Gatherify Privacy Policy

1. Who we are and what this policy covers

Gatherify operates a platform for discovering events and trips, buying tickets, organizing events and contests, and finding and booking suppliers. This policy covers personal information processed through Gatherify's website, application and related support services. The operator and privacy contact are listed below.

The information we collect depends on the services you choose. Browsing a public page does not by itself create an account or authorize Google sign-in. The separate ticket-booking review demo uses an anonymous session and simulated payments; its additional details are explained in section 11.

2. Information received through Sign in with Google

When you choose Continue with Google and authorize sign-in, Google provides basic account information to Gatherify through Supabase, our authentication provider. This includes your name, email address, email verification status, Google account identifier and, when available, your profile picture. The permissions used for this are openid, userinfo.email and userinfo.profile.

We use this information to authenticate you, create or identify your Gatherify account, populate available account details, maintain your signed-in session and protect account access. Your account information also supports services you request, such as identifying the attendee on a booking and sending ticket, security or support messages. Google sign-in does not grant hosting or supplier privileges automatically.

We do not receive your Google password. This sign-in integration does not request access to Gmail messages, Google Drive files, Google Calendar, Google Contacts or Google Photos libraries. Your Google profile picture, if supplied, is basic profile information, not access to your photo library. A phone number, location, age declaration or verification document submitted separately to Gatherify is not obtained through these Google sign-in permissions.

Google-derived identity information is stored in Supabase Authentication and relevant Gatherify account records. It is shared only as described in sections 5 and 6 to operate requested services, protect accounts or meet applicable obligations. We do not sell Google user data, share it with data brokers, use it to build personalized advertising profiles, determine creditworthiness or train general-purpose artificial intelligence models.

Information obtained from Google is handled under the Google API Services User Data Policy, including its Limited Use requirements. Google account data is used for the user-facing functions explained here. New uses that require additional access will be explained before the relevant permission is requested.

Google API Services User Data Policy

3. Other information you provide or generate

Account and profile information may include your name, email address, phone number, profile image, age group, account roles and optional profile details. We also process authentication identifiers and session information. Information you choose to publish in a public profile, event listing or review is visible to people who can access that content.

Booking and event information includes your event selections, ticket quantities, attendee or contestant details, team details where applicable, admission and check-in records, travel itineraries, quotations, booking agreements, messages, reviews and support requests. Hosts and suppliers may provide business contacts, venue addresses, menus, prices, service descriptions and media.

Where a feature requires verification or settlement, we process the documents and details submitted for that purpose, verification status, bill evidence, bank account details and payment, refund or payout references. These fields are separate from Google sign-in. Do not include unnecessary identity or bank information in public uploads or messages.

Technical information may include IP addresses, browser or device information, request times, session identifiers, error information and security or activity logs. These help deliver the service, prevent abuse, investigate failures and keep financial and administrative audit trails.

4. Why we use personal information

We use personal information to provide account access; show relevant events and suppliers; process bookings, quotations, tickets and payments; support admission and event management; administer host and supplier applications; deliver requested messages; investigate complaints; prevent fraud and duplicate transactions; and maintain required financial and security records.

Optional marketing and optional analytics have separate choices in Privacy Center and are not required to receive essential booking, payment or security messages. Signing in with Google does not by itself subscribe you to marketing. We may also process information where necessary to respond to valid legal requests or protect the rights and safety of users and the service.

5. Who receives information, including Google sign-in data

Supabase processes authentication information, including Google identity information, and provides database and file-storage services. Gatherify's backend and hosting providers process the account and service records needed to run the application. Authorized staff may access relevant information for account support, verification, security, dispute handling and financial administration; access is restricted by their responsibilities.

When you book or participate in an event, the responsible host receives the relevant participant details, such as name, contact details, ticket quantity and check-in status, needed to administer that event. A supplier or host receives the booking, quotation, bill and contact information needed for the transaction you enter into with them. If your account name or email came from Google, that information may form part of these requested service records. We do not disclose Google passwords or authentication tokens to hosts, suppliers or other attendees.

Cashfree receives the customer and transaction details needed to process a payment, refund or payout. A name or email initially supplied through Google may be used as the customer contact for a payment you request. Payment credentials are handled by the payment provider; Gatherify does not store full card numbers, CVVs or UPI PINs. Configured email, SMS and identity-verification providers receive the information required for the message or check being performed.

We may disclose relevant information in response to a valid legal requirement or to investigate fraud, abuse or security incidents. Public content is shared when you choose to publish it. We do not sell personal information or provide Google sign-in data to advertising networks or data brokers. Advertiser reporting about views, clicks and bookings uses event activity summaries rather than disclosing viewers' Google account profiles.

