weddingkart
Try Free

Privacy Policy

Last updated: 21 August 2026

1. Who We Are

Weddingkart ("we," "us," or "our") operates the website www.weddingkart.co, the Weddingkart mobile apps (iOS and Android), and the Weddingkart web app at app.weddingkart.co (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Information you provide

  • Account information: name, email address, phone number
  • Wedding details: event dates, venue information, guest lists
  • Guest data: names, phone numbers, RSVP responses, travel details uploaded by event managers
  • Payment information: processed securely through third-party payment providers
  • Communications: messages sent through the platform, support requests

Information collected automatically

  • Device and browser information
  • IP address and approximate location
  • Usage data: pages visited, features used, time spent
  • Cookies and similar tracking technologies

3. How We Use Your Information

  • To provide and maintain the Service
  • To send WhatsApp messages on behalf of event managers to their guests
  • To process RSVPs, travel tickets, and ID card collections
  • To improve our platform and develop new features
  • To communicate with you about your account and the Service
  • To comply with legal obligations

4. WhatsApp Messaging

Weddingkart sends WhatsApp messages to wedding guests on behalf of event managers using the WhatsApp Business API, operated by Meta Platforms, Inc. Messages are only sent to guests whose contact information has been provided by the event manager. We do not sell or share guest phone numbers with third parties for marketing purposes. As Meta operates the WhatsApp Business API outside India, message delivery involves international transfer of guest contact information - see Section 11 (International Data Transfers).

5. Google Drive Integration (Optional)

Effective: 21 April 2026

Weddingkart offers an optional integration with Google Drive that lets hosts save guest candid photos to their personal Google Drive. When you connect Google Drive:

  • What we access: We use Google's drive.file OAuth scope, which restricts our access to only files and folders Weddingkart creates in your Drive. We cannot see, download, or modify any other files in your Drive - including documents, photos, or folders you created yourself or that other apps created.
  • What we upload: Only the guest candid photos and videos sent to your wedding's chat number. We do not upload ID cards, travel tickets, or other operational documents.
  • Where files are owned: Files uploaded by Weddingkart are owned by you, in your Google Drive, and count against your Google storage quota. You can delete, move, rename, or share them at any time without involving Weddingkart.
  • What we store on our side: We store an encrypted Google refresh token so we can upload to your Drive on your behalf. This token is encrypted at rest and never exposed in any API response. You can revoke this access at any time by:
    • Tapping "Disconnect Google Drive" in the Weddingkart app, or
    • Visiting Google Account → Security → Third-party apps and removing Weddingkart
  • Data deletion: When you disconnect, we immediately delete the encrypted refresh token from our servers. Files we previously uploaded to your Drive remain in your Drive (they are yours) - you can delete them yourself if desired.
  • Use of Google user data: Weddingkart's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Sharing

We do not sell your personal data. We may share information with:

  • Service providers who help us operate the platform (hosting, analytics, messaging)
  • WhatsApp/Meta for message delivery
  • Google, when you connect Google Drive - limited to uploading guest candid photos to your own Drive under the drive.file scope (see Section 5)
  • Payment processors for transaction handling
  • Law enforcement when required by law

7. Data Security

Weddingkart is hosted on Amazon Web Services in the Mumbai region (ap-south-1). Your data is protected by:

  • Encryption in transit: all traffic to and from the Service is served over HTTPS/TLS.
  • Encryption at rest: our database uses AES-256 storage encryption managed through AWS KMS, and all uploaded files (guest documents, travel tickets, ID cards, photos) are stored in S3 buckets with AES-256 server-side encryption enabled by default.
  • Private-by-default file storage: guest documents are written to a private bucket with an explicit private access control list; they are never publicly listable.
  • Secrets isolation: third-party credentials and OAuth refresh tokens are encrypted before storage and are never returned in any API response.

No method of electronic storage or transmission is 100% secure, and we do not claim otherwise. If we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India as required under the DPDP Act, 2023 and the DPDP Rules, 2025.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Wedding-specific data (guest lists, RSVPs) is retained for up to 12 months after the wedding date unless you request earlier deletion. Google OAuth refresh tokens are deleted immediately when you disconnect Google Drive.

9. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Export your data in a portable format
  • Withdraw consent for data processing
  • Nominate another person to exercise these rights on your behalf in the event of your death or incapacity

Withdrawing consent

You can withdraw consent at any time, and it is as easy to withdraw as it was to give. Any guest can reply STOP to a Weddingkart WhatsApp message. The opt-out is recorded permanently, applies across every channel we use to contact you (WhatsApp announcements, chat, and voice calls), and cannot be reversed by an event manager re-uploading your number.

When you withdraw consent, we stop processing your personal data for that purpose. Under Section 6(6) of the DPDP Act, 2023, we will also erase your personal data unless we are required to retain it — for example, to keep a record of your opt-out so we do not contact you again, or to meet a legal or accounting obligation. Where we retain an opt-out record, it holds only the minimum needed to honour your request.

To withdraw consent and request erasure in one step, reply DELETE to any Weddingkart WhatsApp message, or email contact@weddingkart.co with the subject line beginning "Privacy:".

10. Cookies

We use essential cookies to maintain your session and preferences. We use Vercel Web Analytics for anonymous usage statistics. No third-party advertising cookies are used.

11. International Data Transfers

Weddingkart is based in India and primarily stores data on servers in the Asia-Pacific region. Some of our service providers process data outside India:

  • Meta Platforms (WhatsApp Business API): guest phone numbers and message content are processed on Meta's infrastructure, primarily in the United States, for the purpose of WhatsApp message delivery.
  • Google (when you connect Google Drive): photos uploaded to your Drive are stored by Google on infrastructure that may be located outside India, in accordance with your Google Account's region settings.
  • Vercel and other hosting / analytics providers: may process anonymous usage data on infrastructure outside India.

These transfers are made for the limited purpose of providing the Service. We rely on contractual safeguards (including the providers' standard data processing terms) to protect personal data during transfer.

12. Compliance with Indian Data Protection Law

Weddingkart operates in accordance with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act). For the purposes of the DPDP Act, Weddingkart acts as a Data Fiduciary in respect of personal data we collect directly from users (Data Principals), and as a Data Processor when handling guest data uploaded by event managers on behalf of those event managers.

As a Data Principal, you have the right to access, correct, erase, and grieve in respect of your personal data, as set out in Section 9 above. To exercise any of these rights, email contact@weddingkart.co with the subject line beginning "Privacy:" so we can route it correctly. We will respond within 30 days.

13. Children's Data

Weddingkart is a business tool for planning weddings. It is not directed at children, and you must be 18 or older to create a Weddingkart account. We do not knowingly collect personal data directly from anyone under 18.

We recognise that a wedding guest list may include children — for example a child's name, their meal preference, or their inclusion on a family's travel booking. Where an event manager or host uploads guest data that relates to a child:

  • The event manager or host is responsible for having obtained the consent of the child's parent or lawful guardian before providing that data to us, as required by Section 9 of the DPDP Act, 2023.
  • We do not use children's data for tracking, behavioural monitoring, or targeted advertising. Weddingkart runs no advertising products and sets no third-party advertising cookies for any user, of any age.
  • We do not knowingly undertake any processing of a child's personal data that is likely to cause a detrimental effect on their well-being.

If you believe a child's personal data has been provided to us without the consent of their parent or guardian, email contact@weddingkart.co with the subject line beginning "Privacy:" and we will delete it.

14. Grievance Officer

In accordance with the DPDP Act and the Information Technology Rules, 2011, the contact details of the Grievance Officer are:

  • Name: Mayank Jaiswal
  • Designation: Grievance Officer, Weddingkart
  • Email: contact@weddingkart.co (subject line: "Grievance:")
  • Address: Delhi, India
  • Response time: we acknowledge within 72 hours and resolve within 30 days of receipt of the complaint

If you are not satisfied with how we have handled your complaint, you may escalate it to the Data Protection Board of India under the DPDP Act, 2023.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated date.

16. Contact Us

For any questions about this Privacy Policy or about Weddingkart, contact us at contact@weddingkart.co or visit our contact page.