Privacy policy
Last updated: 4 September 2026
Who we are
PUJO360 (“we”) runs the PUJO360 visitor app, the PUJO360 Committee app and pujo360.in. This notice is given under the Digital Personal Data Protection Act, 2023 (DPDP) in English and Bangla. Where the two differ, the English text controls.
What we collect and why
| Data | Purpose | Kept for |
|---|---|---|
| Phone number (OTP login) | Identify your account; one rating per person; pass ownership | Until you delete your account |
| Precise location while the app is open, and in Pandal Hop Mode while the foreground service runs | Show pandals near you; detect visits; live crowd estimate (anonymous) | Raw traces 90 days; visit records (pandal, day, method) until deletion |
| Background location (only if you turn it on, and only if the feature is enabled) | Mark visits when the app is closed | Same as above |
| Ratings, category picks, comments | Compute public awards | Season + 1 year; unlinked from you on deletion |
| Device model, OS version, app version, a per-install device ID, push token | Keep the app working, send notifications you opted into, detect abuse | Until deletion or 180 days of inactivity |
| Photos and videos uploaded by committees | Show pandals; EXIF (including location) is stripped on upload | Until the committee removes them or 2 years |
| Committee KYC: entity PAN, bank account, registration certificate, signatory ID | Pay out pass revenue; tax compliance | 8 years after the last payout (tax law) |
| Payment records (order, amount, Razorpay IDs). We never see your card or UPI details. | Issue passes; refunds; accounts | 8 years (tax law) |
Consent and choices
- You can browse pandals without an account. Login is asked for only when you rate, track visits or buy a pass.
- Location permission is asked for in the app with a plain-language screen before the system prompt. You can revoke it any time in Android settings; the app keeps working with QR check-in.
- We do not sell personal data and do not show third-party advertising.
- Processors we use: Google (Firebase Auth, Cloud Messaging, Play), MSG91 (SMS OTP fallback), Razorpay (payments), our hosting and object storage providers in India. Each is bound by contract to use data only for our instructions.
Children
The apps ask you to confirm you are 18 or older before visit tracking and ratings are enabled. If you are under 18, you can still browse pandals without an account. We do not knowingly process a child’s data; if you believe we have, write to the grievance officer.
Your rights (DPDP Act, 2023)
- Access: a summary of the personal data we hold about you and who it has been shared with.
- Correction and erasure: fix your name or ward in the app; delete your account in the app or at pujo360.in/delete-account.
- Withdraw consent: turn off location, notifications or delete the account. Withdrawal does not affect processing done before it.
- Grievance redressal: write to the grievance officer (see the grievance page). We respond within 7 working days. If unresolved, you may approach the Data Protection Board of India.
- Nominate: you may nominate another person to exercise these rights for you in case of death or incapacity.
Security
Data is encrypted in transit (TLS) and at rest. Phone numbers are stored hashed for matching and encrypted for display. Access to admin tools is role-based and every admin action is written to an audit log. We will notify affected users and the Data Protection Board of a personal-data breach as the law requires.
Changes
If this notice changes materially we will show a one-line notice in the app and update the date above. Older versions are available on request.