Draft under legal review. Last updated 3 November 2026.
Privacy Policy
We collect only what we need to run stall bookings, we don't sell your data, and you can ask us to see, correct or delete it at any time.
This policy explains how [to be confirmed] ("Stalzo") handles personal data under the Digital Personal Data Protection Act, 2023 and other Indian law. We are the "data fiduciary" for the data described here.
What we collect
- Everyone who signs in: mobile number, your name, and the time you signed up.
- Vendors: business name, what you sell, and if you provide them, your FSSAI licence number and GSTIN.
- Organisers: organisation name, whether you're an individual or company, usual event size, a social media or website link, your events, and our verification notes.
- Bookings: which stall you booked, amounts, booking reference and time.
- Payments: handled by our payment partner. We receive payment status and reference numbers; we never see or store your full card, UPI PIN or bank login.
- Technical: a login cookie that keeps you signed in, and standard server logs (such as IP address and browser type) used for security and fixing problems. We don't use advertising cookies.
Why we use it
- To sign you in with a one-time code and keep your account secure.
- To show organisers who booked their stalls, and to show your stall and ticket to you and the organiser.
- To verify organisers, so vendors can book with confidence.
- To take payments, pay organisers, issue invoices and handle refunds.
- To send booking and event messages by SMS, WhatsApp or email.
- To meet legal, tax and accounting obligations and to prevent fraud.
We process your data with your consent, given when you sign up, and where needed to provide the service you asked for or to comply with the law.
Who we share it with
- Organisers see the business name, category and stall of vendors who book their events.
- Everyone can see the names of verified organisers of published events.
- Service providers who process data for us under contract: Supabase (database and login, hosted in Mumbai, India), Vercel (website hosting), our payment partner (such as Razorpay), and our SMS provider (such as MSG91).
- Authorities, when required by law.
We do not sell your personal data.
How long we keep it
We keep your account data while your account is open. We keep booking and payment records for 8 years to meet tax and accounting laws. When you delete your account, we delete or anonymise the rest within 30 days.
Your rights
Under the DPDP Act you can:
- ask what personal data we hold about you and how we use it;
- correct or update it (most details can be edited from your account page);
- ask us to delete it, or withdraw your consent;
- nominate someone to exercise these rights on your behalf; and
- raise a grievance with us, and then with the Data Protection Board of India if you're not satisfied.
To use these rights, email stalzo.in@gmail.com from the number or email linked to your account.
Security
Data is encrypted in transit, access to it is controlled by strict database rules so people see only what they're allowed to, and our team accesses personal data only when needed. If a breach affects you, we'll inform you and the authorities as the law requires.
Children
Stalzo is for people aged 18 and over. We don't knowingly collect data from children.
Contact
Grievance Officer: [to be confirmed], stalzo.in@gmail.com, [to be confirmed]. See Contact us.