Privacy Policy

Effective & Last Updated: 29 August 2026

VASSUP Technologies Private Limited, hereinafter referred to as VASSUP, is committed to protecting your personal data in compliance with the relevant laws of India, and we follow appropriate standards to safeguard your data on our websites and applications. We respect your privacy and understand the importance of protecting personal data, such as your name and email address, that you may share with us.

VASSUP is a company incorporated under the laws of India, having its Head Office at 11/5B Pusa Road, 2nd Floor, New Delhi, Delhi, 110005, India.

1. INTRODUCTION TO THE POLICY

VASSUP does not automatically collect or store your personal data unless you choose to share such information with us. You may access the application/website of VASSUP without providing your personal information to us. We do not collect information on our platform that identifies you unless you voluntarily share your personal details with us; however, we may log limited technical data for security and operational purposes. We advise you to read all our policies before creating an account on our platform.

2. THE DATA WE COLLECT AND WHY

We only collect personal data when you create an account on our platform or when you voluntarily share your personal details with us. We collect data that is strictly necessary to provide our services.

Tier 1: Website Visitors

When you browse our public pages without creating an account on VASSUP:

  • Data Collected: IP Address, User Agent (browser type).
  • Purpose (Essential): Security logging and fraud prevention.
  • Note: If you provide consent through our cookie/analytics banner, we also collect anonymised usage analytics for analysis and evaluation to help us improve VASSUP and enhance your experience on our platform. This data is treated as non-personal data unless it is combined with personal details that you voluntarily share with us.

Tier 2: Registered Users (Account Creation)

To create an account and purchase tickets, we require certain basic personal data for the following purposes:

  • Data Collected: Name and email address.
  • Purpose: To create and secure your account; process ticket purchases and related financial transactions; send OTPs, links, transaction receipts, refund, and cancellation updates; communicate with you; and provide the services available on our platform.
  • Consent Withdrawal: If you withdraw your consent, we will delete your personal and non-personal data from our platform unless required by applicable law. Please note that withdrawing your consent will result in the permanent deletion of your account. We may retain certain data in good faith to comply with applicable laws in the event of any internal inquiry or government inquiry, or pursuant to the directions of a court of law, or any other legal process relating to fraud or any other complaints against you arising from your access to our platform.

Tier 3: Stream Attendees (Ticket Buyers)

When you purchase a ticket and join an interactive live stream on VASSUP:

  • Data Collected: Your location (the Indian State in which you are located, or “Outside India”) as provided at the time of ticket purchase; messages sent to the Host; live reactions (emojis); stream reviews; presence timestamps (when you joined and left the stream); and the phone number you provide at the time of ticket purchase.
  • Purpose: To facilitate the interactive live room experience, allow the Host to communicate with you, and generate aggregated stream analytics for the Creator. This data is also collected for legal compliance purposes where a user engages in conduct that violates the laws of India or the User Conduct and Acceptable Use provisions of our Terms of Service. Your location is collected solely to determine the correct tax treatment applicable to your ticket purchase (e.g., IGST or CGST/SGST) and to comply with applicable tax and financial regulations. Your phone number is collected to process your payment through our Payment Gateway partners and to send you transaction-related communications such as receipts and refund or cancellation updates.
  • Note: When you participate, your name, reactions and messages may be visible to the Host, and the Host may announce, display, or screen-share such content as part of the streaming session at their discretion. Reviews submitted by you for streams that you attend are also visible to the public. If you use the “Raise Hand” feature and the Host permits you to speak, your voice will be transmitted in real time through our servers and will be audible to both the Host and other attendees in the session. You are directed not to engage in any illegal action or activity while attending the session, and you are solely responsible for any legal consequences arising from such conduct. VASSUP disclaims any liability arising from your actions or activities.
  • Consent Withdrawal & Legal Hold: You may withdraw your consent for public processing at any time. If you do so, your public reviews and your public presence in stream activity and analytics on the Host’s dashboard will be pseudonymised (e.g., your name will appear as “Anonymous Viewer” and your text will be masked). However, we will retain the original backend logs of your interactions for the period required by applicable law, strictly for compliance with law enforcement requests or investigations, resolution of payment disputes, handling of consumer complaints, and enforcement of legal rights. After the applicable retention period, the data will be permanently deleted. Please note that if you withdraw consent, you will not be able to join new streams or continue participating in any ongoing stream, as the processing of your data is necessary to provide the service and prevent any kind of abuse.

