Privacy Policy

Circl is a community-events platform run by Circl Technologies Pvt Ltd (“Circl,” “we,” “us”). This page explains what personal data we collect, why we collect it, who we share it with, and what choices you have. It is written to comply with India's Digital Personal Data Protection Act, 2023.

1. Data we collect

• Account: name, email, phone number, profile photo, city, host status, identity verification data (Aadhaar last 4 digits for hosts only).
• Bookings & payments:events you've booked, ticket references, amount paid, payment status. Payment-card data is handled by Razorpay. We never see or store it.
• Activity: events you view, lounges you join, chat messages you send, reviews you post. This powers personalised recommendations.
• Device: browser type, IP address (for security and fraud detection only), push-notification subscription endpoints if you opt in.
• Cookies / local storage: auth tokens so you stay signed in, dismissal flags for prompts. No third-party advertising cookies.

2. Why we use it

• To create your account and let you book / host events.
• To process payments and issue refunds via Razorpay.
• To send transactional emails (ticket confirmations, refund notifications) and in-app / push notifications you've opted into.
• To personalise what you see on Explore based on your city and the lounges you've joined.
• To investigate abuse, fraud, and breach of our Terms.
• To meet legal obligations (tax records, court orders).

3. Who we share it with

We only share data with service providers we genuinely need to run Circl. Each handles your data under their own privacy commitments.

• Supabase (database + auth hosting). Data is stored in their cloud infrastructure.
• Razorpay (payments + refunds). Subject to RBI regulation.
• Resend (transactional email delivery).
• Hosts: when you book an event, the host sees your name and profile picture so they can welcome you at the door. They do not see your email, phone, or address.
• Law enforcement / regulators: only when required by a valid legal request.

We do not sell your data. We never have. We never will.

4. How long we keep it

Account data: as long as your account is active, plus 12 months after deletion (in case you change your mind or for fraud investigation). Booking and tax records: 8 years, as required by Indian tax law. Anonymised aggregate analytics: indefinitely.

5. Your rights under the DPDP Act

• Access: ask for a copy of your data.
• Correction: fix anything that's wrong.
• Erasure: ask us to delete your account.
• Withdraw consent: for marketing, push, etc.
• Grievance redressal: complain if we mishandle your data.

Email circlapp.in@gmail.com with the subject line “Data Request” and we'll respond within 14 days.

6. Children

Circl accounts are for adults 18 and older. We don't knowingly collect data from anyone under 18 to create accounts. Where a host permits minors to attend their event (e.g. junior dance classes, family workshops), the booking is made by a parent or guardian from their own account, and only the parent's data is processed by Circl. The host is responsible for verifying the minor's eligibility at the venue.

If you believe we have inadvertently collected an under-18's data, email us and we'll delete it.

7. Security

We use TLS in transit, encryption at rest via Supabase, and Razorpay for payment processing. No system is 100% secure, but we treat your data like our own.

8. Changes to this policy

We'll post any material changes here and email registered users. Continued use of Circl after a change means you accept the new policy.

9. Grievance officer

Per the DPDP Act, our Grievance Officer is Abhiraj Tayer, reachable at circlapp.in@gmail.com. Acknowledgement within 48 hours, resolution within 30 days.