Privacy Policy

What we collect, and why

Your WhatsApp number, because it is how we verify your identity and how the puja video and updates reach you. Your name and, optionally, your email, for the booking record and receipt.

The names and gotras you enter for the sankalp. These are the heart of the service: the pandit speaks them at the temple. We treat them as personal data belonging to each named person, not just to you.

A delivery address, only if you have asked for temple prasad to be couriered.

Your puja wish, if you write one. It is passed to the pandit and to nobody else.

Birth details for the sankalp

For the detailed sankalp we ask four things about you and about every other person you name: date of birth, gender, time of birth and place of birth. If you do not know a time of birth you can say so, and the puja proceeds without it. We ask for these at the last step, after payment, and only under an explicit consent that is not ticked for you and that you give separately from accepting our terms.

They are used for one purpose. The pandit's detailed sankalp names each person by their birth details as well as by their name and gotra, and nothing else on this site reads them.

They are never used for advertising, profiling, segmentation or retargeting. They are never sold. They are never shared beyond the temple and the pandit performing that puja. No birth detail is ever included in anything sent to an analytics or advertising service, and a check that runs on every build fails the build if a code path would allow it.

This is a change from what this page used to say, and we would rather state it plainly than let you find it: birth details are stored on our servers. The rashi finder at /rashifal is a separate thing and has not changed — it does its calculation entirely inside your browser, and the date, time and place you type there are never sent to us at all.

We keep birth details for two years after the puja they were given for, and then erase them from the saved person and from the booking, while keeping the booking record itself for the eight years described below. Where you have saved a person we have not named in a puja, the two years run from the last time you entered or changed their details. Erasing means exactly that: the date of birth, the gender, the time and the place are overwritten with nothing — on the saved person, on the sankalp, and on the copy your account holds of your own entry. They are not hidden behind a flag, because the promise is that we no longer have them. That period is deliberately not those eight years: the eight years exist because tax law requires transaction records to be kept, and a birth detail is not a transaction record.

If you name someone else, you are confirming that you have their permission — for their birth details as much as for their name and gotra. They may write to us and ask us to remove them, and we will.

A person under 18 may be named in a sankalp. Where the date of birth you enter means the person is a child, we ask you to confirm on that card that you are their parent or guardian and are consenting on their behalf. No advertising and no measurement is ever keyed to a child's record. Whether that confirmation meets the standard the DPDP Act sets for verifiable parental consent is with our legal advisers.

What we do not collect

We never see or store your card number, UPI PIN or bank credentials. Payments are handled entirely by our payment gateway; we receive only a confirmation and a reference.

We do not sell your data to anyone, at any price, ever. We do use advertising and measurement services, which is described in full below — but only where you have agreed to it, and never with anything from your sankalp.

Who your details are shared with

The temple and the pandit performing your puja receive the sankalp names, gotras and birth details — that is the point of the booking. They receive nothing else, not your phone number, address or email.

Our courier partner receives your name, address and phone number, solely to deliver prasad.

Our payment gateway receives what it needs to process the transaction.

Where you have given advertising consent, a one-way scrambled form of your phone number and of your account identifier is sent to Meta, so that an advertisement can be matched to a booking. Nothing else about you goes with it: no name, no email, no address, no gotra, no sankalp name, no puja wish and no birth detail. Without that consent nothing is sent at all.

We disclose data to a government authority only where a written order compels us to, and we will tell you when that happens unless the order forbids it.

Analytics and advertising

Google Analytics runs on this site for every visitor, from the first page you open, whether or not you have given advertising consent. It is how we see which pages are read, which pujas are looked at and where people leave. It sets a Google Analytics cookie in your browser so that a second page you open counts as the same visit rather than a new stranger, and it receives the pages you view, the language you are reading in, which steps of a booking you reach and the rupee amount involved, the approximate area you are in — worked out from your internet address, which we never see ourselves — and the kind of device and browser you are using.

It does not receive your name, phone number, email, address, gotra, sankalp names, puja wish or any birth detail. If you would rather not be counted at all, a browser setting or extension that blocks Google Analytics will stop it, and the site works exactly the same way with it blocked.

Advertising is a separate thing and still requires your consent. Google Tag Manager and the Meta pixel do not load, and no advertising identifier is set, unless you give advertising consent. Without it nothing about you is sent to any advertising network. That consent is off by default, it is not ticked for you, and you can use the whole site without ever giving it.

With your consent we load Google Tag Manager and the Meta pixel, and we additionally send Meta a server-side record of the same few steps — reaching the offerings step, adding an offering, reaching the payment step, and completing a booking — so that we can tell which advertisements actually lead to a puja being booked.

What those advertising services receive is: which of those steps you reached, the rupee amount involved, and, server-side only, the scrambled phone number and account identifier described above. They do not receive your name, email, address, gotra, sankalp names, puja wish or any birth detail.

You can withdraw advertising consent at any time from your bookings page. Withdrawing it stops the advertising described above and deletes any unfinished booking selection we were holding. It does not stop Google Analytics, which is not what that consent covers, and it does not affect messages about a puja you have actually booked — those are a different thing, described next.

Messages we send you

WhatsApp is how we reach you about a puja you have booked: the one-time password that logs you in, the confirmation, the recorded video and delivery updates. These are part of the service you paid for and are on by default. SMS is used only as a fallback when the login code cannot be delivered on WhatsApp.

Anything promotional — festival pujas, reminders, offers — is a separate thing and is off unless you turn it on. WhatsApp, SMS and email are chosen independently of each other, and you can change any of them at any time from your bookings page.

Turning every promotional channel off records the date you did it, so that a later promotional message is a mistake we can find rather than a claim you have to argue.

Selections saved before you pay

When you reach the offerings step we save what you have chosen so far — the puja, the package, any bhet, any dakshina amount and who you have named — against your account, so that you can close the page and come back to it. It holds no birth detail, because those are only ever asked for after payment.

If you do not complete the booking, that saved selection is deleted. We keep it for up to 90 days after you last touched it, or until the puja's date passes, whichever comes first. That is the same 90 days whether or not you have given advertising consent: consent changes what a saved selection may be used for, not how long it is kept.

During that window a saved selection may be used to show you a reminder or an advertisement only if you have given advertising consent. Without that consent it is held so that you can come back to it and for nothing else, and it is not used to advertise to you. Sending you a reminder message additionally needs the relevant promotional channel to be switched on: the advertising consent on its own is not permission to message you.

Withdrawing advertising consent deletes any selection you have left behind. A selection you are in the middle of is not taken off the screen in front of you: it is held to finish the booking you are making, and it goes on the ordinary schedule above if you then leave it.

How long we keep it

Booking records, including sankalp names, are kept for eight years, because Indian tax and accounting rules require transaction records to be retained for that period.

One-time passwords are deleted within ten minutes. Login sessions expire after sixty days, and are destroyed immediately when you log out.

If you ask us to delete your account we remove your contact details, your sankalp names and every birth detail we hold, retaining only the minimum transaction record the law requires.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, or withdraw consent for us to process it. Withdrawing consent for the phone number will end your ability to log in.

Write to support@sevapuja.app from the number or email on your account. We respond within 30 days. An erasure request removes your contact details, the names and gotras in your sankalps, every birth detail on your saved people and on your bookings, and any unfinished selection we were holding; it keeps the booking reference, the amount and the date, because tax law requires us to.

If you entered someone else's name, gotra or birth details in a sankalp, you confirmed you had their permission to do so. They may ask us to remove it at any time.

Security

The site is served only over HTTPS. Login uses a one-time password sent to your WhatsApp number; we never store the code itself, only a keyed hash of it, and it expires in ten minutes.

Session cookies are HTTP-only, so no script on the page can read them, and every booking page checks that the session actually owns the booking before showing anything.

No system is perfect. If we discover a breach affecting your data we will notify you and the Data Protection Board without undue delay.

Cookies

We set one essential cookie, which holds your login session. It is not used for tracking, profiling or advertising.

Google Analytics sets its own cookie for every visitor, as described above, whether or not you have given advertising consent. An advertising cookie — Google Tag Manager's or Meta's — is set only where you have given advertising consent, and only by the services named above. Without that consent none of those is set.

Contact and grievances

Data controller: Brewing Conversations Private Limited, 48-B Ambamata Scheme, Udaipur, Rajasthan 313004. Write to support@sevapuja.app to exercise any right on this page, or to ask a question about how your data is handled under the Information Technology Rules, 2011 and the DPDP Act, 2023.