Privacy Notice

In short

• We collect the minimum needed to run events: your name, email, optionally your phone number and city.
• We never see your card, UPI or bank details. Payments are handled by Razorpay on their pages.
• Organizers of events you register for receive your name, email and phone so they can run the event, and are bound by a data-processing addendum.
• Marketing (the weekly digest, invitations from organizers, WhatsApp) is opt-in and separate, with a switch each at Email preferences — no sign-in needed, the link at the bottom of any of those emails opens it.
• Data is stored in India. You can export or delete your data on request; we respond within 7 days.

1. What we collect

2. Purposes and lawful basis

Under the DPDP Act we process personal data either with your consent or for a “legitimate use” listed in section 7 of the Act. Each purpose is itemised below.

3. Consent and withdrawal

• Consent to these terms and this notice is recorded when you sign in for the first time, with a timestamp.
• Marketing consent (the weekly digest, WhatsApp broadcasts) is a separate, unticked checkbox. We record the date you opted in.
• The three marketing channels are three separate switches, and turning one off never turns another off: the weekly city digest, invitations from organizers whose events you attended or follow, and WhatsApp messages.
• You can withdraw any consent at any time, from Email preferences (reachable without signing in, from the link at the bottom of any marketing email), from the “Notifications” section of your dashboard, or by an email to grievance@jamao.in. Withdrawal is as easy as giving consent and takes effect immediately.
• Some emails cannot be turned off, because they are how the service works and they only ever concern something you did: your sign-in codes, your ticket and QR code when you register for an event, reminders for events you registered for, changes or cancellations to those events, and payment receipts and refunds. To stop these, cancel your registrations or delete your account. The full list, template by template, is on Email preferences.
• Withdrawing consent does not affect processing already done, and does not undo registrations you have already made; we still need to send you the messages above about those events.

4. Who we share data with

• Organizers of events you register for (name, email, phone, ticket, status, answers). They may use it only to run that event unless you separately opt in to their updates. See the data-processing addendum.
• Other attendees see your name and avatar in the “who's going” list on the event page, never your email or phone.
• Sub-processors listed below, strictly to provide the service.
• Authorities when required by Indian law, or to protect the safety of users.
• We do not sell personal data and do not run third-party advertising.

5. Sub-processors

6. Retention

When the retention period ends, data is deleted or irreversibly anonymised. Backups roll off within 35 days after deletion.

7. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and the processing we do.
• Correct or update inaccurate or incomplete data (name, phone and city can be edited from your dashboard).
• Erase your data, subject to the retention obligations above (we must keep invoices, for example).
• Withdraw consent as described in section 3.
• Nominate a person to exercise these rights on your behalf in the event of death or incapacity.
• Complain to the Data Protection Board of India if we do not resolve your grievance.

To exercise any right, email grievance@jamao.in from your registered email address. We respond within 7 days and complete requests within 30 days. Data exports are provided as a JSON or CSV file.

8. Security

• Encryption in transit (TLS 1.2+) and at rest (database and object storage).
• Sign-in by one-time codes: there are no passwords for us to leak.
• Role-based access: organizers see only their own events' attendees; staff access is logged and limited to support needs.
• Payment details are handled entirely by Razorpay (PCI-DSS Level 1).
• Breach response: we notify the Data Protection Board and affected users without undue delay, and within 72 hours of confirming a breach, as required by the DPDP Rules.

9. Children

Jamao accounts are for people 18 and over. Some events (student hackathons, college fests) welcome younger attendees; for those, the organizer must obtain verifiable parental consent and collect no more than name and institution. We do not knowingly process data of children for tracking, behavioural monitoring or targeted advertising, and we will delete a child's data on request from a parent or guardian.

10. Cookies

We use one strictly necessary cookie (jamao_session) to keep you signed in. It is HttpOnly and expires after 30 days. We do not use advertising cookies or third-party trackers. Our analytics are cookie-less; see the next section.

11. Analytics

We measure how the site is used so we can fix what is broken and build what people actually visit. This is deliberately the smallest amount of data that answers that question.

• What we collect. For each page view: the path you visited (never the query string), the type of page, the event or city it relates to, the website you arrived from (its domain only), your country, whether you were on a phone, tablet or computer, whether you were signed in, and the time.
• Clicks out to an organizer's page. Many listings on Jamao are curated: the registration happens on the organizer's own site, not here. When you use the button that takes you there, we record which listing you left from, the name of the site you went to, whether you were on a phone, tablet or computer, whether you were signed in, and the time. We do not record the address of the page you land on beyond that site's name, and we never store the link's web address or anything after the question mark in it. We add utm_source, utm_medium and utm_campaign to the link so the organizer can see that Jamao sent you; those tell them nothing about you personally. This is how we find out whether our listings are useful to anyone — and we chose to measure that rather than make you sign in first.
• No IP address is ever stored. Your IP is used for a fraction of a second to compute a one-way code and is then discarded. The code mixes in today's date, so it changes every night: it cannot be linked to you, and it cannot be linked to your visits on any other day.
• Why. To understand which events and cities people are looking for, to show organizers how many people viewed their event page, and to keep the service secure and working. Lawful basis: legitimate use under section 7 of the DPDP Act (security and integrity of the service), on data that does not identify you.
• How long. 90 days, after which page-view and outbound-click records are deleted automatically.
• No cookies, no third-party trackers, no advertising. We also use Cloudflare Web Analytics, which is cookie-less by design, collects no personal data and does not follow you across sites.
• How to object. Email grievance@jamao.in and we will exclude you and delete anything we hold. Browser “Do Not Track” and any content blocker that blocks our beacon also work for page views: we do not attempt to work around them. A blocker cannot stop the outbound-click record, because it is made by our own link rather than by anything running in your browser; to be excluded from it, email the address above.

12. Grievance officer

In line with the DPDP Act and the Information Technology (Intermediary Guidelines) Rules, 2021, our grievance officer is:

General questions: hello@jamao.in. If you are not satisfied with our response, you may approach the Data Protection Board of India.