Privacy Policy

Ano ("Ano", "we", "us", "our") is the Data Fiduciary as defined under the DPDP Act, 2023, responsible for determining the purposes and means of processing personal data collected through the Ano Platform (ano.in and related applications).

If you have any questions about this policy or wish to exercise your data rights, please contact our Grievance Officer at privacy@ano.in.

We do not collect sensitive personal data (as defined in the DPDP Act) unless strictly necessary and with your explicit consent.

We use your personal data to:

• Create and manage your account and authenticate your identity.
• Enable Creators to plan events, manage guest lists, and send digital invitations.
• Enable Vendors to list services and connect with Creators.
• Enable Guests to receive invitations, RSVP, and view event content.
• Send transactional notifications (OTP, booking confirmations, event reminders).
• Improve and personalise the Platform experience through usage analytics.
• Detect, prevent, and investigate fraud, security incidents, and abuse.
• Comply with legal obligations, including responding to lawful government requests.

We do not sell your personal data to third parties. We do not use your data for unsolicited advertising or profiling without your explicit consent.

Under the DPDP Act, 2023, we process personal data on the following grounds:

• Consent (Section 6): for account creation, sending invitations, marketing communications, and any processing not covered below. You may withdraw consent at any time (see Section 7).
• Legitimate uses (Section 7): for processing necessary to perform a contract with you (e.g., providing Platform services), complying with a legal obligation, or protecting vital interests.
• State and its instrumentalities: where required by law or a lawful order from a competent authority.

Where we rely on consent, we will seek it through a clear, specific, and informed notice at the point of data collection. We will keep a record of the consent given.

We share your personal data only as described below:

• Service providers (Data Processors): we engage Supabase (database and authentication), Vercel (hosting), and similar infrastructure providers under data processing agreements that restrict them from using your data for any purpose other than providing their services to us.
• Other Platform users: event details shared with Guests, and Vendor profile information shared with Creators who browse listings — only to the extent necessary for Platform functionality.
• Legal requirements: where required by applicable law, court order, or lawful government request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to the acquirer maintaining equivalent privacy protections.

We do not transfer personal data outside India except to service providers operating in jurisdictions approved by the Government of India under the DPDP Act, or with your explicit consent.

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:

• Account data: retained until you request deletion, plus a 30-day grace period.
• Event data: retained for 12 months after the event date, then deleted unless you request earlier deletion.
• Communication logs: retained for 12 months for abuse prevention and legal compliance.
• Financial records (when applicable): retained for 7 years as required by Indian tax law.

After the applicable retention period, data is securely deleted or anonymised.

As a Data Principal under the DPDP Act, you have the following rights:

• Right to access (Section 11): request a summary of the personal data we hold about you and the purposes for which it is processed.
• Right to correction and erasure (Section 12): request correction of inaccurate or incomplete data, and erasure of data that is no longer necessary or where consent has been withdrawn.
• Right to grievance redressal (Section 13): lodge a complaint with our Grievance Officer (Section 11). If unsatisfied, you may escalate to the Data Protection Board of India.
• Right to nominate (Section 14): nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent: withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, email privacy@ano.in. We will respond within 30 days (or the period prescribed by applicable regulations).

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: session authentication tokens required for the Platform to function. These cannot be disabled.
• Analytics cookies: to understand how users interact with the Platform (e.g., page views, feature usage). These are only set with your consent.

You can manage cookie preferences through your browser settings. Disabling analytics cookies will not affect your use of the Platform but will prevent us from improving it based on your usage patterns.

A cookie consent banner is displayed on your first visit to the Platform, allowing you to accept or decline non-essential cookies.

We implement industry-standard technical and organisational measures to protect your personal data, including:

• TLS/HTTPS encryption for all data in transit.
• At-rest encryption for database storage.
• Row-level security policies enforced at the database layer.
• Hashed password storage; no plaintext passwords are ever stored.
• Access controls limiting data access to personnel with a need to know.

In the event of a personal data breach that is likely to result in risk to your rights, we will notify you and the Data Protection Board of India within the timeframe prescribed by applicable law.

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@ano.in and we will delete it promptly.

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, we have appointed a Grievance Officer to address your concerns about data processing:

We may update this Privacy Policy to reflect changes in our practices or in applicable law. When we make material changes, we will notify you by email or in-app notification at least 14 days before they take effect. The "Effective date" at the top of this page indicates when the current version was last revised.

Continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you should close your account before the changes take effect.

For any questions about this Privacy Policy or our data practices: