Privacy Policy

Wowzey is an interactive digital gifting platform operated by [Company Name], a company registered in India. Our registered address is [Address], India. You can contact us at hello@wowzey.com for all data-related requests.

Account data: When you sign up, we collect your mobile phone number. Optionally, you may provide your name and email address. If you sign in with Google, we receive your name, email address, and profile photo from Google.

Experience content: Photos, text messages, voice notes, and other content you upload to create experiences. This content is stored securely and only shared as part of the experience link you generate.

Usage data: Pages visited, experiences created, reaction events (when a recipient opens or interacts with an experience), and timestamps. This is used to improve the product and provide analytics to creators.

Payment data: We use Razorpay for payments. We do not store your card number, UPI PIN, or full payment credentials. Razorpay's privacy policy applies to payment processing. We store order IDs, payment amounts, and transaction references.

Device and technical data: IP address, browser type, device type, and operating system — collected automatically for security and abuse prevention.

To provide the service: Create and serve experience links, send scheduled deliveries, provide creator analytics, process payments, and send important service notifications.

To improve the product: Aggregate, anonymised usage data helps us understand which occasions are popular, where users drop off, and what features to build next.

Security and fraud prevention: Rate-limiting OTP requests, detecting suspicious activity, and preventing abuse of the platform.

Legal compliance: We may process data to comply with applicable Indian law, including the Digital Personal Data Protection Act 2023 (DPDPA) and Information Technology Act 2000.

Ad-supported features: On the Free plan, we show advertisements in your creator dashboard and after AI generation. To serve relevant ads, Google AdMob may collect anonymised signals such as your device type, approximate location, and ad interaction data. See Section 4 for details. Upgrading to any paid plan removes all ads and stops AdMob data collection for advertising purposes.

We do not sell your data to third parties. We do not use your content to train AI models without explicit consent.

We share personal data only where necessary:

• Msg91 — for OTP delivery via SMS and WhatsApp, and for scheduled experience delivery.
• Razorpay — for payment processing. Subject to their privacy policy.
• OpenAI — when you use AI message generation, your input (recipient name, memories, tone) is sent to OpenAI's API. We use OpenAI's data processing agreement. Your inputs are not used by OpenAI to train their models under our enterprise agreement.
• Contabo / Cloudflare — for secure file storage and CDN delivery of experience assets.
• Google AdMob — on the Free plan, ads are shown in the creator dashboard and after AI generation. AdMob may collect device identifiers, approximate location, and ad interaction signals per Google's privacy policy to serve relevant ads. This applies only to logged-in Free-plan creators; recipients who open experience links are never exposed to AdMob. You can opt out of personalised ads in your device settings (iOS: Settings → Privacy → Tracking; Android: Settings → Google → Ads). Upgrading to any paid plan stops AdMob from loading entirely.

All third-party processors are bound by data processing agreements and handle data only as instructed by us.

As a data principal under the Digital Personal Data Protection Act 2023, you have the right to:

• Access: Request a copy of your personal data. Use Settings → Privacy → Export Data.
• Correction: Update your name, phone number, or email in Settings → Profile.
• Erasure: Request deletion of your account and all associated data. We will comply within 72 hours. Use Settings → Privacy → Delete Account, or email hello@wowzey.com.
• Grievance Redressal: Contact our Grievance Officer at hello@wowzey.com. We acknowledge within 48 hours and resolve within 30 days.

We retain your data for as long as your account is active. Specific retention periods:

• Reaction event data: 30 days, then permanently deleted.
• Deleted experiences: immediately removed from public access; purged from backups within 30 days.
• Payment records: 7 years (tax compliance).
• Account data: deleted within 72 hours of a deletion request.

We use a small number of first-party cookies and browser local storage:

• Session authentication (httpOnly cookie — cannot be read by JavaScript).
• Remote config cache (localStorage — expires after 1 hour).
• Builder draft state (localStorage — expires when you publish or clear).
• OTP channel preference (localStorage).

We do not use third-party tracking cookies or Google Analytics. You can clear local storage at any time via your browser settings.

We take security seriously:

• All data in transit is encrypted with TLS 1.3.
• Passwords are never stored — we use OTP (one-time password) authentication only.
• File uploads are stored with UUID-based filenames; no personal information in URLs.
• Access tokens expire in 15 minutes; refresh tokens in 30 days and are rotated on each use.
• Admin accounts require TOTP two-factor authentication.

If you discover a security vulnerability, please report it to hello@wowzey.com. We do not pursue legal action against good-faith security researchers.

Wowzey is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child, please contact hello@wowzey.com immediately.

We may update this policy. We will notify registered users of material changes via SMS or in-app notification at least 7 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance.

For any privacy-related questions, data requests, or to lodge a grievance:

• Email: hello@wowzey.com
• Postal: [Company Name], [Address], India — Attn: Data Grievance Officer
• Response time: 48 hours acknowledgement, 30 days resolution.