Privacy Policy
This Privacy Policy is issued by Spotmyseat Platform LLP (hereinafter referred to as the 'Data Fiduciary', 'Company', 'we', 'us', or 'our') in its capacity as the Data Fiduciary within the meaning of Section 2(i) of the Digital Personal Data Protection Act, 2023 (hereinafter the 'DPDP Act'). This Privacy Policy governs the collection, receipt, storage, usage, processing, sharing, and protection of Digital Personal Data pertaining to Data Principals who access or use the Spot My Seat platform, comprising a customer-facing mobile application, an organiser mobile application, an organiser web dashboard, and a platform administration console.
This document is published in compliance with: (i) the Digital Personal Data Protection Act, 2023; (ii) the Information Technology Act, 2000 ('IT Act'); (iii) the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ('IT Rules 2021'); (iv) the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ('SPDI Rules'); and (v) applicable Reserve Bank of India guidelines governing payment intermediaries.
BY ACCESSING OR USING THE SPOT MY SEAT PLATFORM, THE DATA PRINCIPAL ACKNOWLEDGES HAVING READ, UNDERSTOOD, AND CONSENTED TO THE COLLECTION AND PROCESSING OF THEIR DIGITAL PERSONAL DATA AS DESCRIBED HEREIN. IF THE DATA PRINCIPAL DOES NOT AGREE TO THE TERMS OF THIS PRIVACY POLICY, THEY ARE REQUIRED TO IMMEDIATELY CEASE USE OF THE PLATFORM.
1. Definitions
For the purposes of this Privacy Policy, in addition to terms defined under the DPDP Act, the IT Act, and the IT Rules 2021, the following definitions shall apply:
"Consent" shall have the meaning ascribed to it under Section 6 of the DPDP Act, being a free, specific, informed, unconditional, and unambiguous indication of the Data Principal's agreement to the processing of their Digital Personal Data through clear affirmative action.
"Customer" means a Data Principal who registers on the Platform for the purpose of discovering and purchasing tickets to Events.
"Data Fiduciary" means Spotmyseat Platform LLP.
"Data Principal" means the natural person to whom Digital Personal Data relates, being any Customer or Organiser using the Platform.
"Digital Personal Data" or "Personal Data" means data about or relating to a natural person who is directly or indirectly identifiable by reference to such data, represented in digital form.
"Organiser" means a Data Principal who registers on the organiser mobile application or organiser web dashboard for the purpose of creating and managing Event listings.
"Platform" means, collectively, the Spot My Seat customer mobile application, the website at spotmyseat.in, the organiser mobile application, the organiser web dashboard, and the platform administration console.
"Processing" means a wholly or partly automated operation performed on Digital Personal Data, including collection, storage, use, disclosure, or erasure.
2. Notice Under Section 5 of the DPDP Act
In accordance with Section 5 of the DPDP Act, the Data Fiduciary provides this Notice prior to seeking Consent: the categories of Digital Personal Data collected and the specific purposes of collection are set out in Clauses 3 and 4; the manner of exercising rights under the DPDP Act is set out in Clause 8; the manner of approaching the Data Protection Board of India is set out in Clause 8.5; and Consent, once given, may be withdrawn at any time, the consequences of which are described in Clause 8.4. Withdrawal of Consent shall not affect the lawfulness of Processing carried out prior to such withdrawal.
3. Categories of Digital Personal Data Collected
3.1 Identity and Authentication Data
Customers register and authenticate using a one-time password (OTP) sent to their registered email address, processed through Supabase Auth. Customers may optionally provide a mobile telephone number, which is stored against their user record but is not, as of the date of this Policy, used as a primary authentication credential. The Company discloses that phone-based OTP authentication is planned for future implementation and this Policy shall be updated accordingly prior to such feature going live.
Organisers register and authenticate using an email address and password. Organiser accounts are assigned a role designation by the Company for the purpose of access control within the organiser dashboard.
3.2 Profile Data
The Company collects and stores the Data Principal's name, email address, and a unique user identifier, for the purposes of maintaining the Data Principal's profile and associating it with bookings and social features on the Platform.
3.3 Booking and Ticketing Data
Upon a Customer initiating or completing a booking, the Company collects and stores: the Event identifier, the identifiers of seats selected, the number of guests, the booking amount, the booking status, and a system-generated idempotency key used to prevent duplicate transactions.
