Privacy Policy

Shaadi Ka Nyota (shaadikanyota.com), operated by RiekApps, India, lets couples make a wedding invitation web page and collect replies. This policy says what we store, why, for how long, and what you can ask of us. It is written for both the couple who makes an Invitation (the “host”) and the guests who open one. It follows India’s Digital Personal Data Protection Act, 2023 (DPDP) and, for visitors from the EU/UK, the GDPR.

1. Who is responsible

For the Service itself (accounts, payments, analytics, hosting), RiekApps is the data fiduciary. For the guest names, phone numbers and replies inside an Invitation, the host decides what to collect and we process it on their behalf; guests with questions about an Invitation’s contents should first ask the couple.

2. What we collect from hosts

• Invitation content you type or upload: names, family names, dates, venues, story, dress code, travel notes, photos, the guest list you paste.
• Account: before you publish, an anonymous Firebase Authentication id created on your device so your draft stays yours. When you publish, your Google account id or email address (and a password hash if you chose email).
• Payment: Dodo Payments handles the transaction and sends us only the payment id, the amount, the status and the email used at checkout. We never see card, UPI or bank details.
• Support: what you write in the Poochho box, the page you wrote it from, your browser type, and an email if you leave one. Support tickets live on our internal dashboard (hq.riekapps.com) with the rest of RiekApps support.

3. What we collect from guests

• Opening an Invitation needs no account and sets no account cookie. The page loads from our servers like any web page: our hosting provider logs the IP address and browser for security and traffic counting, kept for up to 30 days.
• If a guest sends a reply: the name they type, whether they are coming, the headcount, the functions chosen, and an optional phone number and message. This is shown only to the host.
• A per-guest link carries the guest’s name as the host typed it. That name appears in the page title and in messaging-app previews of that link; share it only with that guest.

4. Why, and on what basis

• To make, host and show the Invitation and deliver replies to the host: performance of the contract / consent given by using the Service.
• To take payment, issue invoices and answer refund and dispute questions: contract and legal obligation (tax law requires invoices to be kept for 8 years).
• To answer support messages: consent.
• To understand how the site is used and measure advertising: legitimate interest / consent where the law requires it (see section 6).

5. Where it is kept and for how long

• Google Cloud (Firebase) in Mumbai, India (asia-south1): database, photos and hosting, encrypted in transit and at rest.
• A published Invitation and its replies are deleted automatically six months after the main wedding date. Drafts that are never published are deleted after 90 days. Photos go with their Invitation. Backups are overwritten within 30 days.
• Payment records (id, amount, email, status) are kept for 8 years as required by Indian tax law. Support tickets are kept for 2 years.
• The host can delete an Invitation at any time from the dashboard; deletion removes the page, the guest list, the replies and the photos.

6. Analytics and cookies

• Marketing pages, the editor and the dashboard use Google Analytics 4 and PostHog (page views, clicks, funnel steps; session replay with every text field masked) and the Meta pixel on marketing pages to measure advertising. These set cookies or local storage identifiers. We do not send names, guest data or reply contents to any analytics service.
• Guest Invitation pages carry no advertising pixel and no session replay.
• Local storage keeps your draft id, your chosen link and a browser id for support replies. You can clear it in your browser at any time; nothing breaks, you simply log in again.

7. Who else processes data

Google LLC / Google Cloud India (hosting, database, authentication, analytics), Dodo Payments Inc. (payments, as merchant of record), PostHog Inc. (product analytics, US servers), Meta Platforms (advertising measurement on marketing pages), and DigitalOcean (the RiekApps server that holds support tickets). Each acts under its own contract with us and its own policy. We do not sell personal data and we do not share guest data with anyone other than the host.

8. Children

The Service is for adults. Children’s names may appear in an Invitation (the “kids’ note”) only because their parents or guardians, the hosts, put them there; we do not knowingly collect data from children ourselves.

9. Your rights

• Hosts can see and change everything on the dashboard, download replies as a CSV, and delete the Invitation or the account.
• Anyone can ask us for access to, correction of, or deletion of their personal data, or to withdraw consent, by writing to riekapps@gmail.com or via Poochho. We verify the request against the account or payment email and act within 30 days. Guests may also ask the host, who can remove a reply or a guest link at once.
• You may nominate a person to exercise these rights for you, as the DPDP Act provides, and you may complain to the Data Protection Board of India if we do not resolve a grievance.

10. Security

Access to the database is limited by rules that let only the host read their Invitation and only our server publish it. Guests receive a copy of the Invitation that contains no account, payment or passcode data. Passcode-protected Invitations are checked against a hash. We review access and dependencies regularly; if a breach affects you, we tell you and the Board as the law requires.

11. Changes

When this policy changes, the date at the top changes; for material changes we show a notice on the dashboard. See also the Terms of Service and the Refund Policy.

12. Contact and grievance officer

RiekApps, India · riekapps@gmail.com. Grievance officer: Prateek Rai (same address). Acknowledgement within 48 hours, resolution within 30 days.