Privacy Policy

This privacy policy ("Policy") applies to Mrge IT Private Limited (operating as "wedd.ai"), a private limited company incorporated under the Companies Act, 2013, having its registered office at 30-15-166/2, 2nd Floor, Hirawat Complex, Dabagardens, Visakhapatnam (Urban), Visakhapatnam-530020, Andhra Pradesh, India (CIN: U63119AP2026PTC126756) ("Company", "we", "us" or "our").

We believe you should always know what personal data we collect, why we collect it, who we share it with and what choices you have. This Policy explains: (i) how and why we collect, store, use and share personal data in the different capacities in which people interact with us; and (ii) the rights you have over that data.

This Policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and is designed to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") as and when their provisions come into force. In this Policy, "you" means the individual whose personal data we process, referred to in the DPDP Act as the "Data Principal" (and in the GDPR as the "data subject"). We explain how we may change this Policy in Section 14.

Summary

• Your relationship with us depends on how you interact with us and our products and solutions ("Services"). You may be: (i) a visitor to https://www.wedd.ai/ or any of its pages (the "Website") ("Visitor"); (ii) a person or business that creates an account or uses the Services, such as a couple, a family member or a professional wedding planner ("Customer"); (iii) a person whose details a Customer adds to, or invites through, the wedd.ai platform ("Guest"); or (iv) a wedding vendor or service provider whose details are recorded on the platform ("Vendor"). "Platform" has the meaning given in our Terms of Use.
• Some features use third-party artificial intelligence (AI) providers, and some of our service providers process data outside India. We explain both in Sections 2, 3 and 7.
• We do not sell personal data, we do not use Guests' contact details to market our own services, and we do not use your data or your Guests' data to train AI models.
• This Policy forms part of, and should be read with, our Terms of Use at https://www.wedd.ai/terms-of-use.
• You can exercise your rights or raise a grievance with our Grievance Officer (Section 12).

If you do not agree with this Policy, please do not use the Website or the Platform.

1. Information We Collect and How We Use It

1.1 Visitors

Data we collect:

• Approximate location derived from your IP address
• Pages you view, time spent on pages and the website that referred you
• Device and browser details (such as model, operating system and browser type)
• Cookie and similar identifiers (see Section 10)
• Name, email address, phone number and message contents, if you submit a form (for example the contact, get-started or template request forms)

We use this data to:

• Understand, in aggregate, how the Website is used, and improve it
• Respond to your enquiries and requests, including sending templates you ask for
• Keep the Website secure and prevent misuse
• Send newsletters and marketing messages, only with your consent

1.2 Customers

Data we collect:

• Name, email address and phone or WhatsApp number
• Your Google account name, email address and profile picture, if you sign in with Google
• Your partner's name and contact details
• Wedding details, such as events, dates, venues, budget, expenses and payments
• Guest lists and Guest data (see Section 1.3)
• To-do items and planning notes
• Vendor details, and quotes, contracts and invoices you upload
• Photos and other gallery uploads
• Messages and broadcasts sent through the Platform
• Questions you ask the AI assistant and the answers it gives
• Billing details (payments are handled by our payment processor, see Section 3.6)
• Device, log and usage data

We use this data to:

• Create and secure your account
• Provide the Services, including guest management, RSVP, identity-document and travel collection, WhatsApp messaging and broadcasts, budget and to-do tracking, reading of uploaded documents, the AI assistant and galleries
• Process subscription payments, recurring mandates and any refunds
• Send service messages and notifications about your account and weddings
• Provide customer support
• Keep the Platform secure and prevent fraud and misuse
• Comply with our legal obligations
• Send marketing communications, only with your consent

1.3 Guests

A Guest is a person whose details a Customer adds to the Platform, or who receives an RSVP, identity-document, travel or gallery link from or through the Platform, including over WhatsApp.

Data we collect:

• Name, phone or WhatsApp number, and relationship or side (for example bride or groom)
• RSVP responses, event attendance and the number of accompanying persons, including children
• Meal and dietary preferences
• Arrival and departure dates, travel, pickup and accommodation details
• Identity documents a Customer requests for hotel check-in or travel bookings, such as a passport, voter ID, masked Aadhaar or another accepted ID (see Section 1.5)
• Photos uploaded to, or appearing in, a wedding gallery and, if the Guest chooses to use face recognition, facial recognition data (see Section 1.5)
• Messages exchanged with the WhatsApp number used for the wedding

We use this data to:

• Let the Customer manage invitations, RSVPs, travel, stay and event logistics
• Send the messages the Customer chooses to send
• Make identity documents available only to the Customer who requested them and, on the Customer's instruction, to the relevant hotel or travel provider
• Run the wedding gallery

Where a Customer adds a Guest's details, the Guest may not have received this Policy directly. The Customer confirms that they are entitled to share each Guest's details with us and that they have told their Guests how their details will be used. Guests may contact us at any time to exercise their rights (Section 4). Our role for Guest data is explained in Section 3.1.

