Privacy notice

• Digital Personal Data Protection Act, 2023.
• Information Technology Act, 2000.
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Where those laws give you rights, this notice tells you how to use them.

• Account details: name, email address, WhatsApp number and neighbourhood.
• Membership and activity: the credits and plans you buy, your credit balance and its history, bookings, waiting-list places and attendance.
• Consent and support records: which versions of the terms, this notice and the WhatsApp consent you accepted, when you accepted them, and messages you send us.
• Payment records: only what is needed to match a payment to your account. Circl order and transaction references, bounded PayU and bank references, amount, currency, payment method category, payment, refund and dispute status, and timestamps.
• Never card numbers, UPI details, PINs, OTPs or bank-login credentials. PayU and the payment network handle those, not us.
• Interest and host applications: if you fill in the interest form or apply to host, the details you give, what you are interested in, and where the link you used came from.
• Photographs and video: images and recordings made at sessions, which may include you. We tell you when a session is being recorded, and section 7 explains how to ask not to appear or to be taken down.
• Technical data: the pages you visit, without query strings, and security signals used to stop automated abuse. Web logs are kept for up to 30 days.

• To create and secure your account.
• To sell, activate and keep track of credits and plans.
• To run bookings, waiting lists and attendance.
• To verify and reconcile payments, and handle refunds, reversals and disputes.
• To answer your messages.
• To prevent abuse and keep members safe.
• To show what Circl evenings are like, using photographs and video from sessions in our own marketing.
• To keep the records the law requires.

• We do not sell personal data.
• We do not use the consent you give for transactional messages to send advertising.

• Essential account and security email, such as sign-in links and receipts, is always sent.
• Transactional WhatsApp messages about your bookings are sent only if you recorded that consent. You can withdraw it from your profile at any time without closing your account.
• Marketing about evenings and offers is sent only if you opted in, and every message tells you how to stop.
• Withdrawing consent does not affect anything done before you withdrew it.

Service providers, by category

• Cloud hosting and database.
• Payment processing: PayU.
• Email delivery.
• Website analytics: Google Analytics, counting page visits with query strings removed, so sign-in links and payment references are never sent to it.
• Abuse prevention.
• Providers act under their own service and security terms, and some process data outside India. The current list of providers is available from hello@thecircl.in on request.

What goes where

• To PayU, when you pay: your name, email, phone number, the order references, a description of the plan, the amount and currency, and secure return addresses. Nothing else.
• To a host: the first names and attendance of members booked on the session they are running. Nothing else.
• To anyone who sees them, when we publish: photographs and video from sessions, on Circl’s own social channels and website. Nothing else about you goes with them, and we never sell or licence images.
• To authorities: only when the law requires it.

• Unconfirmed, unused signups: removed after 72 hours.
• Account, credit, booking, attendance and support records: up to 24 months after your account closes or your last plan ends.
• Payment records: up to 24 months, and up to 36 months where a refund, dispute, fraud review or tax obligation still needs them.
• Interest and host applications: up to 24 months from your last contact with us.
• Web logs and backups: 30 days. A backup is not restored into active use after a verified deletion request.
• These are the points at which we delete or anonymise, unless a live issue or a legal obligation still needs the record. Anything kept longer is limited to what that purpose requires.

You can do these yourself

• Correct your name, phone number, neighbourhood and WhatsApp choice from your profile.
• Change your email, through a secure verification flow.

Write to hello@thecircl.in from the email on your account to

• Ask for a copy of your personal data.
• Ask us to correct or delete it.
• Withdraw consent.
• Close your account.
• Sign out of every device.
• Ask not to appear in photographs or video, or ask us to take down something already published.

• We acknowledge requests within two business days and normally complete verified requests within 30 days.
• Security, safety, dispute or legal records that must be kept are restricted rather than deleted, and we tell you if that applies.

• Circl does not offer a self-service account to anyone under 18 and does not knowingly collect a child’s personal data.
• A parent or lawful guardian who wants a managed account must write to hello@thecircl.in before signing up.
• If we learn a child has signed up without that, we remove the account.

• Secure cookies and short-lived sign-in tokens.
• Database access controls that keep one member’s data out of another’s reach.
• Abuse checks at signup.
• Only the people who need it to run the club can see member data.
• Do not share sign-in codes or recovery links.
• No system is perfectly secure. If you think your account has been compromised, tell us straight away.

• Grievance officer: Nakshat Gupta.
• Email: hello@thecircl.in.
• Post: Golcircl Experiences Pvt Ltd, 36, FV Road, Upper Kharadi, Pune 412207, Maharashtra, India.
• We acknowledge privacy complaints within 48 hours and aim to resolve them within 30 days.
• If you are not satisfied, you may approach the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

• We may update it. Each version carries a date and a version code, shown at the top of this page.
• If a change is material, we will tell you and, where the law requires it, ask for your consent again.