This policy explains what personal data SpareSeat collects, why, who can see it and the choices you have. It is written to meet the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 and the Google API Services User Data Policy.
Who we are
SpareSeat is operated by SpareSeat, which decides how and why your personal data is processed (the data fiduciary). Contact us at .
Information we collect
| What | When |
|---|---|
| Name, email address, password (stored only as a one-way hash) | When you sign up with email |
| Name, email address and Google account ID | When you sign in with Google |
| Mobile number, and optionally WhatsApp number, alternate number, city and state | When you complete your profile or publish a listing |
| Listing details: event, ticket type, quantity, seats, original and selling price, notes, delivery method | When you list tickets |
| Which listings you unlocked, reports you send, alerts you turn on | When you use those features |
| Payment records: amount, date, purpose and Razorpay order and payment IDs | When you pay a fee |
| Security data: IP address with one-time code requests, login attempts, email delivery logs | Automatically, to protect accounts |
We do not collect card numbers, UPI PINs or bank details, and we do not use advertising or analytics trackers.
Sign in with Google
If you choose "Continue with Google", Google shares with us only your name, your email address, whether Google has verified that email, and a unique Google account identifier. We request only the basic openid, email and profile permissions. We do not access your Gmail, contacts, Drive, calendar or any other Google data, and we never see your Google password.
- We use this information only to create your SpareSeat account, sign you in, and link it to an existing SpareSeat account with the same email.
- We do not sell it, use it for advertising, or share it with anyone except as needed to run SpareSeat (see "Who can see your information").
- SpareSeat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- You can remove SpareSeat's access at any time from your Google Account settings (Security, Third-party connections). Your SpareSeat account remains until you ask us to delete it.
How we use information
- To run your account: sign-in, email verification, one-time codes and password resets.
- To publish listings and show Sellers' contact details to Buyers who pay to unlock them.
- To send service emails: codes, contact details you unlocked, listing receipts, "a buyer unlocked your contact" notices and ticket alerts you asked for.
- To process fees through Razorpay and keep records required by law.
- To prevent fraud, scalping and abuse, enforce our Terms, and respond to lawful requests.
We process your data on the basis of your consent, given when you sign up and use these features, and where needed to comply with law. We do not use it for marketing without asking you first.
Payments
Fees are processed by Razorpay Software Private Limited. Razorpay collects and processes your payment details under its own privacy policy and PCI-DSS standards. We receive only the payment status and reference IDs.
How long we keep data
- Account data: while your account is open, and deleted or anonymised within 30 days of an approved deletion request.
- Unlocked contact details: hidden from Buyers at the end of the day after the event.
- One-time codes: deleted after 7 days.
- Payment and tax records: kept for as long as Indian law requires (typically 8 years), even if you delete your account.
Security
The site is served only over HTTPS. Passwords are stored as salted scrypt hashes and one-time codes as keyed hashes that expire in minutes. Sessions use signed, HttpOnly, secure cookies; forms are protected against forgery; login and code requests are rate-limited; and payment results are verified with Razorpay before they count. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you and the authorities as the law requires.
Your rights and choices
Under the Digital Personal Data Protection Act, 2023 you may:
- access a summary of the personal data we hold about you;
- correct or update it (most of it you can edit yourself under My account, Profile);
- withdraw consent and ask us to delete your account and data, subject to records we must keep by law;
- nominate another person to exercise these rights if you die or become incapacitated; and
- raise a grievance with us, and if unresolved, with the Data Protection Board of India.
Write to from the email on your account. We respond within 30 days.
Children
SpareSeat is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
We may update this policy. The "last updated" date shows the latest version. If a change materially affects how we use your data, we will tell you by email or on the site before it takes effect.
Contact and grievances
Grievance Officer, SpareSeat. Email: . We acknowledge complaints within 24 hours and resolve them within 15 days.