1. Introduction

Snapja (“Platform”) is a mobile and web application operated by Meharix Private Limited (“Company,” “we,” “us,” or “our”), a company incorporated under the Companies Act, 2013, with its registered office in Hyderabad, Telangana, India.

This Privacy Policy applies to independent content creators (“Creators,” “you,” “your,” or “Partner”) who register on the Partner app to offer photography, videography, editing, or related content creation services to customers through the Platform. It is a separate document from the Privacy Policy that applies to customers, since Creators and customers have a genuinely different relationship with the Platform.

This Privacy Policy describes what personal data we collect, why we collect it, how we process and protect it, and the rights you have over your data. This policy applies to your use of the Partner app, website, and APIs.

By creating a Creator account on Snapja, you confirm that you have read, understood, and consent to the collection, use, and processing of your personal data as described in this Privacy Policy. If you do not agree, please do not register or use the Platform as a Creator.

2. Definitions

In this Privacy Policy, unless the context otherwise requires:

• “Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• “Data Principal” means the individual to whom the Personal Data relates — i.e., you, the Creator.
• “Data Fiduciary” means Meharix Private Limited, which determines the purpose and means of processing of Personal Data.
• “Processing” includes collection, storage, use, modification, retrieval, disclosure, transmission, erasure, or destruction of data.
• “Customer” means the individual who books your services through the Platform.
• “Deliverables” means the photographs, videos, and edited content you produce and deliver to Customers through the Platform.
• “KYC Documents” means the identity and verification documents you submit during onboarding, such as a government-issued photo ID and PAN.

3. Information We Collect

3.1 Information You Provide at Registration

When you create a Creator account on Snapja, we collect the following personal data:

• Full Name — to identify you on the Platform and personalise your experience.
• Email Address — for account identification, transactional communications, and account recovery.
• Phone Number — for OTP-based authentication and essential service notifications.
• Profile Picture — to create your public profile visible to customers. Upload is voluntary; a default avatar is assigned if you choose not to provide one.

We do not collect passwords. Snapja uses a passwordless OTP-based authentication system.

3.2 Identity Verification (KYC)

Before you can accept bookings, we collect the following to verify your identity and comply with applicable Indian KYC requirements:

• Government-Issued Photo ID — to verify your identity.
• PAN — for tax and identity verification purposes.

KYC documents are stored using encrypted cloud storage (Amazon S3), and access is restricted to authorised verification personnel. They are never shared with customers.

3.3 Bank Details

We collect your bank account number and IFSC code to process your payouts. This information is shared only with Razorpay, our payment and payout processor, and is never shared with customers.

3.4 Location Data

While you are online and available for bookings, and during an active job, we collect your live location to match you with nearby bookings and to share your location with the customer for the duration of that booking. Location tracking stops when you go offline or the job ends.

3.5 Professional Information

We collect your service categories, portfolio samples, pricing, and availability, which are displayed on your public profile to help customers choose and book you.

3.6 Content and Deliverables

The photographs, videos, and edited content you deliver to customers (“Deliverables”) are stored securely using Amazon S3 with CloudFront content delivery, not in the database itself. (Profile pictures are a narrow, temporary exception: they may be stored as inline image data during upload while we complete migration to the same cloud storage.)

3.7 Information Collected Automatically

When you use the Platform, we may automatically collect:

• Device Information — device type, model, operating system version, and unique device identifiers.
• Usage Data — pages viewed, features used, session duration, interaction patterns, and app crash reports.
• Log Data — IP address, access timestamps, browser type, and API request logs.

We collect this data to maintain Platform performance, diagnose technical issues, and improve the user experience. This data is not linked to your identity for marketing purposes.

3.8 Information We Do Not Collect

For clarity, Snapja does not collect:

• Passwords (we use OTP-based login only).
• Biometric data (fingerprints, face scans, iris scans).
• Contacts, call logs, SMS, or data from other applications on your device.
• Financial or banking information beyond the account number and IFSC code described in Section 3.3, and never your card details.

