of marketing without stopping essential service messages.

12. Children

The platform is intended for adults and is not directed to persons under 18. Do not submit a child’s personal data unless it is necessary for a legitimate wedding requirement and you are authorised to do so. Avoid including sensitive or unnecessary information in free-text notes.

13. International processing

Some service providers may process data outside India. We will use contractual and technical safeguards and comply with restrictions notified under applicable Indian law. Destination properties outside India may process an enquiry in their country after your explicit sharing consent.

14. Cookies and analytics

Essential storage supports authentication, security, consent state, saved properties and comparisons. Optional analytics or marketing technologies will be used according to the Cookie Notice and applicable consent settings. General analytics should exclude raw contact details, wedding notes, proposals and private messages.

15. Grievance, updates and contact

Privacy and grievance requests can be submitted through the Contact page and, for authenticated users, the account privacy area. We may update this policy and will provide notice of material changes as required.

Before public launch, Pupchu Tech Private Limited must publish the verified name and direct contact details of its designated Data Protection/Grievance contact and confirm its registered-office address. This draft must be reviewed against the company’s actual vendors, data map and retention schedule by qualified Indian counsel.