# Giggifi Privacy Policy
How to read this policy. Sections 1 to 22 apply to everyone. Sections 23 to 27 are jurisdiction-specific annexes that apply only if and to the extent that the law they describe applies to our processing of your personal data. Where a law does not apply to us, we may still honour the requests it describes as a matter of policy — but we do not claim that a law binds us when it does not.
1. Who we are and how to contact us
1.1 The controller / data fiduciary.
Legal entity: GIGGIFI MEDIATECH (see Terms of Service, Clause 1.1, for
registration particulars and successor arrangements)
Registration no.: Sole proprietorship (no company registration number).
GSTIN 27ATUPC2318J1ZI; Udyam UDYAM-MH-18-0555250
Registered office: 4th Floor, B-5/C-401, Shivam C, Pankaj Shah Marg, near
Hanuman Temple, Goregaon East, Mumbai, Mumbai Suburban,
Maharashtra 400063
Country: India
For the personal data described in this policy, this entity is the controller (GDPR/UK GDPR terminology), the data fiduciary (Indian terminology) and the business (California terminology), except where we state that we act as a processor or service provider on a client's behalf.
1.2 How to reach us about privacy.
| Purpose | Contact |
|---|---|
| Privacy questions and rights requests | admin@giggifi.com |
| Grievances (India) | Grievance Officer — Mr. Sachin Kalpnath Chaudhary, Proprietor — admin@giggifi.com — see Terms of Service, clause 30.7, for full detail |
| Privacy contact | admin@giggifi.com (we have not appointed a Data Protection Officer) |
| EU representative | Not applicable — Giggifi serves customers in India and does not target the European Union |
| UK representative | Not applicable — Giggifi does not target the United Kingdom |
| Security incidents | admin@giggifi.com |
| Postal address for privacy correspondence | 4th Floor, B-5/C-401, Shivam C, Pankaj Shah Marg, near Hanuman Temple, Goregaon East, Mumbai, Mumbai Suburban, Maharashtra 400063 |
1.3 Scope. This policy covers personal data we handle through the Giggifi website, our mobile applications, our communications with you, and our back-office systems. It does not cover the independent practices of third parties whose services you use directly — for example your payment provider, your social sign-in provider, an app store, or a venue.
1.4 Our people; the limits of this policy. This Privacy Policy is a notice about how we handle personal data — it does not itself create, expand or waive any liability. Where this policy or our handling of your personal data gives rise to a claim, clauses 22 to 24 of the Terms of Service (warranties, limitation of liability and indemnification) apply to that claim in the same way as to any other claim against us, including the extension of every exclusion, cap and carve-out in those clauses to Giggifi Mediatech's proprietor and to our past, present and future directors, officers, employees, contractors and agents (Terms of Service, clause 23.9), and including the carve-outs in clause 23.5 that are never excluded (for example, our fraud, wilful misconduct or gross negligence, or a right Applicable Law does not allow us to exclude). Naming an individual as a contact point in clause 1.2 above — including our Grievance Officer — identifies who to write to. It does not make that individual personally liable to you; they act for, and are protected on the same basis as, Giggifi Mediatech.
2. A plain summary before the detail
| Question | Short answer |
|---|---|
| What do you collect? | Your identity and contact details; your profile and portfolio if you are an Artist; identity and bank details if you are being paid; event and booking details; payment records; messages sent through the Platform; device and usage data; and location data in specific situations described in section 5 |
| Why? | To run your account, make and manage bookings, take and release payments, keep the Platform safe, resolve disputes, meet legal obligations, improve the service, and — only if you agree — to send you marketing |
| Do you sell my data? | We do not sell personal data for money. Where advertising or measurement technologies are enabled, the disclosures they involve may count as a "sale" or "sharing" under some US state laws, and where they do we provide an opt-out. Section 12 explains this honestly rather than with a slogan |
| Who sees it? | Our service providers (hosting, database, messaging, payments, media storage, analytics), the other party to your booking to the extent necessary, and authorities where the law requires |
| Where is it stored? | Our database is hosted in the United States (AWS us-east-1, through Neon) and our website runs on Vercel in the United States. Payment data is held by Razorpay in India. Section 13 explains the rest |
| How long? | Different periods for different data, set out in section 14 |
| What can I do? | Access, correct, delete, object, port, withdraw consent, opt out of marketing, and complain. Section 16 and our privacy request page (https://giggifi.com/privacy-request) explain how |
| Children? | Giggifi is for adults. Section 18 explains |
3. Sources of the data we hold
We obtain personal data from:
| Source | Examples |
|---|---|
| You, directly | Registration details, profile and portfolio, identity and bank details, event and booking details, messages, reviews, support enquiries, survey responses |
| Your device | IP address, device and operating system information, app version, device identifiers, crash and diagnostic data, and location where you permit it |
| The other party to a booking | An Artist receives event and contact details from a Booker; a Booker receives profile and, where applicable, arrival information from an Artist |
| Third-party sign-in providers | If you sign in with a supported provider, we receive the basic profile information you authorise — typically name, e-mail address and profile image |
| Payment and payout providers | Transaction status, authorisation and failure codes, reference identifiers, refund and chargeback information. We do not receive your full card number or security code |
| Verification and anti-abuse providers | Verification results, risk and integrity signals |
| Analytics and, where enabled, advertising technologies | Usage and interaction data, only where you accept it in the website cookie banner |
| Publicly available sources | Where an Artist provides a social or portfolio link, or where we check a public claim made in a profile |
| Referrals | Where an existing user refers you, we learn that you were referred and by whom |
| Reports from other users | Information contained in a report or complaint about you |
4. What we collect — detailed inventory
4.1 Identity
| Data | Notes |
|---|---|
| Name | |
| Full legal name | Artists, for verification and payout |
| Stage or performing name | Artists |
| Profile photograph | |
| Gender | Optional. Shown on an Artist's profile so Bookers can filter by performer gender where relevant to the act. For Bookers it is an optional profile detail that we do not use to make decisions about you |
| Religion and anniversary date | Optional details a Booker may add to their profile. They are stored in your profile; we do not currently use them for matching, pricing or any automated decision. They are removed when you delete your account |
| Date of birth | Self-declared, collected once after sign-up. We reject and do not store a date of birth showing you are under 18. This 18+ check is enforced on our website and in both of our mobile apps (the Client app and the Artist app): you cannot use the Platform until you confirm a date of birth showing you are at least 18 |
| Languages spoken | Artists |
4.2 Contact
| Data | Notes |
|---|---|
| Mobile number | Used for sign-in and one-time passcodes |
| E-mail address | |
| Postal address, city, state, PIN code | Artists, for verification and invoicing |
| Event contact person and phone number | Provided by Bookers for a specific booking |
4.3 Account and authentication
| Data | Notes |
|---|---|
| Account identifier, role, account status | |
| Password, stored only as a salted hash | We never store your password in readable form |
| One-time passcode records | Stored as a hash, with expiry, attempt count and rate-limit events. We do not retain the passcode itself in readable form |
| Phone and e-mail verification timestamps | |
| Sign-in provider linkage | Where you use a third-party sign-in |
| Last login time, onboarding progress, locale preference | |
| Password reset tokens and expiry | |
| Referral code, who referred you, when it was used | |
| Terms and policy acceptance records | Which version, when, and the IP address and browser or app identifier at the time — kept as evidence that acceptance occurred |
4.4 Artist profile and portfolio
Profession, category and sub-category, performer type, genres, skills, biography, years of experience, event types performed, minimum engagement duration, travel availability, availability status, pricing (including per-format and per-ensemble pricing and whether it is negotiable), service radius and daily availability window for short-format bookings, profile photograph, gallery images, showreel and intro video, performance links, press kit, and social media links.
