Privacy Policy

• Account and security: name, email, optional phone, password hash, verification state, session and limited security logs—to create and secure accounts, authenticate, prevent fraud and provide support.
• Bookings and admission: event/ticket selection, quantity, payment/order reference, booking status, supplied attendee name or optional email, QR/check-in state—to issue tickets, process payment/refunds and support entry.
• Organisers: organisation and contact details, event content, identity-verification and PAN details, tax profile, bank verification, settlement information and payout records—to verify organisers, publish events, reconcile funds and meet tax/accounting duties.
• Support and rights: messages, attachments, request type/status, responses and audit events—to resolve queries, grievances and statutory requests.
• Optional marketing: email or phone only when separately enabled. Service, security, booking, refund and legal messages are not marketing.
• Optional analytics: page addresses, browser/device information, interaction events and analytics identifiers only after you allow analytics.

Accounts are restricted to people aged 18 or older. A parent or lawful guardian must manage ticket details supplied for a minor attendee.

Where we ask for consent, optional choices start off and you can change them later. Withdrawal does not undo processing already completed. We may also use data for a purpose specifically permitted by the DPDP Act or retain or disclose a record when another Indian law requires it.

• Razorpay Software Private Limited or Cashfree Payments India Private Limited receives checkout data only when that provider is selected.
• The configured SMTP provider receives email destination, message and delivery metadata. Gmail SMTP is the default configuration.
• The configured SMS provider receives phone, message and delivery metadata. MSG91 is the default; Twilio and Textlocal are supported configurations.
• Google Analytics / Google Tag Manager receives optional analytics data only after Allow is selected. Advertising storage, ad-user-data and ad personalisation remain denied.
• The organiser of a booked event receives the minimum roster needed for admission: booking reference, ticket tier, supplied attendee name and check-in state. Buyer email and phone are excluded from organiser analytics and exports.
• Approved webhook recipients receive only the reduced, documented payload for subscribed events.
• Advisers, auditors, authorities or courts receive data only for a documented professional or legal need.

For questions about a provider or how your information is shared, contact us using the privacy email address above.

Expired registration sessions are deleted. Attendee names, email addresses and optional details are de-identified after the post-event period (180 days by default). Payment notifications and certain processing/security records are kept for at least 365 days. Records of your privacy choices and acknowledged notices are kept while your account exists and for any additional period needed to address a legal claim.

Booking, invoice, refund, payout, tax, settlement, identity-verification, fraud and payment-dispute records may be kept longer when required by law or needed to address a claim. When direct identity is no longer needed, EventsVibe deletes or de-identifies it. A legal hold must have a documented reason and expiry date.

Authenticated Privacy controls provide:

• a copy of your data in JSON or CSV format, with a summary of how it is used and shared;
• profile correction and a tracked correction request for fields that cannot be self-edited;
• the ability to withdraw optional marketing and analytics choices;
• a tracked grievance with request ID and status;
• nomination, update and revocation of a trusted person under section 14;
• erasure/anonymisation of eligible data.

Erasure of an attendee account removes or de-identifies eligible personal information. Transaction records needed for refunds, accounting or legal duties may remain without directly identifying the account holder. Organiser erasure requests are reviewed so identity-verification, tax, bank, settlement and payout records that must be retained can be separated from information that can be removed.

EventsVibe uses encrypted connections, protected passwords, access restrictions, administrator two-factor authentication, encryption for selected sensitive records, audit logs, limited organiser data and safeguards for payment notifications and data exports.

No system is risk-free. If a personal-data breach occurs, EventsVibe will assess and contain it, preserve evidence, and notify affected people and the Data Protection Board of India when required by applicable law.

Use Privacy controls to create a tracked request, or email privacy@eventsvibe.com with “Privacy grievance” in the subject and your request reference if you have one. Do not email passwords, verification codes, card numbers, UPI PINs, PAN images or bank documents. We aim to acknowledge requests within two working days and resolve them within 15 days. If your grievance remains unresolved after using this process, you may use the complaint mechanism made available by the Data Protection Board of India under applicable law.

General support: support@eventsvibe.com

Material changes receive a new notice version. Existing signed-in users receive the updated notice and acknowledgement control. The accepted notice text/version is preserved in the consent record.