Privacy Policy

1. Who we are

LagnaPrasang is a wedding vendor marketplace that connects couples planning their wedding with local service providers across India. The platform is operated by fdivlabs.

Operated by

fdivlabs, operating as LagnaPrasang

Where we are

Gujarat, India

Contact email

[email protected]

Grievance Officer

Grievance Officer, LagnaPrasang — [email protected]

Applicable law

Digital Personal Data Protection Act 2023 (India), IT Rules 2011

This policy applies to all users of lagnaprasang.com — visitors, consumers (couples), and vendors (service providers). The platform is currently available in India only.

2. Data we collect

All visitors (without an account)

• Server access logs: IP address (stored as a one-way SHA-256 hash — raw IP is never persisted), URL requested, HTTP method, status code, response time, user-agent string (first 200 characters). Retained for 30 days.
• Language preference cookie (NEXT_LOCALE) if you have chosen a language before.
• Website analytics (Google Analytics): the pages you visit, the page you came from, your device type, browser, screen size and language, your approximate location (city level, derived from your IP address), and a random identifier stored in a cookie so repeat visits can be told apart. It does not include your name, phone number or email.

Consumer accounts (couples)

Required at signup: Mobile phone number (E.164 format). We verify ownership via a WhatsApp OTP — no password is required.

Optional profile fields: Full name, email address, home city, wedding date, and an optional profile photo (avatar).

Generated by your activity:

• Reviews you write: star rating, review text, optional photos or videos.
• Wishlist entries: which vendors you saved and when.
• Checklist items: title, category, due date, completion status, notes.
• Budget entries: category name, expense name, estimated and actual costs, linked vendor, payment status.
• Contact reveal events: when you reveal a vendor's phone number — logged as timestamp + your account ID + vendor ID (for abuse prevention only).
• Moderation reports: target vendor, reason, optional notes, optional attached media.

Vendor accounts

Required at signup: Mobile phone number, business name, base city. Verified via WhatsApp OTP.

Profile and package information: Business description, public contact phone, logo image, website, social links (Instagram, Facebook, YouTube), base village, service cities, package title, description, pricing, category, tags, and photos.

Vendor diary (private — not visible to consumers): Client name, event date, booking status, notes, client phone, client email, booking amount. This data is entered by the vendor and stored on their behalf. Vendors are responsible for having appropriate authority to store their clients' personal details.

Sign in with Google

If you choose to sign in with Google, we receive your Google account email, display name, and a Google-issued identifier. We verify the token cryptographically on our servers — we never receive your Google password.

Mobile app (Android & iOS)

• Device push token: if you grant notification permission, we store the push token issued by your device's push service (Expo / Firebase Cloud Messaging on Android, Apple Push on iOS) so we can deliver transactional notifications. You can revoke this anytime in your device settings.
• Crash and performance diagnostics: the app reports crashes and basic performance data to our error-monitoring provider (Sentry). These reports are scrubbed of personal data (phone, email, tokens) before they leave your device.
• On-device storage: authentication tokens are stored in the device's secure storage (iOS Keychain / Android Keystore), not in cookies.

3. How we use your data

Authentication

Verify your identity via WhatsApp OTP or Google Sign-In when you log in or perform account actions.

Platform features

Power the marketplace — vendor browsing, wishlist, checklist, budget planner, vendor diary, reviews, and contact reveal.

Transactional email

Send account-related emails only: OTP codes, vendor welcome, profile approved/rejected notifications, contact form receipts. No marketing email.

Abuse prevention

Log contact reveal events and moderation reports to detect and act on misuse.

Security & debugging

Operational logs (hashed IP, user-agent, response times) for diagnosing errors and detecting attacks.

Platform analytics

Internal operational metrics for dashboards only — not queryable per individual user.

Website analytics

Count visits and see which pages are used and how people find the site (Google Analytics), so we can improve it. Reports are aggregate — we do not use them to identify you.

