Privacy Policy

1. Information We Collect

We collect your phone number, email address (optional), and booking history to provide cinema ticketing services. We may also collect device identifiers and usage analytics to improve our platform.

2. How We Use Your Data

Your data is used to process bookings, send e-tickets, provide 24/7 customer support via Maya, send important transactional notifications, and improve our services. We do not use your data for automated decision-making that significantly affects you without your explicit consent.

3. Data Sharing

We share your data only as necessary to fulfill your bookings: with payment processors (Stripe), theatres where you book seats, and SMS/email delivery providers. We do not sell your personal data to third parties.

4. Your Rights Under DPDPA 2023

Under India's Digital Personal Data Protection Act 2023, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your account and personal data.
• Withdraw Consent — withdraw any consent you have previously given.
• Grievance Redressal — raise a complaint with our Data Protection Officer.
• Nominate — nominate another individual to exercise these rights on your behalf in case of death or incapacity.

You can exercise these rights via the Account Settings page or by contacting us directly.

5. Data Export

To download a copy of all data we hold about you, go to Profile → Account Settings → Download My Data. The export is delivered as a JSON file and includes your profile information and full booking history.

6. Data Deletion

To delete your account and all associated personal data, go to Profile → Account Settings → Delete Account, or email privacy@houseful.io. We will anonymise your data within 30 days. Booking records are retained in anonymised form for 7 years as required by Indian financial regulations.

7. Data Retention

We retain personal data for as long as your account is active. On deletion, we anonymise all PII within 30 days. Transactional data (booking records, payment receipts) is retained in anonymised form for 7 years to comply with the Companies Act 2013 and GST record-keeping obligations.

8. Security

We protect your data using TLS 1.2+ encryption in transit, AES-256 at rest, rate limiting, and regular security audits. Our infrastructure follows ISO/IEC 27001 practices.

9. Cookies

We use strictly necessary cookies for authentication (JWT refresh token) and session management. We do not use advertising or tracking cookies.

10. Changes to This Policy

We will notify you of material changes via in-app notification and email (if provided) at least 7 days before the change takes effect.

11. Contact — Data Protection Officer

For any privacy questions or to exercise your rights, contact our Data Protection Officer: