Privacy Policy

Unifesto is operated by Unifesto Private Limited (CIN U63112TS2025PTC208307), C/O Malla Reddy Education, Sy. No. 640/P and 641/P, Quthbullapur Mandal, Hyderabad, Telangana 500100, India (“Unifesto”, “we”, “us”). This policy covers the Unifesto website, the Unifesto app for iOS and Android, and the Unifesto Space console (together, the “Services”).

For personal data you give us to use the Services, Unifesto is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). When you register for an event, the organiser of that event also receives your registration details and is responsible for how they use them (see section 5).

You give us

• Account: mobile number, email address (if you sign in with email, Google or Apple), name, username, gender, profile photo, bio and the social links you choose to add.
• Event registrations: the ticket you choose, the answers you give to an organiser’s questions (which can include files you upload), and the details of team members you register.
• Stays: for accommodation bookings, each guest’s name, phone, email, gender and a photo ID, plus arrival time and an emergency contact.
• Payments: payments are made through Razorpay. We receive the order and payment reference, amount and status. We never receive or store your card, UPI PIN or bank login details.
• Organisers: Space details, event content, team members, and the bank account you add for payouts.
• Participation: check-ins, hackathon teams and submissions, judging scores, help desk queries, live session participation, support requests, and messages you send to our WhatsApp business number.
• Unifesto Orbit: if you apply to or take part in our campus programme as an Orbit Lead: your college, course and year, your programme activity (clubs onboarded, events published, tier and rank), exam windows you declare, check-in notes, your acceptance of the Orbit Lead Programme Terms, and content you share with us for the programme. See section 11.
• Job and internship applications: what you send us when you apply, such as your CV, portfolio links, cover note and any task you submit, and our interview notes. See section 12.

Collected automatically

• Device and app: app version, platform, a push notification subscription ID and the time you were last active.
• Usage and crashes: in the app, Google Firebase records which screens are used and crash reports, to fix problems and improve the app.
• Page views: when an event or Space page is opened, we record an anonymous visitor ID, the platform and any campaign (UTM) tags on the link, so organisers can see where visitors came from.
• Location (optional): if you allow it, the app reads an approximate location while you use it and converts it to your city on your device. Only the city name is sent to us, to show nearby events. We do not collect precise or background location.

The app asks for the camera (to scan QR passes and take photos), microphone (to speak in live sessions), photo library and notifications only when you use a feature that needs them. You can change these permissions in your device settings at any time.

• To create and secure your account and sign you in, including one-time codes sent over WhatsApp.
• To register you for events, issue passes and tickets, check you in, and send confirmations, reminders and updates about events you joined.
• To process payments, refunds and payouts, and keep the records tax and accounting law requires.
• To run the features you use: stays, live sessions, hackathons, certificates and support.
• To show nearby and relevant events, and to keep the Services reliable, secure and free of fraud and abuse.
• To send product announcements and campaigns, which you can turn off in Notification settings.

We process your data on the basis of your consent, given when you sign up or use a feature, and for the legitimate uses the DPDP Act allows, such as performing a transaction you asked for or complying with the law. You can withdraw consent at any time (section 8); this does not affect processing already done.

Your public profile (name, username, photo, bio, social links, the Spaces you follow and the public events you are going to or have been to) can be seen by other Unifesto users. Your mobile number, email address and registration answers are never shown on your profile. Certificates you earn have a verification link that anyone with the link can open.

• Event organisers: when you register for an event, its organisers (the Space team and any co-hosting Space) receive your name, contact details, ticket, registration answers and check-in status, to run that event. For stays, the event team receives guest details and photo IDs.
• Sponsors: only if you let a sponsor scan your pass at their booth or send them an enquiry yourself.
• Hackathon judges and volunteers: your team, submission and help desk queries, for that hackathon.
• Service providers who process data for us under contract, listed below.
• Authorities, when the law requires it or to protect the rights and safety of users and the public.
• A successor, if Unifesto is merged or acquired, under the same protections.

We do not sell your personal data, and we do not share it with advertisers.

Our servers and database run on Amazon Web Services in India (Mumbai). Some providers above process data outside India; such transfers are made as permitted under the DPDP Act and under contracts that require them to protect it.