1.4 Vendors

We hold vendor contact and business details that Customers record on the Platform (such as name, business name, phone number, email, services and quoted prices, and the contents of quotes and contracts the Customer uploads), and details vendors give us when they contact us. We use this data to provide the Services to the Customer who recorded it and to respond to vendors who contact us. Customers decide what vendor information to record or share.

1.5 Identity documents, financial data and face recognition

We treat identity documents, financial information (such as budgets, payment schedules and bank details in uploaded contracts) and facial recognition data as sensitive personal data under the SPDI Rules. We process it only for the purposes stated in this Policy and, where the law requires, with consent.

Identity documents. A Customer may ask Guests to provide an identity document for hotel check-in or travel bookings. Providing one is optional, and Guests may choose any accepted document. Aadhaar is never mandatory. If a Guest chooses to share Aadhaar, the Guest should share only a masked Aadhaar, with the first eight digits hidden. We do not publish or display Aadhaar numbers. Identity documents are stored encrypted, can be viewed only by the Customer who requested them, the team members that Customer authorises, the hotel or travel provider the Customer chooses to share them with, and our authorised personnel where needed for support, security or legal compliance, and are not used for marketing or any other purpose. Guests and Customers can delete identity documents at any time, and we delete them in line with Section 6.

Face recognition in galleries. Our galleries offer a "find my photos" feature. When you use it, we create a facial template from the selfie you provide and compare it only with photos in that wedding's gallery. We do this only if you expressly choose to use the feature. We use the template only for that wedding's gallery, never sell or share it, and delete it in line with Section 6 or when you withdraw your consent. You can use the gallery without face recognition.

1.6 Aggregated and de-identified data

We may create aggregated or de-identified information that cannot reasonably be used to identify you or any other individual, and use it for any lawful purpose, including analytics and improving the Services. We will not attempt to re-identify it.

2. Artificial Intelligence Features

Some features of the Services use large language models from third-party providers. These include the wedd.ai assistant, reading and summarising of vendor quotes and contracts, message drafting, and our free tools such as the wedding hashtag generator and the WhatsApp message writer. Our current providers are Anthropic, PBC and/or OpenAI, L.L.C., in the United States.

When you use these features, we send the provider the content you submit and the related data needed to answer your request. Depending on the feature, that may include names (for example the couple's names you enter in the hashtag generator), text from uploaded documents, guest names and RSVP status, budget entries and to-do items. We send only what the feature needs.

We use these providers under their commercial API terms, which do not permit the provider to use our API inputs or outputs to train its models. Providers may retain inputs and outputs for a limited period for abuse monitoring and legal compliance. We do not use your personal data, or your Guests' personal data, to train AI models, and we do not sell personal data or provide it to anyone for training AI models.

AI output is generated automatically and may be inaccurate or incomplete. Please check amounts, dates and contract terms against the original documents. AI output is not legal, financial or other professional advice. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

3. Our Role, Data Sharing and Third-Party Services

3.1 Our role for different data

• Your own account and contact data (Visitors, Customers and Vendors who contact us): wedd.ai is the Data Fiduciary (controller).
• Guest data added by a couple or family for their own wedding: you use the Platform for a personal and domestic purpose, and wedd.ai is the Data Fiduciary (controller) for how the Platform stores and processes that Guest data. We process it only to provide the features you use, give you control over it, and handle Guests' requests under this Policy. You confirm that you are entitled to share each Guest's details with us and that you will use the Platform to contact Guests only about your wedding.
• Guest, client and contact data added by a wedding planner, venue or other business Customer: the business Customer is the Data Fiduciary (controller) and wedd.ai is its Data Processor (processor), acting on its documented instructions under our Data Processing Addendum, whichever WhatsApp number is used. Guests of a business Customer should send requests to that business. If they contact us, we will pass the request on and help the business respond.
• Vendors: Customers decide what vendor information to record or share. Vendors do not see Customer or Guest data unless a Customer chooses to share it.

