Privacy Policy

1. This Privacy Policy explains how Alpheric Consultants Private Limited (CIN U85500UP2023PTC187437), operating the HAP.Partners and HAP CheckIn services (“HAP”, “we”, “us”), handles personal data.
2. It applies to hap.live, the HAP applications, the HAP CheckIn applications used by organisers, sellers, crew and partners, our gate-entry systems, and the emails and messages we send.
3. For the personal data described here, HAP is a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). We also handle personal data in line with the Information Technology Act, 2000 and the rules made under it.
4. An Event Organiser is a separate and independent Data Fiduciary for the attendee data it receives. See section 7.
5. This Policy forms part of our Terms of Service.

We collect the categories below. Not every category applies to every person: a visitor who only browses generates far less than an organiser who is onboarded and settled.

• From you — when you browse, book, create an account, contact support, or fill in a form.
• From the person who booked for you — a buyer may enter your name and email as an attendee. Where they do, they confirm that they are authorised to share your details for that purpose.
• From your device — IP address and user-agent, automatically, as part of any web request.
• From our payment aggregator — the outcome of a payment, the method used, the fee charged, and any refund or chargeback.
• From gate devices — check-in records, which may be created offline and synchronised later.
• From an Organiser — where it adds a crew member or a seller to its event.

Under the DPDP Act, personal data is processed either with your consent or for a “legitimate use” the Act recognises. Each purpose below states which applies.

We do not use personal data to make a decision that produces a legal effect on you without a human being involved.

Service providers act on our instructions under written terms, may use the data only for the purpose we gave it to them for, and are required to protect it.

1. Our Terms require an Organiser to use attendee data only to operate its event, not to sell or transfer it, not to use it for unrelated marketing, and not to keep it longer than its lawful purpose requires.
2. We enforce those terms, and suspend organisers who breach them, but we do not control an Organiser’s systems. A request to access, correct or erase data held by an Organiser should be made to that Organiser. Its contact details are on the event page and in your order confirmation.
3. Write to [email protected] if an Organiser does not respond, or if you believe one has misused your data, and we will take it up.
4. Each organisation’s data is isolated from every other in our systems. One organiser cannot see another organiser’s attendees. Cross-organisation access exists only for our own platform administrators, is restricted to named roles, and every such access is recorded.

1. Payments are processed by an RBI-authorised payment aggregator. Your card number, CVV, expiry, UPI PIN and net-banking credentials are entered inside the aggregator’s environment and are never transmitted to, seen by, or stored on, our systems.
2. We store only what we need to reconcile the transaction: a payment reference, the method used, the amount, the status, the fee charged, and the reason for any failure.
3. The aggregator processes your data under its own privacy policy and its obligations to the Reserve Bank of India.

We use a small number of cookies. Most are necessary for the service to work; the rest are analytics cookies, set by Google Analytics and Microsoft Clarity and described below. We do not use advertising cookies, and we do not embed third-party advertising or social media trackers.

Your browser can block or clear cookies. Blocking the session cookie means signing in more often; blocking cookies entirely will prevent parts of the Platform from working. Blocking only the analytics cookies above has no effect on anything you can do on the Platform.

Google Analytics. We use Google Analytics 4 to measure how the website is used in aggregate — which pages are reached, from where, and where people leave. Google LLC acts as our Data Processor for this, and the data is processed on servers outside India. We have not enabled Google Signals or any advertising feature, so this data is not used to build advertising audiences and is not combined with your signed-in Google account. Google Analytics receives your truncated IP address, not the full one. It is loaded on this public website only — never in the organiser console, the gate-entry apps, or the HAP CheckIn applications.

Microsoft Clarity, and session recording. We use Microsoft Clarity to see how pages are actually used — where people click, how far they scroll, and where a page confuses them. Clarity does more than count visits: it records a replay of your visit, which reconstructs the pages you saw and the mouse movement, scrolling and clicks you made on them. It does not record your camera, microphone, or anything outside the browser tab. Microsoft Corporation acts as our Data Processor, and this data is processed outside India.

Recording runs on this public website only — never in the organiser console, the gate-entry apps, or the HAP CheckIn applications. If you would rather not be recorded at all, any tracker-blocking browser extension or privacy-focused browser will stop it, and everything on the Platform continues to work. You can also ask us to exclude you by writing to [email protected].

1. Crash reporting is off unless it has been switched on for a particular build of the app. Where it is off, the app collects nothing described in this section and contacts no third party.
2. Where it is on, a report is sent only when the app actually fails — a crash, an unhandled error, or a screen that could not be drawn. The app does not send reports on a schedule, and does not report ordinary use.

1. The crew device identifier is a pseudonymous code we issued, not a name — but we and the Organiser that enrolled the device can link it back to a person, so we treat a crash report as personal data and it carries every right in section 14.
2. We use these reports for one purpose: keeping the application working. They are not used to monitor a crew member’s performance, activity or whereabouts, and we do not make them available to an Organiser for that purpose.
3. Reports are processed by a specialist crash-reporting provider on our instructions, under written terms, and are deleted after 90 days. That provider stores them outside India — see section 11.
4. A crew member who would rather send nothing can say so, and the Organiser or [email protected] can have reporting turned off for that device. The app is fully usable with it off. The in-app diagnosis report — which stays on the phone unless somebody chooses to share it — is unaffected either way.