3.4 Payment Data
The Company collects and stores Razorpay order and payment identifiers, the transaction amount, and the payment method selected. The Company does not, at any point, collect, transmit, or store card numbers, card verification values (CVV), or other card authentication data on its own servers. Such Sensitive Personal Data or Information is collected and processed exclusively by Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India, within Payment Card Industry Data Security Standard (PCI-DSS) compliant environments.
3.5 Tax and Invoicing Data
For the purpose of compliance with the Central Goods and Services Tax Act, 2017 and corresponding State Goods and Services Tax legislation, the Company maintains a GST ledger recording the Central Goods and Services Tax (CGST) and State Goods and Services Tax (SGST) applicable on the platform fee component of each transaction, together with associated invoice references and invoice documents.
3.6 Ticket QR Code Data
Upon booking confirmation, the Company generates a cryptographically signed (HMAC) QR code payload comprising the booking identifier, Event identifier, user identifier, and seat identifier. This payload is generated server-side and is cached on the Customer's device to enable offline presentation of the ticket at the venue entry point.
3.7 Resale Data
Where a Customer lists a Ticket for resale, the Company collects and stores the listing price, the identifiers of the seller and prospective buyer, and the escrow status of the transaction.
3.8 Social and Group Data
Where a Customer uses social features of the Platform, the Company collects and stores friend connections, group membership, voting activity on proposed Events, and a record of Events booked or saved, for the purpose of enabling such social features.
3.9 Chat Data
Where a Customer uses the group or 'squad' chat feature, the Company collects and stores the text content of messages transmitted, the sender's identifier, the conversation identifier, and message timestamps. The Data Principal is expressly informed that chat messages are stored and processed in plain text and are not end-to-end encrypted. Chat messages are automatically and permanently deleted seventy-two (72) hours after transmission, as further described in Clause 6.
3.10 AI Concierge Data
Where a Customer uses the AI Concierge feature, the Company collects the text of the query submitted by the Customer (limited to a maximum of five hundred (500) characters), together with the Customer's user identifier and a session identifier. Such query data is transmitted to Groq, Inc. for natural language processing and response generation, and to OpenAI, L.L.C. for the generation of vector text embeddings used to power search and recommendation functionality. Query data is cached for a period of ten (10) minutes and is not retained as a persistent chat log.
3.10A SpotX Preference and Age Verification Data
Where a Customer uses the SpotX AI Concierge or age-restricted recommendation features, the Company may process the Customer's declared age or age category solely for the purpose of restricting recommendations relating to venues, dining experiences, or Events that are legally available only to persons above the applicable statutory age. Such information is processed exclusively for eligibility verification and recommendation filtering.
3.10B SpotEats Reservation Data
Where a Customer makes or attempts to make a restaurant reservation through the SpotEats feature, the Company processes reservation details including the selected restaurant, reservation date and time, number of guests, booking status, payment status where applicable, and associated identifiers necessary to facilitate the reservation.
3.11 Organiser Door-Scan Data
Where an Organiser uses the door-scanning feature to verify Tickets at a venue, the Company collects and stores a record of each check-in, including the scanning device identifier, for the purpose of venue admission control. Such data is accessible to the relevant Organiser solely in respect of their own Event.
3.11A Organiser Uploaded Content
The Company processes images and other media voluntarily uploaded by Organisers while creating or managing Event listings. Such content is processed solely for publication, management, moderation, and operation of the relevant Event listing.
3.12 Technical and Security Data
The Company collects authentication tokens (JSON Web Tokens) stored in secure on-device storage, server-side API request logs, and rate-limiting and IP address data captured at the network edge, for the purposes of platform security and fraud prevention.
3.13 Device Permissions and Optional Device Data
The Platform requests access only to those device capabilities that are necessary for specific features expressly initiated by the Data Principal. Where the Data Principal grants location permission through the operating system of the device, the Platform may access the device's approximate or precise geographic location solely for the purpose of displaying nearby restaurants and dining experiences through the SpotEats feature. Such permission is entirely optional. If permission is denied, the Platform shall continue to operate using a default location or manually selected location, and the Company does not continuously monitor, track, or store the Data Principal's live location history.
