1. Who is responsible
Kathu is run by VipzLab. For your account details we decide how data is used (we are the “data fiduciary”). For the details you add about your family and guests, you decide what to share; we process them only to provide the service. This policy is written with India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 in mind.
2. What we collect
About you (the host)
- Account: name, email, optional mobile number, optional profile picture, password (stored only as a secure hash).
- Google sign-in: your Google account id, name, email and profile photo — only to sign you in. We never see your Google password, Gmail, Drive or contacts.
- Wallet: your token balance and history, coupons you used, token requests and any UPI reference number you choose to give us.
- Referrals: which account invited you (from a referral link) and whom you invited.
- Support: messages and screenshots you send, the page you came from and your browser type.
- Technical: sign-in time and IP address, browser type and error logs, to keep accounts secure.
In your letters
- Names (yours, the couple’s and families’), wording, dates, venues, map links, contact number and hashtag you enter.
- Photos and music you upload. Photos are resized and re-encoded, which removes hidden metadata such as GPS location.
- Guest list (names and optional phone numbers) if you use personal links. We use phone numbers only to open WhatsApp on your device when you tap “Send”; we never message your guests ourselves.
- Face checks: when you put a real face on your cartoon couple, the face check (one face, looking at the camera, eyes open, light, sharpness) runs inside your browser on your device. Only the cut-out face you accept is uploaded — never the whole photo — and no face measurements or biometric data are stored. You can remove it any time.
From your guests
- RSVP: name, optional mobile number, attending or not, number of people, optional note.
- Wishes: name and message, shown on the letter.
- Game scores: only the name a guest types and the score (with the scrambled visitor fingerprint below, to limit spam), shown on the letter’s leaderboard. The host can remove any name.
- Reports: the reason, details and optional contact, sent only to the Kathu team.
- Visits: to count “unique views” we keep a keyed, one-way hash of the visitor’s IP address and browser for each day. We cannot turn it back into an IP address.
3. How we use data
- To provide the service: build and show your letters, make share images, collect RSVPs and wishes, run your wallet.
- To keep accounts and letters safe, prevent abuse and fix problems.
- To send service emails (email confirmation, password reset, replies to your tickets, wallet updates, changes to these policies).
- To understand usage in aggregate (for example how many letters are published per week) and improve Kathu.
We do not sell personal data, use it for advertising, or contact your guests.
4. Who sees what
- Anyone with a published letter’s link sees what you put in the letter and the wishes you have not hidden.
- You see your guests’ RSVPs and wishes, and which personal links were opened.
- The Kathu team can view letters to handle reports and support, and sees account and wallet details to run the service.
- Service providers under confidentiality: hosting (Hostinger VPS in a secure data centre), email delivery, and Google for sign-in. Maps and WhatsApp links open those services directly on the guest’s device.
- Authorities when Indian law requires it.
5. How long we keep data
- Photos (including cartoon faces), music, share images and game scores of a letter are deleted 90 days after the letter’s link expires. The text of the letter stays in your account until you delete it.
- Letters you delete are removed permanently after 30 days (so a mistaken delete can be undone by contacting us).
- Deleting your account removes your letters, photos, music, guest lists, replies and wallet (see Account & Data Deletion). Some records may be kept longer where the law requires.
- Server logs are kept for up to 14 days; database backups for up to 14 days.
6. Security
All traffic uses HTTPS. Passwords are hashed. Two-factor sign-in is available. Uploaded files get random names. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
7. Your rights
You can see and correct your data in the app, withdraw consent by deleting photos or letters, and delete your account. You can ask us what we hold about you, or nominate someone to act for you. Guests can ask the host, or write to us, to remove an RSVP or wish. Contact vipzlab@gmail.com or our grievance officer (see Grievance & Report Abuse).
8. Children
Kathu is for adults. Letters may include children’s names or photos (for example a naming ceremony) only when added by their parent or guardian.
9. Changes
We will post updates here and tell you about important changes by email or in the app.