Privacy Policy

1. Introduction & scope

This Privacy Policy explains how Snapajoy processes personal data in connection with the photobook ordering service offered via WhatsApp and the associated web editor at this domain. It is framed to align with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as applicable to us as a "Data Fiduciary" processing your personal data (as a "Data Principal").

By placing an order, sending photos, or using the web editor, you acknowledge that you have read and understood this Policy and consent to the processing described here. If you do not agree, please do not use the service.

2. What we collect

When you use Snapajoy via WhatsApp and the web editor, we collect the following categories of personal data, limited to what is necessary to process your order:

• Your WhatsApp phone number (used for order communication, order identification, and OTP-based verification)
• Photos you send for your album (used solely to generate and print your photobook)
• Album preferences such as size, finish, theme, cover style, and layout choices
• Delivery address and recipient name/contact number provided during checkout
• Payment confirmation details from our payment processor, Razorpay (we do not receive or store your card, UPI, or bank credentials)
• Basic technical data (such as IP address and device/browser type) generated automatically when you use the web editor, for security and fraud-prevention purposes

3. How and why we use your data (purpose limitation)

We process your personal data only for the specific purposes for which it was collected, and no further:

• Photos are uploaded to secure cloud storage to generate your album layout and enable web-based preview and editing
• Your phone number is used to send order updates and OTP codes for secure, passwordless access to your web editor link
• Album layout data is stored to allow you to preview, edit, and approve your photobook before it is sent to print
• Delivery details are shared only with our printing and courier partners strictly to ship your order
• Payment data is used solely to confirm and reconcile your order

We do not use your photos or personal data to train machine-learning models, for behavioural advertising, or for any purpose beyond fulfilling and supporting your order, except where you separately and explicitly consent.

4. Legal basis and consent

We process your personal data on the basis of your consent, given when you initiate an order on WhatsApp and voluntarily share your photos, preferences, and delivery details, and (where applicable) for the performance of the contract created once you place a paid order. You may withdraw consent at any time by contacting us (see Section 12), though this may mean we are unable to complete an order already in progress.

5. Who can see your photos

Your photos are private. Access is restricted to:

• You, via the OTP-protected web editor link sent to your WhatsApp
• Our printing partner, solely for the purpose of producing your photobook
• Snapajoy support staff, only where necessary to assist with your specific order

We do not sell, rent, or trade your photos or personal data to any third party for their own marketing or commercial purposes.

6. Data storage, security & cross-border transfer

Your photos and order data are stored using industry-standard cloud infrastructure, hosted in Amazon Web Services (AWS) data centres located in India:

• Data is stored on AWS with server-side encryption at rest
• Photos are delivered to the web editor via a signed-URL content delivery network
• Access to stored data requires authentication (OTP-issued token)
• All data transmission between your device and our servers uses HTTPS/TLS encryption

We take reasonable technical and organisational security safeguards appropriate to the nature of the data to prevent unauthorised access, alteration, disclosure, or destruction, as required under the DPDP Act and the SPDI Rules, 2011. No method of electronic storage or transmission is 100% secure, and while we work to protect your personal data, we cannot guarantee absolute security.

Where any personal data is processed by a sub-processor located outside India (for example, a global service provider's support infrastructure), we take reasonable steps to ensure an equivalent level of protection is maintained, consistent with applicable law.

7. Data sharing with third parties

We share limited personal data with trusted third-party processors, only as needed to fulfil your order, and under obligations of confidentiality:

• Amazon Web Services (AWS) — cloud storage and content delivery for your photos and order data
• Razorpay — payment processing (we do not store your card or bank details)
• AWS SNS — OTP delivery via SMS
• Gupshup — WhatsApp Business API platform used for chat communication
• Printing & courier partners — to produce and deliver your photobook

We may also disclose personal data where required to comply with a legal obligation, a valid order from a court or government authority, or to protect the rights, property, or safety of Snapajoy, our users, or the public, as permitted under applicable law.

