Legal

Privacy Policy

Last updated: 29 October 2026

This policy explains how CraftWishes ("CraftWishes", "we") handles personal data when you use www.craftwishes.com. We follow the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023.

1. Data we collect

  • Hosts: the invitation content you enter (names, event details, messages, photos, videos), and optionally your email and phone number so we can send you your private links and receipts.
  • Guests: when a guest replies, the name, phone number, number of people, chosen events and message they type; when a guest leaves a wish, the name and message.
  • Payments: order and payment IDs, amount, currency and status. Card, UPI and bank details are entered on the secure page of our payment partner (Razorpay) and are never stored by us.
  • Technical data: a session cookie needed for security, a salted and hashed form of your IP address (used only to count unique views and to prevent abuse — we never store the raw IP for this), browser type, and server logs kept for security.
  • Contact messages: what you send us through the contact form or email.

2. How we use it

  • To create, show and deliver your Invite to the people you share it with.
  • To show you RSVPs and wishes on your private manage page.
  • To process payments, send receipts and provide support.
  • To keep the Service secure (rate limits, fraud and spam prevention).
  • To meet legal, tax and accounting obligations.

We do not sell or rent personal data, we do not show third-party ads, and we never send marketing messages to your guests.

3. Who can see it

  • Your Invite is visible to anyone who has its link (unless you add a PIN). Invites are marked "noindex" so search engines do not list them.
  • RSVP details and phone numbers are visible only on your private manage page.
  • Service providers who help us run the Service: our hosting provider, Razorpay (payments), Google Fonts and other content delivery networks (to load fonts and scripts), and our email provider. If you embed a YouTube or Vimeo video, that service receives the viewer's request when it plays.
  • Authorities, when required by law.

4. Cookies and local storage

We use one essential session cookie (security and keeping you signed in to the editor) and your browser's local storage to remember your drafts, the invites you made on this device, and your language or dark-mode choice. We do not use advertising or cross-site tracking cookies.

5. How long we keep it

Free invites expire 30 days after the event; Premium invites one year after the event; greetings one year after creation. We delete expired invites with their photos, videos, RSVPs and wishes within 90 days of expiry. Deleting an invite from its manage page removes it immediately. Payment records are kept for 8 years as required by Indian tax law. Contact messages are kept for up to 2 years.

6. Security

We use HTTPS, hashed private links and PINs, CSRF protection, rate limiting and restricted file uploads. No method is 100% secure, but we work to protect your data and will inform you and the authorities of any breach as required by law.

7. Your rights

You can access, correct or delete your data at any time through your manage page, or ask us to do it. Guests can ask the host, or write to us with the invite link, to remove their RSVP or wish. You may withdraw consent and nominate another person to exercise your rights as provided by the DPDP Act. Write to support@craftwishes.com.

8. Children

The Service is meant for adults. Parents may create invitations for children's events; please share children's photos thoughtfully and consider a PIN.

9. Grievance Officer

Grievance Officer — support@craftwishes.com. We acknowledge complaints within 24 hours and resolve them within 15 days. See Grievance Redressal.

10. Changes

We will post any changes on this page with a new date.