Back to Homepage ⤣




Welcome to our Privacy Policy


Effective Date: March 10, 2026  |  Last Updated: August 24, 2026


Eventic ("we", "us", or "our") is committed to protecting the privacy and personal data of every person who visits or uses the Eventic platform (the "Platform"), accessible at eventic.in. This Privacy Policy describes what personal data we collect, why we collect it, how we use and protect it, and the rights available to you — including rights under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).


This Policy applies to all users worldwide, with additional provisions specifically for residents of India, the European Economic Area (EEA), the United Kingdom (UK), and the United States (California). By accessing or using the Platform you acknowledge that you have read and understood this Policy.



1. Who We Are & Data Controller


The data controller responsible for your personal data is:



For EEA/UK residents: if you require a local representative or wish to lodge a complaint with a lead supervisory authority, please contact us at the email above and we will direct you to the appropriate contact.



2. Information We Collect


2.1 Information You Provide Directly


When you register, create an invitation, make a purchase, or contact us, we may collect:


  1. Identity data: Full name, username, profile photo
  2. Contact data: Email address, phone number, billing address, country
  3. Account credentials: Hashed passwords (we never store plain-text passwords)
  4. Event & invitation data: Event name, date, venue, guest list details, RSVP responses, media uploads (photos, music files)
  5. Payment data: Billing name, billing address, last four digits of card, and transaction identifiers. Full card numbers are processed exclusively by our PCI-DSS certified payment processors and are never stored on our servers.
  6. Communications: Messages, support tickets, and feedback you send us
  7. Preferences: Language, currency, notification settings

2.2 Information We Collect Automatically


When you use the Platform, we automatically collect:


  1. Device & technical data: IP address, browser type and version, operating system, device identifiers, screen resolution
  2. Usage data: Pages visited, features used, time spent, search queries, links clicked, referring URLs
  3. Location data: Country/region inferred from IP address. Precise geolocation is only collected with your explicit consent.
  4. Cookie & tracking data: See Section 8 (Cookies) for full details
  5. Log data: Server logs recording access times, error rates, and API calls

2.3 Information We Receive From Third Parties


  1. Social login providers (Google, etc.): If you sign in via a third-party account we receive your name, email, and profile photo as permitted by that provider's settings.
  2. Payment processors (e.g., PayPal, Razorpay): Transaction status, fraud signals, and billing confirmations.
  3. Analytics providers: Aggregated or pseudonymised user behaviour data.
  4. Anti-fraud and security services: Risk scores and flagged signals.


3. Legal Basis for Processing Personal Data (EEA & UK Users)


Under GDPR, we process your personal data only where we have a valid legal basis. The bases we rely on are:


  1. Contract (Art. 6(1)(b)): Processing is necessary to provide the services you have requested — creating invitations, managing RSVPs, processing payments, and delivering your account.
  2. Legal obligation (Art. 6(1)(c)): We must retain certain financial and transactional data to comply with tax, accounting, and anti-money-laundering laws.
  3. Legitimate interests (Art. 6(1)(f)): We process certain data for fraud prevention, platform security, service improvement, and internal analytics, where those interests are not overridden by your rights.
  4. Consent (Art. 6(1)(a)): For marketing emails, non-essential cookies, and precise geolocation — collected only with your explicit, freely given, and withdrawable consent.
  5. Vital interests / Public task: In rare emergency circumstances that require disclosing data to protect life or comply with law enforcement.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. To withdraw consent, email privacy@eventic.in or use the account settings page.



4. How We Use Your Information


  1. To create and manage your account and deliver the core invitation services
  2. To process payments and issue receipts or refunds
  3. To send transactional emails (booking confirmations, RSVP notifications, password resets)
  4. To send marketing communications — only where you have provided explicit consent, and always with a clear unsubscribe link
  5. To personalise your experience and show relevant templates or features
  6. To detect, investigate, and prevent fraudulent transactions and abuse
  7. To analyse usage patterns and improve Platform functionality and performance
  8. To comply with applicable laws, regulations, legal processes, and lawful governmental requests
  9. To enforce our Terms of Service and other policies
  10. To respond to your enquiries and provide customer support


5. Data Sharing & Disclosure


We do not sell your personal data to third parties. We share your data only in the circumstances described below.