• All traffic to the Services is encrypted in transit (HTTPS/TLS).
• Uploaded files such as photo IDs and registration documents are kept in private storage and are available only to the people who need them for that event.
• Access inside organiser teams is limited by role, and Unifesto staff access is restricted and logged.
• Payments are handled by Razorpay, a PCI-DSS compliant payment processor.

If a personal data breach occurs, we will inform the Data Protection Board of India and affected users as the DPDP Act and Rules require.

• Your account: until you delete it. Deletion closes the account after a 30-day grace period and removes your personal details (see Delete your account).
• Payment, refund, payout and tax records: for as long as tax and accounting laws require, which can be up to eight years, with your name and contact details removed once your account is closed.
• Event records such as registrations, check-ins and stay bookings: kept as part of that event’s records. When your account is closed they are no longer linked to your name or contact details, but answers you gave to an organiser’s questions stay with that event. To have those erased too, write to privacy@unifesto.app.
• Server and security logs: kept for a limited period to keep the Services secure and investigate problems.
• Unifesto Orbit: while you are an Orbit Lead and for 24 months after your role ends, then deleted or anonymised. The record of each certificate we issued (your name, what it was for and when) is kept for as long as its public verification page is live.
• Club contacts collected by Orbit Leads: deleted within 6 months of collection if the person or club does not join Unifesto, or sooner if you ask.
• Job and internship applications: 12 months if you are not hired, then deleted. If you are hired, they become part of your internship or employment records.

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how it is processed;
• correct, complete or update it (most of it you can edit yourself in the app);
• have it erased, by deleting your account or writing to us;
• withdraw consent and turn off optional processing such as campaigns and location;
• nominate another person to exercise these rights if you die or become incapacitated;
• have your grievances addressed (section 10).

Use the Privacy Request Center or write to privacy@unifesto.app from the email or phone number on your account. We may verify your identity before acting; the Data Principal Rights Policy explains how we handle each request.

The Services are meant for people aged 18 and over. Anyone under 18 may use them only with the verifiable consent of a parent or lawful guardian. We do not knowingly track, profile or target advertising at children. If you believe a child has given us personal data without that consent, write to privacy@unifesto.app and we will delete it.

If you have a complaint about how your personal data is handled, contact our Grievance Officer, Vinay Buddolla, at grievance@unifesto.app. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

If you are not satisfied with our response, you may approach the Data Protection Board of India once it accepts complaints under the DPDP Act.

This section applies if you apply to, or take part in, Unifesto Orbit as an Orbit Lead, and to club members whose contact details an Orbit Lead collects.

Why we use Orbit Leads' data. To run the programme (your access to your campus Space, probation, check-ins and spot checks), to work out your tier and rank, to give recognition such as certificates, letters of recommendation and features, to keep a record of what you agreed to, and to keep the programme fair and prevent misuse. We process it on the basis of your consent, given when you apply and when you accept the Orbit Lead Programme Terms, and because you give it to us voluntarily for that purpose. If you withdraw consent, we stop processing your Orbit data, which will usually end your role.

Who sees it. Unifesto staff who run or support the programme, and our service providers acting on our instructions. Other Orbit Leads do not see your name or your metrics: each Orbit Lead sees only their own campus's tier, rank and club counts. We feature you publicly, for example on our website or social media, only if you agree to it separately, and you can withdraw that consent at any time.

Club contacts. Orbit Leads may collect the contact details of club and fest committee members (such as a name, phone number or email address) to help those clubs join Unifesto. Unifesto is the Data Fiduciary for this data, and Orbit Leads handle it only on our behalf and on our instructions: only with the person's consent, kept secure, and deleted or handed to us when their role ends. We use it only to contact you about bringing you or your club onto Unifesto. If you did not agree to be contacted, write to privacy@unifesto.app and we will stop contacting you and delete your details.

When you apply for a job or internship, usually by email to careers@unifesto.app, we use what you send us only to assess your application, contact you about it and, if you are selected, make you an offer. You give us this data voluntarily for that purpose. Only the Unifesto staff involved in hiring see it, along with our email and storage providers acting on our instructions. Task submissions are used only to assess your application, and never in our product unless you are hired and agree in writing. You can ask us to delete your application at any time by writing to careers@unifesto.app or privacy@unifesto.app.

We will update this policy when our practices change and show the new effective date at the top. For material changes we will tell you in the app or by email before they take effect.