3.2 Service providers and other recipients

We share personal data with the following service providers to run the Services:

We bind our service providers by contract to process personal data only for the purposes we specify and to protect it with reasonable security safeguards. Some providers, such as Meta, Google and Cashfree, also process data as independent controllers under their own terms and privacy policies. Where we process data on behalf of a business Customer, the sub-processors we use are listed in our Data Processing Addendum.

3.3 Marketing

If you are a Visitor or Customer and you opt in, we may send you news, tips and offers about wedd.ai by email or WhatsApp. You can opt out at any time by using the unsubscribe link in our emails, by following the opt-out instructions in our WhatsApp messages, or by writing to admin@wedd.ai. We never use Guests' contact details, or any data a Customer uploads about other people, to market our own products and services. We do not sell personal data or share it with third parties for their own marketing, except that Meta may use the advertising data described in Section 10 for its own ad delivery and measurement under its own terms.

3.4 WhatsApp Business Platform and Meta

We use the WhatsApp Business Platform (including the WhatsApp Cloud API) provided by Meta Platforms, Inc. and its affiliates ("Meta") to send and receive messages such as service notifications, wedding and Guest communications, and marketing messages you have opted in to receive. All WhatsApp messages on the Platform are sent only through Meta's official WhatsApp Business Platform (Cloud API). Messages can be sent in one of two ways:

• Using a wedd.ai number (default): wedd.ai operates the WhatsApp Business Account and is the Data Fiduciary (controller) for that account, its opt-in records and the service messages we send. For Guest data, our role is as described in Section 3.1.
• Using your own number: where a business Customer connects its own WhatsApp Business Account and number through Meta's official onboarding (including Coexistence, which lets the number continue to be used in the WhatsApp Business app), the Customer controls that account and the associated message data and acts as the Data Fiduciary (controller). We act as a technology provider and Data Processor, sending and managing messages only on the Customer's documented instructions. The Customer is responsible for obtaining the required recipient opt-ins and for giving its own privacy notice to its recipients. Our processing of that data is governed by our Data Processing Addendum (Section 3.5).

When you communicate with a business through WhatsApp, your messages and related information are also processed by Meta under the WhatsApp Business Messaging Policy, the WhatsApp Privacy Policy and Meta's Privacy Policy, over which we have no control. Message content sent through the WhatsApp Cloud API may be stored by Meta for a limited period (generally up to 30 days) to deliver those messages.

We send WhatsApp marketing messages only to individuals who have given the required opt-in consent. You can opt out at any time by following the instructions in the message or by writing to admin@wedd.ai. We do not use phone numbers or message content obtained through the WhatsApp Business Platform for any purpose other than providing the requested Services, and we do not sell this data.

3.5 Data Processing Addendum and sub-processors

Where we act as a Data Processor for a business Customer (Sections 3.1 and 3.4), that processing is governed by our Data Processing Addendum (DPA), which forms part of our Terms of Use. The DPA sets out the subject matter and duration of processing, the parties' roles, our security measures, breach notification, assistance with requests from individuals, deletion or return of data on termination, and the current list of sub-processors.

3.6 Payments

Our payment processor, Cashfree Payments India Private Limited ("Cashfree"), in India, processes payments, recurring mandates and any refunds. You enter card, UPI and bank details on Cashfree's secure pages. We do not receive or store full card numbers, CVV, UPI PINs or net-banking credentials. We receive only the transaction reference, amount, status, payment method type, the last four digits of a card or a tokenised reference, and your billing name, email and phone number. We use these for invoicing, tax compliance, renewals, any refunds and fraud prevention. For recurring subscriptions, your card issuer, bank or UPI app will send you a pre-debit notification before each charge, as required by the Reserve Bank of India, and you can cancel the mandate through your card issuer, bank or UPI app. Refunds and cancellations are governed by our Terms of Use (Section 5.3).

4. Your Rights

4.1 Rights under Indian law

Subject to applicable law, you have the right:

• to obtain a summary of your personal data and of our processing of it, and the identities of the Data Fiduciaries and Data Processors we have shared it with;
• to have your personal data corrected, completed, updated or erased;
• to withdraw your consent at any time, as easily as you gave it (Section 5 explains the effect of withdrawal);
• to have your grievances redressed by our Grievance Officer (Section 12); and
• to nominate another individual to exercise your rights if you die or become incapacitated.

We offer these rights now, even where the corresponding provisions of the DPDP Act are not yet in force.

4.2 Additional rights where the GDPR or UK GDPR applies

If the GDPR or UK GDPR applies to our processing of your data (see Section 13), you also have the right to restrict processing, to object to processing (including an absolute right to object to direct marketing), to data portability, and to complain to your data protection supervisory authority.

