1. Introduction

WedTrack ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

WedTrack acts as a Data Controller for the information processed through our platform. This policy applies to all users including studio owners, team members, and end-clients whose data may be stored on our platform.

2. Data We Collect

From Studios (Tenants)

• Account Data: Name, email, phone number, password (hashed)
• Business Data: Agency name, subdomain, logo, branding preferences
• Billing Data: Payment history, credit transactions, subscription details
• Usage Data: Feature usage, login history, activity logs

From End-Clients (via Studios)

• Contact Information: Name, email, phone numbers, addresses
• Event Details: Wedding dates, event locations, package selections
• Signatures: Digital signatures for booking confirmations

Automatic Data Collection

• Server Logs: IP addresses, browser type, access times
• Cookies: Essential session cookies for authentication
• Performance Data: Page load times, error reports

3. How We Use Your Data

• Service Operations: To provide and maintain the WedTrack platform
• Payment Processing: To process credit purchases and subscriptions via Razorpay
• Notifications: To send booking confirmations, payment reminders, and anniversary wishes
• Customer Support: To respond to inquiries and resolve issues
• Platform Improvement: To analyze usage patterns and improve our services

4. Multi-Tenant Data Isolation

WedTrack operates as a multi-tenant platform. Each studio's data is isolated using a unique tenant_id. This ensures:

• Your data is never visible to other studios
• All database queries are scoped to your tenant
• Access controls prevent cross-tenant data access

5. Third-Party Services

We share data with the following service providers (we do not sell your data):

• Razorpay: Payment processing (PCI-DSS compliant)
• Cloudinary: Image and file storage
• Vercel: Hosting and infrastructure
• Resend: Email delivery services

6. Cookies

WedTrack uses essential cookies only. We do not use tracking or advertising cookies.

• Session Cookies: To maintain your authenticated session
• CSRF Tokens: To protect against cross-site request forgery

7. Data Retention

• Active Accounts: Data retained as long as your account is active
• Tax Records: Financial records retained for 7 years as required by law
• Account Deletion: Upon request, data is deleted within 90 days (except legally required records)

8. Security Measures

We implement industry-standard security measures:

• HTTPS: All data transmitted over encrypted connections
• Database Encryption: Data encrypted at rest
• Password Hashing: Passwords stored using bcrypt hashing
• Session Versioning: Automatic session invalidation on password changes

9. Your Rights

Under the Digital Personal Data Protection Act 2023 (India), you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal requirements)
• Portability: Request your data in a machine-readable format

10. Contact & Grievance Officer

For privacy-related inquiries or to exercise your rights:

• Grievance Officer: WedTrack Privacy Team
• Email: privacy@wedtrack.in
• Response Time: We will respond within 30 days

11. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the platform. Continued use of WedTrack after changes constitutes acceptance of the updated policy.