This Privacy Policy explains how Baraati LLP ("Baraati", "we", "our", or "us") collects, uses, stores, shares, and protects your information when you use the Baraati mobile application and related websites at baraati.co.in, including the post-wedding album (the "Service").
Baraati is a private, invite-only platform for organising and participating in weddings. Within each wedding, some users are Hosts (the couple, family, or planners who administer that wedding) and others are Guests. A single account may be a Host in one wedding and a Guest in another.
Your use of the Service is governed by the notice given in this Policy, published in compliance with applicable law. Where this Policy identifies a feature as optional or consent-based, we obtain your free, specific, informed, unconditional, and unambiguous consent for that specific purpose separately, in terms of Section 6 of the Digital Personal Data Protection Act, 2023 (the "Act"), before that feature is activated (see Section 5, "Consent", below).
By using Baraati, you agree to this Policy. It is published in compliance with the Information Technology Act, 2000 and the Act, and, where applicable, addresses the EU/UK GDPR. We do not collect your device's GPS location, do not use advertising identifiers, and do not run third-party advertising or behavioural-tracking analytics.
We collect the information below for the following specified purposes: to create and operate your account; to set up and run your wedding — schedule, venues, guest list, RSVPs, feed, games and leaderboards; to enable Hosts to coordinate travel, room allocations, and (where requested and consented) ID-based check-in for Guests; to deliver in-app and push notifications about wedding activity; to diagnose issues and improve reliability; and to secure the Service, prevent abuse, and detect compromised devices, in terms of the present Policy. If we intend to use your personal data for a purpose not described in this Policy, we will update this Policy and, where the new purpose requires it, seek your consent before that use begins.
We do not use your data for advertising or profiling, and we do not sell it.
The Service lets a Guest upload a government ID (Aadhaar, PAN, passport, voter ID, driving licence, or other) only when a Host has requested it, for the sole purpose of hotel/venue check-in coordination. This is always optional and consent-based.
Each document is encrypted with AES-256-GCM envelope encryption and stored in private, access-controlled storage (Cloudflare R2). Documents are never served as public links — when an authorised person views one, it is decrypted and streamed for that single request. Access is restricted to you and the Hosts of that specific wedding, and every access is logged with the user, time, IP address, and device. ID features are disabled on devices detected as rooted/jailbroken, and accessing them requires recent re-authentication.
Government IDs are automatically and permanently deleted 3 days after the last day of the wedding they were uploaded for. You may also delete yours sooner at any time in the app or by contacting us.
Content you post is shared with members of that wedding. Feed photos, videos, avatars, and hero images are stored on content-delivery storage and served via unguessable links; these files are not individually access-controlled at the storage layer, so anyone with a link can view that file. Where a Host publishes a post-wedding album, selected content becomes viewable by people the Host shares it with.
You are responsible for content you post, including having permission to post images of other people. If your content includes a child (under 18) or a person with disability who has a lawful guardian, you confirm that you have the verifiable consent of the child's parent, or the person's lawful guardian, before posting it.
A parent or lawful guardian who identifies their child or person with disability in content on the Service may request its removal at any time, by contacting the Host of that wedding or writing to support@baraati.co.in.
We collect and process that information only where you give specific, informed consent for the stated purpose, through a clear action — such as filling in an optional field, enabling a toggle, or completing an upload — separate from your general use of the Service. You may withdraw this consent at any time by writing to support@baraati.co.in.
We share data only within a wedding, with that wedding's Hosts and Guests per role, and government IDs and travel/room details only with that wedding's Hosts.
We may also share data for legal reasons, such as complying with a court order, government request, or legal obligation.
If Baraati is involved in a business transfer, such as a merger, acquisition, or sale of assets, we will notify you before your data becomes subject to a different privacy policy.
We also share data with the service providers listed below, each bound by an agreement requiring them to process personal data only on our instructions and to maintain security safeguards equivalent to our own:
We do not share your data with wedding vendors, advertisers, or any other third parties, and we never sell it.
We retain personal data only for as long as necessary for the purpose for which it was collected, and erase it once that purpose is no longer being served, in accordance with Section 8(7) of the Act, except where retention is required by law. In practice:
In terms of the Act, you have the right to:
To exercise these rights, email us at support@baraati.co.in. We will respond within 30 days. You can delete your account at any time in the app (Profile → Delete Account) or via baraati.co.in/delete-account.
We take reasonable security safeguards to prevent personal data breaches, including but not limited to using HTTPS/TLS for all traffic with certificate pinning in the app, Row-Level Security isolating each wedding's data, encrypted device session storage, AES-256-GCM envelope encryption for government IDs with audited and streamed-only access, disabling of sensitive features on compromised devices, re-authentication gating for ID access, and rate limiting on sensitive operations.
No method of transmission or storage is 100% secure; we take every reasonable measure to protect your information but cannot guarantee absolute security. On becoming aware of any personal data breach, we, to the best of our knowledge, will promptly inform you about (i) a description of the breach, (ii) the consequences of such breach which are relevant to you, (iii) the measures implemented and being implemented by us, if any, to mitigate risk, (iv) safety measures that you may take to protect your interest, and (v) the business contact information of a person who is able to respond on our behalf to your queries, if any.
We will also notify the appropriate authority of the breach, with a detailed follow-up report within 72 hours of becoming aware of it, or such longer period as the Board may permit.
This section addresses personal data we collect directly through account creation. Where a child appears in content posted by a Host or Guest — for example, in a wedding photo — see Section 4 (Photos, Videos & User Content) for how that is handled.
The Service is intended for adults 18 years and older. We do not knowingly allow individuals under 18 to create accounts, and we do not knowingly collect personal data from them. Where a person with disability has a lawful guardian appointed under applicable law, we do not knowingly collect their personal data without the lawful guardian's verifiable consent.
We do not use any data relating to a child, or to a person with disability who has a lawful guardian, for tracking, behavioural monitoring, or targeted advertising, regardless of any consent given.
If you believe a minor, or a person with disability who has a lawful guardian, has provided us with personal data without the requisite verifiable consent, please contact us at support@baraati.co.in, and we will promptly delete it.
We are based in India and primarily store data for the Indian region. Some service providers may process data on servers outside India; where we transfer personal data internationally, we rely on appropriate safeguards and only transfer to jurisdictions permitted under applicable Indian law. For EU/UK users, transfers use appropriate safeguards such as Standard Contractual Clauses.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date and notify users via the app or email if the changes are material.
For privacy-related questions or requests, or to reach our Grievance / Data Protection Officer, please contact:
Baraati LLP
Grievance / Data Protection Officer: Manju Gupta
T5B-1001 Godrej Infinity, Keshav Nagar, Mundhva, Pune – 411036, Maharashtra, India
Email: support@baraati.co.in
Website: baraati.co.in