Where an Organiser elects to upload images while creating or managing an Event listing, the organiser application may request access to the device camera or photo library solely for the purpose of capturing or selecting images for such Event listing. Images uploaded by an Organiser are stored within the Company's infrastructure solely for the operation of the relevant Event listing.
The Company does not access or process the Data Principal's device contacts or microphone except where such functionality is introduced in a future version of the Platform and disclosed through an updated Privacy Policy.
4. Purpose of Processing
The Company processes Digital Personal Data solely for the specific, clear, and lawful purposes set out below, for which the Data Principal's Consent is obtained at the relevant point of collection:
- Authentication: Email and, where applicable, mobile telephone number are used to issue and verify one-time passwords for login, and to maintain authenticated sessions via JSON Web Tokens.
- Booking Fulfilment: Booking and ticketing data is processed to confirm reservations, generate QR-coded Tickets, and maintain booking records as required under Applicable Law.
- Payment Processing: Payment metadata is processed to complete transactions through Razorpay and to reconcile payment status against bookings.
- Tax Compliance: Tax and invoicing data is processed and retained to comply with the Company's obligations under the Central Goods and Services Tax Act, 2017 and allied State legislation.
- Venue Admission: QR code data and door-scan records are processed to verify a Customer's right of entry at the Event venue.
- Resale Facilitation: Resale data is processed to operate the peer-to-peer Ticket resale marketplace, including the escrow mechanism described in the Terms of Use.
- Social Features: Social and group data is processed to enable friend connections, group coordination, and activity visibility, subject to the Data Principal's privacy settings.
- Group Coordination: Chat data is processed to enable real-time coordination between Customers within a group, for the limited seventy-two (72) hour retention period described in Clause 6.
- AI-Assisted Recommendations: AI Concierge query data is processed by the Company's AI processing partners to generate Event recommendations and itinerary suggestions.
- Location Based Services: Where location permission has been granted by the Data Principal, geographic location data is processed solely for displaying nearby restaurants and dining experiences available through the SpotEats feature.
- Event Listing Management: Images and media voluntarily uploaded by Organisers are processed for creation, publication, moderation, and maintenance of Event listings made available through the Platform.
- Age Restricted Recommendations: Age information voluntarily provided by the Customer is processed solely for restricting recommendations relating to products, venues, restaurants, or Events that are legally subject to age based access restrictions.
- Security and Fraud Prevention: Technical and security data is processed to detect and prevent unauthorised access, fraud, and abuse of the Platform.
- Legal Compliance: Data is processed and retained to fulfil obligations under Applicable Law and to respond to lawful orders of courts and government authorities.
5. Disclosure of Digital Personal Data to Third Parties
The Company does not sell Digital Personal Data, does not disclose Digital Personal Data to advertisers, and does not construct advertising profiles of Data Principals. The Company discloses the following processors with whom Digital Personal Data is shared, strictly to the extent necessary for the stated purpose:
| Processor | Role | Data Shared | Location |
|---|---|---|---|
| Supabase, Inc. | Authentication (JWT issuance, email OTP) | Email address, authentication tokens | Outside India |
| Razorpay Software Private Limited | Payment aggregation | Payment metadata; card data handled exclusively by Razorpay | India |
| Amazon Web Services, Inc. | Cloud infrastructure (RDS Postgres, EC2, Redis, MinIO) | All application data | Mumbai (ap-south-1), India |
| Cloudflare, Inc. | DNS, CDN, Web Application Firewall, TLS termination | IP address, request metadata | Global edge network |
| Groq, Inc. | AI intent recognition and narrative generation | User Concierge query text, user identifier | Outside India |
| OpenAI, L.L.C. | Text embedding generation (1536-dimension vectors) | Concierge query/mood text | Outside India |
| Google LLC | Transit directions (Google Maps Platform) | Venue coordinates (not user location) | Outside India |
| Google Sheets (Google LLC) | Event and venue catalogue ingestion (internal tool) | Event catalogue data (not personal data of Customers) | Outside India |
5.1 Cross-Border Transfer
The transmission of Personal Data to Supabase, Groq, OpenAI, and Google LLC, each of which may process data on servers located outside the territory of India, constitutes a cross-border transfer of Digital Personal Data within the meaning of Section 16 of the DPDP Act. Where the Data Principal elects to use optional location based services or AI powered features, the corresponding geographic location information or query information, as applicable, may be transmitted to the Company's processors solely for the purpose of providing the requested functionality.