4.3 How to make a request

You can make a request, including a request to delete your data, by submitting our data request form, by emailing admin@wedd.ai with the subject line "Data Rights Request", or by writing to our Grievance Officer (Section 12). Please tell us what you are asking for and include the email address and/or WhatsApp number associated with your data so that we can locate your records. If you are a Guest, please also tell us the name of the couple or planner who invited you.

We may need to verify your identity before acting on a request. We will acknowledge your request within 72 hours and respond within 30 days. If we need more time, we will tell you why, and we will respond within 90 days in any case. Once your identity is verified, we will delete the personal data you ask us to delete, except where we must keep it under Section 6 or applicable law. Where we process your data as a Data Processor for a business Customer (Section 3.1), we will pass your request to that business and help it respond.

4.4 Escalation

If our Grievance Officer does not resolve your grievance to your satisfaction, you may, once you have used our grievance process and the relevant provisions are in force, complain to the Data Protection Board of India.

4.5 Your duties

Under section 15 of the DPDP Act, you must not give false information, impersonate another person, suppress material information when providing personal data, or file false or frivolous grievances or complaints.

5. Legal Basis for Processing

We process personal data on the following grounds. The GDPR column applies only where the GDPR or UK GDPR applies to you.

Where we rely on consent, you may withdraw it at any time, as easily as you gave it, by writing to admin@wedd.ai or using our data request form. Withdrawal does not affect processing carried out before it. If you withdraw consent that a feature needs, we may be unable to keep providing that feature.

6. Data Retention

We apply a single retention rule to all account and wedding data. All account and wedding data, including guest lists, Guest personal data, identity and travel documents, uploaded contracts and other documents, messages, galleries and photos, and facial recognition data, is automatically and permanently deleted 2 months after the wedding date. The wedding date is the date of the last event set in the account.

You can ask us to delete your data earlier at any time, using our data request form or as described in Section 4.3. Customers can also delete data from the Platform themselves.

The only exceptions are:

• Records we are legally required to keep, such as invoices, payment and accounting records, which we keep for the period the law requires (currently about eight years); and
• Data needed for an ongoing legal claim or investigation, which we keep only until that claim or investigation is resolved.

We use data kept under these exceptions only for those purposes. Deleted data is purged from our backups within the normal backup rotation, within 30 days.

7. Data Storage and Transfers

7.1 Where your data is stored and transferred

Our primary databases and file storage are hosted by Amazon Web Services in India. To provide the Services, some personal data is processed outside India, mainly in the United States, by the service providers listed in Section 3.2. These include Meta (WhatsApp messaging and advertising measurement), Google (sign-in, email delivery and website analytics), our content-delivery network and our AI model providers. These transfers are necessary to provide the Services.

We transfer personal data outside India only as permitted by applicable Indian law, including the Information Technology Act, 2000 and its rules and, once in force, section 16 of the DPDP Act and the rules made under it, and not to any country or territory the Central Government has restricted. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (or the UK equivalent), an adequacy decision or another lawful transfer mechanism.

7.2 Service providers

We use the service providers listed in Section 3.2 to provide parts of the Services. They may access personal data only to perform those services for us.

8. Disclosure Required by Law and Business Transfers

We may disclose personal data where we reasonably believe it is necessary:

• to comply with law, a court order or a lawful request of a government authority;
• to respond to a medical emergency or a threat to anyone's life or safety;
• to establish, exercise or defend our legal rights; or
• to prevent or investigate fraud, security incidents or offences.

If we are involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the successor entity, which will be bound by this Policy or one at least as protective, and we will notify you.

9. Security

9.1 Our security practices

We maintain reasonable security practices and procedures, as required by section 43A of the Information Technology Act, 2000, the SPDI Rules and, once in force, the DPDP Act. These include encryption of data in transit (TLS), encryption of identity documents, role-based access controls so that personal data is accessed only by authorised personnel on a need-to-know basis, regular backups, procedures for responding to security incidents, and contractual security obligations on our service providers. Our infrastructure providers maintain physical security controls at their data centres.

9.2 No absolute security

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials and devices secure, for the accuracy and lawfulness of the data you upload, and for the people you choose to share it with through the Platform.

9.3 Information you provide about others

If you upload or share personal data about another person (such as Guests, family members or vendors), you confirm that you are entitled to do so and that you have given them any notice and obtained any consent the law requires. Our Terms of Use set out your responsibilities and indemnity for that data.

9.4 Third-party services

The Platform links to and integrates with third-party services such as WhatsApp, Google and payment providers. Their own terms and privacy policies govern how they handle your data.