6. Storage and security

Account and service records are held in Gatherify's application database and Supabase Authentication; uploaded files are held in configured storage, including Supabase Storage. Essential session information is also stored on your browser or device so you can stay signed in. Hosting, authentication and other providers may process information in locations outside your home region or India, depending on their service configuration.

Our safeguards include HTTPS on public services, authenticated access, role-based permissions, restricted access to private documents, expiring document links, protection of stored bank account details and security audit records. Public event media and profile content you publish are intended to be visible. No internet service can guarantee absolute security; report suspected unauthorized access using the privacy contact below.

7. Cookies, location and optional activity measurement

We use cookies or similar browser and device storage where needed for authentication, session continuity, security and preferences such as appearance. The review demo uses an essential session cookie. Google and other providers operate their own sign-in or payment pages under their respective policies.

You can select a city manually. If you use a location feature, the service may process the place you enter or coordinates you permit the device to provide; a mapping provider may receive that search or those coordinates. Remembering precise location is a separate preference. Gatherify does not continuously track your background location.

Where optional analytics is enabled with the applicable permission, Gatherify may record views or clicks on promoted events and associated booking outcomes to report campaign performance. This activity measurement is distinct from the information Google supplies at sign-in. You can manage optional analytics, marketing and remembered-location choices in Privacy Center. Blocking essential storage may prevent sign-in or booking features from working.

8. How long information is retained

We retain account information, including the identity information received from Google, while it is needed to operate your account and provide the services described here. When you request deletion, eligible profile information and files are removed or anonymized after identity checks and review of outstanding obligations.

Active bookings, event responsibilities, balances, payments, refunds and disputes may need to be resolved first. Transaction, invoice, settlement, consent, fraud-prevention and audit records may be retained with restricted access for applicable accounting or legal obligations and dispute resolution. Retention depends on the record's purpose and those obligations, rather than a single deletion period for every category.

Backups and service-provider copies may remain for their applicable retention cycles and require separate follow-up. We explain any records retained and remaining steps when responding to a deletion request. Revoking Google access prevents future authorized access through that connection but does not automatically erase information already stored by Gatherify.

9. Access, correction, deletion and withdrawing Google access

In the main Gatherify application, sign in and open Privacy Center to review privacy choices, request a data export, raise a privacy concern or request account deletion. Profile editing lets you correct supported account fields; verified identifiers may require additional checks. Export and deletion requests require recent authentication to protect your information.

If you cannot sign in, email hr@gatherify.in with the subject Privacy request and explain whether you want access, correction or deletion of your Gatherify information, including information obtained through Google. We may ask for proportionate evidence that you control the account. Do not email a password, OTP, full card number or UPI PIN. We will explain the request's progress, any information needed and any applicable retention limitations.

You can remove Gatherify's access in your Google Account's third-party connections settings. Removing that connection is separate from deleting your Gatherify account. Request deletion through Privacy Center or the contact above if you also want us to erase eligible information already held by Gatherify. Removing access may require another supported sign-in method to use your account.

Manage third-party connections in your Google Account

10. Accounts for people under 18

People under 18 can register, but protected account activity requires the applicable parent or guardian permission and verification. An age declaration or signing in with Google alone does not establish verified parental consent. We process the age-group declaration, guardian contact and permission or review records needed for this process.

Optional marketing and analytics remain unavailable to child accounts. A parent or guardian can contact us to request access, correction, withdrawal of permission or deletion on a child's behalf after their authority is verified. Event and contest participation may have additional age requirements.

11. The anonymous ticket-booking review demo

The separate review demo does not sign you in with Google, collect real payments or request real card, UPI, bank or identity-document details. It stores the selected demo events, quantities, simulated payment or refund outcomes and any optional cancellation reason. Do not enter personal information into demo free-text fields.

An essential HttpOnly, SameSite cookie identifies the anonymous demo session. Demo session records expire 24 hours after creation; request-rate counters expire after one minute. Deleting the cookie removes access from that browser but does not immediately delete the server's record before expiry. Development may use temporary memory; a hosted demo uses its configured Redis service. Hosting providers also receive ordinary request information required to deliver the website.

12. Policy changes and privacy contact

We update this policy when our services or data practices change and show the update date at the top. Material changes will be communicated through appropriate in-app notices or contact channels. New optional uses or additional Google permissions require the applicable explanation and choice; a policy update does not silently renew optional permissions.

For questions, grievances or a request about personal information, contact Gatherify using the email, phone or postal address below. These contact routes are also available if you cannot use Privacy Center.