Effective: April 29, 2026Version: 1.0Entity: Meharix Private Limited
1. Introduction
Snapja (“Platform”) is a mobile and web application operated by Meharix Private Limited (“Company,” “we,” “us,” or “our”), a company incorporated under the Companies Act, 2013, with its registered office in Hyderabad, Telangana, India.
The Platform enables customers (“you,” “your,” or “User”) to discover, book, and engage professional content creators (“Creators”) for photography, videography, and related content creation services at events including weddings, birthday celebrations, corporate functions, social gatherings, and other occasions.
This Privacy Policy describes what personal data we collect, why we collect it, how we process and protect it, and the rights you have over your data. This policy applies to all users of the Platform, including our mobile applications (iOS and Android), website, and APIs.
By creating an account on Snapja, you confirm that you have read, understood, and consent to the collection, use, and processing of your personal data as described in this Privacy Policy. If you do not agree, please do not register or use the Platform.
2. Definitions
In this Privacy Policy, unless the context otherwise requires:
“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
“Data Principal” means the individual to whom the Personal Data relates — i.e., you, the User.
“Data Fiduciary” means Meharix Private Limited, which determines the purpose and means of processing of Personal Data.
“Processing” includes collection, storage, use, modification, retrieval, disclosure, transmission, erasure, or destruction of data.
“Content” means photographs, videos, and other creative deliverables produced by Creators through the Platform.
“Deliverables” means the final photographs, videos, and edited content delivered to Customers through the Platform.
3. Information We Collect
3.1 Information You Provide at Registration
When you create an account on Snapja, we collect the following personal data:
Full Name — to identify you on the Platform and personalise your experience.
Email Address — for account identification, transactional communications, and account recovery.
Phone Number — for OTP-based authentication and essential service notifications.
Profile Picture — to create your public profile visible to Creators and other Users. Upload is voluntary; a default avatar is assigned if you choose not to provide one.
We do not collect passwords. Snapja uses a passwordless OTP-based authentication system. We do not collect financial information (credit cards, bank accounts, UPI IDs) directly; all payment processing is handled by authorised third-party payment gateways.
3.2 Event and Booking Information
When you use the Platform to book a Creator, we collect information necessary to fulfil your booking:
Event type, date, time, location, and venue details.
Special instructions, event descriptions, and service preferences.
Communication messages exchanged with Creators through the in-app messaging system.
3.3 Content and Deliverables
After an event, your Creator delivers photographs and videos (“Deliverables”) through the Platform. These Deliverables are stored securely on our backend systems in Base64-encoded format within our database. This content may depict you, your guests, and your event environment.
3.4 Information Collected Automatically
When you use the Platform, we may automatically collect:
Device Information — device type, model, operating system version, and unique device identifiers.
Usage Data — pages viewed, features used, session duration, interaction patterns, and app crash reports.
Log Data — IP address, access timestamps, browser type, and API request logs.
We collect this data to maintain Platform performance, diagnose technical issues, and improve the user experience. This data is not linked to your identity for marketing purposes.
3.5 Information We Do Not Collect
For clarity, Snapja does not collect:
Passwords (we use OTP-based login only).
Biometric data (fingerprints, face scans, iris scans).
Precise GPS location (unless you explicitly grant permission for event-related features).
Contacts, call logs, SMS, or data from other applications on your device.
Financial or banking information directly (handled exclusively by third-party payment processors).
4. How We Use Your Information
We process your personal data for the following specific, lawful purposes:
4.1 Account and Authentication
To create, maintain, and verify your user account.
To authenticate your identity via OTP at each login session.
To manage session tokens (JWT and refresh tokens) for secure, persistent access.
4.2 Service Delivery
To facilitate bookings and match you with available Creators.
To enable in-app communication between you and your booked Creator.
To store, organise, and deliver your event Deliverables (photographs and videos) within the Platform.
To process payments through authorised third-party payment gateways.
To send transactional notifications (booking confirmations, delivery alerts, payment receipts).
4.3 Platform Improvement
To analyse usage patterns and improve Platform features, performance, and stability.
To diagnose technical issues, bugs, and crashes.
To conduct internal research and development.
4.4 Safety and Legal Compliance
To detect, prevent, and investigate fraud, abuse, and security threats.
To enforce our Terms of Service.