No third party receives your photos for any purpose other than fulfilling your order.

8. Cookies and tracking

The Snapajoy web editor uses minimal cookies:

• An HTTP-only authentication cookie (session token) to keep you logged in during your editing session
• No advertising cookies or third-party ad-trackers are used
• No analytics cookies that identify you personally

See our Cookie Notice for more details.

9. Data retention & erasure

Consistent with the DPDP Act's storage-limitation principle, we retain personal data only for as long as necessary for the purpose it was collected, or as required by law:

• Photos and album layout data are retained for up to 90 days after order fulfilment, solely to support reprints or order-related help
• After 90 days (or earlier on request), photos are permanently and irreversibly deleted from our servers
• Basic order records (excluding photos) may be retained for up to the period required under applicable accounting, tax, and consumer-protection law
• You may request earlier deletion at any time by contacting us (Section 12)

10. Photo storage & deletion lifecycle

Here is how the lifecycle of your photos works, in practice:

• Photos are uploaded to secure storage when you send them via WhatsApp or upload them in the web editor
• They are made available on the web editor via secure, signed links for preview and editing
• Once your order is printed and delivered, photos remain available for up to 90 days in case you need a reprint or support
• After 90 days, all photos associated with your order are permanently deleted
• Deletion is irreversible — we cannot recover photos once removed, so please keep your own backup copies

If you want your photos deleted sooner, contact us and we will process your request within 30 days, or such shorter period as required by applicable law.

11. Your rights as a Data Principal

Subject to applicable law, you have the right to:

• Obtain a summary of the personal data we hold about you and the processing activities carried out on it
• Request correction, completion, or updating of your personal data
• Request erasure of your personal data, unless we are required to retain it for a legal purpose
• Withdraw your consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
• File a grievance with us, and if unsatisfied with our response, approach the Data Protection Board of India or other competent authority

To exercise any of these rights, contact us using the details in Section 12. We will respond within a reasonable time and, in any event, within any timeline prescribed by applicable law.

12. Grievance redressal & contact

For any privacy-related question, consent withdrawal, or grievance, please contact our Grievance Officer:

• Email: hello@snapajoy.in
• WhatsApp: via the number you used to place your order

We aim to acknowledge grievances promptly and resolve them within 30 days, or such other period as prescribed under applicable law.

13. Children's privacy

Snapajoy's services are intended for use by adults capable of entering into a binding contract under Indian law and are not directed at children. In line with the DPDP Act's treatment of individuals under 18 as children, we do not knowingly collect personal data from children, and we do not track, monitor behaviourally, or serve targeted advertising to children. If we become aware that we have inadvertently collected a child's personal data without verifiable parental/guardian consent, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

14. Third-party links & services

Our WhatsApp chat, web editor, and payment flow may link to or rely on third-party platforms (for example, WhatsApp/Gupshup, Razorpay, courier tracking pages). We are not responsible for the privacy practices or content of third-party platforms, and we encourage you to review their respective privacy policies.

15. Limitation of liability

While we implement reasonable security safeguards as described above, to the maximum extent permitted by applicable law, Snapajoy shall not be liable for any indirect, incidental, or consequential loss arising from unauthorised access to, or disclosure, alteration, or loss of, personal data caused by circumstances beyond our reasonable control, including but not limited to a breach or failure of a third-party service provider, force majeure events, or any unlawful act by a third party. Nothing in this Policy limits any liability that cannot be excluded or limited under applicable law.

16. Governing law & jurisdiction

This Policy is governed by the laws of India. Subject to Section 11 above (your right to approach the Data Protection Board of India), the courts of competent jurisdiction in India shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. Material changes will be posted on this page with an updated effective date, and, where required by law, notified to you directly. Continued use of Snapajoy after such changes constitutes your acknowledgement of the revised Policy.

Effective date / last updated: August 2026.

18. Contact us

For any questions about this Policy or your personal data, reach out via our Contact page, email hello@snapajoy.in, or message us on WhatsApp.