Privacy Policy

For organiser accounts (your profile, billing, platform usage) we decide how data is used — we act as the data fiduciary.

For attendee data collected through an event (names, emails, answers to registration questions), the organiserdecides why it is collected; we process it on their behalf to deliver tickets, check-ins, and event communication. Attendee questions about how an event uses your data are best directed to that event’s organiser first.

• Account data — name, email, password (stored as a salted hash), timezone, locale, and team membership.
• Event and order data— events you create, tickets you buy, attendee names and emails, answers to the organiser’s registration questions, and check-in records.
• Payment data — order amounts, currency, payment status, and provider references. Card and UPI details go directly to the payment provider; we never see or store them.
• Technical data — IP address, browser type, and request logs used for security, rate limiting, and debugging.

We use personal data to:

• run the service — accounts, event pages, ticket issuance, check-ins, invoices, and order lookups;
• send transactional email you have asked for — order confirmations, tickets, waitlist offers, password resets, and organiser broadcasts about events you registered for;
• keep the platform safe — fraud prevention, abuse detection, rate limiting, and audit logging of sensitive actions; and
• meet legal obligations, including tax and accounting.

We do not sell personal data, and we do not use attendee data for advertising.

We process data with your consent (given when you create an account or register for an event) and for certain legitimate uses recognised by law, such as complying with legal obligations and responding to emergencies. You may withdraw consent at any time; services that depend on that data may stop working once you do.

• Organiserssee the attendee data collected through their own events — never another organiser’s.
• Payment providers (such as Razorpay and Stripe) process payments and refunds.
• Service providers host our infrastructure and deliver email on our instructions, under contracts that restrict their use of the data.
• Authorities, where the law requires us to disclose.

We keep cookies to the minimum the product needs:

• a session cookie that keeps you signed in; and
• a preference cookie that remembers your theme so pages paint correctly on first load.

We do not set third-party advertising or cross-site tracking cookies. Payment providers may set their own cookies on their checkout components, governed by their policies.

Account data is kept while your account is active. Order, invoice, and payout records are kept for as long as tax and accounting law requires, typically eight years in India. Security logs are kept for short, fixed windows. When data is no longer needed, we delete it or irreversibly anonymise it.

You can:

• access and correct your data from your account settings;
• ask for a copy of your data, or for erasure where we have no legal duty to keep it;
• withdraw consent for non-essential processing; and
• raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

Requests go to privacy@ojas.events — we respond within the timelines the law sets.

Data is encrypted in transit, passwords are stored as salted hashes, access is scoped per tenant so one customer can never read another’s data, sensitive actions are audit-logged, and ticket and invoice files are served from private storage with ownership checks. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Organiser accounts are for adults (18+). Where an event admits minors, the organiser is responsible for collecting any consents the law requires from parents or guardians.

Our primary infrastructure serves customers in India. Where a service provider processes data outside India, we do so only as permitted by applicable law and under contracts that protect the data to the standards of this policy.

We may update this policy as the product and the law evolve. The “Last updated” date reflects the current version; material changes are notified by email or in-product notice.

Privacy questions and grievances: privacy@ojas.events. General support: support@ojas.events or the contact page. Postal correspondence reaches us at the registered office of CHITRAM.AI PRIVATE LIMITED.