Notifications

If you grant permission in the mobile app, we send transactional push notifications (e.g. booking and profile-status updates). We send no marketing push.

We do not sell, rent, or share your personal data with advertisers, and we send no marketing email, SMS, or push. The only push notifications we send are transactional (account and activity updates), and only on the mobile app after you grant notification permission — you can turn them off anytime in your device settings.

4. Third-party processors

We share personal data with the following sub-processors only to the extent necessary to operate the platform:

Amazon Web Services

All infrastructure: application servers, database, cache, and media storage (S3) — all in AWS ap-south-1, Mumbai, India.

Amazon SES

Transactional email delivery. Email address + message content. Region: ap-south-1, India.

Meta WhatsApp Cloud API

WhatsApp OTP delivery for login and account verification. Phone number + OTP message. Processed on Meta's servers in the United States.

Google Identity Services

Sign in with Google. Your Google email, name, and Google ID are shared when you choose this sign-in method. Processed by Google (United States).

Google Analytics

Website usage statistics — the visit details listed in section 2 under All visitors. Processed by Google (United States). We do not use its advertising features.

Cloudflare

CDN and DDoS protection. Visitor IP addresses and request metadata pass through Cloudflare's global edge network. No personal user data is stored by Cloudflare beyond standard edge logs.

Sentry

Crash and performance monitoring for the website and mobile app. Receives crash/diagnostic events that are scrubbed of personal data (phone, email, tokens) before transmission. Processed in the European Union (Germany).

Expo & Firebase Cloud Messaging (Google)

Mobile push-notification delivery. Your device push token is relayed through Expo's push gateway and the platform push service (Firebase Cloud Messaging for Android; Apple Push for iOS) to deliver transactional notifications. United States.

No payment processor is used — LagnaPrasang does not collect or process any payment card or banking information.

5. Cookies & tracking

Every cookie our own code sets is essential — it either keeps you signed in, carries you through a sign-in step, or remembers your language. Google Analytics sets two more, to count visits. The full list, and what each one holds, is in our Cookie Policy:

prasang_access, prasang_refresh

Your sign-in tokens. HttpOnly, Secure — not accessible to JavaScript. They last as long as the token inside them, and are deleted when you sign out.

prasang_session

A marker holding the digit 1 and nothing else, so a page already open can tell that you signed in or out. Readable by JavaScript; carries no token.

prasang_otp_session, prasang_social_pending, prasang_registration

Set only while you are part-way through signing in or registering. HttpOnly, Secure, and self-expiring in 10 to 15 minutes.

NEXT_LOCALE

Remembers your language preference (English or Gujarati). Not HttpOnly. Expires after 1 year.

_ga, _ga_RMG78PZFHB

Set by Google Analytics. A random identifier that tells one visitor's visits apart from another's, and the state of the current visit. Expire after 2 years. Not needed for the site to work — you can block them without losing anything.

We set no advertising or cross-site tracking cookies. The Google Identity Services SDK is loaded on pages with a Sign in with Google button — this may cause Google to set its own cookies per Google's Privacy Policy.

6. International data transfers

Most of your data is stored and processed in India (AWS ap-south-1, Mumbai). A few flows involve servers outside India:

• WhatsApp OTP — your phone number is sent to Meta's servers in the United States solely to deliver the OTP message.
• Google Sign-In — your Google account details are received from Google's servers (United States) when you choose this sign-in method.
• Cloudflare CDN — request metadata (including IP address) passes through Cloudflare's global edge network for performance and DDoS protection.
• Website analytics — details of your visit (section 2) are sent to Google Analytics, processed by Google in the United States.
• Crash/performance diagnostics — PII-scrubbed crash reports are sent to Sentry in the European Union (Germany).
• Push notifications — your device push token is relayed via Expo and the platform push service (Firebase Cloud Messaging / Apple Push) in the United States to deliver notifications.

These transfers are limited to what is technically necessary to deliver the service. The platform is intended for users in India only.

