Privacy notice
What we keep about you
Plain English first, because a notice nobody reads protects nobody. Last updated 9 November 2026. Also available in తెలుగు.
The short version. We keep your name, your flat number and one mobile number, so your committee can run your community’s festivals. We do not keep photographs of children. We never see or hold your money. We do not sell anything about you to anybody.
Who is responsible for your data
[TO BE CONFIRMED BEFORE LAUNCH — see note below.] Your community’s association (the AOA) decides what festivals are run and who is on the list. DhoomDhaam provides the software and stores the data on their behalf. The written agreement between DhoomDhaam and your association sets out which of us is the Data Fiduciary and which is the Data Processor under the Digital Personal Data Protection Act, 2023. Until that agreement is signed for your community, treat DhoomDhaam as responsible and write to the grievance officer below.
What we store, and why
| What | Why | How long |
|---|---|---|
| Your name | So your neighbours and your block lead know who you are | While you are a member of the community |
| Your flat and block | Collections, prasadam counts, who your block lead is | Recorded with dates; past tenancies are kept for the accounts |
| One mobile number | To sign you in, and for festival messages | While you are a member |
| Your photo (optional) | So people at the pandal know who is collecting | Until you remove it |
| Payment records | What you paid, when, and the UPI reference you gave us | Kept with the festival’s accounts |
| Names of others in your home | Prasadam counts only. No photographs, no ages | While you are a member |
| Technical logs | Security, and showing what happened if a payment is disputed | At least one year, as the DPDP Rules require |
What we do not store
- Photographs of children. Group photographs from events may show children, with no names and no profiles attached. We do not create records about children, and no sponsor is ever shown alongside children’s content.
- Your money. Payments go from your own UPI app to your society’s account. We never hold it, route it or take a share. We record that you say you paid, and your treasurer confirms it against the bank statement.
- Your UPI PIN, card details or bank credentials. We never ask for them.
- Your location. We do not track where you are.
Who can see what
How much your community collected in total, and how many homes contributed, is shown to everyone. Which home has paid, which has not, who declined and how much any one home gave is private — visible only to you, your block lead, and whoever holds the money switch on your committee. There is no list of defaulters, and there never will be.
Whether your flat number appears in the resident directory is your choice, and it is off until you turn it on.
Guests at personal events
If someone invites you to their own event, they send you a link themselves. We never receive your phone number from them. If you reply, we keep the name you type and your answer, and we delete them 30 days after the event. The page you see shows only what the host typed — never their flat number or their community.
What you can ask for
- A copy of what we hold about you.
- A correction, if something is wrong.
- Deletion of your account and your personal data. Entries in a festival’s financial ledger cannot be erased — they are what the published accounts rest on — but we remove your name from them and keep only the flat.
- Withdrawal of any consent you gave: your photo, the directory, or messages.
Write to the grievance officer below. We answer within 90 days, and usually far sooner.
If something goes wrong
If your personal data is exposed, we will tell you and report it to the Data Protection Board of India. We will tell you whatever the size of the incident — “it was only a few flats” is not a reason to stay quiet.
Where it lives
On Google Cloud in Mumbai, and on Cloudflare’s network. Photographs are stored with Cloudflare R2. We do not move your data out of India except as these providers do in the ordinary course of running their networks.
Grievance officer
Contact details are here, as the DPDP Rules require.