Legal
Privacy Policy
Last updated 27 October 2026
This policy explains how [Company legal name] ("Wakebooked", "we") handles personal data.
Two roles
- Our customers (hosts) and visitors to our website: we decide how this data is used (we are the "controller", and a "data fiduciary" under India's Digital Personal Data Protection Act, 2023). This policy applies.
- People who register for a host's webinar (attendees): the host decides how their data is used; we process it on the host's behalf under our Data Processing Addendum. Every registration page links to the host's own privacy policy. Please contact the host first; we will help them answer your request.
What we collect about hosts and site visitors
- Account data: name, email, password (stored as a secure hash by our authentication provider) or sign-in links, business name, and business postal address.
- Billing data: handled by Razorpay; we receive plan, payment status and limited card details (such as the last four digits).
- Usage data: pages used, settings changed, error logs, device and browser type.
- Communications: support emails and call notes.
What we process for hosts (attendee data)
Name, email, optional phone number, chosen showing time and time zone, viewing progress (minutes watched, whether the offer was reached or clicked), private questions, consent choices, and a one-way hash of the IP address used to prevent abuse.
Why we use it
- To provide the Service, accounts and support (contract).
- For billing and tax records (legal obligation).
- For security, abuse prevention and debugging (legitimate interests).
- To send product emails about your account (contract / legitimate interests).
- To send marketing emails, where you consented or where the law allows; you can unsubscribe at any time.
We do not sell personal data or share it for cross-context behavioural advertising.
Who we share it with
Service providers listed on our Subprocessors page (hosting, database, email, payments), professional advisers, and authorities when the law requires. Each provider is bound by contract to protect the data.
International transfers
We are based in India and use providers in the United States, the European Union and elsewhere. Where GDPR or UK GDPR applies, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.
Retention
Account data: while your account is open and up to 60 days after closure. Billing records: as tax law requires (typically 8 years in India). Security logs: 12 months. Attendee data: as the host instructs, and deleted within 60 days after the host's account closes.
Security
Encryption in transit (TLS) and at rest (by our database provider), strict separation between customers' data, least-privilege keys and logged access. If a personal-data breach occurs we will notify affected people and the authorities as the law requires.
Your rights
Depending on where you live you may have rights to access, correct, delete or port your data, to object or restrict processing, to withdraw consent, and to complain to a data-protection authority (in India, the Data Protection Board of India). Email privacy@example.com; we reply within 30 days.
Children
The Service is not directed to children, and we do not knowingly collect children's data.
Cookies and local storage
Our dashboard uses essential storage to keep you signed in. Attendee pages do not use advertising cookies. Fonts may be loaded from Google Fonts. Hosts who add their own tracking scripts are responsible for any consent those require.
Grievance officer (India)
[Grievance officer name] — privacy@example.com
Changes
We will post updates here and notify account holders of material changes.