1. Introduction

Snapja (“Platform”) is a mobile and web application operated by Meharix Private Limited (“Company,” “we,” “us,” or “our”), a company incorporated under the Companies Act, 2013, with its registered office in Hyderabad, Telangana, India.

The Platform enables customers (“you,” “your,” or “User”) to discover, book, and engage professional content creators (“Creators”) for photography, videography, and related content creation services at events including weddings, birthday celebrations, corporate functions, social gatherings, and other occasions.

This Privacy Policy describes what personal data we collect, why we collect it, how we process and protect it, and the rights you have over your data. This policy applies to all users of the Platform, including our mobile applications (iOS and Android), website, and APIs.

By creating an account on Snapja, you confirm that you have read, understood, and consent to the collection, use, and processing of your personal data as described in this Privacy Policy. If you do not agree, please do not register or use the Platform.

2. Definitions

In this Privacy Policy, unless the context otherwise requires:

• “Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• “Data Principal” means the individual to whom the Personal Data relates — i.e., you, the User.
• “Data Fiduciary” means Meharix Private Limited, which determines the purpose and means of processing of Personal Data.
• “Processing” includes collection, storage, use, modification, retrieval, disclosure, transmission, erasure, or destruction of data.
• “Content” means photographs, videos, and other creative deliverables produced by Creators through the Platform.
• “Deliverables” means the final photographs, videos, and edited content delivered to Customers through the Platform.

3. Information We Collect

3.1 Information You Provide at Registration

When you create an account on Snapja, we collect the following personal data:

• Full Name — to identify you on the Platform and personalise your experience.
• Email Address — for account identification, transactional communications, and account recovery.
• Phone Number — for OTP-based authentication and essential service notifications.
• Profile Picture — to create your public profile visible to Creators and other Users. Upload is voluntary; a default avatar is assigned if you choose not to provide one.
• Date of Birth — to verify you meet the Platform’s minimum age requirement (see Section 11).
• Gender — collected at registration for personalisation and internal service-matching purposes.
• Location — your general location, used to show you relevant Creators and services in your area. This is distinct from the precise event-location data described in Section 3.2, which you provide separately for each booking.

We do not collect passwords. Snapja uses a passwordless OTP-based authentication system. We do not collect financial information (credit cards, bank accounts, UPI IDs) directly; all payment processing is handled by authorised third-party payment gateways.

3.2 Event and Booking Information

When you use the Platform to book a Creator, we collect information necessary to fulfil your booking:

• Event type, date, time, location, and venue details.
• Special instructions, event descriptions, and service preferences.
• Communication messages exchanged with Creators through the in-app messaging system.

3.3 Content and Deliverables

After an event, your Creator delivers photographs and videos (“Deliverables”) through the Platform. These Deliverables are stored securely using Amazon S3 with CloudFront content delivery, not in the database itself. (Profile pictures are a narrow, temporary exception: they may be stored as inline image data during upload while we complete migration to the same cloud storage.) This content may depict you, your guests, and your event environment.

3.4 Information Collected Automatically

When you use the Platform, we may automatically collect:

• Device Information — device type, model, operating system version, and unique device identifiers.
• Usage Data — pages viewed, features used, session duration, interaction patterns, and app crash reports.
• Log Data — IP address, access timestamps, browser type, and API request logs.

We collect this data to maintain Platform performance, diagnose technical issues, and improve the user experience. This data is not linked to your identity for marketing purposes.

3.5 Information We Do Not Collect

For clarity, Snapja does not collect:

• Passwords (we use OTP-based login only).
• Biometric data (fingerprints, face scans, iris scans).
• Precise GPS location (unless you explicitly grant permission for event-related features).
• Contacts, call logs, SMS, or data from other applications on your device.
• Financial or banking information directly (handled exclusively by third-party payment processors).

4. How We Use Your Information

We process your personal data for the following specific, lawful purposes:

4.1 Account and Authentication

• To create, maintain, and verify your user account.
• To authenticate your identity via OTP at each login session.
• To manage session tokens (JWT and refresh tokens) for secure, persistent access.