5.1 Service Providers (Data Processors)


We engage trusted third-party vendors to operate certain parts of the Platform. These processors act only on our instructions and are bound by data processing agreements in accordance with GDPR requirements:



5.2 Business Transfers


If Eventic is involved in a merger, acquisition, restructuring, or sale of all or a portion of its assets, your data may be transferred. We will notify you via email and/or a prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.


5.3 Legal & Regulatory Disclosures


We may disclose your data when required by law, court order, regulatory authority, or to protect the rights, property, or safety of Eventic, our users, or the public. We will, where legally permitted, notify you of such a request.


5.4 With Your Consent


We may share data with third parties when you have given us explicit consent to do so.



6. International Data Transfers


Eventic operates globally. Your data may be transferred to, stored, and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country.


For transfers from the EEA or UK to third countries not deemed adequate by the European Commission, we rely on one or more of the following safeguards:


  1. European Commission Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs)
  2. Adequacy decisions covering the destination country
  3. Binding Corporate Rules (where applicable)
  4. Derogations under Art. 49 GDPR for specific situations (e.g., explicit consent, performance of a contract)

To obtain a copy of the safeguards we have put in place for international transfers, contact us at privacy@eventic.in.



7. Data Retention


We retain personal data only for as long as necessary for the purposes set out in this Policy and to comply with our legal obligations. Our general retention schedule is:



When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with any individual.



8. Cookies & Tracking Technologies


We use cookies and similar tracking technologies (pixels, local storage, session tokens) to operate and improve the Platform. Cookies are small text files placed on your device.


8.1 Types of Cookies We Use



8.2 Your Cookie Choices


On your first visit, we present a cookie consent banner. You can accept all, accept necessary only, or customise your preferences. You may also:


  1. Change your cookie preferences at any time via the "Cookie Settings" link in the footer
  2. Configure your browser to block or delete cookies (see your browser's help documentation)
  3. Use browser extensions designed to block trackers

Disabling non-essential cookies may reduce the quality of your experience but will not prevent you from using the core features of the Platform.


8.3 Third-Party Tracking


Google Analytics data is subject to Google's Privacy Policy. Microsoft Clarity data is subject to Microsoft's Privacy Statement.


8.4 Advertising & Personalisation (Google Ads)


Third-party vendors, including Google, may use cookies to serve ads on the Platform based on a user's prior visits to this or other websites. Google's use of advertising cookies enables Google and its partners to serve ads to users based on their visit to the Platform and/or other sites on the internet.


You can opt out of personalised advertising at any time by visiting Google Ads Settings. You can also opt out of a participating third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info.



9. Payment Data & Financial Security


All payment transactions on the Platform are processed by PCI-DSS Level 1 certified third-party payment processors. We do not store, process, or transmit full credit or debit card numbers on our servers. The payment processors we work with — including Stripe and PayPal — employ industry-standard encryption and tokenisation.


We retain only non-sensitive payment metadata (transaction ID, amount, currency, payment status, last four digits of card) necessary for billing, refunds, and fraud prevention.



10. Data Security


We implement a comprehensive set of technical and organisational security measures, including:


  1. Encryption in transit: All data exchanged between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).
  2. Encryption at rest: Sensitive data fields are encrypted in our database using industry-standard algorithms.
  3. Password security: Passwords are hashed using a strong one-way algorithm (bcrypt / Argon2). We never store plain-text passwords.
  4. Access controls: Strict role-based access control ensures only authorised personnel can access personal data, on a need-to-know basis.
  5. Regular security audits: We perform periodic vulnerability assessments and penetration tests.
  6. Incident response: We maintain a documented data breach response plan. In the event of a breach that poses a risk to your rights, we will notify relevant supervisory authorities within 72 hours and affected users without undue delay, as required by GDPR Art. 33–34.

Despite our best efforts, no method of transmission or electronic storage is 100% secure. If you suspect any unauthorised access to your account, please contact us immediately at security@eventic.in.



