Privacy Policy

Wowzey is an interactive digital gifting platform operated from India. We are a small, independently-run team; formal company registration details will be published here once the entity is incorporated. You can contact us at hello@wowzey.com for all data-related requests.

Account data: When you sign up, we collect your mobile phone number. Optionally, you may provide your name and email address. If you sign in with Google, we receive your name, email address, and profile photo from Google.

Experience content: Photos, text messages, voice notes, and other content you upload to create experiences. This content is stored securely and only shared as part of the experience link you generate.

Usage data: Pages visited, experiences created, reaction events (when a recipient opens or interacts with an experience), and timestamps. This is used to improve the product and provide analytics to creators.

Payment data: We use Razorpay for payments. We do not store your card number, UPI PIN, or full payment credentials. Razorpay's privacy policy applies to payment processing. We store order IDs, payment amounts, and transaction references.

Device and technical data: IP address, browser type, device type, and operating system — collected automatically for security and abuse prevention.

To provide the service: Create and serve experience links, send scheduled deliveries, provide creator analytics, process payments, and send important service notifications.

To improve the product: Aggregate, anonymised usage data helps us understand which occasions are popular, where users drop off, and what features to build next.

Security and fraud prevention: Rate-limiting OTP requests, detecting suspicious activity, and preventing abuse of the platform.

Legal compliance: We may process data to comply with applicable Indian law, including the Digital Personal Data Protection Act 2023 (DPDPA) and Information Technology Act 2000.

Ad-supported features: On the Free plan, we may show advertisements in your creator dashboard and after AI generation. Where ads are shown, Google AdSense may collect anonymised signals such as your browser type, approximate location, and ad interaction data to serve relevant ads. See Section 4 for details. Upgrading to any paid plan removes all ads and stops AdSense data collection for advertising purposes.

We do not sell your data to third parties. We do not use your content to train AI models without explicit consent.

We share personal data only where necessary:

• Msg91 — for OTP delivery via SMS and WhatsApp, and for scheduled experience delivery.
• Razorpay — for payment processing. Subject to their privacy policy.
• OpenAI — when you use AI message generation, your input (recipient name, memories, tone) is sent to OpenAI's API. We use OpenAI's data processing agreement. Your inputs are not used by OpenAI to train their models under our enterprise agreement.
• Contabo / Cloudflare — for secure file storage and CDN delivery of experience assets.
• Google AdSense — on the Free plan, ads may be shown in the creator dashboard and after AI generation. Where ads are shown, AdSense may collect cookies, approximate location, and ad interaction signals per Google's Privacy Policy to serve relevant ads. This applies only to logged-in Free-plan creators; recipients who open experience links are never exposed to AdSense. You can opt out of personalised ads at adssettings.google.com. Upgrading to any paid plan stops AdSense from loading entirely.

All third-party processors are bound by data processing agreements and handle data only as instructed by us.

As a data principal under the Digital Personal Data Protection Act 2023, you have the right to:

• Access: Request a copy of your personal data. Use Settings → Privacy → Export Data.
• Correction: Update your name, phone number, or email in Settings → Profile.
• Erasure: Request deletion of your account and all associated data. We will comply within 72 hours. Use Settings → Privacy → Delete Account, or email hello@wowzey.com.
• Grievance Redressal: Contact our Grievance Officer at hello@wowzey.com. We acknowledge within 48 hours and resolve within 30 days.

We retain your data for as long as your account is active. Specific retention periods:

• Reaction event data: 30 days, then permanently deleted.
• Deleted experiences: immediately removed from public access; purged from backups within 30 days.
• Payment records: 7 years (tax compliance).
• Account data: deleted within 72 hours of a deletion request.

We use a small number of first-party cookies and browser local storage:

• Session authentication (httpOnly cookie — cannot be read by JavaScript).
• Remote config cache (localStorage — expires after 1 hour).
• Builder draft state (localStorage — expires when you publish or clear).
• OTP channel preference (localStorage).

We do not use third-party tracking cookies or Google Analytics. You can clear local storage at any time via your browser settings.

We take security seriously:

• All data in transit is encrypted with TLS 1.3.
• Passwords are never stored — we use OTP (one-time password) authentication only.
• File uploads are stored with UUID-based filenames; no personal information in URLs.
• Access tokens expire in 15 minutes; refresh tokens in 30 days and are rotated on each use.
• Admin accounts require TOTP two-factor authentication.

If you discover a security vulnerability, please report it to hello@wowzey.com. We do not pursue legal action against good-faith security researchers.

Wowzey is intended for users aged 13 and above. The platform is not directed at, marketed to, or designed for children under the age of 13. We do not knowingly collect, store, or process personal data from anyone under the age of 13.

Google AdSense and children: We have configured Google AdSense with child-directed treatment settings disabled, as the platform is not designed for audiences under 13. Any AdSense ads shown on the Free plan comply with Google's policies for general audiences.

If we become aware that we have inadvertently collected data from a user under 13, we will promptly delete that data and the associated account. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at hello@wowzey.com.

We may update this policy. We will notify registered users of material changes via SMS or in-app notification at least 7 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance.

For any privacy-related questions, data requests, or to lodge a grievance:

• Email: hello@wowzey.com — Attn: Data Grievance Officer
• Response time: 48 hours acknowledgement, 30 days resolution.
• A postal address will be published here once our registered business entity is formalized.