To comply with applicable laws, regulations, court orders, and governmental requests.
To protect the rights, property, and safety of the Company, Users, and the public.
To send promotional communications only with your explicit opt-in consent. You may opt out at any time.
5. Authentication and Security Measures
We implement the following technical security measures to protect your personal data:
5.1 OTP-Based Authentication
Snapja uses a passwordless, OTP-based login system. A unique One-Time Password is generated and sent to your registered phone number or email address each time you log in. OTPs are time-bound (they expire after a defined period), single-use, and cannot be reused or intercepted for future access.
5.2 Data Encryption and Hashing
Sensitive data elements, including email addresses and OTPs, are processed using bcrypt hashing, a one-way cryptographic function that renders the original data unreadable and irreversible.
All data in transit between your device and our servers is encrypted using TLS (Transport Layer Security) protocols.
Data at rest in our database is protected by encryption and access controls.
5.3 Session Management
Authenticated sessions are managed using JSON Web Tokens (JWT) paired with refresh tokens. JWTs are short-lived, cryptographically signed, and verified on every API request. Refresh tokens enable seamless session renewal without requiring repeated OTP entry, and are securely stored and can be revoked by the user or the system at any time.
5.4 Infrastructure Security
Input Validation — all user inputs are validated and sanitised to prevent injection attacks (SQL injection, XSS, CSRF).
Rate Limiting — API endpoints are rate-limited to prevent brute-force attacks, credential stuffing, and denial-of-service attempts.
Secure API Architecture — all API endpoints require authentication, use HTTPS exclusively, and follow RESTful security best practices.
Access Controls — internal access to production databases and user data is restricted to authorised personnel on a need-to-know basis, following the principle of least privilege.
No system is perfectly secure. While we implement commercially reasonable security measures that meet or exceed industry standards, we cannot guarantee absolute security against all threats. We strongly recommend that you keep your registered phone number and email address secure and notify us immediately if you suspect unauthorised access to your account.
6. Data Storage and Retention
6.1 Storage Infrastructure
All user data, including personal information, profile images, and Customer Deliverables (photographs and videos in Base64-encoded format), is stored in our backend database powered by MongoDB. Our database infrastructure is hosted on secure servers with encryption, access controls, and regular backups.
6.2 Retention Periods
Account Data (name, email, phone, profile picture) — retained for the duration of your active account. Upon account deletion, personal data is erased within 90 days, except where retention is required by law.
Event Deliverables (photographs and videos) — stored on our servers for a minimum of 12 months from the date of delivery. After this period, Deliverables may be archived or permanently deleted. You are responsible for downloading and maintaining your own copies before the retention period expires.
Transaction Records — retained for a minimum of 8 years as mandated under the Income Tax Act, 1961, Goods and Services Tax Act, 2017, and the Companies Act, 2013.
Communication Logs — in-app messages and support correspondence are retained for 3 years from the date of the last interaction.
Automatically Collected Data (logs, analytics) — raw logs are retained for up to 24 months and then anonymised or deleted. Aggregated, non-identifiable analytics may be retained indefinitely.
6.3 Deletion
Upon expiry of the applicable retention period, or upon your valid request for erasure, personal data is permanently deleted or irreversibly anonymised so that it can no longer be associated with you. Certain data may be retained beyond these periods solely where required by applicable Indian law.
7. Data Sharing and Disclosure
We do not sell, rent, trade, or share your personal data with any third parties for their marketing or commercial purposes. All data collected is used strictly for application functionality and improving your experience.
7.1 Sharing with Creators
When you book a Creator through the Platform, we share only the information necessary for service delivery: your name, event type, date, time, location, and any special instructions you provide. Creators are contractually bound by strict confidentiality obligations under their Creator Partner Agreement.
7.2 Payment Processors
Payment transactions are processed by authorised third-party payment gateways (such as Razorpay or Stripe). We share only the minimum information required to process your transaction. We do not store your payment card details, bank account numbers, or UPI credentials on our servers. Payment processors operate under their own privacy policies and comply with PCI-DSS standards.
7.3 Legal Requirements
We may disclose your personal data if required by law, including in response to:
Orders from a court of competent jurisdiction in India.
Directions issued by the Data Protection Board of India under the DPDP Act, 2023.
Lawful requests by Central or State Government agencies, law enforcement, or regulatory authorities.