7. Data retention

Account data

Deleted within 30 days of an account deletion request. Anonymised aggregate statistics (e.g. review counts, view totals) are retained indefinitely.

Server logs

30 days rolling. Raw IP addresses are never stored — only a SHA-256 hash.

Website analytics

Google Analytics keeps the details of individual visits for 2 months, and data tied to the random visitor identifier until 14 months after your last visit, then deletes them. Aggregate reports (e.g. monthly visit totals) are kept.

Uploaded media

Package photos, review photos, and report attachments are deleted from storage within 7 days of the associated content being deleted.

OTP records

OTPs expire 10 minutes after issuance and are invalidated immediately on successful use. Expired records are purged periodically.

Vendor diary

Deleted immediately when a vendor account is deleted (database cascade).

Moderation reports

Retained for 2 years for platform safety and legal compliance, then anonymised or deleted.

Database backups

Nightly encrypted database backups stored in AWS S3 (ap-south-1) and automatically expired after 30 days.

8. Your rights

Under the Digital Personal Data Protection Act 2023 (India) you have the following rights:

• Right to access — request a summary of personal data we hold about you.
• Right to correction — correct inaccurate data. Many fields can be updated directly in your profile settings.
• Right to erasure — request deletion of your account and personal data.
• Right to grievance redressal — raise a complaint with our Grievance Officer (contact details below). We respond within 30 days.
• Right to nominate — nominate another person to exercise your rights on your behalf in the event of incapacity or death.
• Data portability — request a copy of your data in JSON format.

To exercise any right, email [email protected] with subject “Data Request — [Access / Correction / Deletion / Other]”. Include the phone number associated with your account for verification. We will acknowledge within 3 business days and complete the request within 30 days.

9. Security

We apply the following technical safeguards:

• All data in transit encrypted with HTTPS/TLS.
• Authentication tokens stored in HttpOnly, Secure cookies on the web (never in JavaScript-accessible storage), and in the device's secure storage (iOS Keychain / Android Keystore) in the mobile app.
• OTPs are single-use, expire shortly after issuance, and are validated using timing-safe methods.
• File uploads validated for type, size, and format before storage.
• IP addresses never stored in raw form — only a SHA-256 hash is retained.
• Google OAuth tokens verified cryptographically on our servers before any account action.
• Uploaded media and nightly database backups use AWS S3 server-side encryption (SSE-S3) at rest.
• Cloudflare provides DDoS protection and TLS termination.
• Rate limiting applied to all authentication endpoints.

In the event of a confirmed data breach, we will notify affected users and the Data Protection Board of India without undue delay, targeting within 72 hours of confirmation, as required by DPDP 2023.

10. Children & minors

LagnaPrasang is intended exclusively for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover that a user under 18 has created an account, that account will be suspended and the associated data deleted promptly.

11. Policy updates

We will notify you of material changes via an in-app notification and, where an email address is on file, by email — at least 7 days before changes take effect. Minor updates (corrected contact details, typos) may be published without advance notice.

Continued use of the platform after the effective date of a material change constitutes acceptance of the updated policy. Previous versions are available on request from v2.0 onwards.

12. Contact & grievance

For any privacy-related questions, data requests, or grievances, contact our Grievance Officer:

Grievance handling process (under IT Rules 2021, Rule 3(2) and Digital Personal Data Protection Act 2023):

1. Submit your grievance by email to the address above. Include your registered phone number, a short description, and any reference (profile URL, screenshot, message ID) that helps us locate the issue.
2. Acknowledgement within 3 working days. You will receive a written reply from the Grievance Officer confirming receipt and a reference ticket number.
3. Resolution within 30 days of receipt. If the issue is complex and needs longer, we will tell you the reason and the expected timeline before the 30-day window closes.
4. Escalation. If you are not satisfied with our response, you may escalate to the Data Protection Board of India (once established under DPDP 2023). Where the grievance concerns intermediary obligations, you may also contact the Grievance Appellate Committee set up under IT Rules 2021.