We collect only what we need to sell and check tickets. We never sell your data, never use it for ads, and never send it to any AI service. We follow the Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Who is responsible for your data
STEANGJEAR PVT LTD (TapMyTicket), A-13, Third Floor, Front Side Left Portion, Maya Puri, New Delhi - 110064, is the "Data Fiduciary" under the DPDP Act: we decide how your personal data is used on TapMyTicket.
Questions or complaints: our Grievance Officer, Vaibhav Senger, at admin@tapmyticket.com.
2. Data we collect
- Account: name, email, WhatsApp number, city, profile photo (optional) and UPI ID (optional, for refunds and resale payouts). If you use Google login, Google gives us your name, email and profile photo.
- Bookings: orders, tickets, attendee names, answers to questions the organizer asks, refunds, transfers, resale listings, waitlist and squad bookings, and gate check-in time.
- Payments: Razorpay processes your payment. We receive the payment reference, amount, method type (for example UPI or card) and status. We never receive your full card number, CVV, UPI PIN or bank password.
- Organizers: organization details, team members, and for payouts the KYC details (PAN, bank account, IFSC, GSTIN, address and documents). Bank and financial details are sensitive personal data; we collect them only with the organizer's consent and only for payouts, tax and verification, and only the owner of the organizer account and our admins can see them.
- Device and usage: IP address, browser and device type, pages visited, and error reports, to keep the service secure and working.
- Messages: what you send us through Contact, Help, email or WhatsApp.
3. Why we use it
- To create your account and log you in.
- To sell, deliver and check your tickets, and send booking confirmations, tickets and event updates by email, and by WhatsApp if you gave us your WhatsApp number for this purpose.
- To process refunds, transfers, resale and organizer payouts.
- To stop fraud, bots and ticket touting, and to keep accounts safe.
- To meet legal duties such as tax invoices, GST and accounting records, and lawful requests from authorities.
- To understand how the app is used and fix problems (analytics and error reports).
- To send offers and new-event news, only if you said yes. You can switch this off in Profile at any time.
5. No AI processing
We do not send your personal data to any artificial intelligence (AI) service, and we do not use it to train AI models. If we ever add a feature that uses AI, we will ask for your consent first, name the AI provider, and update this policy before it starts.
6. How long we keep it
- Account data: until you delete your account.
- Orders, invoices and payment records: up to 8 years, as required by tax and company law. When you delete your account, these records are anonymised (your name, email and phone are removed).
- Organizer KYC and payout records: up to 8 years after the organizer account closes, for tax and audit.
- Security and system logs (such as login events and IP addresses): at least 180 days and up to 1 year, as Indian cyber-security rules (CERT-In directions) and the DPDP Rules require. Hashed IP addresses used only to stop form spam: 24 hours. Error reports: up to 90 days. Analytics: up to 12 months.
- Support messages: up to 2 years.
7. Your rights under the DPDP Act
- Access: ask for a summary of the personal data we hold about you and who we shared it with.
- Correction: fix or complete your details in Profile → Edit, or ask us.
- Erasure: delete your account in Profile → Delete account. Your personal data and login are deleted straight away, except records we must keep by law (anonymised). See How to delete my account.
- Withdraw consent: switch off offers in Profile, or delete your account.
- Nominate: name someone to use these rights for you if you die or become unable to.
- Grievance: complain to our Grievance Officer, and then, if you are not satisfied, to the Data Protection Board of India.
To use any of these rights, email admin@tapmyticket.com. We reply within 7 days. You can ask for this policy in Hindi or any other language listed in the Eighth Schedule of the Constitution, and we will provide it.
8. Consent and withdrawal
When you first log in, we ask you to agree to our Terms and this Privacy Policy. Marketing messages are a separate, optional choice. You can withdraw consent at any time; this doesn't affect what we did before, and we may still keep records the law requires.
9. Children's data
Accounts are for people aged 18 and over. Tickets for children (for example kids and family events) should be booked by a parent or guardian, who gives consent for the child's name to be used on the ticket. We do not track children or show them ads.
10. How we protect it
All traffic is encrypted (HTTPS). Every database table has row-level security, so each person can only reach their own data. Staff access is limited and logged. Ticket QR codes are signed and change every 15 seconds. Card and UPI details never reach our servers.
If a data breach affects you, we will tell you without delay, and report it to the Data Protection Board of India and CERT-In within the times the law sets.
12. Changes to this policy
We will show the new date at the top and tell you about important changes by email or in the app.
13. Contact the Grievance Officer
Vaibhav Senger, Grievance Officer, STEANGJEAR PVT LTD, A-13, Third Floor, Front Side Left Portion, Maya Puri, New Delhi - 110064. Email admin@tapmyticket.com. See Grievance Officer for timelines.