Privacy Notice

1. Who we are

Surpriseflix (the “Service”, “we”, “us”) is operated by [CONFIRM LEGAL ENTITY NAME — e.g. sole proprietorship / registered company], with a registered address at [CONFIRM REGISTERED ADDRESS]. Under the DPDP Act, we act as the Data Fiduciary for the personal data described in this notice.

2. Scope

This notice covers personal data processed through the Surpriseflix website and app at https://surpriseflix.com, including account creation, building and sharing a personalized “Surprise” experience, payments, and support. It does not cover third-party websites we link to.

3. What personal data we collect

We only collect what the Service actually needs to function. In detail:

Account data (you, the creator)

• Email address and password (password is hashed by our authentication provider, Supabase Auth — we never see or store it in plain text).
• Full name and phone number, if you choose to provide them at signup or in account settings (phone is always optional; used only to reach you about your order if needed).
• Account creation date and last sign-in time.

Your “Surprise” content

• Photos and videos you upload, and any titles, descriptions, or tags you add to them.
• The Surprise’s title, description, custom URL (“slug”), and an optional password you set to restrict access to it.
• Viewer-profile names (e.g. “who’s watching”) you create for people you share the Surprise with, and an optional custom avatar photo.

A recipient’s email address (third-party data you provide)

When you share a Surprise, we require the recipient’s email address. We use it to (a) send them a notice before an inactive Surprise’s media is permanently deleted, and (b) let the recipient themselves pay to keep the Surprise active if the creator doesn’t renew it. Because this is someone else’s personal data provided by you, our share form asks you to confirm you have that person’s permission before we store it — see Section 6 (Consent) below.

Payment data

• Payment amount, currency, plan purchased, status, and identifiers issued by our payment processor (Razorpay) — order ID and payment ID. We never receive or store your card, UPI, or bank details — those are entered directly with Razorpay, a licensed Indian payment aggregator, and never pass through our servers.
• If someone other than the account owner pays to renew a Surprise on the owner’s behalf (a “guest renewal”, e.g. the recipient renewing it themselves), we collect that payer’s name and email to identify who made the payment.

Technical and log data

• Standard web server/CDN logs (IP address, browser user-agent, timestamps, requested URL) generated automatically by our hosting provider, Cloudflare, for security and reliability — not linked to a profile we build about you.
• A password-gate session cookie and your authentication session cookie (see Section 8 — Cookies).

What we do not collect

• No analytics, advertising, or tracking cookies/pixels of any kind (see Section 8).
• No CAPTCHA/bot-detection service that profiles you.
• No behavioral tracking, ad targeting, or sale of personal data to third parties, ever.

4. Why we process your data (purposes)

• To create and secure your account — email/password authentication, session management.
• To provide the Service — storing and displaying the Surprise you build, enforcing the password you set on it, enforcing your plan’s storage/video limits.
• To process payments — creating orders with Razorpay, verifying payment success, granting/extending access to your plan.
• To contact a Surprise’s recipient — a pre-deletion warning, and enabling them to renew the Surprise themselves (see Section 3).
• To operate customer support and respond to your requests — including the data-rights requests described in Section 9.
• To keep the Service secure and prevent abuse — e.g. ownership checks on every write, rate/quota limits.

We do not use your data for advertising, do not build behavioral profiles, and do not sell personal data to third parties.

5. What's necessary vs. optional

• Necessary to create an account: email, password.
• Optional at signup: full name, phone number.
• Necessary to build a Surprise: at least a title and one piece of media (the free preview lets you build with photos only, before paying).
• Optional: an access password on the Surprise, a custom viewer-profile avatar.
• Required specifically to share a Surprise: the recipient’s email address (see Section 3) — this is required for the sharing step itself, not for building/previewing the Surprise.
• Necessary to renew/extend access: payment details, handled entirely by Razorpay (not by us).

6. Consent and legal basis

Under the DPDP Act, we process personal data on the basis of your consent, given clearly and affirmatively:

• Account creation: when you sign up, you must actively check a box confirming you've read and agree to this Privacy Notice and our Terms of Service. This checkbox starts unticked — it is never pre-selected — and a record of that consent (with a timestamp and the notice version) is kept.
• Sharing a recipient's email: at the point you share a Surprise, you must separately check a box confirming you have that person's permission to share their email with us. This is also unticked by default and logged separately from your account consent.

You can withdraw the recipient-contact consent at any time from your Surprise's settings — doing so removes the stored recipient email and disables the pre-deletion warning and guest-renewal features for that Surprise. Withdrawing the account-creation consent is equivalent to no longer wanting an account with us — request this via Section 9 below.

