Privacy Policy

1. Introduction

SIPSTORIES (“we”, “our”, “the Platform”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data across the app and event registrations. Your rights are subject to applicable data protection law, including provisions of the Digital Personal Data Protection Act, 2023 as they come into force.

2. Data We Collect

We collect the following data:

• Account data: Email address, date of birth (for age verification), username, and an optional private mobile number when you choose to add one
• Event registration data:Attendee names, required contact numbers and email addresses, self-declared attendee genders, ticket categories and quantities, named couple/individual entry groups, optional drink notes, registration status, consent records, and uploaded payment screenshots. Couple registrations include companion details; provide these only with that person's permission. Screenshots may contain transaction references, payer names, or other financial information. Upload only what is needed to verify payment; obscure unrelated balances and account details. Do not upload government IDs, card details, passwords, or OTPs.
• Profile data: Display name, bio, city, state, drinking style preference (all optional)
• Content data: Posts, comments, votes, and reviews you create, and images you choose to upload. Messages you send to Ask James are processed to generate its responses.
• Usage data: Interactions with the Platform (views, searches, clicks) for improving recommendations
• Optional location: When you use nearby discovery and allow location access, coordinates are sent to our server and Google Places to find nearby venues. Nearby search coordinates are rounded to three decimal places; this can still identify a precise area. Your live location is not shown to other members.
• Optional analytics data: If you allow analytics, Google Analytics receives sanitised screen paths, coarse device and browser information, and selected funnel events. We do not send emails, dates of birth, OTPs, usernames, invite codes, search text, posts, or messages to Google Analytics.

We do not request government ID uploads or payment credentials. Location is requested only for features that need it. A mobile number is optional for a community profile but required for event registration. Contact details are not displayed publicly.

3. Purpose of Data Collection

• Age checks for community eligibility and applicable event requirements
• Account authentication and security
• Managing event bookings, contacting attendees about their registration, checking payment evidence, and handling event support or disputes
• Providing and improving Platform features
• Personalizing drink and content recommendations (with your consent)
• Content moderation and abuse prevention
• Compliance with legal obligations (IT Act, DPDP Act)

4. Data Storage and Security

Your data is stored on secure servers provided by Supabase (PostgreSQL). We use encryption in transit (TLS) and at rest. Access to personal data is restricted to authorized personnel only.

Your date of birth is used solely for age verification and is not displayed publicly. Your email and optional mobile number are private and not displayed to other community members. Authorized event personnel may access attendee contact details as described below.

5. Data Sharing

We do NOT sell your personal data. We do NOT share your data with alcohol brands or advertisers. We may share data only:

• With law enforcement when required by valid legal process
• With service providers who assist in operating the Platform including Clerk for email authentication, our hosting and storage providers, Groq for Ask James responses, and an image-safety provider when image screening is enabled
• With Google Analytics when analytics is enabled, for measuring aggregate site and funnel performance, and with Google Places when you request nearby venue results
• With authorized event organizers and event-support personnel only as needed to manage attendance, contact attendees, and review payment evidence. The organizer must be identified in the event details; any separate organizer privacy notice must be shown before registration.
• In anonymized, aggregated form for research or analytics

6. Your Rights (DPDP Act, 2023)

Under the DPDP Act, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Withdraw consent: Withdraw consent for data processing at any time
• Grievance redressal: Lodge complaints with our Grievance Officer or the Data Protection Board of India

7. Data Retention

We retain account data for as long as your account is active. Upon account deletion, we will erase your personal data within 30 days, except where retention is required by law (e.g., for moderation audit trails).

Account deletion instructions explain how to delete your account in Settings or request deletion by email. Optional exit feedback is retained separately; your email is included with that feedback only if you explicitly allow follow-up.

Event registration and privacy

You can fill an event form without logging in. A draft of attendee details, ticket quantities, and optional drink notes is kept in this browser tab for up to 24 hours. Selected screenshots stay in memory until submitted and must be selected again after a refresh. Verify your email to save a registration; an account is created if needed. Existing accounts are used for sign-in, and editing event details does not change your community profile.

Server-issued booking quotes, submitted registrations and screenshots are stored privately. We use them for registration, payment review, event communications, and support. Temporary QR submissions collect a sample screenshot and do not collect payment. A submitted screenshot is evidence for review, not confirmation of payment. Attendee gender is used for event ticket eligibility and organizer/entry checks, not to infer identity or update community profiles. Each couple is stored as a distinct pair. Obtain permission before providing anyone else's contact details or gender. No government ID upload is requested. For real UPI payments, we store the transaction reference, amount due, reviewed amount received, bank payment timestamp, pricing tier and expiry, approval or rejection reason, review time and authorized reviewer identifier. Approved bookings also have named entry passes with unique pass identifiers. The organizer checks the receiving bank statement before confirming entries. This does not give SipStories access to your bank account or payment credentials.

Date of birth is not requested in the event form. You may provide it later to complete your profile and check community eligibility; it is not public. Event registration does not grant access to the community or permission to drink.

Event records are retained while needed to manage the registration, event, refunds or disputes, and applicable legal obligations. You or your companion can request access, correction, deletion, or withdrawal of consent at grievance@sipstories.in, even without community access. Account deletion also removes linked registration files, except data legally required to be retained. Withdrawing necessary registration data may prevent us from managing your booking; it does not itself determine any refund entitlement. Minimal payment-review records, including transaction-reference hashes and booking references, may be retained separately to prevent the same payment being reused. They contain no attendee names, email addresses, phone numbers, or screenshots. Contact us for review of retained payment records.

Event registration does not subscribe you to marketing. Any future marketing opt-in must be separate and optional.

Reported AI responses and health information

If you report an Ask James response, we retain the response excerpt and your optional explanation for moderation. The rest of the conversation is not included with the report. Reports submitted while signed in are associated with your account; guests can report without providing an email or account.

Hangover SOS provides general wellbeing information, not medical diagnosis or treatment. The selected symptom level and pledge are held only in the current page’s memory and are not saved to your account or sent to our servers. They reset when the page is reloaded. If you voluntarily include health information in a post, report or Ask James message, it is processed as described for that feature. Ordinary page-view analytics may record that the page was visited according to your analytics setting.

8. Children and Minors

Community access is restricted to users aged 25and above. Event eligibility is separate, so adult attendees below that community age may have registration records and an event-only account. The event flow is intended for adults and does not provide a parental-consent process. Do not submit a child's details through this flow. Contact grievance@sipstories.in if a child's details have been submitted. A community age restriction does not automatically cancel an event booking.

9. Cookies & Optional Analytics

We use essential cookies for authentication, age confirmation, preferences, and session management. Google Analytics is currently enabled by default unless you have saved a preference to disable it. It helps us understand screen usage and signup, login, onboarding, and PWA funnels. Advertising storage, advertising personalisation, and Google Signals remain disabled.

You can choose “Essential only” or “Allow analytics” at any time using the Privacy Choices below or in Settings. Withdrawing analytics consent stops future Analytics events and removes first-party Google Analytics cookies available to this site. Google may process consented analytics data as our service provider under its applicable data-processing terms. We do not use third-party advertising cookies.

10. Contact & Grievance Officer

For privacy-related concerns, contact our Grievance Officer:

Email: grievance@sipstories.in

Response time: 72 hours for user complaints, 36 hours for government/court orders.