Effective: 1 January 2026 · Version 1.0 · Last updated: 10 May 2026
This policy describes how Event Super OS (the "Platform") collects, uses, shares, and protects personal data when you use:
/, /pricing)/event-manager) — for event-studio operators/team) — for studio crew/client) — for couples / event clients/rsvp, /invitation, /voucher, /vendor)/studio/<slug>This policy is published in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP) and aligned with the EU General Data Protection Regulation (GDPR).
| Category | Examples | Source |
|---|---|---|
| Account data | Email, password hash, full name | You, at sign-up |
| Studio profile | Studio name, tagline, logo, brand colors, phone | You, in onboarding / settings |
| Event data | Event name, dates, venue, vendors, crew, guests, RSVPs, photos, documents | Studios & their clients enter this |
| Guest data | Guest names, contact details, RSVPs, dietary preferences, accommodation | Studios upload; guests respond via /rsvp |
| Payment data | Card last 4, payment status. Full card numbers are NEVER stored on our servers. | Stripe / Razorpay (PCI-compliant) |
| Usage data | Pages viewed, actions taken, IP address, browser, OS | Automatically, when you use the Platform |
| Marketing data | UTM parameters, referrer, ad campaign IDs | If you arrive via a campaign link |
We do not sell your data. We do not use your event data to train AI models. We do not share guest contact details with third parties for advertising.
| Processor | Purpose | Data location |
|---|---|---|
| Supabase Inc. (USA) | Database & auth hosting | AWS Mumbai (ap-south-1) by default |
| Cloudflare | CDN & static asset delivery | Global edge |
| Stripe / Razorpay | Payment processing | Their respective regions |
| Resend / Postmark | Transactional email | USA / EU |
| OpenAI (optional) | AI co-pilot — only if you provide your own API key | USA |
Each sub-processor is bound by a data-processing agreement that requires equivalent or stronger safeguards than this policy.
Primary storage is in India (AWS Mumbai). Data may transit briefly through Cloudflare's global edge for delivery. We do not transfer your event data outside of India for storage without your consent. White-label resellers may select an alternative region in writing.
Under the DPDP Act and GDPR, you have the right to:
You can exercise data export and account deletion directly inside /event-manager → Settings → Privacy. Other requests: email us using the address below; we respond within 30 days.
If you believe you've found a security vulnerability, email security@eventsuperos.com. We respond within 24 hours and will not pursue legal action against good-faith researchers.
The Platform is not intended for users under 18. Studios may capture guest data that includes children (e.g., kids attending a wedding). In those cases, we treat such data with extra care and the studio is the data controller; we are merely a processor. Studios must obtain appropriate consent from parents/guardians before entering minors' data.
Data Protection Officer
Email: dpo@eventsuperos.com
Postal: [Studio mailing address — to be filled in by Anthropic / studio operator]
India grievance officer (DPDP §10): grievance@eventsuperos.com · we acknowledge within 24 hours and resolve within 30 days.