4. How We Use Your Information

We process your personal data for the following specific, lawful purposes:

4.1 Account and Authentication

• To create, maintain, and verify your user account.
• To authenticate your identity via OTP at each login session.
• To manage session tokens (JWT and refresh tokens) for secure, persistent access.

4.2 Service Delivery

• To verify your identity and eligibility to operate as a Creator on the Platform.
• To match you with nearby bookings and display your profile to customers.
• To enable in-app communication between you and your customers.
• To store, organise, and deliver your Deliverables (photographs and videos) within the Platform.
• To share your live location with customers during an active job, and to match you with nearby bookings while you are online.
• To process your payouts through Razorpay.
• To send transactional notifications (booking confirmations, delivery reminders, payout receipts).

4.3 Platform Improvement

• To analyse usage patterns and improve Platform features, performance, and stability.
• To diagnose technical issues, bugs, and crashes.
• To conduct internal research and development.

4.4 Safety and Legal Compliance

• To detect, prevent, and investigate fraud, abuse, and security threats.
• To enforce our Terms of Service.
• To comply with applicable laws, regulations, court orders, and governmental requests.
• To protect the rights, property, and safety of the Company, Users, and the public.

4.5 Communications

• To send essential service-related communications (account alerts, booking updates, policy changes).
• To send promotional communications only with your explicit opt-in consent. You may opt out at any time.

5. Authentication and Security Measures

We implement the following technical security measures to protect your personal data:

5.1 OTP-Based Authentication

Snapja uses a passwordless, OTP-based login system. A unique One-Time Password is generated and sent to your registered phone number or email address each time you log in. OTPs are time-bound (they expire after a defined period), single-use, and cannot be reused or intercepted for future access.

5.2 Data Encryption and Hashing

• Sensitive data elements, including email addresses and OTPs, are processed using bcrypt hashing, a one-way cryptographic function that renders the original data unreadable and irreversible.
• All data in transit between your device and our servers is encrypted using TLS (Transport Layer Security) protocols.
• Data at rest in our database is protected by encryption and access controls.

5.3 Session Management

Authenticated sessions are managed using JSON Web Tokens (JWT) paired with refresh tokens. JWTs are short-lived, cryptographically signed, and verified on every API request. Refresh tokens enable seamless session renewal without requiring repeated OTP entry, and are securely stored and can be revoked by the user or the system at any time.

5.4 Infrastructure Security

• Input Validation — all user inputs are validated and sanitised to prevent injection attacks (SQL injection, XSS, CSRF).
• Rate Limiting — API endpoints are rate-limited to prevent brute-force attacks, credential stuffing, and denial-of-service attempts.
• Secure API Architecture — all API endpoints require authentication, use HTTPS exclusively, and follow RESTful security best practices.
• Access Controls — internal access to production databases and user data is restricted to authorised personnel on a need-to-know basis, following the principle of least privilege.

No system is perfectly secure. While we implement commercially reasonable security measures that meet or exceed industry standards, we cannot guarantee absolute security against all threats. We strongly recommend that you keep your registered phone number and email address secure and notify us immediately if you suspect unauthorised access to your account.

6. Data Storage and Retention

6.1 Storage Infrastructure

All user data, including personal information and account records, is stored in our backend database powered by MongoDB. Deliverables (photographs and videos) are stored using Amazon S3 with CloudFront delivery, not in the database. Our database and storage infrastructure are hosted on secure servers with encryption, access controls, and regular backups.

