Privacy policy

What we hold, and for how long

This table is the whole list. It is enumerated from the actual database, not written from memory, so there is nothing held back for a vaguer catch-all clause at the end.

We do not collect anything in order to profile you, and we do not build advertising audiences. There is no tracking pixel on the pages a guest sees.

If someone invited you and you never signed up

A host added your number because they are inviting you to something. You did not create an account and you do not need one. You have the same rights over your data as any host does, and you can use them without signing in:

• Stop hearing from us. Reply STOP to the WhatsApp message. It is permanent, and it applies to every host on Nexus Celebrate — not just the one who invited you.
• Be removed from a guest list. Message us from that number and say so.
• Ask what we hold about you. Message us from that number and we will tell you.

Hosts are responsible for the guest lists they build. Our terms require a host to have a genuine reason to contact each person they add, and we suspend accounts that send unwanted messages.

Photos, video and the optional selfie match

A party can have a shared album. The host uploads to it, and on an upgraded party guests can too if the host allows it. Who may view an album is the host’s choice, and a person who was never given access cannot see it.

Albums are deleted on a timer, automatically. 60 days after a free party, 365 days after an upgraded one. This is not a promise to review it later; it is how the system is built.

“Find my photos” is face matching, and it is optional in two separate ways. The host chooses whether the feature is available on their party at all, and a guest chooses whether to use it. A guest who uses it takes one selfie; it is matched against that one party’s album and then:

• the selfie itself is deleted immediately after the match;
• the face data derived from it is deleted immediately after the match;
• the face data for the album as a whole is deleted when that album expires.

Face data from one party is never matched against another party, and it is never used to identify anyone outside the album they asked about.

Children

Nexus Celebrate is for adults. You must be 18 or over to create an account and host a party. We do not knowingly let a child create an account, and we do not profile children or serve them advertising — we serve no advertising at all.

Children do appear in celebrations, and a host’s album may contain photographs of them. Where it does, the host has uploaded those photographs and is responsible for having the right to do so — including the agreement of the child’s parent or guardian. India’s Digital Personal Data Protection Act treats a child’s personal data as requiring verifiable parental consent, and in this product that consent is between the host and the parent, because we never have a relationship with the child.

Face matching is never applied to a child’s account, because a child has no account. A guest who uses “find my photos” has verified their own phone number and confirmed they are an adult doing it for themselves.

If you are a parent or guardian and a photograph of your child is in an album you did not agree to, tell us and we will remove it — see Contact & grievances. You do not need an account, and we will not ask you to justify the request.

How WhatsApp fits in

Invitations, reminders and replies travel over WhatsApp. That means Meta carries those messages and handles them under its own terms, exactly as it does for any message you send on WhatsApp. We send through a business number we operate.

We can see the messages exchanged with that number and whether a message was delivered. We cannot see any other conversation on your phone.

We cannot guarantee WhatsApp will deliver every message to every recipient — that is Meta’s decision — which is why every party also has a share link a host can send themselves.

If you connect a Canva account

Connecting Canva is entirely optional, and Nexus Celebrate works fully without it. If you do connect it, we store an access token for your own Canva account, encrypted, and we use it for exactly two things: listing your designs so you can pick one, and exporting the design you picked so it can become your invitation card.

The access we ask for is read-only. Nexus Celebrate cannot create, change, move or delete anything in your Canva account, and it cannot see anything you have not shared with the account you connected. We ask for no other Canva permission.

Disconnect at any time from your account settings. Disconnecting deletes the stored token. You can also revoke the connection from inside Canva, which has the same effect.

Who else sees your data

We do not sell personal data, and we do not share it for anyone else’s marketing. We do use service providers to run the product, and they are named rather than described in the abstract:

• Meta Platforms (WhatsApp Business) — carries the invitations, reminders and replies.
• Vercel — runs the application and serves the website.
• Supabase (managed PostgreSQL) — stores accounts, parties, guest lists and replies.
• Cloudflare R2 — stores album photos, video and invitation artwork. Files are not publicly addressable; they are served through links that expire.
• Razorpay — takes payment details directly for credit top-ups. Card numbers never reach us.
• AI providers, reached through the InSynapse Nexus platform — generate invitation copy and artwork when you ask for them, and perform the optional face match. They are not permitted to use your content to train their models.
• Canva — only if you connect it, and only as described above.

