Draft — awaiting business and legal approval

This page is not yet in force. Items marked “To be provided” need confirmed business details, and the whole text must be reviewed by a qualified lawyer before launch.

Privacy Policy

This policy explains how [To be provided: legal entity name] (“HEPPEN”, “we”) handles personal data when you use HEPPEN to discover events and book tickets.

Information we collect

Account: your email address, and optionally your name and profile photo.
Sign-in security: one-time codes are stored only in hashed form and expire after 5 minutes. For each signed-in session we store the device's IP address and browser type so you can review and sign out sessions.
Bookings: orders, tickets, the events you booked and payment status. Card, UPI and bank details are entered with our payment processor and are not stored by HEPPEN; we keep the processor's payment and order references.
Location preference: the city you choose, saved in a cookie. If you use “Use current location”, your browser shares approximate coordinates once, only after you allow it; we use them to find the nearest city and do not store them.
Entry: when a ticket is scanned at an event, we record the scan time and result.

How we use it

To create your account, sign you in and keep your account secure (including rate limiting of sign-in codes).
To process bookings and payments, issue tickets, email them to you and verify them at entry.
To process refunds where a payment cannot be honoured (for example, a duplicate charge).
To show events in your chosen city.

Service providers

We use service providers to run HEPPEN: a payment processor (Razorpay), an email delivery service (Resend) and an image hosting service (Cloudinary). Event organizers receive the booking details needed to run their event. Additional processors, hosting location and international transfer details: [To be provided: hosting provider and data transfer details]

Cookies

We use essential cookies for sign-in sessions and to remember your chosen city. We do not use advertising cookies. [To be provided: confirmation of any analytics tools]

Retention

[To be provided: retention periods for account, booking and payment records]

Your rights

You can view and update your profile and sign out of sessions from your account. To request access, correction or deletion of your data, or to withdraw consent, contact us at [To be provided: privacy contact email]. [To be provided: rights and process approved under the Digital Personal Data Protection Act, 2023]

Grievance Officer

[To be provided: Grievance Officer name], [To be provided: designation]
Email: [To be provided: Grievance Officer email]
Address: [To be provided: Grievance Officer address]
Response time: [To be provided: acknowledgement and resolution timelines]