11. Your Rights Under GDPR (EEA & UK Residents)


If you are located in the EEA or UK, you have the following rights under the GDPR and UK GDPR:


  1. Right of Access (Art. 15): Request a copy of the personal data we hold about you and information on how we process it.
  2. Right to Rectification (Art. 16): Request that we correct inaccurate or incomplete personal data.
  3. Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data where it is no longer necessary, or you withdraw consent, or there is no overriding legitimate interest for us to retain it.
  4. Right to Restriction of Processing (Art. 18): Ask us to halt certain processing activities in specific circumstances (e.g., while a rectification request is pending).
  5. Right to Data Portability (Art. 20): Receive a machine-readable copy of data you provided to us, and request that we transmit it to another controller.
  6. Right to Object (Art. 21): Object at any time to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds.
  7. Rights related to automated decision-making (Art. 22): We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing, including profiling.
  8. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without penalty.
  9. Right to Lodge a Complaint: You have the right to lodge a complaint with your national data protection supervisory authority. For example:

To exercise any of these rights, submit a request to privacy@eventic.in. We will respond within 30 days. We may need to verify your identity before processing your request. Requests are free, though we may charge a reasonable fee for manifestly unfounded or excessive requests.



12. Your Rights Under CCPA / CPRA (California Residents)


If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:


12.1 Categories of Personal Information We Collect


In the preceding 12 months, we have collected the following CCPA categories of personal information:



12.2 Your California Rights


  1. Right to Know (§ 1798.100): You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purposes, and the categories of third parties with whom we share it.
  2. Right to Delete (§ 1798.105): You may request deletion of personal information we have collected, subject to certain exceptions (e.g., data needed to complete a transaction, comply with a legal obligation, or for security purposes).
  3. Right to Correct (§ 1798.106): You may request that we correct inaccurate personal information.
  4. Right to Opt-Out of Sale or Sharing (§ 1798.120): We do not sell your personal information as defined under the CCPA. We do not share it for cross-context behavioural advertising. You may still submit an opt-out request at privacy@eventic.in.
  5. Right to Limit Use of Sensitive Personal Information (§ 1798.121): We do not use sensitive personal information beyond purposes necessary to provide the requested service.
  6. Right to Non-Discrimination (§ 1798.125): We will not discriminate against you for exercising any of your CCPA rights. We will not deny services, charge different prices, or provide a lesser quality of service because you exercised a privacy right.

12.3 How to Submit a CCPA Request


Submit verifiable consumer requests to privacy@eventic.in. We will acknowledge receipt within 10 business days and respond within 45 calendar days (extendable by a further 45 days where reasonably necessary with prior notice). You may submit up to two requests per 12-month period.


12.4 Authorised Agents


California residents may designate an authorised agent to make requests on their behalf. The agent must provide written permission signed by you, and we may require verification of your identity directly.



13. Guest & Invitee Data (Hosts' Guests)


Eventic is built around invitations, which means we routinely handle personal data belonging to people who never created an Eventic account or visited eventic.in themselves — the guests and invitees a Host adds to their event. This may include a guest's name, phone number, email address, RSVP response, dietary preferences or restrictions, plus-one details, and — for events involving families — children's names. This section explains how that data is handled, separately from the account data covered elsewhere in this Policy.


13.1 Who Controls Guest Data


The Host who creates an invitation is the data controller for the guest and RSVP information they add to or collect through that invitation. Eventic acts as a data processor / service provider: we store and process guest data strictly to operate the invitation, RSVP tracking, and related features the Host has chosen to use, on the Host's instructions. We do not independently decide what to do with a Host's guest list.


13.2 Retention & Deletion


Guest and RSVP data tied to a specific invitation is retained for as long as that invitation's validity period is active. Once an event has passed, we retain the associated guest data for up to 12 months to allow the Host to review responses, export their guest list, or extend the invitation, after which it is automatically deleted or anonymised unless the Host deletes it sooner or exports and retains it independently.


13.3 Host Export & Deletion Rights


Hosts can export their guest list and RSVP responses from their Eventic dashboard at any time, and can delete individual guest entries or an entire guest list before the automatic retention period above elapses.


13.4 Guest Removal Requests


If you are a guest who received an Eventic invitation and want your information removed, you may contact us directly at privacy@eventic.in. Because the Host controls the guest list, we will generally direct the Host to action the removal; where we are not legally required to retain the data (e.g., for an active transaction or legal obligation), we will remove it from our systems directly upon request.