4.5 Verification and financial data — special care
| Data | Notes |
|---|---|
| Government identity document images | Currently front and back images of a national identity document, needed because verification is done by a human reviewer, not an automated ID-check service. Stored with our image-hosting provider; we do not encrypt the image files ourselves. Images uploaded from 12 October 2026 are private and are shown to our reviewers only through short-lived signed links. Older images are being moved to private storage and, until that is done, can be opened by anyone who has the direct link (see Section 15) |
| Tax identification number | |
| Business tax registration number | Where applicable |
| Bank account name, account number and branch code | For payouts |
| UPI or equivalent payment handle | For payouts |
| Verification status, reviewer, review timestamp and rejection reason | |
| Photograph or short video for verification | No automated face comparison or liveness check is performed — these are reviewed manually by our team |
We treat this category with the greatest care. It is used only for verification, payouts, fraud prevention, dispute resolution and legal compliance. It is never used for marketing, never used to train models, and never sold. Access is restricted to the personnel who need it to carry out a review.
4.6 Booking and event data
Event name, type and occasion; event date, flexibility and alternate dates; start and end time; duration; venue type, name and address; city and state; audience size; performance type; language preference; special requests; whether sound, lighting, travel and accommodation are provided; budget range; response urgency; mood-board or reference material; quoted price; booking status and status history; cancellation and dispute reasons; and, for short-format bookings, the requested time window and arrival and completion confirmations.
4.7 Messages and communications
Messages exchanged through the Platform in relation to an enquiry or booking; notification delivery records, including channel, status, failures and retries; your notification preferences and quiet hours; and your consent records for each communication type, including the version of the consent text you were shown, the time, and the IP address and browser or app identifier.
Where calls or messages between you and another user are routed through a platform number so that neither of you needs to disclose your personal number, we hold records of that routing. Call and message content is not recorded or logged by us or our telephony provider — only connection metadata (who, when, duration) needed to route the call.
4.8 Payment data
Transaction amount and currency; the fee breakdown, including platform fee, tax component and artist payout; payment provider name; provider order, payment and transaction reference identifiers; payment status; failure codes and messages; authorisation, payment, release, refund and reversal timestamps; refund amounts; reconciliation records; and chargeback records.
We do not collect or store your full card number, card expiry or card security code. Those are handled by our payment provider.
4.9 Technical and device data
IP address; approximate location derived from IP address; device type, model and manufacturer; operating system and version; browser type and version; application version; device and push notification identifiers; language and time zone; server, access and security logs; error and crash diagnostics; and integrity and anti-abuse signals from bot-protection services.
4.10 Location data — read this section
We handle location in four distinct ways, and they are not equivalent:
| Type | When | Who sees it | Retention |
|---|---|---|---|
| City and state you type in | Registration, search, booking | Used for matching; an Artist's city is shown publicly | While your account or booking record exists |
| Approximate location from IP address | Whenever you use the Platform | Us and our security providers, for security, fraud prevention and rough localisation | As for security and access logs (see section 14) |
| Address you type into an address search field | When you search for a venue or address | Sent from our servers to Google's Places service, which suggests matching addresses; we do not send Google your account details. The address you choose is saved with your booking | With the booking record |
| Precise coordinates for an Artist's base location and service radius | If you are an Artist who enables short-format bookings | Used to match you to nearby requests. The precise coordinates are not shown publicly | While the feature is enabled on your profile — deleted immediately if you turn it off |
| Live location while travelling to a booking | Only for a short-format booking, only after you indicate you are on your way, and only until arrival is confirmed | The Booker for that specific booking, so they know when to expect you | Up to 30 days after your last location update, then automatically deleted — only the booking's arrival/completion time is kept after that |
About live location sharing:
- It applies only to the short-format booking product, not to ordinary bookings.
- It starts only when the Artist actively indicates they are on the way.
- It is shared only with the Booker of that booking.
- It ends when arrival is confirmed.
- We ask for the operating system location permission, and we explain why at the point we ask.
In plain terms: We only track where you are while you are actually travelling to a booking you accepted, and we only show it to that one client. We know this matters — many performers on Giggifi travel alone, at night, to private addresses.
4.11 Reviews and reputation
Ratings and written reviews you give and receive, the booking they relate to, aggregate rating, and completion and cancellation history.
4.12 Support and trust-and-safety data
Support tickets and correspondence; reports you make about others and reports made about you; investigation notes and outcomes; moderation actions; enforcement history; and fraud and abuse signals.
4.13 Marketing and campaign data
Campaign membership and recipient status; delivery and click events; referral programme activity and rewards; promotional consent state and history.
4.14 What we do NOT collect
To be explicit:
- We do not collect your full card number, card expiry or card security code.
- We do not collect health data, and you should not include it in a profile, message or special request.
- We do not collect data about your political opinions, religious beliefs, caste, sexual orientation or trade union membership, and we do not ask for it. Note that some information a user volunteers — for example a preference for a performer for a religious ceremony — may indirectly reveal such information; we do not use it for any purpose other than fulfilling the booking.
- We do not collect data from public social media beyond a link you provide.
- We do not read your device's contacts, calendar, SMS messages or call logs. Our mobile apps request only your photo library (so you can choose a photo or video to upload) and your location (to match you with nearby short-format bookings, or to run your live-location updates while travelling to one) — and never your camera or microphone directly. Verified against both apps' declared permissions as of September 2026; if a future feature needs a new permission, this section will be updated before that feature ships.
4.15 Planned future permissions
We are planning an in-app calling feature (so an Artist and Booker can call each other directly through the app, alongside or instead of today's number-masking relay), which is expected to need access to your contacts (to let you start a call without typing a number), calendar (to check and show availability for a booking) and call log (to show your call history for a booking, for example if you need to show that a call did or did not happen as part of resolving a dispute). None of this is built or collected today — this section describes it here only so that when it ships, this Policy already says what it does honestly, rather than us adding new permissions silently. Before any of this goes live, we will update this section with what is actually collected, request the specific device permission from you at that time (not in advance), and obtain any consent the applicable law requires first.
5. Why we process your data, on what legal basis, and for how long
The Legal basis column applies where the GDPR or UK GDPR applies to the processing (see Annexes 24 and 25). Where the Indian framework applies, our approach is described in section 6 and Annex 23; it is structured differently and is not simply a translation of the GDPR column.