7. How long we keep your data

8. Cookies and local storage

We use only what's strictly necessary to run the Service — no analytics, advertising, or tracking cookies of any kind exist on Surpriseflix today.

• Authentication cookies (set by Supabase Auth) — keep you signed in.
• A password-gate cookie (sf_unlock_{slug}) — remembers that you correctly entered a Surprise's password, for 7 days. It never identifies you personally.
• Local, on-device storage (browser localStorage) for small conveniences that never leave your device: caching a video's thumbnail frame so it loads instantly on repeat visits, and remembering whether you've dismissed a one-time popup. This data is never transmitted to us or any third party.

Because none of the above are optional/non-essential trackers, we haven't built a cookie consent banner — one would have nothing meaningful to ask permission for. If that changes (e.g. we ever add analytics), this notice and a consent mechanism will be updated first.

9. Your rights

Under the DPDP Act, as a Data Principal you have the right to:

• Access a summary of the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Erase your personal data, where it's no longer needed for the purpose it was collected for or you withdraw consent (subject to our legal retention obligations, e.g. payment records — see Section 7).
• Withdraw consent you previously gave, as easily as you gave it.
• Grievance redressal — raise a complaint about how we've handled your data.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, use our data-rights request form. If you submit a request while signed in, we can verify it's you automatically from your session. If you submit it signed out, we'll need to verify your identity manually before acting on it — see the form for details. We aim to respond within a reasonable time; some requests may take longer where verification or legal review is required.

Nominating someone, or acting on behalf of a deceased or incapacitated account holder: use the same request form — choose “Raise a grievance” and describe the nomination or the situation in the details field (e.g. who you are, your relationship to the account holder, and what you're asking us to do). We'll follow up to verify and handle it manually.

10. Who we share data with

We share personal data only with service providers who help us run Surpriseflix, under contracts that require them to protect it, and never for their own marketing purposes:

• Supabase — authentication and our application database.
• Cloudflare — hosting/compute (Cloudflare Workers) and object storage for photos/videos (Cloudflare R2).
• Razorpay — payment processing (a licensed Indian payment aggregator regulated by the RBI). We share your name/email and the amount/plan being purchased; Razorpay independently collects and handles your actual card/UPI/bank details.
• Resend — sends transactional emails on our behalf (password reset, pre-deletion warnings). Only the specific email content and recipient address needed for that message is shared.

We do not sell personal data, and we do not share it with advertisers or data brokers.

11. Cross-border data transfer

Some of our service providers (Section 10) operate infrastructure outside India. The DPDP Act permits transferring personal data outside India except to countries specifically restricted by the Central Government (no such restriction list affecting our providers is known to us as of this notice's date). [CONFIRM: exact data-residency regions/countries used by Supabase and Cloudflare for this project, and re-check against any updated Government restriction list before relying on this section].

12. Security measures

We apply reasonable technical and organizational measures appropriate to the data we hold, including:

• Passwords hashed (never stored in plain text) by our authentication provider.
• Database-level access rules (row-level security) so one user's data cannot be read or altered by another.
• All traffic encrypted in transit (HTTPS, enforced via HTTP Strict Transport Security).
• Security-hardening HTTP headers (clickjacking, MIME-sniffing, and referrer protections).
• Least-privilege service credentials — administrative database access is limited to trusted server-side code, never exposed to your browser.

No system is 100% secure. See BREACH_RUNBOOK.md in our engineering repository for how we'd respond to and notify you of a personal data breach, should one occur.

13. Children's data

You must be 18 or older to create a Surpriseflix account — you confirm this with a dedicated, unticked checkbox at signup (“I am 18 years of age or older”), separate from agreeing to this notice and our Terms.

14. Automated decision-making

We do not use your personal data for any automated decision-making that produces legal or similarly significant effects on you.

15. Changes to this notice

We'll update the “Last updated” date and version number above whenever this notice changes, and keep a record of which version you consented to (Section 6). Material changes will be highlighted; continuing to use the Service after a change means you accept the updated notice, without prejudice to your right to withdraw consent at any time.

16. Grievance Officer / Contact

For any question about this notice, or to raise a grievance, contact our Grievance Officer:

• Name: [CONFIRM GRIEVANCE OFFICER NAME]
• Email: [CONFIRM GRIEVANCE CONTACT EMAIL]
• Address: [CONFIRM REGISTERED ADDRESS]

You can also submit a request through our data-rights request form. If you're not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India under the DPDP Act.

17. Governing law

This notice is governed by the laws of India, including the Digital Personal Data Protection Act, 2023.