Privacy Policy

This policy applies to the Musical Mahaul website and services operated by Musical Mahaul. It covers artists booking performance slots, people buying tickets, and organisers running events. It does not cover what an organiser or venue does with your information after you attend or perform at their event — that is governed by their own privacy practices.

Information you give us

• Account details from Google sign-in: your name, email address and profile picture.
• Profile details you add: phone number, city, artist or act name, category, biography, photos and public social links.
• Booking and order details: the slots you request, the tickets you buy, quantities, promotional codes and the name and mobile number given for an order.
• Payout details if you are an artist or organiser receiving money through the platform.
• Anything you send to support — emails, messages and attachments.

Information we collect automatically

• Session information: a signed session cookie, the approximate IP address and the browser user-agent of each active sign-in, so you can see and revoke your own sessions.
• Usage and diagnostic logs: pages requested, timestamps and errors, used to keep the service working and to investigate abuse.
• Your selected city, stored in a cookie so the app opens on the right city next time.
• Your approximate location, only if you tap “Use my current location” and your browser grants permission. We use it once to pick the nearest city and do not store the coordinates.

• To create and secure your account, and to keep you signed in.
• To process slot bookings and ticket orders, issue confirmations and QR codes, and admit you at the venue.
• To let organisers contact confirmed artists about their event, and to show a confirmed artist’s public profile in the event line-up.
• To take payments, issue refunds and settle payouts.
• To send transactional messages — booking confirmations, reminders, cancellations and refund updates. These are part of the service and are not marketing.
• To prevent fraud, enforce booking limits and rate limits, and investigate abuse.
• To meet legal, accounting and tax obligations.

We do not sell personal data, and we do not share it with advertisers.

Payments are handled by our payment gateway partner. When you pay, you are taken to the gateway’s own secure checkout. Your full card number, CVV, UPI PIN and net-banking credentials are entered there and are never sent to, seen by, or stored on our servers.

What we receive back and store is the outcome: a transaction reference, the amount, the payment method type, the status and the timestamp. We need these to reconcile orders, issue refunds and keep accounting records.

Event organisers

For a confirmed slot booking: your artist name, category, public profile and the contact details you provided, so the organiser can run the event. For ticket orders: the buyer name, order code and ticket count for check-in.

Payment gateway

The order amount, order reference and the contact details needed to process the payment or refund.

Infrastructure providers

Hosting, database and email-delivery providers that process data on our instructions under contract.

Authorities

Where we are required by law, a court order or a valid regulatory request, or to protect the rights and safety of people at an event.

We use a small number of first-party cookies:

• mm_session — a signed, HTTP-only session cookie that keeps you logged in. Strictly necessary; the service cannot work without it.
• mm_city — remembers the city you selected. A convenience cookie you can clear at any time.

We do not use third-party advertising or cross-site tracking cookies.

• Account and profile data: for as long as your account is open, and for a short period afterwards in case you return.
• Booking, ticket and payment records: retained for the period required by Indian tax and accounting law, currently eight years from the end of the relevant financial year.
• Session records: until the session expires or you revoke it, and rolling sessions expire 30 days after last use.
• Diagnostic logs: a short rolling window, typically no more than 90 days.

• All traffic is served over HTTPS.
• Session tokens are stored only as a one-way hash — a stolen database row cannot be replayed as a login.
• Access to production data is limited to the people who need it to operate the service.
• Uploaded media is validated by file type and re-encoded before it is served.
• We rate-limit sensitive actions such as sign-in and check-in to slow down automated abuse.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority as the law requires.

• Access — ask for a copy of the personal data we hold about you.
• Correction — fix your name, phone number or artist profile yourself in Account settings, or ask us to correct anything else.
• Deletion — ask us to delete your account. We will do so unless we are required to keep specific transaction records for tax or legal reasons, in which case we keep only those records.
• Withdraw consent — revoke location permission in your browser, or clear the city cookie, at any time.
• Session control — see every active sign-in on your Account page and sign out of any of them.
• Complain — if you are unhappy with how we have handled your data, contact our grievance officer below.

To exercise any of these, write to [email protected] from the email address on your account. We respond within 30 days.

Musical Mahaul is not intended for people under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, tell us and we will remove it.

Our databases and uploaded media are hosted on servers located in India. Some service providers — for example email delivery — may process limited data outside India under contractual safeguards that require an equivalent standard of protection.

We will update this page when our practices change. The “last updated” date at the top always reflects the current version, and we will give notice in the app before a material change takes effect.

In line with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Consumer Protection (E-Commerce) Rules, 2020, you can reach our grievance officer at:

Organisation

Musical Mahaul

Email

[email protected]

Phone

9967444478

Response time

Acknowledged within 48 hours, resolved within 30 days

Details of how we handle complaints are on the Contact Us page.