This policy explains what personal data Groupiie collects, why, who can see it, and the choices you have. We collect only what we need to run clubs and events, we do not sell your data, and we do not use ad trackers.
01Who is responsible
Groupiie, based in Ahmedabad, Gujarat, India, decides how and why your personal data is processed on Groupiie. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary. You can reach us at support@groupiie.com.
02What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, username, email address, password | You, when you sign up | To create and secure your account. Your password is stored only as a one-way bcrypt hash, never as plain text. |
| Bio, city, interests | You, if you add them | To show your profile and suggest clubs and events that match you. |
| Clubs you create, join or manage, and your role in them | Your actions on the site | To run memberships, join requests and club management. |
| Events you create, RSVPs, waitlist places and check-ins | Your actions, and organisers who scan your entry pass | To manage attendance, capacity and entry passes. |
| Club and event details you publish, such as contact email, website and Instagram | Organisers | To show the club or event publicly. |
| Club photos | Organisers, if they upload one | To show the club. Photos are public. They are resized on the uploader’s device first, which removes hidden data such as the GPS location phones store in pictures. |
| Your city (not your location) | Your choice, your device’s time zone, or your device location if you tap “Use my location” | To show clubs and events near you first. Your device works out the nearest city itself; your coordinates are never sent to us. Only the city name is kept, in a cookie. |
| Sign-in session | Created when you log in | To keep you logged in. See the Cookie Policy. |
| IP address and browser details | Your device, automatically | To limit repeated sign-up and login attempts and keep the service secure. Our host’s web server also keeps standard access logs. |
We do not collect payment details, government IDs, your precise location or your contacts, and we only receive photos that organisers choose to upload for a club. We do not use advertising or analytics trackers.
03Your consent
We process your personal data on the basis of the consent you give when you create an account and agree to this policy, and for the legitimate uses the DPDP Act allows, such as complying with the law and responding to emergencies.
You can withdraw your consent at any time by deleting your account in Settings or by writing to us. Withdrawing consent does not affect processing that happened before, and we will stop processing your data except where the law requires us to keep it.
04What other people can see
- Public: your name, username, bio, city, interests and the clubs you belong to appear on your profile page. Approved clubs and events are public, including what organisers put on them.
- Members and organisers: names of people going to an event and members of a club are visible on those pages. Organisers see join requests and attendance for their own clubs and events.
- Private: your email address and password are never shown to other users.
- Site admins: a small number of Groupiie staff can see account details to moderate content and keep the service safe. Every admin action is logged.
06How long we keep it
- Account data: for as long as your account exists.
- When you delete your account: your name, username, email, bio, city and interests are erased straight away, and you are removed from clubs and events. Clubs or events you created stay on the site, shown as created by “Deleted user”.
- Sign-in sessions: they expire after 30 days, or when you log out.
- Rate-limit counters: kept in memory for minutes, never written to disk.
- Server logs and backups: kept by our host for a limited period before being overwritten. Records we must keep under the IT Rules 2021 are kept for 180 days.
07Your rights
Under the DPDP Act you have the right to:
- Access a summary of your personal data and how we process it. Download a copy any time from Settings.
- Correct and update your data. Edit your profile in Settings.
- Erase your data. Delete your account in Settings.
- Withdraw consent at any time, as explained above.
- Nominate someone to exercise these rights for you if you die or become unable to. Write to us with their details.
- Grievance redressal through our Grievance Officer (see Contact & Grievances). We respond within the time the law sets.
If you are not satisfied with our response, you can complain to the Data Protection Board of India once you have used our grievance process.
08How we protect it
- The whole site uses HTTPS encryption.
- Passwords are hashed with bcrypt. Session tokens are random and stored only as hashes.
- Login and sign-up attempts are rate-limited, and admin actions are logged.
- New clubs and events are reviewed before they are public.
09Children
Groupiie is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, write to grievance@groupiie.com and we will delete it.
10If something goes wrong
If a personal data breach happens, we will inform the Data Protection Board of India and affected users as the DPDP Act requires, and tell you what we are doing about it and what you can do.
11Changes to this policy
We will post any change here with a new date. For important changes we will tell you on the site, and ask for your consent again where the law requires it.
12Contact us
Privacy questions and requests: support@groupiie.com. Grievance Officer: Raman Tungal, grievance@groupiie.com, Ahmedabad, Gujarat, India.