6.2 Retention Periods

• Account Data (name, email, phone, profile picture), retained for the duration of your active account. Upon a valid account-deletion request, we anonymise your personal data immediately so it can no longer be associated with you; the underlying account record and its linked bookings, payments, and chat history are retained thereafter for as long as required by Indian law (see Section 6.3 below), rather than being scheduled for erasure on a fixed later date.
• Delivered Content (photographs and videos you deliver to customers), stored on our servers for 4 months from the date of delivery. After this period, Deliverables are automatically and permanently deleted from our systems. This is not archival, and the content cannot be recovered. You are responsible for keeping your own copies before the 4-month period expires.
• KYC Documents and Bank Details — retained for as long as your account remains active, and thereafter for the period required under applicable KYC, anti-money-laundering, and tax record-keeping obligations under Indian law. They are not subject to the 4-month delivered-content retention period above, since they serve a different, ongoing verification purpose. Deleting your account does not immediately erase these records where we are legally required to retain them.
• Transaction Records — retained for a minimum of 8 years as mandated under the Income Tax Act, 1961, Goods and Services Tax Act, 2017, and the Companies Act, 2013.
• Communication Logs and Automatically Collected Data (in-app messages, support correspondence, device and usage logs) — retained for as long as necessary to operate the Platform, respond to support requests, and maintain security and service quality, after which they are deleted or anonymised in the ordinary course of our data lifecycle practices.

6.3 Deletion

Upon expiry of the applicable retention period, or upon your valid request for erasure, personal data is permanently deleted or irreversibly anonymised so that it can no longer be associated with you. Certain data may be retained beyond these periods solely where required by applicable Indian law.

7. Data Sharing and Disclosure

We do not sell, rent, trade, or share your personal data with any third parties for their marketing or commercial purposes. All data collected is used strictly for application functionality and improving your experience.

7.1 Sharing with Customers

When a customer books you through the Platform, we share the information necessary for them to identify and engage you: your name, profile picture, portfolio, service categories, pricing, and your live location for the duration of an active booking. We do not share your KYC documents, bank details, or full contact information with customers.

7.2 Other Service Providers

We share limited data with the following categories of service providers, each acting under contractual confidentiality and data-protection obligations:

• Razorpay — processing of your payouts and, where you accept payments through the Platform, payment processing (see Section 7.3 below).
• Firebase Analytics (Google) — in-app usage analytics.
• Our SMS provider — delivery of OTP messages for authentication.
• Our email delivery provider(s) — transactional and account emails.
• Amazon Web Services (S3 and CloudFront) — secure storage and delivery of Deliverables, portfolio images, and KYC documents.

We do not share your data with any of these providers for their own marketing purposes. KYC documents are shared only with the minimum personnel and systems needed for identity verification.

7.3 Payment and Payout Processing

Your payouts are processed by Razorpay. We share only the minimum information required, including your bank account number and IFSC code, to process your payout. We do not store your card details or UPI credentials on our servers. Razorpay operates under its own privacy policy and complies with PCI-DSS standards. See Section 5 of our Terms of Service for how funds are held and released.

7.4 Legal Requirements

We may disclose your personal data if required by law, including in response to:

• Orders from a court of competent jurisdiction in India.
• Directions issued by the Data Protection Board of India under the DPDP Act, 2023.
• Lawful requests by Central or State Government agencies, law enforcement, or regulatory authorities.
• Compliance with the Information Technology Act, 2000, and rules thereunder.

7.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of substantially all assets of the Company, your personal data may be transferred as part of the transaction. You will be notified via email or in-app notification prior to any such transfer and will have the opportunity to delete your account.

7.6 With Your Consent

We may share your data with third parties when you explicitly authorise us to do so — for example, when you choose to share an event gallery on a social media platform through the app.

8. Content Ownership and Licensing

8.1 Your Portfolio and Deliverables

You retain ownership of the content you capture and upload, including your profile picture, portfolio samples, and Deliverables you produce for customers. By uploading content, you grant the Company a limited, non-exclusive, royalty-free licence to use, display, and store that content solely for operating the Platform, matching you with customers, and delivering your work to the customer who booked you.

8.2 Customer Usage Rights

Upon full payment by the customer, they receive a non-exclusive, personal, non-commercial licence to use, download, print, and share the Deliverables you produced for their booking, as described in the customer Terms of Service. Commercial use of your Deliverables by a customer requires separate written authorisation from you and the Company.