13.5 No Repurposing of Guest Data


Guest data collected for one event is used solely to operate the invitation, RSVP, and related features for that specific event. We do not use it for marketing, do not sell it, and do not repurpose it for any other event, Host, or purpose.



14. Your Rights Under India's Digital Personal Data Protection Act, 2023 (DPDP Act)


Eventic is based in India, and this section applies — in addition to, not instead of, the GDPR and CCPA/CPRA provisions above — to all "Data Principals" whose personal data we process as a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").


14.1 Basis for Processing


We process your personal data on the basis of your consent, given for a specific, lawful purpose that is communicated to you at or before the point of collection, or under the "certain legitimate uses" recognised by the DPDP Act — for example, where you have voluntarily provided your data to us for a specified purpose (such as an RSVP), or where processing is necessary to perform a contract with you.


14.2 Purpose Limitation


We process your personal data only for the purpose for which it was collected and to which you consented, or for a purpose you would reasonably expect given the context of collection. We do not use your personal data for a materially different purpose without seeking fresh consent.


14.3 Your Rights as a Data Principal


  1. Right to access information: A summary of the personal data we hold about you and the processing activities we undertake with it.
  2. Right to correction and erasure: Request that we correct inaccurate or incomplete personal data, update data that has changed, or erase data that is no longer necessary for the purpose it was collected for.
  3. Right to grievance redressal: Raise a grievance with our Grievance Officer (Section 14.5) and receive a response within the timeline required by the DPDP Act and its Rules.
  4. Right to nominate: Nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
  5. Right to withdraw consent: Withdraw consent at any time, as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact privacy@eventic.in.


14.4 Data Storage & Cross-Border Transfer


Eventic's infrastructure providers may store and process personal data both within India and in other jurisdictions, as described in Section 6 (International Data Transfers). We do not transfer any category of personal data outside India where the Central Government has restricted such transfer under the DPDP Act.


14.5 Grievance Officer


In accordance with the DPDP Act, Eventic has designated a Grievance Officer to address complaints regarding the processing of your personal data:



If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as provided under the DPDP Act.



15. Children's Privacy


The Platform is not directed to children. We define "children" as:



We do not knowingly collect personal data from children under these ages. If we become aware that we have inadvertently collected such data, we will take prompt steps to delete it. If you are a parent or guardian and believe your child has submitted personal data to us, please contact us at privacy@eventic.in.



16. Third-Party Links & Services


The Platform may contain links to third-party websites and services (e.g., social media sharing, map embeds, payment gateways). Once you leave our Platform, we have no control over the content or privacy practices of those third parties. We encourage you to read the privacy policies of any external services you use. This Policy does not apply to third-party websites or services.



17. Do Not Track Signals


Some browsers offer a "Do Not Track" (DNT) feature. Because there is currently no uniform standard for interpreting DNT signals, our Platform does not respond differently to DNT requests. We do, however, provide robust cookie controls as described in Section 8 to let you manage tracking directly.



18. Data Breach Notification


In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:


  1. Notify the relevant supervisory authority (e.g., applicable EU Data Protection Authority or the UK ICO) within 72 hours of becoming aware of the breach, where feasible.
  2. Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, with clear information about the nature of the breach and recommended protective steps.
  3. Maintain an internal record of all data breaches regardless of whether notification is required.


19. Changes to This Privacy Policy


We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:


  1. Update the "Last Updated" date at the top of this page
  2. Post a prominent notice on the Platform homepage or within your account
  3. Send you an email notification if the changes materially affect your rights (where we hold a valid email address for you)

Your continued use of the Platform after any changes take effect constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you should discontinue using the Platform and may request deletion of your account.



20. Contact Us & Exercising Your Rights


For general privacy enquiries or to exercise any of the rights described in this Policy:



We will acknowledge your request within 5 business days and aim to resolve all requests within the timeframes required by applicable law (30 days under GDPR; 45 days under CCPA).


If you are an EEA or UK resident and are not satisfied with our response, you have the right to escalate your complaint to your local data protection supervisory authority. You can find details of EU supervisory authorities at edpb.europa.eu, and the UK ICO at ico.org.uk.