9.5 Personal data breach

If a personal data breach affects your personal data, we will tell you without undue delay, as required by law. We will explain in plain language what happened and when, the likely consequences, what we are doing to reduce the harm, what you can do to protect yourself, and how to contact us. We will also report the breach to the Data Protection Board of India, CERT-In and any other authority as the law requires. Where we act as a Data Processor for a business Customer, we will notify that Customer, which is responsible for notifying the affected individuals.

9.6 Limitation of liability

Our liability in connection with this Policy is subject to the limitations in our Terms of Use, to the extent permitted by applicable law.

10. Cookies and Similar Technologies

We use:

• Strictly necessary cookies and local storage, which keep the Website and Platform working, keep you signed in and protect against misuse;
• Analytics cookies set by Google Analytics 4 (Google LLC), which tell us how visitors use the Website: pages viewed, time on page, approximate location derived from your IP address, device and browser type, and the referring website. Google processes Google Analytics data, including in the United States; and
• Advertising cookies set by the Meta Pixel (Meta Platforms, Inc.), which tell us whether our Facebook and Instagram adverts work: pages viewed, actions such as submitting a form or clicking to sign up, browser and device information, and your IP address. Meta may link this to your Facebook or Instagram account and processes it, including in the United States. You can control the ads you see in your Facebook or Instagram ad settings.

We do not sell data collected through cookies. You can block or delete cookies in your browser settings, install the Google Analytics opt-out browser add-on, or block Meta's tracking with a content blocker. Blocking strictly necessary cookies may affect how the Website and Platform work.

11. Children

Account holders must be at least 18 years old. Guest lists and galleries may include children (under 18) attending a wedding. A Customer or Guest who adds a child's details or uploads a child's identity document or photo confirms that they are the child's parent or lawful guardian, or act with that person's consent. We use children's data only to organise the event the child is attending. We do not track, behaviourally monitor or profile children, or send them marketing or targeted advertising. Face recognition must not be used with a child's selfie unless a parent or lawful guardian chooses to enable it. If we learn that we hold a child's data without the required consent, we will delete it promptly.

12. Grievance Officer and Privacy Contact

You may contact our Grievance Officer with any concern, complaint or request about this Policy or how we process personal data. The Grievance Officer is also our contact for questions about how we process personal data under the DPDP Act.

Name: Raj
Designation: Chief Technology Officer
Company: Mrge IT Private Limited (operating as wedd.ai)
Address: 30-15-166/2, 2nd Floor, Hirawat Complex, Dabagardens, Visakhapatnam (Urban), Visakhapatnam-530020, Andhra Pradesh, India
Email: admin@wedd.ai
Phone: +91 63035 68185

We will acknowledge your complaint within 24 hours and resolve it within 7 days of receipt, or sooner where the law requires. We will act within 2 hours on complaints about content that exposes a person's private area, shows full or partial nudity or a sexual act, or impersonates a person (including morphed images), and within 36 hours on other complaints about content prohibited under our Terms of Use, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended.

13. Users and Guests in the EU, EEA or UK

Our Services are aimed at weddings in India. Where the GDPR or UK GDPR nevertheless applies to our processing of your data, Mrge IT Private Limited is the controller (or processor, as described in Section 3.1). Our lawful bases are set out in Section 5, your additional rights in Section 4.2, and how transfers out of the EEA or UK are protected in Section 7.1.

14. Changes to This Policy

We may update this Policy to reflect changes in our Services or the law. We will post the updated Policy on this page with a new "Last updated" date and keep earlier versions available on request. For material changes, we will notify Customers by email or in-app notice at least 15 days before the change takes effect. If a change involves processing your personal data for a new purpose that requires consent, we will ask for your consent first.

15. Governing Law and Language

This Policy is governed by the laws of India. Disputes are subject to the dispute resolution clause of our Terms of Use, without affecting your right to approach the Data Protection Board of India or, where applicable, your local supervisory authority.

You may ask for this Policy in English or any language listed in the Eighth Schedule to the Constitution of India by writing to admin@wedd.ai.

16. Contact Information

If you have any questions about this Policy or our data practices, please contact us at:

Mrge IT Private Limited (operating as wedd.ai)
CIN: U63119AP2026PTC126756
30-15-166/2, 2nd Floor, Hirawat Complex
Dabagardens, Visakhapatnam (Urban), Visakhapatnam-530020
Andhra Pradesh, India
Email: admin@wedd.ai
Website: https://www.wedd.ai