8.3 Company Rights

The Company may use anonymised, de-identified, or aggregated content, or your portfolio samples with your consent, for Platform marketing, quality assurance, and internal training. You may opt out of promotional use of your content at any time by contacting us.

9. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, and other applicable Indian laws, you have the following rights:

• Right to Access — request confirmation of whether we process your personal data and obtain a summary of such data.
• Right to Correction — request correction of inaccurate or misleading personal data, and completion of incomplete data.
• Right to Erasure — request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention requirements.
• Right to Withdraw Consent — withdraw your consent for data processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Note that withdrawing consent may limit your ability to use certain Platform features.
• Right to Grievance Redressal — raise a complaint with our Grievance Officer or, if unsatisfied, with the Data Protection Board of India.
• Right to Nominate — nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

To exercise any of these rights, including registering a nominee under the Right to Nominate, please contact us at support@snapja.com. We will acknowledge your request within 48 hours and act on it within 30 days, or such period as prescribed under applicable law.

10. Cookies and Tracking Technologies

Our mobile application does not use browser cookies. However, our web platform may use the following:

• Essential Cookies — required for authentication, session management, and core functionality. These cannot be disabled.
• Analytics Cookies — help us understand how users interact with the Platform. These can be disabled through your browser settings.

We do not use advertising or third-party tracking cookies. We do not participate in cross-site tracking or behavioural advertising networks.

11. Children’s Privacy

The Platform is not directed at individuals under the age of 18 years, and registration requires you to confirm your date of birth; accounts that do not meet the minimum age are not created. We do not knowingly collect, process, or store personal data of children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take immediate steps to delete such data.

Deliverables that incidentally include images of minors (for example, children attending a family event) are captured on behalf of the booking customer, who is responsible for obtaining all necessary consents from the parents or legal guardians of any minors depicted.

If you believe a child under 18 has provided personal data to us, please contact us immediately at support@snapja.com.

12. International Data Transfers

Snapja primarily stores and processes data within India. If in the future your data needs to be transferred to servers or service providers located outside India, we will ensure that:

• The transfer complies with the provisions of the DPDP Act, 2023, and any restrictions notified by the Central Government.
• Appropriate contractual safeguards are in place with the receiving entity.
• Your data is not transferred to any country restricted by the Central Government under Section 16(1) of the DPDP Act.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

• Material Changes — will be notified to you via in-app notification and/or email at least 30 days before taking effect.
• Minor Changes — (formatting, clarifications with no substantive impact) may be made without prior notice.

The “Effective Date” at the top of this document reflects the date of the most recent revision. Your continued use of the Platform after any update constitutes your acceptance of the revised policy. If you disagree with any changes, you should discontinue use and request account deletion.

14. Grievance Redressal

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the Company has appointed a Grievance Officer:

• Name: Balakrishna S
• Designation: Grievance Officer
• Organisation: Meharix Private Limited
• Email: support@snapja.com
• Address: B310, Giridhari Murari, Kismatpur, Bandlaguda Jagir, Hyderabad, Telangana 500086, India

Complaints will be acknowledged within 24 hours of receipt. The Grievance Officer shall resolve complaints within 15 days, or within such extended period not exceeding 30 days as may be reasonably required given the complexity of the complaint.

If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India as constituted under the DPDP Act, 2023.

15. Data Breach Notification

In the event of a personal data breach, the Company will take immediate steps to contain and assess the breach. Where the breach is likely to result in harm to affected Data Principals, we will notify affected users without undue delay via email and/or in-app notification, describing the nature of the breach, the data involved, and the steps we are taking. We will also notify the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023, and applicable rules.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact:

Meharix Private Limited
B310, Giridhari Murari, Kismatpur, Bandlaguda Jagir
Hyderabad, Telangana 500086, India
Email: support@snapja.com
Website: www.snapja.com