Privacy Policy

This Privacy Policy explains how SILYA PRIVATE LIMITED (CIN: U62099PN2026PTC254644), operating guestcam.in ("GuestCam", "we"), collects, uses, stores, and protects personal data in connection with the Service. It is issued under the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and related rules. For the purposes of the DPDP Act, we act as the Data Fiduciary for personal data processed through the Service.

From Event Owners: name, email address, and authentication data (via Supabase Auth); event details you create (title, date, description, cover image); billing details once payments are enabled (processed by a third-party payment gateway, not stored by us).

From Guests: an optional display name; the photos you upload, which may include your own image and the images of other identifiable individuals; basic technical data such as IP address and timestamps, logged automatically by our hosting and storage providers for security purposes.

We process personal data to: create and operate your event album; let guests upload and view photos in that album; authenticate Event Owners; generate and honour QR codes/links; process payments for paid plans; respond to support and grievance requests; and comply with legal obligations.

Our legal basis is your consent (given by creating an event, entering a name, or uploading a photo) and, where applicable, performance of the contract formed by these Terms.

Photos uploaded to an event may contain images of people other than the uploader. We do not perform facial recognition or identify individuals in photos. Responsibility for obtaining appropriate consent from people depicted (including, for minors, from a parent or guardian) rests with the person uploading the photo, as set out in our Terms & Conditions.

We share personal data with the following categories of service providers, acting as our data processors, solely to operate the Service:

• Supabase — database, authentication, and file storage for events, guests, and photos. Data is currently hosted in Supabase's Northeast Asia (Tokyo) region.
• Payment gateway (once enabled) — to process plan purchases. We do not receive or store your card/bank details.

We do not sell personal data. We may disclose data if required by law, court order, or a lawful request from a government authority.

Your data is currently stored on servers located outside India (Tokyo, Japan) via our hosting provider, Supabase. Under the DPDP Act, cross-border storage/transfer of personal data is permitted except to countries specifically restricted by the Government of India; Japan is not currently on any such restricted list.

Event photos and related data are retained for the hosted-access period of the applicable plan — 3 days (Free), 3 months (Standard), or 6 months (Premium) — from the event's creation date, after which they may be permanently deleted. Event Owner account data is retained until the account is deleted or as required to comply with legal, tax, or accounting obligations.

GuestCam is not directed at children and does not knowingly allow children to independently create Event Owner accounts. Where an event involves photos of minors (e.g. a children's birthday party), we rely on the Event Owner and uploading Guests to have obtained appropriate parental/guardian consent, as described in Section 4 of the Terms & Conditions and Section 4 above. If you believe a child's personal data has been uploaded without appropriate consent, contact our Grievance Officer (Section 12) and we will investigate and remove it as warranted.

Subject to the DPDP Act, you have the right to:

• access a summary of the personal data we hold about you;
• request correction or completion of inaccurate or incomplete personal data;
• request erasure of personal data that is no longer necessary for the purpose it was collected;
• withdraw consent at any time (this may mean we can no longer provide part of the Service to you);
• nominate another individual to exercise these rights on your behalf in the event of death or incapacity; and
• lodge a grievance with our Grievance Officer, and thereafter with the Data Protection Board of India.

To exercise any of these rights, email support@guestcam.in from the address associated with your request, or via the event page if you're a Guest.

We rely on our infrastructure providers' security controls, including encryption in transit (HTTPS), row-level access controls on our database, and authenticated access for Event Owner actions. No system is completely secure; if we become aware of a data breach likely to affect you, we will notify you and the relevant authorities as required by law.

We use essential browser storage (such as a locally stored guest identifier and authentication session tokens) required for the Service to function. We do not use third-party advertising trackers.

We acknowledge privacy-related grievances within 48 hours and resolve them within 30 days of receipt.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.