Privacy Policy

We act as the data fiduciary/controller for personal data processed through the Platform. This policy applies to all use of the Platform. It does not cover third-party services with their own privacy policies (such as the Payment Processor or external sites we link to).

We do not store full payment card numbers; these are handled directly by the Payment Processor / Merchant of Record.

We process your data for the following purposes and on the following bases:

• To create and secure your account and provide the Platform (performance of contract / your consent).
• To facilitate Bookings, payments, Wallets and Payouts, and to share necessary details between Customer and Artist.
• To verify identity (KYC), prevent fraud, enforce limits, score risk, and protect the safety and integrity of the Platform (legitimate uses / legal obligation).
• To resolve disputes and make Admin decisions based on submitted evidence and platform records.
• To provide support, send service and transactional messages, and (where permitted) relevant updates.
• To comply with legal, tax, accounting and regulatory obligations.
• To analyse, maintain and improve the Platform.

We do not sell your personal data. We share it only as needed:

• With the other party to a Booking — Customers and Artists receive the information necessary to arrange and complete the performance.
• With our Payment Processor / Merchant of Record to process transactions, Payouts, refunds and tax compliance.
• With service providers (hosting, infrastructure, authentication, analytics, communications) who process data on our behalf under appropriate safeguards.
• With authorities, regulators or third parties where required by law, legal process, or to protect rights, safety, property, or to investigate fraud and abuse.
• In a merger, acquisition, financing or sale of assets, subject to this policy.

If you sign in with Google, we receive basic profile information (such as your name, email and profile photo) to create and authenticate your account. We do not access your Google account beyond what you authorise.

Identity and financial details (such as PAN/Aadhaar and bank account information) are treated as sensitive. We apply additional safeguards: access is restricted to authorised personnel and systems on a need-to-know basis, identifiers are masked in user-facing screens, and the data is used only for verification, Payout, fraud-prevention and legal compliance. We retain KYC and transaction records for the periods required by tax and other laws.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Platform, and understand usage. You can control cookies through your browser or device settings, though some features may not function without them.

We keep personal data for as long as your account is active and as needed to provide the Platform. We retain certain data after account closure where required to meet legal, tax, accounting, security and fraud-prevention obligations, to resolve disputes, and to enforce our agreements. Residual records may be kept to prevent banned or fraudulent users from re-registering.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may:

• Access and obtain a summary of the personal data we process about you.
• Request correction, completion or updating of inaccurate or incomplete data.
• Request erasure of your personal data where it is no longer required and no legal obligation requires us to retain it.
• Withdraw consent where processing is based on consent (this does not affect prior processing).
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Raise a grievance with us and, where applicable, escalate to the Data Protection Board.

To exercise these rights, contact us using the details in Section 13. We may need to verify your identity, and some rights are limited where we must retain data by law or to prevent fraud.

We use technical and organisational measures to protect personal data, including access controls, encryption in transit, role-based restrictions and monitoring. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your credentials confidential and notify us of any suspected compromise. If a breach affecting your data occurs, we will respond as required by applicable law.

The Platform is not intended for individuals under 18. We do not knowingly collect data from children. If we learn that we have collected such data without the required consent, we will delete it.

Your data may be processed and stored on infrastructure located in or outside your country of residence. Where data is transferred across borders, we take steps to ensure it is protected consistent with this policy and applicable law.

We may update this Privacy Policy from time to time. Material changes will be notified in-app or by other reasonable means, and the “Last updated” date will change. Continued use after changes take effect means you accept the updated policy.

For privacy questions or to exercise your rights, contact:

• Grievance / Data Protection Officer: [Officer name]
• Privacy email: [privacy@wybers.com]
• Address: [Registered business address]