1. Personal data is stored on infrastructure located in India.
2. A limited number of service providers — for example email delivery — may process data outside India in the course of delivering a message. Where that happens, it is only to a country the Central Government has not restricted under section 16 of the DPDP Act, and under contractual protections.
3. Crash reports from the crew app, where that build has reporting switched on, are stored outside India by our crash-reporting provider under the same conditions, and deleted after 90 days. What such a report can and cannot contain is set out in section 10.
4. Backups are encrypted and held under the same restrictions.

We keep personal data only for as long as the purpose it was collected for requires, or for as long as the law requires, whichever is longer. When a period ends, the data is deleted or irreversibly anonymised so that it can no longer identify anyone.

Where you ask us to erase data that we are also required by law to keep, we erase what we can and retain the rest for the statutory period only, restricted so it is not used for anything else.

• Encryption in transit. Everything travels over TLS. Data at rest, including backups, is encrypted.
• Passwords are never stored. Only a one-way cryptographic hash is kept, so a copy of our database does not yield anyone’s password.
• Isolation between organisations, enforced three times. At the request layer, in the data access layer, and in the database itself with row-level security. A mistake in one layer is caught by the next.
• Least privilege. Staff access is limited to what a role needs. Administrative access to the platform console requires a second factor in addition to a password.
• Reading is audited, not just writing. Looking up an attendee is itself access to personal data, and is recorded.
• Tickets are signed, not guessable. A ticket code carries a digital signature. A gate device can verify one but cannot create one.
• Uploads are checked by content. Files are identified by their actual bytes rather than by the name or type a browser claims, and formats that can carry executable content are refused.
• Payment credentials are out of scope by design. They never enter our systems, so they cannot be lost from them.

No system is perfectly secure. Where a personal data breach occurs, we will notify the Data Protection Board of India and every affected person, in the form and within the time the DPDP Act requires. If you believe you have found a vulnerability, please report it to [email protected] rather than disclosing it publicly.

As a Data Principal under the DPDP Act, you have the following rights.

Access

Ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with.

Correction

Have inaccurate or incomplete data corrected or completed, and out-of-date data updated.

Erasure

Ask us to delete data we no longer need for the purpose it was collected for, subject to the retention periods the law imposes.

Withdraw consent

Withdraw consent as easily as it was given. Withdrawal applies going forward and does not undo processing already done, and it may mean we can no longer provide part of the service.

Grievance

Raise a complaint with us about how your data has been handled — section 17.

Nomination

Nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them.

1. To exercise a right, write to [email protected] from the email address on your account or order, telling us what you want and, where relevant, which order it concerns.
2. We respond within 30 days. Where a request is complex we may tell you it will take longer, and why.
3. We may ask you to verify your identity before acting. This protects you: acting on an unverified request is how one person gets another person’s data.
4. Requests are free. We may decline a request that is manifestly unfounded or repetitive, or that would reveal another person’s data, and we will tell you why.
5. The DPDP Act also places duties on you: to give authentic information, not to impersonate anyone, and not to file a false or frivolous complaint.

1. The Platform is not directed at children. A person under 18 may not create an account or place an order.
2. Where a child attends an event, a parent or guardian buys the ticket and provides the child’s name where the event requires it. Doing so is the guardian’s consent for that purpose.
3. We do not track a child’s behaviour, target advertising at a child, or process a child’s data in a way likely to have a detrimental effect on their well-being.
4. If you believe a child has given us personal data without a guardian’s consent, write to [email protected] and we will delete it.

1. Transactional messages — your ticket, your order confirmation, a reschedule or cancellation notice, a one-time password, a refund update — are part of the service and are not marketing. They are sent for as long as you hold an active order.
2. Marketing is sent only with your consent. Every marketing message carries a one-click way to withdraw it, and you can also write to [email protected].
3. Marketing sent by an Organiser about its own events is that Organiser’s responsibility, and is unsubscribed with the Organiser.

We may update this Policy. The version in force is always published at hap.live/legal/privacy, with its version number and effective date. Where a change materially affects how we use your data, we give notice before it takes effect and, where the law requires consent, we ask for it again.

Write to us first. We would rather fix something than have you take it further, and in most cases we can do it faster.

Data Fiduciary

Alpheric Consultants Private Limited, Alpheric, 6th Floor, Magnus Tower, Sector 73, Noida, Uttar Pradesh 201301, India

Data Protection Contact

Ashish Randhawa · [email protected]

Grievance Officer

Ashish Randhawa · [email protected]

Acknowledgement

Within 48 hours of receipt

Resolution

Within 30 days of receipt

If you are not satisfied with our response, you may complain to the Data Protection Board of India established under the DPDP Act. The Act requires you to have exhausted our grievance process before doing so.