5.2 Disclosure to Government and Law Enforcement
The Company may disclose Digital Personal Data to a competent court, tribunal, government authority, or law enforcement agency where required under Applicable Law, including under Section 69 of the IT Act or Section 91 of the Code of Criminal Procedure, 1973. Where not legally prohibited, the Company shall endeavour to notify the affected Data Principal prior to such disclosure.
6. Data Retention
| Category of Data | Retention Period | Mechanism |
|---|---|---|
| Chat messages | 72 (seventy-two) hours from transmission | Automated purge (scheduled database job) |
| Friend and social activity | 72 (seventy-two) hours from creation | Automated expiry |
| Seat hold records | 15 (fifteen) minutes from seat selection | Automated expiry (in-memory cache) |
| AI Concierge query cache | 10 (ten) minutes from query submission | Automated expiry (in-memory cache) |
| Authentication session | Until logout or session expiry | Secure on-device storage and session store |
| Booking, payment, and ticketing records | Retained as required for tax and legal compliance under the Central Goods and Services Tax Act, 2017 and the Income Tax Act, 1961, currently maintained on an ongoing basis pending finalisation of a fixed retention schedule by the Company in consultation with its statutory auditors | Ongoing pending fixed schedule |
| Profile and account data | Until account deletion is effected pursuant to a verified request under Clause 8.2 | Manual deletion upon verified request |
The Company acknowledges that a comprehensive, fixed-duration retention schedule for booking, payment, and ticketing records is presently being finalised in consultation with the Company's tax advisors, and undertakes to publish such schedule as an update to this Privacy Policy upon finalisation. Pending such finalisation, such records shall be retained only for so long as reasonably necessary to satisfy the Company's tax and legal obligations.
7. Security Measures
The Company has implemented the following technical and organisational security measures in respect of Digital Personal Data, in accordance with Section 8(4) of the DPDP Act and Rule 4 of the SPDI Rules:
Transport Layer Security (TLS) encryption for all data in transit between the Cloudflare edge network and the Company's application servers.
Encryption at rest for the Company's primary database (Amazon RDS for PostgreSQL), with enforced SSL connection mode.
Authentication of all Application Programming Interface (API) requests using JSON Web Tokens, with role-based access segregation between Customer, Organiser, and platform administrator roles.
Cryptographic signing (HMAC) of Ticket QR codes and Razorpay webhook payloads to prevent forgery and tampering.
Storage of authentication tokens within secure, encrypted on-device storage on the Customer's mobile device.
The Data Principal is expressly informed that chat messages transmitted through the in-application group chat feature are stored and processed in plain text within the Company's database and are not end-to-end encrypted. The Data Principal should exercise discretion accordingly and refrain from transmitting sensitive information through this feature.
In the event of a Personal Data Breach within the meaning of Section 2(t) of the DPDP Act that is reasonably likely to result in harm to the Data Principal, the Company shall notify the affected Data Principal and the Data Protection Board of India in accordance with Section 8(6) of the DPDP Act and within such timeframe as may be prescribed by the Board.
8. Rights of the Data Principal
8.1 Right to Access Information (Section 11, DPDP Act)
The Data Principal may request a summary of the Personal Data processed by the Company and the identities of processors with whom such data has been shared, by emailing privacy@spotmyseat.in. The Company shall respond within thirty (30) days of receipt, subject to identity verification.
8.2 Right to Correction and Erasure (Section 12, DPDP Act)
(a) Correction: The Data Principal may request correction of inaccurate Personal Data by emailing privacy@spotmyseat.in. The Company shall act on such request within thirty (30) days.
(b) Erasure: The Company discloses that, as of the date of this Privacy Policy, account and data deletion is processed manually and is not yet available as a self-service, in-application function. A Data Principal seeking erasure of their Personal Data must submit a request to privacy@spotmyseat.in. Upon verification of the requestor's identity, the Company's authorised personnel shall process the deletion of the Data Principal's account and associated Personal Data from the Company's systems, including the Supabase authentication record and the corresponding database entries, within thirty (30) days of a verified request. Booking, payment, and tax-related records shall be retained, in de-identified form to the extent feasible, only to the extent and for the period required under Applicable Law as described in Clause 6. The Company undertakes to implement a self-service, in-application account deletion mechanism and shall update this Privacy Policy to reflect such mechanism upon its deployment.
8.3 Right to Grievance Redressal (Section 13, DPDP Act)
The Data Principal may direct any grievance regarding the processing of their Personal Data to the Grievance Officer at grievance@spotmyseat.in. The Company shall acknowledge receipt within forty-eight (48) hours and resolve the grievance within thirty (30) days, in accordance with the Grievance Redressal Policy (contact grievance@spotmyseat.in).
8.4 Right to Withdraw Consent (Section 6(4), DPDP Act)
The Company obtains the Data Principal's Consent through clear affirmative action at the time of account registration and, where applicable, immediately prior to the first use of optional Platform features requiring additional permissions, including location-based services, the AI Concierge feature, and access to the device camera or photo library. The Data Principal may withdraw such Consent at any time to the extent permitted by the Platform or by submitting a request to privacy@spotmyseat.in. Withdrawal of Consent shall not affect the lawfulness of any Processing undertaken prior to such withdrawal. The Company discloses that a structured Consent capture and audit-trail mechanism, recording the specific Consents given by each Data Principal and the timestamp thereof, is currently being implemented and is not yet fully operative as a user-facing interface as of the date of this Privacy Policy. The Company undertakes to complete implementation of this mechanism and to update this Privacy Policy accordingly.
8.5 Right to Approach the Data Protection Board
Where the Data Principal is not satisfied with the Company's resolution of a grievance, the Data Principal shall have the right, upon constitution of the Data Protection Board of India under the DPDP Act, to file a complaint before the Board under Section 28 of the DPDP Act.
8.6 Right of Nomination (Section 14, DPDP Act)
The Data Principal may nominate another individual to exercise their rights under Sections 11, 12, and 13 of the DPDP Act in the event of the Data Principal's death or incapacity, by submitting such nomination to privacy@spotmyseat.in.
9. Children - Restriction on Processing
The Platform is intended exclusively for use by individuals who are eighteen (18) years of age or older. In accordance with Section 9 of the DPDP Act, the Company does not knowingly process the Digital Personal Data of any child, being a person below the age of eighteen (18) years, and does not seek or obtain parental Consent for child users, as the Platform does not permit registration by minors under any circumstance. By creating an account, the Data Principal represents that they are eighteen (18) years of age or older. Where the Company becomes aware that it has inadvertently collected Personal Data of a minor, such data shall be deleted forthwith. Any person with knowledge of a minor having registered on the Platform is requested to notify privacy@spotmyseat.in without delay.
10. Artificial Intelligence - Disclosure
The Company discloses, in compliance with its transparency obligations under the IT Rules 2021, that the AI Concierge feature employs: (i) large language model infrastructure provided by Groq, Inc. for intent recognition and narrative response generation; and (ii) text embedding infrastructure provided by OpenAI, L.L.C. for semantic search and recommendation matching. Both processors receive the text of the Data Principal's query, limited to five hundred (500) characters, together with a user and session identifier, and such query data is cached for ten (10) minutes. AI-generated recommendations are not guaranteed to be accurate, and Event availability is confirmed only upon successful completion of a booking, not upon the basis of any AI-generated suggestion.
11. Amendments to this Privacy Policy
The Company reserves the right to amend this Privacy Policy from time to time. Material amendments - including any change to the categories of Personal Data collected, the purposes of Processing, or the processors with whom data is shared - shall be notified to the Data Principal through the Platform's notification mechanism not less than fourteen (14) days prior to the amendment taking effect. Where an amendment requires fresh Consent under the DPDP Act, such Consent shall be sought prior to the amendment taking effect. Continued use of the Platform following the notice period, without withdrawal of Consent, shall constitute acceptance of the amended Privacy Policy.
12. Grievance Officer and Contact
This Privacy Policy was approved by the Board of Directors of Spotmyseat Platform LLP and is effective from 3 June 2025.