Privacy Policy

Highly Bored LLP operates ShaadiScheduler and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your data. It is compliant with the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDPA") to the extent its provisions are in force.

1. Data We Collect

1.1 Information You Provide

• Account information: name, email address, phone number.
• Wedding details: date, city, type, community, guest count, budget range.
• Guest list: names, phone numbers, family relationships, RSVP status.
• Budget information: estimated and actual spend per category.
• Personal notes, letters to self, and Couple's Corner content.
• Messages sent to the Is This Normal? chat feature.
• Decisions logged in the Decision Log.

1.2 Information Collected Automatically

• Device information: browser type, operating system, device type.
• Usage data: pages visited, features used, time on Platform.
• Log data: IP address, access times, referring URLs.
• Cookies and similar technologies (see Section 8).

1.3 Sensitive Personal Data

Under the SPDI Rules, we may collect the following Sensitive Personal Data or Information (SPDI):

• Financial information - budget figures and spending data.
• Mental health-related data - messages shared in the Is This Normal? feature.

We handle all SPDI with heightened care and do not share it with third parties except as described in Section 4.

2. How We Use Your Data

• To provide, operate, and improve the Platform.
• To generate personalised AI-powered checklists, estimates, and planning content.
• To power the Is This Normal? emotional support chat.
• To enable the Family Portal.
• To process payments and manage your plan.
• To send service-related communications.
• To respond to queries, complaints, and support requests.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with applicable legal obligations.
• To improve our AI models and Platform features using anonymised and aggregated data only. We will never use identifiable personal data for AI training without your explicit additional consent.

By using the Platform, you consent to anonymised and aggregated data from your activity being used for AI model improvement and service enhancement.

3. Legal Basis for Processing

• Consent: You provide explicit consent when you register and accept these policies.
• Contract: Processing is necessary to provide the services you subscribed to.
• Legitimate Interest: To improve our services, prevent fraud, and ensure security.
• Legal Obligation: To comply with applicable laws and regulations.

You may withdraw consent at any time by contacting grievance@shaadischeduler.com. Withdrawal does not affect the lawfulness of prior processing.

4. How We Share Your Data

4.1 Third-Party Service Providers

We share data with the following processors to operate the Platform:

• Supabase Inc. - database storage and authentication.
• Vercel Inc. - Platform hosting and deployment.
• OpenAI Inc. - AI content generation (checklist, budget, Is This Normal? chat).
• Anthropic PBC - AI content generation (insights and selected features).
• Payment gateway providers - for transaction processing.

We do not sell your personal data to any third party.

4.2 Family Portal

When you activate and share the Family Portal link, the following becomes visible to anyone with the link: wedding event dates and locations, overall planning progress percentage, and tasks assigned to family members.

Budget details, full guest list, personal notes, and Couple's Corner content are never shared via the Family Portal.

4.3 Legal Disclosure

We may disclose your data if required by law, court order, or government authority, or to protect the rights, property, or safety of the Company, users, or the public.

5. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify affected users without undue delay after becoming aware of the breach.
• Notify relevant authorities as required under applicable law, including the Data Protection Board of India once constituted under the DPDPA 2023.
• Provide you with information about the nature of the breach, data affected, likely consequences, and steps we are taking to address it.
• Maintain a record of all data breaches regardless of whether notification is required.

To the fullest extent permitted by law, our liability for data breaches shall be limited as described in our Terms and Conditions.

6. International Data Transfers

Your data may be transferred to and processed in countries outside India, including the United States and the European Union, by our third-party service providers. We take reasonable steps to ensure appropriate safeguards are in place for any international transfer.

If you access the Platform from outside India, you do so at your own risk and are responsible for compliance with your local data protection laws.

7. Data Retention

• Active account data: Retained for the duration of your account plus 90 days after your last login.
• Is This Normal? messages: Retained for the duration of your account and deleted upon account deletion.
• Payment records: Retained for 7 years as required by Indian financial regulations.
• Anonymised and aggregated data: May be retained indefinitely for analytics and service improvement.

You may request deletion of your data at any time by contacting grievance@shaadischeduler.com. We will process deletion requests within 30 days, subject to legal retention obligations. Note: while a self-serve account deletion feature is on our product roadmap, deletion requests submitted by email will be actioned with the same priority.

8. Your Rights

Under applicable Indian law, including the DPDPA 2023, you have the following rights:

• Right to Access: Request a copy of your personal data.
• Right to Correction: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data, subject to legal retention requirements.
• Right to Withdraw Consent: Withdraw consent to processing at any time.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer.
• Right to Nominate: Nominate an individual to exercise rights on your behalf in the event of death or incapacity, as provided under the DPDPA 2023.

To exercise any right, contact our Grievance Officer at grievance@shaadischeduler.com. We will respond within 30 days.

9. Cookies Policy

We use cookies to keep you logged in, remember your preferences, and analyse Platform usage. We do not use cookies for advertising. You can control cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality.

10. Data Security

We implement industry-standard security measures including encryption of data in transit (TLS/HTTPS), encryption of sensitive data at rest, access controls limiting data access to authorised personnel, and regular security reviews. No method of transmission over the internet is 100% secure, and to the fullest extent permitted by law, we cannot guarantee absolute security.

11. Children's Privacy

ShaadiScheduler is not intended for persons under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact grievance@shaadischeduler.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy at any time. Changes will be notified via email and/or a notice on the Platform. Continued use after the effective date constitutes acceptance.

13. Grievance Officer

If you are not satisfied with our resolution, you may approach the Data Protection Board of India (once constituted under the DPDPA 2023) or any other appropriate authority.

Last updated: May 3, 2026 · Highly Bored LLP