Tier 4: Creators/Hosts

If you apply to become a Creator to host paid streams, the following additional information will be retained for the following purposes:

Note: Creator/Hosts are also users; therefore, the data collection under Tiers 1 to 3, for the purposes specified therein, also applies to them.

  • Data Collected: Your PAN number, GSTIN (if applicable), Bank details, business address, and mobile number are collected and retained as part of the KYC phase of your creator onboarding process. Aadhaar information, also collected during the KYC phase, is not retained by VASSUP and only passed to Payment Gateways for their own KYC compliance.
  • Purpose: To comply with mandatory KYC (Know Your Customer) requirements, verify your identity, and process payouts. This information is necessary for billing, TDS deduction, GST invoicing, and facilitating payouts.
  • Data Sharing: PAN, GSTIN (if registered), Aadhaar, and bank account details are transmitted securely to our Payment Gateway partners solely for KYC compliance and payout processing. No Creator data is used for any other purpose. The said data shall be retained in good faith only for the period prescribed by applicable law and financial regulations, or in the event of any internal inquiry, government inquiry, or on the directions of any court of law, or any other legal process. Please note that Aadhaar data is not stored by VASSUP on its servers but is passed on to Payment Gateway Partners for KYC compliance.

3. AGE VERIFICATION

You must be of 18 years of age or older to use VASSUP, and minors (i.e., persons below the age of 18) are strictly prohibited from creating an account on our platform or making any transactions through it. We rely on the age declared by users at the time of account registration/creation, which we accept in good faith, and we reserve the right to terminate accounts if a user is found to have misrepresented their age.

4. THIRD-PARTY DATA COMPLIANCES

We strictly do not share your personal data with any third party who are not our service providers. We may share data only with trusted third-party service providers (Data Processors) in good faith who act on our behalf and are contractually bound to process your data solely for the following purposes:

  • Identity Verification Providers: For Creator KYC, using API-based verification services that validate Aadhaar, PAN, and GSTIN against government databases. These providers receive only the minimum data necessary for verification and return a pass/fail result.
  • Payment Gateways: To securely process your ticket purchases and Creator payouts, including verifying and processing payments or transactions made on VASSUP.
  • Cloud Infrastructure Providers: To securely host our servers and databases.
  • Law Enforcement: To retain and disclose data as required by a valid court order or government request in accordance with applicable Indian laws. Data may also be retained to enforce our policies and Terms of Use and to verify the information shared by you.
  • Note: VASSUP disclaims, to the extent permitted by law, any liability arising from the disclosure of information provided by you to third parties, and we advise you to read the privacy statements of such third parties. However, we endeavour to ensure that our third-party service providers protect your data from unauthorised use and retain it only for the purposes described in this Policy.

5. DATA STORAGE AND LOCALISATION

All data collected by us is stored on servers located in India. Our infrastructure providers are configured to use data centres located in India. Your data does not leave the Indian territory for storage or primary processing.

You will receive prior intimation of any change to our data storage or localisation policy.

6. CONSENT MANAGEMENT

You can manage your consent preferences directly through your account dashboard on our platform. This includes toggling consent for optional analytics, withdrawing consent for specific stream data, or requesting account closure. We manage and process your consent in accordance with the procedures established by applicable law.

7. ACCOUNT PROTECTION

We use password-less authentication to protect your data from misuse. It is your responsibility not to share your account credentials with anyone, as doing so may allow others to access your data and other information shared by you with us. VASSUP sends a one-time password (OTP) to your registered email address for account authentication, and you may also receive an OTP from our payment gateway partners for completing payment transactions. VASSUP disclaims any liability in the event that you share these OTPs with any third party or if they are compromised in any manner.