4.2 Service Delivery

• To facilitate bookings and match you with available Creators.
• To enable in-app communication between you and your booked Creator.
• To store, organise, and deliver your event Deliverables (photographs and videos) within the Platform.
• To process payments through authorised third-party payment gateways.
• To send transactional notifications (booking confirmations, delivery alerts, payment receipts).

4.3 Platform Improvement

• To analyse usage patterns and improve Platform features, performance, and stability.
• To diagnose technical issues, bugs, and crashes.
• To conduct internal research and development.

4.4 Safety and Legal Compliance

• To detect, prevent, and investigate fraud, abuse, and security threats.
• To enforce our Terms of Service.
• To comply with applicable laws, regulations, court orders, and governmental requests.
• To protect the rights, property, and safety of the Company, Users, and the public.

4.5 Communications

• To send essential service-related communications (account alerts, booking updates, policy changes).
• To send occasional promotional communications via push notification or email. You can opt out of push notifications at any time through your device’s notification settings, and of promotional emails via the unsubscribe link included in each one.

5. Authentication and Security Measures

We implement the following technical security measures to protect your personal data:

5.1 OTP-Based Authentication

Snapja uses a passwordless, OTP-based login system. A unique One-Time Password is generated and sent to your registered phone number or email address each time you log in. OTPs are time-bound (they expire after a defined period), single-use, and cannot be reused or intercepted for future access.

5.2 Data Encryption and Hashing

• Your One-Time Passwords are short-lived, single-use, and are not reusable once consumed or expired, as described in Section 5.1.
• All data in transit between your device and our servers is encrypted using TLS (Transport Layer Security) protocols.
• Data at rest in our database is protected by encryption and access controls.
• Employee and administrator accounts, which use password-based authentication rather than OTP, have their passwords processed using bcrypt hashing, a one-way cryptographic function that renders the original password unreadable and irreversible.

5.3 Session Management

Authenticated sessions are managed using JSON Web Tokens (JWT) paired with refresh tokens. JWTs are short-lived, cryptographically signed, and verified on every API request. Refresh tokens enable seamless session renewal without requiring repeated OTP entry, and are securely stored and can be revoked by the user or the system at any time.

5.4 Infrastructure Security

• Input Validation — all user inputs are validated and sanitised to prevent injection attacks (SQL injection, XSS, CSRF).
• Rate Limiting — API endpoints are rate-limited to prevent brute-force attacks, credential stuffing, and denial-of-service attempts.
• Secure API Architecture — all API endpoints require authentication, use HTTPS exclusively, and follow RESTful security best practices.
• Access Controls — internal access to production databases and user data is restricted to authorised personnel on a need-to-know basis, following the principle of least privilege.

No system is perfectly secure. While we implement commercially reasonable security measures that meet or exceed industry standards, we cannot guarantee absolute security against all threats. We strongly recommend that you keep your registered phone number and email address secure and notify us immediately if you suspect unauthorised access to your account.

6. Data Storage and Retention

6.1 Storage Infrastructure

All user data, including personal information and account records, is stored in our backend database powered by MongoDB. Deliverables (photographs and videos) are stored using Amazon S3 with CloudFront delivery, not in the database. Our database and storage infrastructure are hosted on secure servers with encryption, access controls, and regular backups.

6.2 Retention Periods

• Account Data (name, email, phone, profile picture), retained for the duration of your active account. Upon a valid account-deletion request, we anonymise your personal data immediately so it can no longer be associated with you; the underlying account record and its linked bookings, payments, and chat history are retained thereafter for as long as required by Indian law (see Section 6.3 below), rather than being scheduled for erasure on a fixed later date.
• Event Deliverables (photographs and videos), stored on our servers for 4 months from the date of delivery. After this period, Deliverables are automatically and permanently deleted from our systems. This is not archival, and the content cannot be recovered. If you revisit a booking after this period, the app will show that the content is no longer available rather than showing broken or missing files. You are responsible for downloading and maintaining your own copies before the 4-month period expires.
• Transaction Records — retained for a minimum of 8 years as mandated under the Income Tax Act, 1961, Goods and Services Tax Act, 2017, and the Companies Act, 2013.
• Communication Logs and Automatically Collected Data (in-app messages, support correspondence, device and usage logs) — retained for as long as necessary to operate the Platform, respond to support requests, and maintain security and service quality, after which they are deleted or anonymised in the ordinary course of our data lifecycle practices.

