Privacy Policy

Mangalyam processes account data, wedding planning records, guest and vendor metadata, uploaded media, and payment workflow references needed to run the platform.

Where payout and compliance flows apply, KYC and banking metadata may be processed with elevated security controls.

Data is used to deliver requested features, operate role-based workflows, secure platform activity, and maintain auditability for financial and governance actions.

We also use limited analytics to improve activation, reliability, and workflow clarity across personas.

Our product analytics (PostHog) is cookieless: it sets no cookies and stores nothing on your device, and it keeps no identifier that follows you between visits. Visitors are counted with a hash that changes every day. That is why we do not show a cookie banner. You can switch analytics off at the end of this page; we also stop it when your browser sends Do Not Track or Global Privacy Control.

Data is segmented by tenant and role. Couples, vendors, agencies, and admins only see data necessary for their permitted tasks.

Payment and KYC data may be shared with regulated payment providers and controlled support workflows only when required for transaction or compliance processing.

Service providers we use to run the platform: Supabase (database and authentication), Vercel (hosting), Cloudflare R2 (photo and file storage), Razorpay (payments and payouts), Resend and WATI (email and WhatsApp notifications), Sentry (error monitoring), and PostHog (product usage analytics). PostHog receives page and feature-usage events; PostHog session recording is switched off and form input values are masked, so it never receives your guest lists, budgets, payment details, or KYC documents.

Sentry receives error reports so we can fix what breaks. We do not record sessions.

Mangalyam uses cloud storage, role controls, and audit logging for sensitive transitions. Access to high-risk operations is limited to authorized roles.

Retention periods differ by data class. Financial and audit records may be retained longer to satisfy regulatory, fraud-prevention, and reconciliation requirements.

Changes made on Mangalyam are written to a permanent audit record, so that couples, partners and Mangalyam can settle disputes and meet accounting and security obligations. The record names who made each change by an internal account number, not by name. It keeps money amounts and statuses, but masks phone numbers and email addresses (only the last four characters are kept) and leaves out notes and contact names. It does not store your IP address or browser details. Nobody can edit or delete the audit record. Money entries in it are kept for at least eight years, as Indian accounting and tax law requires.

You can request profile corrections, consent updates where applicable, and data handling clarifications through support.

Certain deletion or export requests may be staged where legal, audit, or financial integrity obligations require temporary retention.

Some of the service providers above process data on infrastructure located outside India, in the United States. Specifically: PostHog (product analytics), Sentry (error monitoring), and Resend (transactional email) receive the limited data described above on US-region infrastructure. Supabase (database and authentication) and Cloudflare R2 (media storage), which hold your core account and wedding data, are configured to store that data in-region.

Under Section 16 of India’s Digital Personal Data Protection Act, 2023, these transfers are made on the basis of your consent, captured at sign-up and manageable from Settings → Privacy & data, together with contractual data-protection terms (standard contractual clauses / data processing addenda) with each sub-processor that require them to protect your data to the standard this policy describes.

You can switch product analytics off at any time with the switch at the end of this page, and withdraw consent for marketing messages from Settings → Privacy & data. Essential providers required to operate the service and meet legal obligations — authentication, payments, storage, and email delivery — will continue to process the minimum data needed to run your account.

If you have an account, you can exercise your data-subject rights directly from Settings → Privacy & data: grant or withdraw consent for marketing messages, download a copy of your personal data (right to access and portability), and delete your account (right to erasure).

Erasure anonymizes your personal data. Records we are legally required to keep — payment, invoice, and compliance/KYC records — are retained in anonymized or immutable form as the law requires, and are not hard-deleted.

When you delete your account, your name is removed from the audit record: changes you made there show as made by a former member.

To raise a grievance or reach our Grievance Redressal Officer, see the Grievance Redressal page or write to grievance@mangalyam.io.