Privacy Policy

We collect only what is needed to run the features you use:

• Account data: your name and email address. If you sign up with email and password, we store a salted hash of your password (never the password itself). If you sign in with Google, we receive your name, email address, and profile photo from Google.
• Event registration data: your name, email, phone number (if the event asks for it), and your answers to the registration questions set by the event organizer.
• Ticket and payment data: for paid tickets, the Razorpay order ID and payment ID, amount, and payment status. Card, UPI, and bank details are entered on Razorpay's checkout and handled by Razorpay. We do not receive or store them.
• Event organizer data: organizer name, email, phone number, organization details, event details and images, and, for paid events, the payout details you provide (such as UPI ID, UPI QR code, or bank account name, number, and IFSC).
• Hunt directory listings: when you apply to be listed as a speaker, sponsor, collaborator, or venue, we collect the details in the application form. This can include your name or organization name, contact person, email, phone or WhatsApp number, city, bio or description, photos or logos, social and website links, past events, and pricing or capacity information.
• Verification codes: one-time passwords (OTPs) sent to your email to verify sign-up or to edit a directory listing. We store only a hash of each code, with an expiry time.
• Newsletter: your email address if you subscribe.
• Certificates: where we issue participation certificates for an event, the participant's name, email, and role.
• Technical data: your IP address is used briefly to limit repeated requests (rate limiting) and is not saved to our database. Our hosting provider may keep standard server logs.

• To create and secure your account and keep you signed in.
• To register you for events, issue your ticket and QR code, and let organizers check you in.
• To process ticket payments through Razorpay, confirm them, and handle refunds.
• To review directory applications and event submissions, and publish the ones we approve.
• To send transactional emails: OTPs, password resets, tickets, and updates on your applications or registrations.
• To send the newsletter, if you subscribed.
• To prevent abuse and fraud, and to meet legal, tax, and accounting obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

• Event organizers see the registration details of people who register for their events (name, email, phone, answers to registration questions, ticket and check-in status), so they can manage attendance.
• The public can see approved directory listings and approved event pages. Contact details on a listing or event page are shown only where the form gives you that choice and you choose to make them public.
• Service providers who process data for us: Convex (database), Vercel (hosting), Cloudinary (image storage for photos, logos, and cover images), Razorpay (payments), Google (sign-in, if you use it), and our email (SMTP) provider. Some of these providers may store data outside India.
• Authorities, where required by law or a valid legal order.

We use only cookies needed to run the site: a session cookie that keeps you signed in, and security cookies used during sign-in. We do not use advertising or third-party analytics cookies. If you block cookies, you will not be able to sign in.

• Account data: until you ask us to delete your account.
• Event registrations and payment records: as long as needed to run the event and to meet tax and accounting requirements under Indian law.
• Directory listings: until you or we remove the listing.
• OTPs and password reset links: they expire within minutes to an hour and cannot be reused.
• Newsletter: until you ask to be removed.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you;
• ask us to correct, complete, or update it;
• ask us to delete it, or withdraw consent, where we are not required to keep it by law;
• nominate another person to exercise these rights for you in case of death or incapacity;
• raise a grievance with us, and, if unresolved, with the Data Protection Board of India.

Directory listings can be edited after email verification on the relevant Hunt page. For anything else, email contact@growthsq.in from the address linked to your data. We aim to respond within 30 days.

Passwords are stored as salted hashes, verification codes and reset tokens are stored hashed and expire, and all traffic uses HTTPS. Payments are handled on Razorpay's PCI-DSS compliant checkout. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you and the authorities as required by law. See our Security page to report a vulnerability.

Offlyne is not intended for children under 18. We do not knowingly collect personal data from children without verifiable consent from a parent or guardian. If you believe a child has given us data, contact us and we will delete it.

We may update this policy. When we do, we will change the "Last updated" date above, and for significant changes we will notify registered users by email.

For privacy questions, requests, or complaints, contact our Grievance Officer:

We acknowledge grievances within 72 hours and aim to resolve them within 30 days.