Privacy Notice

In short

• We collect the minimum needed to run events: your name, email, optionally your phone number and city.
• We never see your card, UPI or bank details. Payments are handled by Razorpay on their pages.
• Organizers of events you register for receive your name, email and phone so they can run the event, and are bound by a data-processing addendum.
• Marketing (the weekly digest) is opt-in and separate. You can withdraw any consent in one click from your dashboard or by email.
• Data is stored in India. You can export or delete your data on request; we respond within 7 days.

1. What we collect

2. Purposes and lawful basis

Under the DPDP Act we process personal data either with your consent or for a “legitimate use” listed in section 7 of the Act. Each purpose is itemised below.

3. Consent and withdrawal

• Consent to these terms and this notice is recorded when you sign in for the first time, with a timestamp.
• Marketing consent (the weekly digest, WhatsApp broadcasts) is a separate, unticked checkbox. We record the date you opted in.
• You can withdraw any consent at any time: unsubscribe links in every digest, the “Notifications” section of your dashboard, or an email to grievance@jamao.in. Withdrawal is as easy as giving consent and takes effect within 24 hours.
• Withdrawing consent does not affect processing already done, and does not undo registrations you have already made; we still need to send you transactional messages about those events.

4. Who we share data with

• Organizers of events you register for (name, email, phone, ticket, status, answers). They may use it only to run that event unless you separately opt in to their updates. See the data-processing addendum.
• Other attendees see your name and avatar in the “who's going” list on the event page, never your email or phone.
• Sub-processors listed below, strictly to provide the service.
• Authorities when required by Indian law, or to protect the safety of users.
• We do not sell personal data and do not run third-party advertising.

5. Sub-processors

6. Retention

When the retention period ends, data is deleted or irreversibly anonymised. Backups roll off within 35 days after deletion.

7. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and the processing we do.
• Correct or update inaccurate or incomplete data (name, phone and city can be edited from your dashboard).
• Erase your data, subject to the retention obligations above (we must keep invoices, for example).
• Withdraw consent as described in section 3.
• Nominate a person to exercise these rights on your behalf in the event of death or incapacity.
• Complain to the Data Protection Board of India if we do not resolve your grievance.

To exercise any right, email grievance@jamao.in from your registered email address. We respond within 7 days and complete requests within 30 days. Data exports are provided as a JSON or CSV file.

8. Security

• Encryption in transit (TLS 1.2+) and at rest (database and object storage).
• Sign-in by one-time codes: there are no passwords for us to leak.
• Role-based access: organizers see only their own events' attendees; staff access is logged and limited to support needs.
• Payment details are handled entirely by Razorpay (PCI-DSS Level 1).
• Breach response: we notify the Data Protection Board and affected users without undue delay, and within 72 hours of confirming a breach, as required by the DPDP Rules.

9. Children

Jamao accounts are for people 18 and over. Some events (student hackathons, college fests) welcome younger attendees; for those, the organizer must obtain verifiable parental consent and collect no more than name and institution. We do not knowingly process data of children for tracking, behavioural monitoring or targeted advertising, and we will delete a child's data on request from a parent or guardian.

10. Cookies

We use one strictly necessary cookie (jamao_session) to keep you signed in. It is HttpOnly and expires after 30 days. We do not use advertising cookies or third-party trackers. Our analytics are cookie-less; see the next section.

11. Analytics

We measure how the site is used so we can fix what is broken and build what people actually visit. This is deliberately the smallest amount of data that answers that question.

• What we collect. For each page view: the path you visited (never the query string), the type of page, the event or city it relates to, the website you arrived from (its domain only), your country, whether you were on a phone, tablet or computer, whether you were signed in, and the time.
• No IP address is ever stored. Your IP is used for a fraction of a second to compute a one-way code and is then discarded. The code mixes in today's date, so it changes every night: it cannot be linked to you, and it cannot be linked to your visits on any other day.
• Why. To understand which events and cities people are looking for, to show organizers how many people viewed their event page, and to keep the service secure and working. Lawful basis: legitimate use under section 7 of the DPDP Act (security and integrity of the service), on data that does not identify you.
• How long. 90 days, after which page-view records are deleted automatically.
• No cookies, no third-party trackers, no advertising. We also use Cloudflare Web Analytics, which is cookie-less by design, collects no personal data and does not follow you across sites.
• How to object. Email grievance@jamao.in and we will exclude you and delete anything we hold. Browser “Do Not Track” and any content blocker that blocks our beacon also work: we do not attempt to work around them.

12. Grievance officer

In line with the DPDP Act and the Information Technology (Intermediary Guidelines) Rules, 2021, our grievance officer is:

General questions: hello@jamao.in. If you are not satisfied with our response, you may approach the Data Protection Board of India.