Each of these processes data only to provide its part of the service, on our instructions. We do not give any of them permission to use your data for their own purposes.

We may also disclose data where the law requires it, or to investigate abuse of the service. If we are ever required to hand over data about you, we will tell you unless we are legally prevented from doing so.

Where your data is stored, and when it leaves India

We host in India where the provider offers it — the database runs in the Mumbai region, and the application is pinned to serve from India.

Some of it does cross a border, and we would rather say so than imply otherwise. Messages travel through Meta’s global infrastructure, because that is what WhatsApp is. Our hosting and object-storage providers operate globally. The AI providers that draft invitation copy, generate artwork and perform the optional face match process those requests outside India. If you connect Canva, the designs you choose are fetched from Canva, which is an Australian company.

Where data leaves India we rely on the contractual protections in our agreements with those providers, and we transfer only what the feature needs. The Indian government may restrict transfers to particular countries; we honour any such restriction.

Cookies

We use one cookie, and it is the one that keeps you signed in. It holds a signed session token, no more. Without it you would have to re-enter a code on every page.

We run no advertising cookies, no third-party trackers and no analytics pixels on the pages guests see. There is no cookie banner because there is nothing to consent to beyond the cookie that makes signing in work.

Clearing it signs you out. Your browser may also keep small amounts of local data to remember things like a draft you were part-way through; that never leaves your device.

Your rights, and how to use them

Under India’s Digital Personal Data Protection Act you can ask us for a summary of the personal data we hold about you, ask us to correct it, ask us to erase it, and complain if you are unhappy with how we have handled it. You do not need an account to ask, and we do not charge for it.

• Delete my account. We delete your account, the parties you host, their guest lists and their albums. Some records survive deletion because the law requires it — tax invoices in particular — and the opt-out record survives on purpose, because deleting it would let hosts message you again.
• Correct something. Most of it you can edit yourself; message us for anything you cannot.
• Get a copy. Ask and we will send you what we hold.
• Complain. Write to us first — see Contact us. If we cannot resolve it, you can escalate to the Data Protection Board of India.

We answer requests as quickly as we can and within 30 days. We will ask you to prove you control the phone number in question, because handing someone else’s data to the wrong person is its own breach.

Keeping it safe

• Everything travels over encrypted connections, and the database is encrypted at rest.
• Access tokens for connected accounts are encrypted with a separate key before they are stored, and are decrypted only at the moment they are used.
• Album files are not publicly addressable. They are served through links that expire, so a copied URL stops working.
• Every query is scoped to the host it belongs to, so one host’s data is not reachable from another’s session.
• Significant actions on an account are logged, so we can answer “who changed this”.

No service can promise it will never be breached. If a breach affects your personal data we will notify you and the Data Protection Board as the law requires, and we will tell you what we know rather than what sounds best.

Changes to this policy

We may update this policy. The date at the top of the page is when it last changed in substance, and we keep that date honest — it moves when the meaning moves, not when a typo is fixed.

If a change materially affects what we collect or what we do with it, we will tell you through the service rather than relying on you to notice. Continuing to use Nexus Celebrate after a change means you accept the updated policy; if you do not, you can ask us to delete your account.

Contact us, and how to complain

Nexus Celebrate is operated by InSynapse Technologies India Pvt Ltd, a company incorporated in India. For anything on this page — a question, a correction, a deletion request, a photograph of your child you want removed, or a complaint — reach us here:

• WhatsApp — message the Nexus Celebrate number. This is the same number your invitations come from, and it is the fastest way to reach a person.

Grievance Officer

In accordance with India’s Digital Personal Data Protection Act and the Information Technology Rules, the Grievance Officer for Nexus Celebrate is Madhusudan Bansal, InSynapse Technologies India Pvt Ltd.

Reach the Grievance Officer through the WhatsApp channel above, saying that your message is for the Grievance Officer so it is routed and recorded as one.

If you want to complain

Write to us first, through any channel above, and say that you are making a privacy complaint so it is handled as one. We will acknowledge it and respond within 30 days. We will tell you what we found, including when the answer is that we got something wrong.

If we do not respond, or you are not satisfied with how we handled it, you can escalate to the Data Protection Board of India under the Digital Personal Data Protection Act. You do not need our permission to do that, and we will not treat it as a reason to close your account.

See also our terms of use and the support page.