8. YOUR RIGHTS AND INTERESTS

You have the right to control your digital footprint. Through your account dashboard, you may exercise the following rights:

  1. Right to Access: View the personal data we hold about you.
  2. Right to Correction & Erasure: Update inaccurate details provided by you or request the deletion of your account and associated data.
  3. Right to Withdraw Consent: Toggle your consent for optional analytics or specific past streams. Please note that the withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
  4. Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.

9. SECURITY MEASURES

We follow industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit and at rest.
  • Access control mechanisms with role-based permissions.
  • Access logging and monitoring to detect unauthorised activity.
  • Regular data backups to ensure continuity of service.
  • Media stream isolation architecture to prevent IP leakage between users.
  • Periodic security reviews and vulnerability assessments.

10. DATA RETENTION

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Policy, to provide our services, or to comply with applicable legal requirements:

  • Account Data (Name and email address): Retained for the duration of your active account and deleted upon account deletion, subject to any applicable legal-hold requirements.
  • Stream Interaction Logs: Backend logs are retained for 3 (three) years from the date of the relevant transaction for dispute resolution and legal compliance. We permanently delete these backend logs thereafter.
  • Creator KYC Data (PAN, GSTIN, Address, Bank Details): Retained for the duration of the Creator’s active account and for any such additional period required under applicable tax laws and financial regulations (e.g., Income Tax Act, GST Act).
  • Aadhaar Data: Not retained. Aadhaar data is used only for real-time API-based verification and is immediately discarded. We do not store, log, or cache Aadhaar numbers at any stage.
  • Security Logs (IP, User Agent): Retained for a reasonable period necessary for security and fraud prevention (180 days), after which they are anonymised or deleted.
  • Optional Analytics Data: Retained only in anonymised/aggregated form. Individual-level data is deleted when consent is withdrawn.
  • Legal: Data may also be retained where required by applicable law, a contract, or similar obligations applicable to our business operations. VASSUP may also retain certain data to defend its legal interests before a court of law, maintain financial records, respond to government inquiries, or comply with an order of a court in India.

11. DATA BREACH NOTIFICATION

In the event of a personal data breach, we follow the procedures established by applicable law to protect your personal and non-personal data. We notify affected users without undue delay, describing the nature of the breach in clear and plain language, the likely consequences, the steps we are taking to address it, and practical advice on measures they can take to protect themselves. We also take immediate steps to contain the breach, assess its scope, prevent recurrence, and cooperate fully with any investigation initiated by a government department or other competent authority. We maintain an internal record of all data breaches, including those that do not meet the notification threshold, documenting the facts relating to the breach, its effects, and the remedial action taken. These records will be made available for inspection by the concerned government department or competent authority upon any enquiry or lawful direction.

We maintain an internal breach-response plan, conduct periodic security drills, and designate a breach response team to ensure rapid and effective incident management.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the evolving regulatory framework. When we make changes to this Policy:

  • The “Last Updated” date at the top of this Policy will always reflect the most recent version.
  • We advise you to read this Policy periodically and check the “Last Updated” date at the top of the Policy.
  • Your continued use of the platform after the “Last Updated” date constitutes your acceptance of the revised terms of this Policy.

13. GRIEVANCE REDRESSAL

If you have any concerns about how we handle your data, or if you wish to exercise any of your rights under this Policy, please contact our designated Data Protection Officer:

Name: Jyoti Chadha
Email:
Address: VASSUP Technologies Private Limited, 11/5B Pusa Road, 2nd Floor, New Delhi, Delhi, 110005, India

We will acknowledge your grievance within 24 hours and aim to resolve it within 30 days of receipt.

If your grievance is not resolved to your satisfaction, you may escalate the matter to our senior grievance contact:

Name: Vikrant Chandel
Email:
Address: VASSUP Technologies Private Limited, 11/5B Pusa Road, 2nd Floor, New Delhi, Delhi, 110005, India

End of Privacy Policy