Privacy

Mehfilbox is operated by MEHFILBOX DIGITAL LLP (LLPIN ADC-9901), a limited liability partnership incorporated in India, with its registered office at Flat No. 302, A-Block, Alpine Eco Apartments, Mahadevapura, Bengaluru 560048, Karnataka, India. “We” and “us” in this policy mean MEHFILBOX DIGITAL LLP. This policy explains what personal data Mehfilbox collects, why, who else handles it, and what you can ask us to do with it. It is written to match what the product actually does.

Mehfilbox hosts films and photographs of an occasion — a wedding, a birthday, a naming ceremony, a company’s event or anything else — on behalf of whoever made the catalogue: a studio, or a client who started one directly. They decide what goes in it and who may see it; we store it and serve it on their instructions. For the accounts on Mehfilbox and the data we collect ourselves, described below, we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023.

What a guest gives us

No account and no email address to watch. A guest opening a catalogue may pick one of a few fixed labels — Family or Friends, or for a wedding the Bride’s side and the Groom’s side — never free text. We keep that label, how far through a film they watched so it can resume, which photographs they liked, and anonymous playback quality measurements used to tell whether video is starting quickly enough. The label describes a relationship to the occasion, not a name.

Two things a guest may choose to give. Where the client allows guests to send their own photographs, we keep the photographs and, if the guest typed one, the name they gave; the client sees them first, and decides whether anyone else does. A guest who writes to a studio through the “Made with Mehfilbox” form gives a name, an email address and a message, which we pass to that studio by email and keep in our record of the emails we have sent.

What a studio or a client gives us

An email address and a way to sign in — a password, or your Google account if you choose to sign in with Google — and a name. A studio also gives its business name and branding, and may add contact details (a phone or WhatsApp number, a website, an Instagram handle) that it chooses to show on its catalogues, and a GSTIN for its invoices. A studio handing a catalogue to a client gives us that client’s email address so we can send the handover. Sign-in is handled by Supabase Auth; we never see a password itself.

When you pay, the payment is taken by Razorpay. We receive a record of the payment — the amount, what it was for, and whether it succeeded — but never your card, bank or UPI details.

Why we use it

To run the service you signed up for: to sign you in, store and stream your catalogues, send the emails the product sends (a handover, a receipt, a reminder before a plan ends, an anniversary note to a client), take payment, keep the records the law requires, and keep the service secure. We do not sell personal data, we do not use it for advertising, and there is no advertising or third-party analytics on a catalogue’s page. Films and photographs are never used to promote Mehfilbox without the owner’s permission, and never used to train any model.

Who else handles it, and where it is kept

We use a small number of service providers, each handling only what its job needs:

• Supabase stores application data — accounts, catalogue records, payment records — on servers in Mumbai.
• Vercel runs the application, also in Mumbai.
• Bunny.net stores and delivers video and photographs, from whichever of its regions is nearest; as of this writing Bunny has no origin server inside India, so media may be stored abroad.
• Razorpay processes payments.
• Resend sends the emails the product sends.
• Anthropic translates a catalogue’s own text — titles and captions the studio or client wrote — when they turn on another language. It receives that text only, never a guest’s data or the media itself.
• Google, only if you choose to sign in with your Google account.

We may also disclose data where Indian law requires it, or to comply with a lawful order from a court or government authority.

Cookies

Mehfilbox sets only its own cookies, each needed for something you asked for: keeping you signed in, remembering that you entered a catalogue’s passcode, your language, and a paired TV. There are no advertising or tracking cookies.

How long it is kept

For as long as the catalogue’s plan is active, and through archive if the studio or client keeps it. Nothing is deleted because a plan lapses — a catalogue goes cold and is restored on payment. Real deletion happens only on a deliberate, recorded request: from the account holder themselves, through their own account settings, or from a lawful third-party request we act on directly (below). Payment records are kept for as long as tax law requires, even after an account is deleted.

Asking for a copy, correcting it, or asking for deletion

A studio can change its own details from its account at any time; a client can change theirs from their own account page, including deleting their account outright — real, irreversible erasure, not a pause, of the account and any catalogue it owns outright. A studio can do the same for its whole account from its own settings, which also removes everyone on its team. Either kind of deletion leaves a catalogue someone else already owns — a client’s handed-over catalogue, if the studio deletes itself, or a catalogue a client is only linked to, if the client deletes theirs — untouched. If you would rather write to us than use the account controls, or the account is no longer reachable, write to the grievance officer (below) and we will act on it directly.

If you are in the pictures

A guest, or anyone shown in a catalogue, has no account with us. To have a photograph or film of yourself — or of your child, as their parent or guardian — taken down, ask the client or the studio who made the catalogue, or write to the grievance officer and we will act on it directly.

Children

Mehfilbox accounts are for adults. A catalogue may show children — a naming ceremony or a birthday often does — and the studio or client who makes it does so as, or with the agreement of, the child’s parent or guardian. We do not knowingly collect personal data from anyone under eighteen through an account, and a guest never gives us more than the label described above.

A request that does not come from you

A government authority, or someone’s authorised legal representative, may ask us to erase an account’s data. We record who asked, under what authority, and keep the request itself on file before acting on it — the same real erasure a self-requested deletion carries out, never something lesser.

Keeping it secure

Data travels encrypted, every studio’s data is kept apart from every other’s at the database itself, and a catalogue behind a passcode is never served without it. If a breach affecting your personal data occurs, we will tell you and the Data Protection Board of India as the law requires.

Your rights, and the grievance officer

Under India’s Digital Personal Data Protection Act you may ask for a summary of the personal data we hold about you, have it corrected or completed, have it erased, and nominate someone to exercise these rights for you if you cannot. You may also raise a grievance with us directly.

Our grievance officer is Anmol Rathore, MEHFILBOX DIGITAL LLP, reachable at support@mehfilbox.com or by post at Flat No. 302, A-Block, Alpine Eco Apartments, Mahadevapura, Bengaluru 560048, Karnataka, India. You can also use our support page. We acknowledge a grievance within 24 hours and resolve it within 15 days. If you are not satisfied with our answer, you may take it to the Data Protection Board of India.

Changes to this policy

When this policy changes, the date at the top changes with it, and anything that affects how your data is used is told to account holders by email before it takes effect.