5.1 Running your account
| Purpose | Data | Legal basis (GDPR/UK) | Retention |
|---|---|---|---|
| Create and maintain your account | Identity, contact, account | Performance of a contract | Account lifetime + 90 days for non-essential data; core account record retained 7 years |
| Authenticate you; send one-time passcodes | Contact, authentication, device | Performance of a contract | Passcode records short-term; auth logs retained at least 12 months |
| Prevent credential abuse and rate-limit passcode requests | Authentication, technical | Legitimate interests — protecting accounts and controlling messaging costs | At least 12 months |
| Record which version of our terms you accepted | Acceptance records | Legal obligation and legitimate interests — evidencing agreement | For as long as needed to evidence the agreement — 7 years |
5.2 Artist listing and discovery
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Publish your Artist profile and portfolio | Profile, portfolio, city | Performance of a contract | While listed + 30–90 days after removal |
| Search, filtering and category discovery | Profile, location, pricing, availability | Performance of a contract; legitimate interests in operating a functioning marketplace | — |
| Review a registration before publication | Profile, verification | Legitimate interests — platform integrity and user safety; legal obligation where applicable | Account lifetime, plus 1 year after account closure |
| Match and recommend Artists | Booking criteria, profile, interaction history | Performance of a contract for the matching you request; legitimate interests for improving relevance | — |
5.3 Enquiries, bookings and events
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Transmit an enquiry to an Artist | Booking, contact | Performance of a contract | With the booking record |
| Enable quotation, negotiation and acceptance | Booking, messages | Performance of a contract | With the booking record |
| Confirm and administer a booking | Booking, payment | Performance of a contract | 8 years from the end of the financial year in which the booking closed |
| Enable communication between the parties | Messages, contact, proxied contact records | Performance of a contract | 12–24 months after the related booking closes |
| Confirm arrival and completion | Arrival and completion codes, timestamps | Performance of a contract | With the booking record |
| Share live location while travelling to a short-format booking | Precise location | Performance of a contract, with the operating system permission you grant. Where consent is the appropriate basis in your jurisdiction, we rely on consent | Up to 30 days, then automatically deleted |
5.4 Payments, payouts and tax
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Take payment | Payment, booking, identity | Performance of a contract | 8 years from the end of the relevant financial year |
| Apply the payment protection hold and release funds | Payment, booking status | Performance of a contract | As above |
| Pay Artists | Bank/payout details, identity, tax details | Performance of a contract; legal obligation for tax records | As above |
| Refunds, reversals and chargebacks | Payment, booking, evidence | Performance of a contract; legitimate interests in defending a chargeback | As above |
| Tax collection, withholding, reporting and invoicing | Identity, tax, payment | Legal obligation | 6 years (72 months) from the due date of the relevant annual return |
| Financial reconciliation, accounting and audit | Payment, reconciliation | Legal obligation; legitimate interests | Statutory period — we keep it for 8 years from the end of the financial year |
5.5 Verification, safety and fraud prevention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Verify identity | Verification documents, identity | Legitimate interests — preventing impersonation and fraud, protecting users; legal obligation where applicable | Approved: 5 years. Rejected: 30–90 days |
| Verify payout details | Bank details, identity | Performance of a contract; legitimate interests in paying the right person | 8 years |
| Detect and prevent fraud, abuse, automation and platform manipulation | Technical, device, integrity signals, behavioural, payment | Legitimate interests — protecting the Platform and its users; legal obligation where applicable | Indefinite, for as long as the fraud-prevention purpose remains valid |
| Investigate reports and enforce our policies | Reports, messages, booking, moderation records | Legitimate interests — user safety and platform integrity; legal obligation | Indefinite, for as long as the purpose remains valid |
| Respond to a serious safety incident | All relevant data | Legitimate interests, vital interests where there is a risk to life or physical safety, and legal obligation | Indefinite, for as long as the purpose remains valid |
| Keep security logs | Technical, access | Legitimate interests — security; legal obligation where a minimum log retention applies | At least 12 months |
5.6 Support and disputes
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answer your enquiries | Support, account, booking | Performance of a contract; legitimate interests | 3 years |
| Administer a dispute between users | Booking, messages, payment, arrival/completion, location, evidence submitted | Performance of a contract; legitimate interests in operating a fair dispute process | Until resolved, plus 3 years |
| Handle a grievance or regulatory complaint | All relevant data | Legal obligation | 3 years |
| Defend or bring a legal claim | All relevant data | Legitimate interests — establishing, exercising or defending legal claims | Until the claim and any appeal is finally resolved, plus the applicable limitation period |
5.7 Improving and securing the Platform
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Diagnose faults and fix bugs | Technical, crash and error data | Legitimate interests | Up to 12 months |
| Understand aggregate usage and improve features | Usage and interaction data. Where analytics uses non-essential cookies or similar technologies, consent applies where the law requires it | Legitimate interests, or consent where required | Up to 12 months |
| Test and develop features | Usually aggregated or pseudonymised data | Legitimate interests | Only aggregated or pseudonymised data is kept, for as long as it remains useful |
| Maintain security and integrity | Technical, device, integrity signals | Legitimate interests; legal obligation | At least 12 months |
5.8 Marketing and communications
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Send transactional messages you need to use the service | Contact, booking, notification | Performance of a contract — these are not marketing and are not subject to marketing consent | With the related record |
| Send promotional messages by e-mail, SMS, WhatsApp or push | Contact, preferences, consent records | Consent. Separate, unbundled, withdrawable at any time | Until you withdraw; your opt-out itself is kept for as long as we hold any contact details for you, so we don't message you again by mistake |
| Personalise promotional content | Interaction, booking history | Consent | Until you withdraw |
| Run referral and reward programmes | Referral, account, reward | Performance of a contract for the programme; legitimate interests in preventing abuse | 3 years after the relevant referral/reward activity |
| Advertising and conversion measurement using third-party technologies | Technical, interaction, identifiers | Consent where required by cookie and electronic communications law; and see section 12 on US "sale/sharing" | Only while you accept the relevant category in the website cookie banner |
We keep a suppression record after you unsubscribe. That is the minimum data needed to make sure we do not contact you again — it exists to honour your choice, not to circumvent it.
5.9 Legal compliance and corporate purposes
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Comply with a law, court order or lawful authority request | As required | Legal obligation | As required |
| Meet regulatory, tax and record-keeping requirements | As required | Legal obligation | Statutory period — we keep it for 8 years |
| Corporate transactions (section 20) | As relevant, minimised | Legitimate interests | Duration of the process |
5.10 On legitimate interests
Where we rely on legitimate interests, we assess whether our interest is real, whether the processing is necessary to achieve it, and whether it is fair to you having regard to your rights and expectations. We do not use legitimate interests as a general-purpose justification, and we do not use it for promotional marketing. You may ask us for a summary of our assessment for any specific processing at admin@giggifi.com, and you may object under section 16.
6. Consent — when we need it and how you control it
6.1 When consent is required. We ask for your consent for:
(a) promotional and marketing communications, by each channel; (b) non-essential cookies and similar technologies, where the law requires prior consent; (c) advertising and conversion measurement technologies, where consent is the applicable basis; (d) access to a device capability such as location, camera, photo library, or notifications — through the operating system permission prompt; (e) any biometric processing, if we introduce it; and (f) any new purpose that is not compatible with the purpose for which we originally collected the data.
6.2 When consent is not the basis. We do not ask for consent to run your account, take payment, verify an Artist's identity, prevent fraud, keep security logs, or meet a legal obligation, because consent is not the appropriate basis for those and presenting them as optional would be misleading. If you do not want that processing, you should not use the Platform.
6.3 How consent works here.
- Separate. Each purpose has its own control. We do not bundle marketing consent into account creation.
- Unticked. Nothing that requires consent is pre-selected.
- Recorded. We log what you agreed to, the version of the text you were shown, when, and from what device and IP address.
- Withdrawable. At any time, as easily as you gave it.
6.4 How to withdraw consent.
| Consent | How to withdraw |
|---|---|
| Marketing e-mail | Unsubscribe link in any marketing e-mail, or notification settings |
| Marketing SMS or WhatsApp | Reply with the stop keyword, or notification settings |
| Push notifications | In-app notification settings, or your device settings |
| Cookies and similar technologies | Cookie banner on the website; change your choice any time with "Cookie Settings" in the website footer |
| Location | Your device's operating system settings, and the in-app control while a live share is running |
| Any other consent | E-mail admin@giggifi.com |
6.5 What withdrawal does and does not do. Withdrawal stops future processing based on that consent. It does not make earlier processing unlawful, and it does not stop transactional communications you need in order to use the service or manage a booking you have already made.
7. Sharing your data with the other party to a booking
This is the sharing users most often overlook, so we set it out plainly.
When you send an enquiry as a Booker, the Artist receives: the event details you provided, your budget range if you gave one, and your message. Your name, phone number and e-mail are not disclosed at this stage — only after your payment is confirmed and held for the booking.
When a booking is confirmed, the parties receive what they need to deliver and receive the performance: the Artist receives the venue address, the contact person and phone number, and the event requirements; the Booker receives the Artist's real name and phone number.
Contact details. Before a booking is paid, neither side sees the other's phone number or e-mail. Once your payment is confirmed, the Artist and the Booker each see the other's real name and phone number inside the Giggifi app so that you can coordinate the performance. Number masking (routing calls through a platform number) is not turned on. We are also planning a direct in-app calling feature for the future — see Section 4.15 for what that is expected to need and the commitment to update this Policy before it ships.
Public information. An Artist's profile, portfolio, city, category, pricing information, aggregate rating and reviews are visible to anyone browsing the Platform, including people who are not logged in. A Booker's profile is not public. Reviews you write are published with your display name.
What is never shared with the other party. Your identity documents, your bank or payout details, your tax identification numbers, your password, your passcodes, and your precise home location.
8. Service providers and other recipients
We share personal data with the categories of recipient below. Each is bound to use it only for the purposes we specify, except where they act as an independent controller for their own purposes.
| Category | Function | Role | Location |
|---|---|---|---|
| Cloud hosting and edge delivery | Running the website and apps | Processor | United States (Vercel; global edge network) |
| Managed database | Storing your data | Processor | United States (Neon-managed Postgres, AWS us-east-1 / N. Virginia) |
| Authentication services | Sign-in and one-time passcodes | Processor | United States (Google/Firebase), as set by Google |
| Bot protection | Preventing automated abuse on website sign-in | Processor | United States (Google — reCAPTCHA Enterprise) |
| SMS delivery | Passcodes and notifications | Processor | India (MSG91, an Indian company) |
| Voice, SMS and business messaging | Notifications and number masking | Processor | United States / global (Twilio) |
| Transactional e-mail | Confirmations and notices | Processor | Resend, or an SMTP e-mail service (provider-managed locations) |
| Realtime messaging | Live booking-page updates on the website | Processor | Pusher (provider-managed locations) |
| Mobile push delivery | App notifications | Processor | United States (Expo) |
| Media storage and content delivery | Photos, video, documents | Processor | Cloudinary (provider-managed global network) |
| Address search | Suggesting venues and addresses as you type | Processor | United States / global (Google Places) |
| Crash reporting | Finding and fixing app crashes | Processor | Not currently active — the Sentry crash-reporting library is included in the apps but no reporting destination is configured, so no crash data is sent. If it is switched on, crash details, device model and operating-system version would be sent to Sentry (United States) |
| Payment and payout providers | Taking payment and paying Artists | Independent controller / regulated entity for its own compliance purposes | India (Razorpay, an RBI-regulated payment aggregator; payment data is required to be stored in India under RBI rules) |
| Analytics | Understanding usage | Not currently active — Google Analytics (GA4) is integrated in code but no measurement ID is configured as at the effective date of this policy | Not applicable while inactive; United States (Google) if enabled |
| Advertising and conversion measurement | Measuring campaign effectiveness | Not currently active — Meta Pixel is integrated in code but no pixel ID is configured as at the effective date of this policy. Likely independent controller — see section 12 — once enabled | Not applicable while inactive; United States (Meta) if enabled |
| Third-party sign-in providers | Where you choose to use them | Independent controller for their own processing | — |
| Professional advisers | Legal, accounting, audit | Processor or independent controller depending on role | As set by the adviser |
| Authorities | Where legally required — see section 9 | Independent controller | — |
| Corporate counterparties | In a transaction under section 20 | — | — |
Our commitments about service providers. We select providers with regard to their security and privacy practices; we put a written data processing agreement in place where one is required; we limit each provider to the data it needs; and we do not permit a processor to use your data for its own purposes.
9. Disclosures required by law
We may disclose personal data where we reasonably believe it is necessary to:
(a) comply with a law, regulation, court order, subpoena or a lawful request from a competent authority; (b) respond to a law enforcement or national security request made in accordance with Applicable Law; (c) establish, exercise or defend a legal claim; (d) enforce our Terms and investigate a suspected breach; (e) detect, prevent or address fraud, security or technical issues; or (f) protect the rights, property or safety of Giggifi, our users or the public, including where there is a risk to a person's life or physical safety.
Our approach. We assess whether a request is valid and lawful. Where we lawfully can, and where doing so would not prejudice an investigation or endanger anyone, we will notify the affected user before disclosing. We disclose the minimum necessary. We keep a record of the disclosures we make.
We do not currently publish a periodic transparency report on government and law-enforcement requests.
10. Publicly visible information
Some information is public by design, because a marketplace cannot function otherwise:
Public: Artist stage name, category, city, biography, profile photograph, gallery and showreel, genres and languages, experience, pricing information as displayed, availability status, aggregate rating, and reviews received. Reviews you write, together with your display name.
Not public: your legal name (unless you use it as your stage name), your phone number and e-mail address, your postal address, your precise coordinates, your identity documents, your bank details, your tax numbers, your messages, your booking history, and Booker profiles.
Think before you publish. Anything you put in a public profile, a review or a portfolio may be seen, copied, indexed by search engines and archived by third parties. We cannot fully undo that after the fact. Do not include your personal phone number, home address or financial details in public content.
11. Marketing
11.1 Transactional vs promotional. Transactional messages are part of the service — passcodes, booking confirmations, quotation alerts, payment and refund confirmations, event reminders, dispute correspondence, security alerts, and notice of changes to our terms. They are not marketing and you cannot opt out of them while you hold an account, though you can often choose the channel.
Promotional messages — offers, artist recommendations, new feature announcements, referral promotions, seasonal campaigns — require your consent and you can withdraw it at any time.
11.2 Channels. E-mail, SMS, WhatsApp or another business messaging channel, push notification, and in-app messages.
11.3 Quiet hours. We apply quiet hours to non-urgent notifications, and we apply them to promotional messages. Time-critical transactional messages — a passcode you just requested, or an alert about an event happening imminently — may be delivered at any time.
11.4 India-specific. Promotional SMS to Indian numbers is sent through registered headers and approved templates in accordance with the applicable telecom commercial-communication framework, and honours the national do-not-disturb preferences registered with your telecom operator. One-time passcode SMS are sent through MSG91 using a DLT-registered template. We send any other SMS only through DLT-registered headers and templates.
11.5 WhatsApp and business messaging. Where we message you on WhatsApp or a similar channel, that platform's own terms and privacy policy also apply, and the platform's opt-in requirements apply in addition to ours.
11.6 No sale of contact details. We do not sell or rent your contact details to third parties for their own marketing.
12. "Sale" and "sharing" of personal data — the honest answer
12.1 We do not sell personal data for money. We do not receive payment in exchange for disclosing your personal data, and we do not rent or trade contact lists.
12.2 But "sale" and "sharing" have wider legal meanings. Several US state privacy laws define "sale" to include disclosing personal information for valuable consideration other than money, and define "sharing" or "targeted advertising" to cover disclosing personal information to an advertising partner for cross-context behavioural advertising. Under those definitions, the use of common advertising and conversion-measurement technologies on a website can constitute a "sale" or "sharing" even where no money changes hands.
12.3 Our position.
We do not sell personal data, and we do not share it for cross-context behavioural advertising. At the effective date of this policy no advertising or analytics technology is active in the Giggifi apps or on the website: the website contains optional Google Analytics (GA4) and Meta Pixel code, but no measurement or pixel ID is configured, so neither runs. If we switch either on, it will load only after you accept the matching category in our website cookie banner and after the age check, and we will update this policy first. We never send identity documents, bank details, tax numbers, passcodes or message content to any advertising or analytics partner. Because no such technology is active, we do not currently offer a "Do Not Sell or Share" link; we will add one, and honour the Global Privacy Control signal, before enabling any advertising technology.
12.4 We never do the following, in any jurisdiction:
- disclose identity documents, bank details, tax numbers or passcodes to an advertising or analytics partner;
- disclose the content of your messages for advertising;
- use precise location for advertising;
- sell personal data of anyone we know to be under 18.
13. International transfers
13.1 Where your data is processed. Your data is processed in India and, where our service providers operate outside India, in the countries where they process data. Our hosting (Vercel) and database (Neon, AWS us-east-1) are in the United States; payment data is held by Razorpay in India; SMS passcodes are sent by MSG91 in India. The location of each other provider is shown in the table of service providers above.
13.2 Transfers under Indian law. Indian data protection law adopts a permissive approach to cross-border transfer, permitting transfer outside India subject to any restriction the Central Government specifies in relation to particular countries or entities. We monitor for any such restriction and will comply with it.
13.3 Transfers of EU/EEA and UK data. Where the GDPR or UK GDPR applies and we transfer personal data to a country without an adequacy decision, we rely on an appropriate safeguard — ordinarily the European Commission's Standard Contractual Clauses, together with the UK Addendum or the UK International Data Transfer Agreement for UK transfers — and we carry out a transfer risk assessment. You may request information about the safeguards we rely on for a particular transfer. We have not signed Standard Contractual Clauses with our service providers and we do not state that they are in place. We rely on each provider's standard data-processing terms.
13.4 Transfers under other laws. Where another jurisdiction's transfer rules apply, we will comply with them, and the relevant annex will describe the mechanism.
14. How long we keep data
14.1 The principle. We keep personal data only as long as we need it for the purposes described in this policy, or as long as the law requires us to keep it. Different categories have different periods because they serve different purposes.
14.2 Retention schedule.
| Category | Period | Why a period is legally necessary |
|---|---|---|
| Account and profile data | Account lifetime, then 90 days for non-essential data (core account record retained 7 years) | Service delivery; short post-closure period for reactivation, dispute and fraud purposes |
| Terms and consent acceptance records | 7 years | Evidence that you agreed, for the duration of any period in which a claim could be brought |
| Artist portfolio and media | While listed, then 30–90 days | Service delivery; short tail for accidental deletion recovery |
| Identity verification documents — approved | 5 years | Fraud prevention, dispute defence, and any applicable legal retention requirement |
| Identity verification documents — rejected | 30–90 days | Preventing repeat fraudulent registration. |
| Bank and payout details | While needed for payouts, then 8 years | Payment delivery; financial record-keeping |
| Booking records | 8 years from the end of the financial year in which the booking closed | Contract performance, dispute resolution, tax |
| Payment and refund records | 8 years from the end of the relevant financial year | Legal obligation — tax and accounting law prescribes a minimum period |
| Tax records and statements | 8 years from the end of the relevant financial year | Legal obligation |
| In-platform messages | 12–24 months after the related booking closes | Dispute resolution and safety investigation |
| Live location records | Raw location pings purged within 7–30 days; only arrival/completion timestamps are retained with the booking record | Arrival verification and dispute resolution |
| Reviews | Published while the account exists; retained after closure (reviewer name may be anonymised) | Marketplace integrity — removing all reviews on closure would let a user erase a poor record by re-registering |
| Support tickets | 3 years | Service quality and dispute history |
| Trust-and-safety and enforcement records | Indefinite, for as long as the fraud/safety-prevention purpose remains valid | Preventing a removed user from returning; safety of other users |
| Security and access logs | At least 12 months | Security investigation. |
| Marketing consent and suppression records | Suppression records kept indefinitely unless you ask otherwise | To ensure we continue to honour your opt-out |
| Dispute and claim records | Until finally resolved, plus 3 years (the general limitation period for a contract claim under India's Limitation Act, 1963) | Establishing, exercising or defending legal claims |
| Backups | 7–30 days | Disaster recovery. Data deleted from live systems persists in backups until the cycle completes |
14.3 What happens when you delete your account.
We want to be precise about this, because "delete" means different things in different systems.
When you delete your account:
- your profile and portfolio stop being publicly visible;
- your listing is removed from search and discovery;
- you stop receiving communications from us, other than any required by law or necessary to conclude an outstanding matter;
- your account is marked as deleted and you can no longer sign in;
- data we are not required or lawfully entitled to keep is deleted or irreversibly anonymised within 90 days.
We retain the following after account deletion, for the periods in the table above: payment, refund and tax records; records of confirmed and completed bookings; records necessary to defend a legal claim or resolve an open dispute; trust-and-safety and enforcement records where you were removed for a breach; records necessary to prevent fraud or repeat abuse; consent and suppression records; and data in backups until the backup cycle completes.
In plain terms: We will remove your profile and stop using your data. We cannot delete a tax record or a payment record just because you closed your account — the law requires us to keep those. And we keep a record if an account was removed for a safety breach, so the same person cannot simply sign up again.
What the deletion process does, field by field. When you confirm deletion in the app or on our website, we immediately: delete your push-notification tokens, your sign-in sessions and any linked sign-in accounts, and the photos and videos in your gallery; replace your name with "Deleted User" (or "Deleted Artist" / "Deleted Vendor" for a business name); remove, for Bookers, the e-mail address, company, city and state on your Booker profile and, for Artists, the legal name, biography, profile photo, intro and showreel videos, performance links, address lines and base-location coordinates on your Artist profile (and for vendors, the contact name, biography, photos and video); remove your e-mail address, phone number, profile photo, date of birth, gender, religion and anniversary date from your account; hide your profile from search; and mark the account as deleted so you can no longer sign in. We keep booking, payment, review and tax records and, for Artists, identity-verification and bank records, as described above. Files you uploaded are unlinked from your profile but may remain in our media storage provider's systems; if you want them removed, write to admin@giggifi.com.
15. How we protect your data
15.1 We maintain technical and organisational measures designed to protect personal data against unauthorised or unlawful access, use, disclosure, alteration, loss and destruction.
15.2 Measures.
| Measure | Status |
|---|---|
| Encryption of data in transit using industry-standard transport security | Implemented — HTTPS/TLS throughout (Vercel), enforced SSL to the database (Neon) |
| Encryption of data at rest by our providers | Our database provider (Neon) and image-hosting provider (Cloudinary) apply their own storage protections as described in their documentation; we have not independently verified them. The image files themselves are not encrypted by us. See the row below for the fields we encrypt ourselves |
| Field-level encryption of bank details, payout handles and tax and identity numbers | Implemented for these stored values — AES-256-GCM application-level encryption (PAN, Aadhaar number where one was stored, bank account name/number, IFSC, UPI ID, GST number), each row keyed by its own data key wrapped under a master key held outside source control. Identity document images (card photos) are files, not database values, and are not encrypted by us |
| Private, signed or access-controlled URLs for identity documents and sensitive media | Implemented for documents uploaded going forward — private (authenticated) Cloudinary storage, served only via a freshly generated, 30-minute expiring signed URL, never persisted. Documents uploaded before this hardening remain on their original public URL until the user re-uploads |
| Passwords stored only as salted hashes | Implemented — bcrypt |
| One-time passcodes stored as hashes, with expiry and attempt limits | Implemented |
| Rate limiting on authentication and passcode requests | Implemented, including admin credential login (added September 2026) |
| Bot protection | Implemented on the website — reCAPTCHA Enterprise on phone sign-in; the apps rely on rate limiting |
| Multi-factor authentication for administrative and vendor console access | Implemented for the admin console (TOTP-based two-step login, added September 2026). |
| Audit logging of administrative access to personal data and identity documents | Implemented for KYC approval and rejection actions — an admin action audit log records them (added September 2026) |
| Secrets held only in a managed secret store, never in source control | Implemented — environment variables, not committed to source control |
| Regular backups, with restore testing | Implemented — Neon automatic backups / point-in-time recovery |
| Dependency and vulnerability management | Implemented — automated weekly dependency updates and a CI check blocking high/critical vulnerabilities on every pull request (added September 2026) |
15.3 No absolute guarantee. No method of transmission over the internet and no method of electronic storage is completely secure. We cannot guarantee absolute security. We maintain reasonable measures and continue to improve them.
15.4 Your part. Use a strong, unique password. Never share a one-time passcode with anyone, including anyone claiming to be from Giggifi — we will never ask for it. Keep your devices and the app updated. Sign out on shared devices. Tell us immediately at admin@giggifi.com if you suspect unauthorised access.
16. Your privacy rights
16.1 Rights we offer to everyone, regardless of where you live. As a matter of policy, and separately from any statutory entitlement, we will consider a request from any user to:
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you |
| Correction | Have inaccurate or incomplete data corrected |
| Deletion | Have your data deleted, subject to the retention obligations in section 14 |
| Portability | Receive certain data in a structured, machine-readable format |
| Withdraw consent | For anything based on consent |
| Object | To processing based on legitimate interests, and to direct marketing |
| Restriction | Ask us to limit processing while a dispute about accuracy or lawfulness is resolved |
| Human review | Of a significant decision made about you solely by automated means |
| Opt out | Of marketing, and of any sale or sharing for behavioural advertising |
| Complain | To us, and to a supervisory authority or consumer forum |
16.2 Statutory rights. In addition, where the law of your jurisdiction gives you rights in relation to your personal data, those rights apply. Annexes 23 to 27 describe the position for India, the EU/EEA, the UK, the United States and other jurisdictions.
16.3 How to exercise a right. Full mechanics are in the Privacy Rights Request Procedure. In summary: e-mail admin@giggifi.com, or use the controls in your account settings where available. We will:
- acknowledge your request;
- verify your identity, proportionately to the sensitivity of the request;
- respond within the period required by the applicable law, or within 30 days where no statutory period applies;
- tell you if we need an extension, and why;
- tell you if we cannot fulfil the request in whole or in part, and on what basis; and
- tell you how to appeal or complain.
16.4 No charge, and no penalty. We do not charge for a request, unless it is manifestly unfounded or excessive or repetitive, in which case we may charge a reasonable fee or decline, and we will explain why. We will not discriminate against you for exercising a privacy right — we will not deny you service, charge you a different price, or give you a lower quality of service.
16.5 Authorised agents. You may use an authorised agent where the applicable law allows. We will ask for evidence of the authorisation and may ask you to confirm it directly.
16.6 Limits. We may not be able to fulfil a request where doing so would: prevent us meeting a legal obligation; compromise the rights of another person; prevent us detecting or preventing fraud; interfere with an ongoing investigation or legal claim; or require us to delete a record we are required to keep. Where that happens we will tell you which limitation applies.
17. Automated decision-making, profiling and AI
17.1 What we do.
| Activity | What it does | Is it a decision that alone significantly affects you? |
|---|---|---|
| Search ranking | Orders Artists in results | No — you choose from the results |
| Artist matching and recommendation | Suggests Artists based on your event details and interactions | No — a suggestion, not a decision |
| Budget-based discovery | Filters by stated price band | No |
| Personalised content and offers | Tailors what we show or send you | No |
| Fraud, abuse and automation detection | Flags suspicious activity | Potentially yes — see 17.3 |
| Automated verification checks | Assists identity review | Potentially yes — see 17.3 |
| Automated content moderation | Not used — reports are reviewed by a person; contact details in public profile text are removed automatically | No |
| Payout risk holds | May pause a payout pending review | Potentially yes — see 17.3 |
17.2 Profiling. Matching, recommendation and personalisation involve analysing your data to infer what is likely to be relevant to you. That is profiling in the sense used in data protection law. It does not produce a legal decision about you.
17.3 Solely automated decisions with significant effects. Where a decision is made about you solely by automated means and has a legal effect or otherwise significantly affects you — for example an automated block that prevents you accessing your account, an automated verification rejection, or an automated hold on a payout — we will:
(a) tell you that the decision was automated; (b) explain, in general terms, the basis for it; (c) give you the right to ask a person to review it; and (d) give you the right to contest it and express your point of view.
To request human review, contact contact@giggifi.com.
In plain terms: If a machine locks you out and you are a genuine user, you can get a human to look at it. Automated fraud checks get things wrong sometimes, and an artist should not lose access to their income because of a false positive.
17.4 Ranking transparency. The categories of factor we use in ranking and matching are described in the AI & Algorithmic Transparency Notice. We do not publish weightings or the model, because that would enable manipulation.
17.5 Featured placement is labelled. Promoted or featured listings are visibly labelled. We do not present a featured placement as an organic result.
17.6 Generative AI. Giggifi does not currently operate any generative AI feature. The "Ask GiggFi" assistant matches artists using fixed rules, not an AI model. If we introduce one, we will disclose it, tell you when you are interacting with an AI system rather than a person, and label AI-generated content as required by Applicable Law.
17.7 Training. We do not use user data or user content to train any machine-learning model.
17.8 Synthetic media uploaded by users. Users must not present content that is generated or materially altered by AI as a recording of a genuine performance. See the Terms of Service, clause 8.7.
18. Children
18.1 Giggifi is for adults. You must be at least 18 to hold an account. We do not knowingly collect personal data from anyone under 18. We do not direct the Platform to children.
18.2 If we learn that a user is under 18. We will suspend the account, delete the personal data we hold about them except where we are required to keep it, and cancel any pending booking.
18.3 Reporting. If you believe a person under 18 holds an account, or that we hold data about a child, contact admin@giggifi.com and we will investigate promptly.
18.4 Minors appearing in content. Artist portfolios may include images or video in which a person under 18 appears — for example a dance troupe or a student ensemble. Anyone uploading such content must have the consent of that person's parent or guardian, and we will remove content on request from a parent or guardian.
18.5 Minor performers. A person under 18 may not register as an Artist. Any engagement involving a performer under 18 must be arranged through our manual process, and we require evidence that the statutory conditions applicable to engaging a child in the entertainment industry have been met.
18.6 Children at events. Bookings for birthday parties, school functions and family events will often involve children as audience members. We do not knowingly collect personal data about them. Please do not include a child's name, photograph, school or other details in event notes, special requests or messages.
18.7 No behavioural advertising to children. We do not knowingly use personal data of anyone under 18 for targeted or behavioural advertising, and we do not sell it.
19. Sensitive and special-category data
19.1 Different laws define "sensitive" differently, and we apply the definition of the law that applies to you rather than labelling data sensitive because it sounds personal.
19.2 What we hold that is likely to be treated as sensitive somewhere.
| Data | Treated as sensitive under | How we handle it |
|---|---|---|
| Government identity document details and images | Widely treated as sensitive or specially regulated. National identity numbers are subject to specific statutory restrictions in India | Verification, payout, fraud prevention, dispute resolution and legal compliance only. Never for marketing. Never sold. Access restricted |
| Bank account and payout details | Treated as sensitive under several US state laws and under the Indian framework | Payouts only. Access restricted |
| Tax identification numbers | Treated as sensitive under several US state laws | Tax compliance and payouts only |
| Precise geolocation | Expressly sensitive personal information under California law and several other US state laws | Only for the purposes in section 4.10, only with device permission, only for the duration needed, with a stop control |
| Account credentials | Sensitive under several US state laws | Never disclosed. Passwords hashed |
| Biometric data | Sensitive in most regimes; some jurisdictions provide a private right of action | Not applicable — no automated face comparison or liveness check is performed today |
19.3 What we do not intentionally collect. We do not ask for and do not want data about your health, disability, political opinions, religious or philosophical beliefs, caste, race or ethnicity, sexual orientation, sex life, trade union membership, genetic data, or criminal record. Please do not include such information in a profile, message, review or special request. If you do, we will use it only to the extent necessary to fulfil the booking or to respond to your message, and we will not use it for any other purpose.
19.4 Limiting use of sensitive personal information. Where the applicable law gives you a right to limit our use of sensitive personal information, section 26 explains how to exercise it. In any event, we use the categories in 19.2 only for the purposes stated and not for advertising or profiling.
20. Corporate transactions
If Giggifi is involved in a merger, acquisition, financing, reorganisation, sale of all or part of its business, insolvency or bankruptcy, personal data may be reviewed by, or transferred to, the counterparty or a successor entity, or to an administrator or liquidator, subject to Applicable Law.
Our commitments: during due diligence we disclose the minimum necessary and prefer aggregated or pseudonymised data; we require the recipient to be bound by confidentiality; we will notify you if your personal data becomes subject to a materially different privacy policy as a result of such a transaction, and we will tell you what choices you have; and a successor remains bound by this policy until it lawfully changes it with notice to you.
21. Third-party links and integrations
The Platform links to third-party websites and services — an Artist's social media, a video hosting service, a payment provider, a maps service, an app store. Those services have their own privacy policies and we do not control them. A link is not an endorsement. Please read the privacy policy of any service you use.
Where you sign in using a third-party provider, that provider learns that you signed in to Giggifi and processes data under its own policy.
22. Changes to this policy
22.1 We may update this policy to reflect changes in our practices, the Platform, or Applicable Law.
22.2 Notice. For a material change — a new purpose, a new category of recipient, a new category of data, an extended retention period, or a change to your rights — we will give you notice before it takes effect, by e-mail and by in-app or on-Platform notice, and we will summarise what is changing. For a non-material change, such as a clarification or a corrected typo, we will update the "last updated" date.
22.3 Consent where required. A new purpose, or a new advertising recipient, requires your consent — not merely notice. We will ask.
22.4 Version history. This policy carries a version number, an effective date and a last-updated date. Earlier versions of this policy are available on request from admin@giggifi.com.
JURISDICTIONAL ANNEXES
Applicability. Each Annex applies to you if and to the extent that the law it describes applies to our processing of your personal data. We describe the rights that law provides and how to exercise them. We do not represent that any particular law currently applies to us. Where a law does not apply to us, we may still honour the requests described as a matter of policy.
ANNEX 23 — India
23.1 Framework. Our processing of personal data in India is governed by the Information Technology Act, 2000 and rules made under it, and — as its provisions come into force — by the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
23.2 Phased commencement — stated plainly. The Rules were notified in November 2025 with a phased commencement. Certain provisions took effect on notification, the provisions relating to registration of Consent Managers take effect approximately twelve months after notification, and the principal substantive obligations — including the content of the notice, the consent mechanics, data-principal rights, breach notification, children's data and security safeguards — take effect approximately eighteen months after notification, that is in May 2027.
We are building to those obligations now and will apply them as they take effect. Nothing in this policy should be read as a statement that a provision currently imposes an obligation on us that it does not yet impose.
23.3 Notice. This policy, together with the specific notices we give you at the point of collection, is intended to serve as the notice required of a data fiduciary. Where a separate, standalone consent notice is required for a particular processing activity, we will provide it.
23.4 Your rights. As those provisions come into force, you will have the right to:
(a) obtain a summary of the personal data we process about you and the processing activities we undertake; (b) obtain the identities of other data fiduciaries and processors with whom your data has been shared, and a description of the data shared; (c) have your personal data corrected, completed or updated; (d) have your personal data erased, subject to our retention of data where required for a legal purpose; (e) nominate another individual to exercise your rights in the event of your death or incapacity; (f) withdraw your consent where consent is the basis for processing; and (g) have a readily available means of grievance redressal.
23.5 How to exercise them. Contact admin@giggifi.com, or our Grievance Officer at admin@giggifi.com (see Terms of Service, clause 30.7). See the Privacy Rights Request Procedure.
23.6 Grievance redressal and escalation. You must first raise a grievance with us. Our Grievance Officer's details, and our acknowledgement and resolution timelines, are in the Terms of Service, clause 30.7. If you are not satisfied with our response, you may complain to the Data Protection Board of India in accordance with the procedure it prescribes.
23.7 Consent Managers. Where a registered Consent Manager mechanism becomes operational and we participate in it, we will update this policy to explain how you can use it.
23.8 Retention. The Rules prescribe a fixed erasure period for certain classes of platform above specified user thresholds. Giggifi is below those thresholds and that fixed period does not apply to us. Our retention periods are in section 14 and are set by reference to our own purposes and legal obligations.
23.9 Children. As those provisions come into force, processing the personal data of a child will require verifiable consent from a parent or lawful guardian, verified through the means the Rules prescribe, and certain tracking and targeted advertising directed at children will be restricted. Giggifi is an 18-and-over platform and does not knowingly process children's data. See section 18.
23.10 Significant Data Fiduciary. Designation as a Significant Data Fiduciary is made by the Central Government. Giggifi has not been designated and does not claim that status or the obligations attaching to it. If we are designated, we will update this policy.
23.11 Cross-border transfer. See section 13.2.
23.12 Security incidents. Where the applicable provisions are in force, we will notify affected individuals without delay and will make the required intimation and detailed report to the Data Protection Board within the prescribed periods.
