Privacy policy

• We collect only what we need to run your invitations, and we tell you exactly what and why below.
• We ask for your consent with a box you tick yourself, and we record which version of this policy you agreed to.
• We never sell personal data, and we never show ads to your guests.
• Guests' details are used only for the event they were added to.
• Photos are stored privately, and location data is removed from them.
• You can see, correct, download or delete your data at any time. A deleted account can be restored for 30 days, then it is erased.

This summary is not the whole policy. The sections below give the details.

Bulava (bulava.in) is a service for digital invitations, RSVPs and event photo sharing. In this policy, "Bulava", "we" and "us" mean the business that runs it, and "you" means anyone who uses it: hosts who create events, the team members they invite, and guests who receive invitations.

We process personal data under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP Act"), and the Information Technology Act, 2000 with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Under the DPDP Act, you are the "Data Principal" and we are the "Data Fiduciary" for your account and for how the service works. When a host adds guests, the host decides whose details to add and why, and we use those details only to deliver that host's event.

When you create an account

Your name, email address and password. The password is "sensitive personal data" under the IT Rules: we store it only as a secure one-way hash that nobody can read. If you sign in with Google, we receive your name, email address and a Google account ID, never your Google password. You may add a phone number.

When you plan an event

What you enter: event and function details, venues and dates, your guest list (names and, if you add them, phone numbers, email addresses, households and notes), RSVP questions, travel, stay and seating details, photos, music choices and messages to guests.

When you are a guest

The details your host entered about you, your RSVP and answers, any travel details you add, photos you upload to the event album, and whether you opened your invitation. If an invitation asks you to confirm a one-time code, we send it to the email address or phone number your host gave us.

When you register for a public event

The details you type into the registration form, and your agreement to share them with the host.

When you pay

The plan you bought, the amount, your agreement to the purchase terms, and the order and payment references from Razorpay. Card, UPI and bank details are financial information, which is sensitive personal data: you enter them only on Razorpay's secure checkout, and we never see or store them.

When you contact us

Your name, email address, phone number if you give it, your message and our replies.

Automatically

Your IP address, browser and device type, and the pages and actions you use, which we need for security, to stop abuse and to understand how Bulava is used. Our cookie policy explains the cookies involved.

We use personal data only for these specified purposes:

• To provide the service you asked for: create events, deliver invitations by link, email or WhatsApp, collect RSVPs, run photo albums and check-in, and send the reminders and updates a host schedules. Basis: your consent.
• To create and protect your account, including sign-in, two-step verification and spotting misuse. Basis: your consent, and our duty to keep data secure.
• To take payments and make refunds, and to keep the records tax law requires. Basis: your consent to the purchase, and compliance with law.
• To answer your messages and support requests. Basis: you gave us the data for that purpose (a "legitimate use" under section 7 of the DPDP Act).
• To improve Bulava, using combined statistics wherever possible. Basis: your consent.
• To meet legal obligations, such as tax records, and to answer lawful requests from courts and authorities. Basis: compliance with law.

We don't sell personal data, build advertising profiles from it, or show ads to guests. We never use a guest's details to market Bulava to that guest. We don't use your data for any new purpose without telling you and, where the law requires it, asking again.

We ask for consent clearly and separately: when you create an account you tick a box to accept our Terms of Service and this Privacy Policy, and when you buy a plan you tick a box to accept the Terms and the Refund and Cancellation Policy. These boxes are never ticked for you. We record each consent with its date and the version of the policy you saw.

You can withdraw your consent at any time, as easily as you gave it: delete your account from Account settings, or write to support@bulava.in. Withdrawing consent doesn't affect anything done before, and we then stop processing your data, except what the law requires us to keep (see "How long we keep it"). Withdrawing may mean we can no longer provide the service.

Once Consent Managers registered with the Data Protection Board of India are available, you may also give, manage and withdraw your consent through one of them.

When you add guests, you share their details with us. Please add only people you are really inviting, add only the details needed to invite them, and remove anyone who asks. Send invitations by WhatsApp or email only to people who would expect to hear from you.

If you are a guest and want your details changed or removed, ask your host, or write to support@bulava.in and we will help.

Bulava accounts are only for adults aged 18 or over. We don't knowingly create accounts for children.

A host may add a child's name to a guest list, for example for a family function. Do so only as, or with the verifiable consent of, the child's parent or lawful guardian. We use a child's details only to deliver that invitation. We never track or monitor the behaviour of children, and never show them targeted advertising.

We share personal data only with the people and services needed to run Bulava:

• The host and their team. A guest's RSVP, answers, travel details and uploaded photos are visible to the host and to the team members the host adds, according to each member's role.
• Other guests, but only what the host chooses to show, such as approved photos in the album or on the live photo wall.
• Data Processors that work for us under written contracts and may use the data only on our instructions: cloud hosting, file storage (Cloudflare), email delivery, WhatsApp messages (Meta's WhatsApp Business Platform), payments (Razorpay), sign-in with Google, maps on invitations (Google Maps), error monitoring, and analytics on our public website.
• Authorities, when the law requires it, for example an order of a court or a lawful request from an authorised government agency.
• A buyer or successor, if Bulava is sold or merged, who must protect the data as this policy does.

You can ask us for the list of the Data Processors and other Data Fiduciaries we have shared your data with. We never sell or rent personal data.

Bulava runs on servers operated by our hosting providers. Some of them, including our file storage, may keep data in data centres outside India.

We transfer personal data outside India only to countries the Government of India has not restricted under section 16 of the DPDP Act, and only to providers bound to protect it as this policy requires.

We keep personal data only as long as it is needed for the purpose you gave it for, or as the law requires, and then erase it.

• Your account: until you delete it. You then have 30 days to change your mind and restore it by signing in. After 30 days we erase your name, contact details and sign-in methods for good. Our account deletion policy explains each step.
• Events, guest lists, RSVPs, photos and videos: until the host deletes them or their account. A deleted event is erased permanently, with its photos and videos, 30 days later.
• Payment and invoice records: as long as tax and accounting laws require, currently up to eight years, kept without your contact details once your account is erased.
• Records of your consent: for as long as we need to show what you agreed to.
• Messages to support: up to two years after the conversation ends. Spam is deleted within 30 days.
• Security and access logs: at least one year, as the DPDP Rules require, to detect and investigate misuse.

Deleted data also disappears from our encrypted backups as they are replaced over the following weeks.

We follow reasonable security practices and procedures, as the IT Act and the DPDP Act require:

• Every connection to Bulava is encrypted (HTTPS), and sensitive values such as sign-in secrets are encrypted at rest.
• Passwords are stored only as salted hashes. Invitation links use long random keys that hosts can revoke or replace.
• Photos and videos are stored privately and shown only through short-lived links after a permission check. Location and camera details are removed from photos when they are uploaded.
• Payment details never reach our servers; payments are handled by Razorpay, a PCI-DSS compliant payment gateway.
• Staff access is limited by role and needs two-step sign-in. Access and security events are logged and reviewed, and we keep backups to restore data if something goes wrong.

No system is perfectly secure, and you help by keeping your password private.

If a breach affects your personal data, we will tell you without delay: what happened, what it may mean for you, what we are doing about it, and what you can do to protect yourself.

We will also report it to the Data Protection Board of India, with a detailed report within 72 hours of becoming aware of it, as the DPDP Rules require, and to CERT-In where the law requires.

Under the DPDP Act you have the right to:

• access information: a summary of your personal data we process and how, and who we have shared it with;
• correction, completion, updating and erasure of your personal data;
• grievance redressal: a quick and fair answer to complaints about how we handle your data;
• nominate someone to use these rights for you if you die or become unable to;
• withdraw consent at any time (see "Your consent").

Much of this you can do yourself: edit your profile and events, download your data, or delete your account from Account settings. For anything else, write to support@bulava.in with "Privacy" in the subject, or use our contact form. We may ask you to confirm who you are, and we answer within 30 days, usually much sooner.

You also have duties under section 15 of the Act: give accurate information, don't impersonate anyone, and don't file false or frivolous complaints.

If you have a concern about how we handle your personal data, please contact our Grievance Officer first. Our grievance redressal page explains how and how quickly we respond.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India, as provided under the DPDP Act.

We use a few cookies to keep you signed in and to make invitations work and, on our public website only, analytics. Our cookie policy lists them all.

When we change this policy, we update the date at the top of this page. If a change is significant, we tell account holders by email or in the app before it takes effect, and where the law requires it we ask for your consent again.

For anything about your privacy, write to support@bulava.in with "Privacy" in the subject, or use our contact form and choose "Privacy and my data".

Grievance Officer: Aman Pratap Singh, reachable at support@bulava.in.

We acknowledge grievances within 24 hours and resolve them within 15 days.