6.3 Deletion

Upon expiry of the applicable retention period, or upon your valid request for erasure, personal data is permanently deleted or irreversibly anonymised so that it can no longer be associated with you. Certain data may be retained beyond these periods solely where required by applicable Indian law.

7. Data Sharing and Disclosure

We do not sell, rent, trade, or share your personal data with any third parties for their marketing or commercial purposes. All data collected is used strictly for application functionality and improving your experience.

7.1 Sharing with Creators

When you book a Creator through the Platform, we share only the information necessary for service delivery: your name, event type, date, time, location, and any special instructions you provide. Creators are contractually bound by the confidentiality terms of their onboarding agreement with the Company.

7.2 Other Service Providers

We share limited data with the following categories of service providers, each acting under contractual confidentiality and data-protection obligations:

• Razorpay — payment processing and creator payouts (see Section 7.3 below).
• Google Firebase — several distinct Firebase products, each for a different purpose: Analytics (in-app usage telemetry), Crashlytics (crash and error diagnostics, with sensitive fields redacted before sending), Realtime Database (in-app chat messages between you and your Creator), and Cloud Messaging (delivering push notifications to your device).
• Google Maps Platform — location search, address autocomplete, and map display when you set an event location or browse nearby Creators.
• Our SMS provider — delivery of OTP messages for authentication.
• Our email delivery provider — delivery of transactional and account emails (welcome, verification, booking, and OTP emails).
• Amazon Web Services (S3 and CloudFront) — secure storage and delivery of Deliverables and portfolio images.
• Anthropic — when you use AI-assisted script generation for UGC content bookings, the brand brief you provide is sent to Anthropic’s API to generate a draft script.

We do not share your data with any of these providers for their own marketing purposes.

7.3 Payment Processing

Payment transactions are processed by Razorpay, our payment gateway. We share only the minimum information required to process your transaction. We do not store your payment card details, bank account numbers, or UPI credentials on our servers. Razorpay operates under its own privacy policy and complies with PCI-DSS standards. See Section 5 of our Terms of Service for how funds are held and released.

7.4 Legal Requirements

We may disclose your personal data if required by law, including in response to:

• Orders from a court of competent jurisdiction in India.
• Directions issued by the Data Protection Board of India under the DPDP Act, 2023.
• Lawful requests by Central or State Government agencies, law enforcement, or regulatory authorities.
• Compliance with the Information Technology Act, 2000, and rules thereunder.

7.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of substantially all assets of the Company, your personal data may be transferred as part of the transaction. You will be notified via email or in-app notification prior to any such transfer and will have the opportunity to delete your account.

7.6 With Your Consent

We may share your data with third parties when you explicitly authorise us to do so — for example, when you choose to share an event gallery on a social media platform through the app.

8. Content Ownership and Licensing

8.1 Your Uploaded Content

You retain ownership of content you upload to the Platform (such as your profile picture). By uploading content, you grant the Company a limited, non-exclusive, royalty-free license to use, display, and store that content solely for the purpose of operating the Platform and delivering services to you.

8.2 Event Deliverables

Photographs and videos captured by Creators at your events are delivered through the Platform. Upon full payment:

• You receive a non-exclusive, personal, non-commercial license to use, download, print, and share the Deliverables for personal purposes.
• Commercial use of Deliverables (for advertising, publication, resale) requires separate written authorisation from the Creator and the Company.
• You may not remove watermarks, metadata, or credits from Deliverables without authorisation.

8.3 Company Rights

The Company may use anonymised, de-identified, or aggregated content for Platform marketing, quality assurance, and internal training. You may opt out of promotional use of your event content at any time by contacting us.

9. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, and other applicable Indian laws, you have the following rights:

• Right to Access — request confirmation of whether we process your personal data and obtain a summary of such data.
• Right to Correction — request correction of inaccurate or misleading personal data, and completion of incomplete data.
• Right to Erasure — request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention requirements.
• Right to Withdraw Consent — withdraw your consent for data processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Note that withdrawing consent may limit your ability to use certain Platform features.
• Right to Grievance Redressal — raise a complaint with our Grievance Officer or, if unsatisfied, with the Data Protection Board of India.
• Right to Nominate — nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

To exercise any of these rights, including registering a nominee under the Right to Nominate, please contact us at support@snapja.com. We will acknowledge your request within 48 hours and act on it within 30 days, or such period as prescribed under applicable law.

10. Cookies and Tracking Technologies

Our mobile application does not use browser cookies. However, our web platform may use the following:

• Essential Cookies — required for authentication, session management, and core functionality. These cannot be disabled.
• Analytics Cookies — help us understand how users interact with the Platform. These can be disabled through your browser settings.

We do not use advertising or third-party tracking cookies. We do not participate in cross-site tracking or behavioural advertising networks.

11. Children’s Privacy

The Platform is not directed at individuals under the age of 18 years, and registration requires you to confirm your date of birth; accounts that do not meet the minimum age are not created. We do not knowingly collect, process, or store personal data of children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take immediate steps to delete such data.

Event Deliverables that incidentally include images of minors (for example, children attending a family event) are the sole responsibility of the booking Customer. By accepting delivery of such content, you represent that you have obtained all necessary consents from the parents or legal guardians of any minors depicted.

If you believe a child under 18 has provided personal data to us, please contact us immediately at support@snapja.com.

12. International Data Transfers

Snapja’s primary database is operated with an India-first hosting policy. We currently share limited data with the following processors that operate infrastructure outside India, as part of the service providers described in Section 7.2:

• Anthropic (United States) — when you use AI-assisted script generation for UGC content bookings, the brand brief text you provide is sent to Anthropic’s API to generate a draft script.
• Google Firebase (global infrastructure) — device and usage telemetry (Analytics), crash diagnostics (Crashlytics), chat messages (Realtime Database), and push-notification delivery (Cloud Messaging), as described in Section 7.2.
• Google Maps Platform (global infrastructure) — location and address data you provide when setting an event location or browsing nearby Creators.
• Amazon Web Services (S3 and CloudFront) — Deliverables and portfolio images may be processed in India or another country where AWS operates its infrastructure, depending on the storage region configured for our account.

If your data needs to be transferred to any additional servers or service providers located outside India in the future, we will ensure that:

• The transfer complies with the provisions of the DPDP Act, 2023, and any restrictions notified by the Central Government.
• Appropriate contractual safeguards are in place with the receiving entity.
• Your data is not transferred to any country restricted by the Central Government under Section 16(1) of the DPDP Act.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

• Material Changes — will be notified to you via in-app notification and/or email at least 30 days before taking effect.
• Minor Changes — (formatting, clarifications with no substantive impact) may be made without prior notice.

The “Effective Date” at the top of this document reflects the date of the most recent revision. Your continued use of the Platform after any update constitutes your acceptance of the revised policy. If you disagree with any changes, you should discontinue use and request account deletion.

14. Grievance Redressal

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the Company has appointed a Grievance Officer:

• Name: Balakrishna S
• Designation: Grievance Officer
• Organisation: Meharix Private Limited
• Email: support@snapja.com
• Address: B310, Giridhari Murari, Kismatpur, Bandlaguda Jagir, Hyderabad, Telangana, India

Complaints will be acknowledged within 24 hours of receipt. The Grievance Officer shall resolve complaints within 15 days, or within such extended period not exceeding 30 days as may be reasonably required given the complexity of the complaint.

If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India as constituted under the DPDP Act, 2023.

15. Data Breach Notification

In the event of a personal data breach, the Company will take immediate steps to contain and assess the breach. Where the breach is likely to result in harm to affected Data Principals, we will notify affected users without undue delay via email and/or in-app notification, describing the nature of the breach, the data involved, and the steps we are taking. We will also notify the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023, and applicable rules.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact:

Meharix Private Limited
B310, Giridhari Murari, Kismatpur, Bandlaguda Jagir
Hyderabad, Telangana, India
Email: support@snapja.com
Website: www.snapja.com