UpahaarBox is a gift registry. Hosts list the gifts they would like; guests pick one and buy it from Amazon.in or Flipkart. We do not sell anything, take payments or ship anything, and we ask for as little personal data as the product can work with. This policy explains exactly what we hold, why, and what you can ask us to do with it.
What we collect
Only three kinds of data: what Google gives us when you sign in, what you type into a registry, and a small amount of technical data needed to keep your session secure.
From Google sign-in: your name, your verified email address, your profile photo URL, and the account identifier Google uses for you. Google sign-in is the only way to create an account, so there is no password for us to store and we never ask for your phone number.
Registry content: the occasion, event and reveal dates, city, your note to guests, the product links you add, and the email addresses you enter when inviting people.
Activity needed for the product to work: which gift you reserved, any private message you send the host, and whether you accepted or declined an invite.
Technical data: two session cookies, your IP address and browser user-agent recorded against a sign-in session, and standard server logs.
Why we use it
We use your data to run the registry and for nothing else. Specifically: to identify you when you sign in, to show your name and photo to people in the same registry, to stop two guests buying the same gift, to match an invite to the right person, to send you the notifications you have not turned off, and to keep accounts secure.
We do not build advertising profiles, we do not run ad networks on the site, and we do not sell or rent your data to anybody.
Email addresses of people you invite
When you invite someone to a registry, we store the address you entered so the invite can be matched to them when they sign in with Google. If they never sign in, that address sits unused against the invite and is deleted when the registry is deleted, or earlier if you revoke the invite. By sending an invite you confirm the person is happy to hear from you. If you were invited and want your address removed, email privacy@upahaarbox.in — you do not need an account, and we will delete it.
Please only invite people you actually know. Using UpahaarBox to send invites to strangers is not allowed under our Terms.
What other people can see
Registry visibility is controlled by the host. A registry is reachable by anyone holding its link unless the host restricts it. Within a registry, other members see your name and profile photo.
Hosts deliberately cannot see which gifts have been reserved or bought, or by whom, until the reveal date they set. Guests can see that an item is taken, but not who took it. Any private message you write to the host is shown to the host only, and only after reveal.
Cookies and sessions
We set two cookies, both strictly necessary and neither used for tracking or advertising: ub_access, a short-lived token that proves you are signed in, and ub_refresh, which keeps you signed in without asking you to sign in again. Both are HttpOnly, so no script on the page can read them.
Google may set its own cookies while its sign-in screen is open. Those are governed by Google’s privacy policy, not ours.
Affiliate links and the stores
Gift links in a registry carry our affiliate tag. When you click through to Amazon.in or Flipkart you leave UpahaarBox, and from that point the store’s own privacy policy applies to your visit, your purchase and any cookies they set.
The stores report purchases to us in aggregate for commission purposes. We do not receive your delivery address, your card details or your order contents. We never see your payment information at all, because payment happens entirely on the store.
Who we share data with
We share data only with service providers who help us run the product, under contract and only for that purpose. That means our cloud hosting and database provider, Google for sign-in, our transactional email provider for notifications, and the affiliate programmes of Amazon.in and Flipkart for click and commission reporting.
We may also disclose data if the law requires it, or to protect the safety and rights of our users. If our business is ever transferred, we will tell users before their data moves.
How long we keep it
A registry auto-archives 60 days after its event date and stays readable as a keepsake until the host deletes it. Deleting a registry removes its items, invites and reservation records.
Your account and its data stay with us until you ask us to delete them. Sign-in session records are pruned automatically once expired, and server logs are kept for 30 days. Your data is stored and processed in India, on Google Cloud infrastructure in the Mumbai region.
Your rights
Under the Digital Personal Data Protection Act 2023, you can ask us to do the following, free of charge, by emailing privacy@upahaarbox.in.
See your data: a copy of what we hold about you and who we shared it with.
Correct it: fix anything wrong. Your name and photo come from Google, so changing them there updates them here on your next sign-in.
Delete it: close your account and remove your data. Where a registry you took part in still exists, we remove your identity from it rather than breaking the host’s records.
Withdraw consent: turn off email notifications in your profile at any time, or withdraw consent entirely by deleting your account.
Nominate someone: name a person to exercise these rights on your behalf if you are unable to.
Security
Data is encrypted in transit and at rest. Session cookies are HttpOnly and scoped to our domain, refresh tokens are stored hashed rather than in the clear, and access is limited to the people who need it to operate the service. No system is perfect; if a breach ever affects your data we will notify you and the Data Protection Board as required.
Children
UpahaarBox is not for children. You must be 18 or older to create an account. A registry may of course be for a child’s event — a naming ceremony or a first birthday — but the account holder is always an adult, and we do not knowingly collect data from anyone under 18. Please do not put a child’s full name, date of birth, address or photograph into a registry — an occasion and a first name are enough.
Changes to this policy
If we change this policy we will update the date at the top and, for anything material, tell signed-in users by email or in the app before it takes effect.
Contact us
Questions about this policy, or a request about your data:
Email privacy@upahaarbox.in
Grievance Officer Dhruv Sharma, reachable at the email above
Entity Dhruv Sharma, sole proprietor · India
We respond to data requests within 30 days. For complaints, our Grievance Officer acknowledges within 24 hours and resolves within 15 days, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 require. If you are not satisfied, you may escalate to the Data Protection Board of India.