Compliance with the Information Technology Act, 2000, and rules thereunder.
7.4 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of substantially all assets of the Company, your personal data may be transferred as part of the transaction. You will be notified via email or in-app notification prior to any such transfer and will have the opportunity to delete your account.
7.5 With Your Consent
We may share your data with third parties when you explicitly authorise us to do so — for example, when you choose to share an event gallery on a social media platform through the app.
8. Content Ownership and Licensing
8.1 Your Uploaded Content
You retain ownership of content you upload to the Platform (such as your profile picture). By uploading content, you grant the Company a limited, non-exclusive, royalty-free license to use, display, and store that content solely for the purpose of operating the Platform and delivering services to you.
8.2 Event Deliverables
Photographs and videos captured by Creators at your events are delivered through the Platform. Upon full payment:
You receive a non-exclusive, personal, non-commercial license to use, download, print, and share the Deliverables for personal purposes.
Commercial use of Deliverables (for advertising, publication, resale) requires separate written authorisation from the Creator and the Company.
You may not remove watermarks, metadata, or credits from Deliverables without authorisation.
8.3 Company Rights
The Company may use anonymised, de-identified, or aggregated content for Platform marketing, quality assurance, and internal training. You may opt out of promotional use of your event content at any time by contacting us.
9. Your Rights as a Data Principal
Under the Digital Personal Data Protection Act, 2023, and other applicable Indian laws, you have the following rights:
Right to Access — request confirmation of whether we process your personal data and obtain a summary of such data.
Right to Correction — request correction of inaccurate or misleading personal data, and completion of incomplete data.
Right to Erasure — request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention requirements.
Right to Withdraw Consent — withdraw your consent for data processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Note that withdrawing consent may limit your ability to use certain Platform features.
Right to Grievance Redressal — raise a complaint with our Grievance Officer or, if unsatisfied, with the Data Protection Board of India.
Right to Nominate — nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
To exercise any of these rights, please contact us at support@snapja.com. We will acknowledge your request within 48 hours and act on it within 30 days, or such period as prescribed under applicable law.
10. Cookies and Tracking Technologies
Our mobile application does not use browser cookies. However, our web platform may use the following:
Essential Cookies — required for authentication, session management, and core functionality. These cannot be disabled.
Analytics Cookies — help us understand how users interact with the Platform. These can be disabled through your browser settings.
We do not use advertising or third-party tracking cookies. We do not participate in cross-site tracking or behavioural advertising networks.
11. Children’s Privacy
The Platform is not directed at individuals under the age of 18 years. We do not knowingly collect, process, or store personal data of children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take immediate steps to delete such data.
Event Deliverables that incidentally include images of minors (for example, children attending a family event) are the sole responsibility of the booking Customer. By accepting delivery of such content, you represent that you have obtained all necessary consents from the parents or legal guardians of any minors depicted.
If you believe a child under 18 has provided personal data to us, please contact us immediately at support@snapja.com.
12. International Data Transfers
Snapja primarily stores and processes data within India. If in the future your data needs to be transferred to servers or service providers located outside India, we will ensure that:
The transfer complies with the provisions of the DPDP Act, 2023, and any restrictions notified by the Central Government.
Appropriate contractual safeguards are in place with the receiving entity.
Your data is not transferred to any country restricted by the Central Government under Section 16(1) of the DPDP Act.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.
Material Changes — will be notified to you via in-app notification and/or email at least 30 days before taking effect.
Minor Changes — (formatting, clarifications with no substantive impact) may be made without prior notice.
The “Effective Date” at the top of this document reflects the date of the most recent revision. Your continued use of the Platform after any update constitutes your acceptance of the revised policy. If you disagree with any changes, you should discontinue use and request account deletion.
14. Grievance Redressal
In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the Company has appointed a Grievance Officer:
Name: Balakrishna S
Designation: Grievance Officer
Organisation: Meharix Private Limited
Email: support@snapja.com
Address: B310, Giridhari Murari, Kismatpur, Bandlaguda Jagir, Hyderabad, Telangana, India
Complaints will be acknowledged within 24 hours of receipt. The Grievance Officer shall resolve complaints within 15 days, or within such extended period not exceeding 30 days as may be reasonably required given the complexity of the complaint.
If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India as constituted under the DPDP Act, 2023.
15. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact: