Privacy Policy

1. What we collect

Account and verification

• Your mobile number, to create your account and deliver your video.
• OTP verification records — the fact and time an OTP was sent and verified, and a hashed form of the number. We do not keep the OTP code itself after verification.

Your invitation

• Invitation field data you type: names of the couple/honoree and family members, event names, dates, times, venue addresses, custom blessing or host lines, and the language you choose.
• Photographs you upload, where the template supports a caricature or photo slot.
• Drafts saved so you can come back to an unfinished video.
• Guest RSVP responses submitted on your invitation page — a guest's name, optional phone number, attendance and party size. You are the host of that page; we process these on your behalf and show them only to you.

Payments

• Payment metadata from Razorpay: order and payment identifiers, amount, status and timestamp. We never receive or store your card number, CVV, UPI PIN or netbanking credentials — those are entered directly on Razorpay's secure checkout.

Technical

• Device and IP information and basic request logs, used for security, fraud prevention, rate-limiting OTP and free renders, and diagnosing failures.

2. Why we use it, and on what basis

We process your data on the basis of the consent you give when you verify your phone number, upload photos and place an order, and for the legitimate uses permitted by the DPDP Act (such as fulfilling an order you asked for and meeting legal obligations). Specifically:

• To create your video — field data and photos are rendered into the template you chose.
• To verify you and protect accounts from misuse (OTP).
• To take payment and issue receipts (payment metadata).
• To deliver your video link by WhatsApp and SMS to your verified number.
• To support you — answering queries, honouring the 7-day re-edit window, processing refunds.
• To keep the service safe and lawful — abuse detection, grievance handling, takedowns, statutory record-keeping.

We do not sell your personal data, and we do not use your photographs or invitation details to advertise to you or to train general-purpose AI models.

3. Who processes data for us

We share the minimum necessary data with Data Processors who work under contract for us:

• Razorpay — payment collection and settlement. They receive your payment details directly and share transaction metadata with us.
• WhatsApp / Meta and our SMS provider — delivering OTPs and your video link to your verified mobile number.
• Microsoft Azure — hosting, storage and the AI services used for caricature and template image generation.
• Sarvam AI — Indian-language text-to-speech for the optional voiceover.

We may also disclose data where required by law, court order or a lawful request from a government agency, and to enforce our Terms or protect someone's rights or safety.

4. How long we keep it

• Source photographs and rendered videos: deleted 60 days after your last render on that order. Download and keep your own copy before then.
• Order records, invitation field data and OTP verification records: retained for 180 days, then deleted or anonymised.
• Financial and tax records: kept for the period Indian tax and accounting law requires.
• Legal holds: where data is relevant to a grievance, dispute, investigation or legal proceeding, we retain it until that matter is closed.

5. Your rights

As a Data Principal under the DPDP Act you may:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct inaccurate or incomplete data — you can also fix invitation details yourself during the 7-day re-edit window;
• Erase your data, where we are not required to keep it — you can delete your account and everything made with it yourself, at once, from utsavinvite.com/account/delete or, in the Android app, More → Delete account;
• Withdraw consent at any time — note that withdrawing consent for photo processing means we can no longer render or host videos containing those photos;
• Nominate another person to exercise these rights in the event of your death or incapacity;
• Raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unsatisfied.

To exercise any of these, email utsavinvite@turtletechsai.com from your registered number's account or use Report a concern. We may verify your identity via an OTP to the registered mobile number before acting.

6. Children's data

UtsavInvite is not intended for anyone under 18 and we do not knowingly create accounts for minors. We also do not accept photographs of people under 18: uploaded images are screened and faces detected as belonging to a minor are rejected at upload, and no caricature or AI processing is performed on them.

Invitation text may legitimately name a child (for example on a naming-ceremony or birthday invitation). If you believe a child's personal data has reached us in any other way, tell us and we will delete it promptly.

7. Cookies and local storage

We do not use advertising or third-party tracking cookies. Your browser's local storage holds:

• your session token after OTP verification, so you stay signed in;
• your unfinished drafts, so your edits survive a page reload;
• a small mapping that lets your delivery page show you the host RSVP dashboard on your own device.

Clearing your browser storage signs you out and discards local drafts. Razorpay's checkout sets its own cookies when it loads, governed by Razorpay's privacy policy.

8. Security

We use HTTPS for all traffic, store phone numbers in hashed form where full numbers are not needed, keep media in access-controlled cloud storage, and serve videos through unguessable delivery links rather than public listings. Access to production data is limited to personnel who need it. No system is perfectly secure; if a personal data breach affecting you occurs, we will notify you and the Data Protection Board of India as the DPDP Act requires.

9. Grievance Officer

For any question, complaint or rights request about your personal data, contact our Grievance Officer, appointed under the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

We acknowledge grievances within 24 hours and resolve them within 15 days. Reports of non-consensual likeness or intimate content are acted on within 3 hours.

10. Changes to this policy

We will update this page when our processing, providers or legal obligations change, and the revision date at the top will change with it. Where a change materially affects how we use data you have already given us, we will seek fresh consent.