ANNEX 24 — European Union / EEA
24.1 Applicability. This Annex applies if and to the extent the GDPR applies to our processing — broadly, where we offer services to individuals in the EU/EEA or monitor their behaviour there. Giggifi serves customers in India and does not actively target the EU/EEA; the Platform being reachable from the EU is not, by itself, targeting.
24.2 Controller and representative. The controller is the entity in section 1.1. We have not appointed an EU representative because Giggifi does not target the EU.
24.3 Legal bases. Set out in the tables in section 5.
24.4 Your rights. Access (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction (Art. 18); data portability (Art. 20); objection, including an absolute right to object to direct marketing (Art. 21); rights in relation to automated decision-making (Art. 22); withdrawal of consent (Art. 7(3)); and the right to lodge a complaint with a supervisory authority (Art. 77).
24.5 Response time. Within one month of receipt, extendable by two further months for complex or numerous requests, with an explanation.
24.6 Complaints. You may complain to the supervisory authority in your Member State of residence, place of work, or the place of the alleged infringement. A list is maintained by the European Data Protection Board.
24.7 Transfers. See section 13.3.
24.8 Cookies and similar technologies. Non-essential cookies and similar technologies require your prior consent under national implementations of the ePrivacy Directive. See the website cookie banner. We will not load non-essential technologies before you consent. Our website shows a cookie-consent banner; analytics and marketing scripts load only after you accept that category and after the age check.
24.9 Data protection impact assessment. We will carry out an assessment where processing is likely to result in a high risk to individuals. Live location tracking of performers, and the processing of identity documents, are both candidates for assessment and should be assessed before the EU is targeted.
24.10 AI transparency. Where Article 50 of the EU AI Act applies to a feature we operate, we will disclose that you are interacting with an AI system, and we will mark synthetic content, as that Article requires. Those obligations have applied since 2 August 2026.
24.11 Platform transparency. Where the Digital Services Act applies to us, we will provide notice-and-action mechanisms, statements of reasons for restriction decisions, an internal complaint-handling system, and the transparency information the Act requires. Certain obligations do not apply to micro and small enterprises.
24.12 Business users. Where the Platform-to-Business Regulation applies, Artists using the Platform in a business capacity have additional rights in relation to ranking transparency, notice of changes to terms, statements of reasons for restriction or suspension, an internal complaint-handling system, and access to mediation.
ANNEX 25 — United Kingdom
25.1 Applicability. This Annex applies if and to the extent the UK GDPR and the Data Protection Act 2018 apply to our processing. Giggifi does not target the United Kingdom.
25.2 Representative. We have not appointed a UK representative because Giggifi does not target the United Kingdom.
25.3 Your rights. Substantively as set out in Annex 24.4, under the UK GDPR.
25.4 Complaints. You may complain to the Information Commissioner's Office.
25.5 Transfers. We rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. See section 13.3.
25.6 Cookies and electronic marketing. Governed by the Privacy and Electronic Communications Regulations in addition to the UK GDPR. Non-essential technologies require prior consent, and direct electronic marketing requires consent or reliance on a recognised exemption. See the website cookie banner.
25.7 Legislative change. The UK data protection framework is being amended by the Data (Use and Access) Act 2025, which is commencing in tranches.
ANNEX 26 — United States
26.1 There is no single US privacy law. Privacy in the United States is regulated principally at state level, and each state law has its own applicability thresholds. As at the date of this policy, roughly twenty states have comprehensive consumer privacy laws in force or with future effective dates.
26.2 We do not claim that any of them currently applies to us. Most state laws apply only above a consumer-volume or revenue threshold — commonly around 100,000 consumers — which a launch-stage platform is unlikely to meet. Note however that at least one state, Texas, applies without a consumer-volume or revenue threshold, subject to a small-business carve-out. That makes Texas the state most likely to apply to Giggifi first, ahead of California.
26.3 Rights we extend to US residents. Where a state law applies to us, we honour the rights it provides. As a matter of policy, we will also consider these requests from any US resident even where the law does not apply to us:
| Right | What we do |
|---|---|
| Know / access | Tell you the categories and specific pieces of personal information we collected, the categories of source, the purposes, the categories of third party to whom we disclosed it, and — where applicable — the categories sold or shared |
| Delete | Delete your personal information, subject to statutory exceptions and to the retention obligations in section 14 |
| Correct | Correct inaccurate personal information |
| Portability | Provide your data in a portable, readily usable format |
| Opt out of sale or sharing | Stop selling or sharing your personal information for cross-context behavioural advertising |
| Opt out of targeted advertising | Stop processing your personal information for targeted advertising |
| Opt out of profiling | Where profiling produces legal or similarly significant effects |
| Limit use of sensitive personal information | Limit our use and disclosure of sensitive personal information to what is necessary to provide the service |
| Non-discrimination | We will not deny service, charge a different price, or provide a lower quality of service because you exercised a right |
| Appeal | Where the applicable state law provides an appeal right, we will tell you how to appeal a refusal, and how to complain to the state Attorney General |
26.4 Notice at collection. The categories of personal information we collect, the purposes, the categories of recipient, and our retention approach are set out in sections 4, 5, 8 and 14. Those sections are intended to serve as our notice at collection.
26.5 Sale and sharing. See section 12, which sets out the position honestly rather than with a slogan. Where advertising or measurement technologies operate in a way that constitutes a sale or sharing under a state law, we will:
(a) provide a clearly labelled "Do Not Sell or Share My Personal Information" link; (b) honour the Global Privacy Control browser signal as a valid opt-out; and (c) not require you to create an account to opt out.
Giggifi does not market to US residents.
26.6 Sensitive personal information. Under California law and several other state laws, precise geolocation is sensitive personal information, as are government identifier numbers, financial account information combined with access credentials, account log-in credentials, and biometric information. Section 19 explains what we hold and how we limit its use. We do not use sensitive personal information for advertising or for inferring characteristics about you.
26.7 Financial incentives. Our referral programme is offered to users in India and is not offered as a financial incentive in exchange for personal data from California residents.
26.8 Minors. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone we know to be under 18. See section 18 — and the note there about the current absence of an age gate.
26.9 Authorised agents. You may use an authorised agent. We will require proof of authorisation and may ask you to verify your identity directly.
26.10 How to exercise a right. E-mail admin@giggifi.com, or use the controls in your account settings. See the Privacy Rights Request Procedure.
26.11 Other US laws. Depending on the activity, other US laws may apply, including federal and state rules on electronic and text-message marketing, children's online privacy, and state biometric privacy statutes.
ANNEX 27 — Other jurisdictions
27.1 Where we begin offering services in another jurisdiction, we will add an annex for it, drafted and confirmed by local counsel, and will update this policy before that market is targeted.
27.2 Reserved slots. Canada (including Quebec) · Australia · Singapore · United Arab Emirates · Saudi Arabia · Japan · South Korea · Brazil · New Zealand · South Africa · Switzerland.
27.3 We do not represent that a single global clause in this policy satisfies the requirements of any of these jurisdictions. Each has distinct requirements on notice, consent, transfer, breach notification and registration, and several require local representation or filing.
Change history
| Version | Date | Author | Summary of change | Approved by |
|---|---|---|---|---|
| 1.0 | 7 October 2026 | Giggifi | First published version | Mr. Sachin Kalpnath Chaudhary, Proprietor |