Who we are
Utsivo is run by [company name, to be added before launch], [registered address, to be added before launch]. This policy explains what we collect, why, who sees it and how long we keep it, under India's Digital Personal Data Protection Act, 2023.
We never handle your money
Cash gifts go straight from a guest's UPI app to the family's UPI ID, and store gifts are bought on the store's own website. We never see card, bank or UPI PIN details, and we never hold money.
What we collect from families
- Your mobile number (to sign in) and your name. An email address only if you choose to add one.
- Your registry: names, occasion, events with dates, times and venues, gifts and store links, photos you upload.
- The UPI ID and the name your UPI app shows, for each side that takes cash gifts.
- A delivery address for store gifts, if you add one.
- Your guest list, if you make one: household names, phone numbers, expected people and tags.
What we collect from guests
- Your name, and if you choose to, a message, how you know the family and the amount you say you sent.
- For RSVPs: your household name, a phone number if you give one or the family asks for it, who is coming to which events, food and stay needs.
- For a friends' pool: your name, the amount and the reference. The organiser sees what you paid them.
- We don't ask guests to create an account. A small cookie in your browser lets you finish or change your own gift or reply.
Why we use it
- To run the registry you asked for: showing gifts, recording who gave what, RSVPs and invites.
- To keep it safe: sign-in codes, limits that stop misuse, and records of changes to payment details.
- We don't sell your data, show ads, or build profiles. We use it only with your consent or where the law allows (DPDP Act, section 7).
Who sees what
- The public registry page shows the names, occasion, gifts and the city of each event. The full venue only if the family turns it on, or after a guest replies yes to an RSVP when the family allows it.
- A UPI ID is shown only after a guest starts a cash gift. A delivery address is shown only to a guest buying a store gift who gives their name, and every time is recorded.
- The family sees the gifts, messages and RSVPs they received. Co-owners and helpers see only what their role allows.
Companies that process data for us
- Supabase: our database and sign-in, on servers in Mumbai, India.
- Vercel: hosts the website (pages are served from Mumbai).
- Meta (WhatsApp): sends your sign-in codes to your WhatsApp. Meta sees your number and the code, and may process them outside India.
- MSG91: sends sign-in codes by SMS in India, when WhatsApp can't be used.
- Cloudflare (Turnstile): checks that a guest form is filled in by a person, not a bot. It sees your browser and network, not what you type.
- Your browser's push service (Google for Chrome on Android, Apple for iPhone): carries phone alerts to devices where you turned them on. The alert text is encrypted so the service can't read it.
- Anthropic: when a family uses AI gift search, only the search words are sent (for example "air fryer under 6k"), never names or phone numbers. This may be processed outside India.
- Resend: sends emails, only to families who give an email address.
- Meta (WhatsApp), for invites: only if a family turns on automatic WhatsApp invites; then the guest's name, number and invite link go to WhatsApp.
- Stores such as Amazon.in and Flipkart: when you tap a link to a store you leave Utsivo, and the store's own privacy policy applies.
Cookies
We use cookies only to keep you signed in, to let a guest finish or change their own gift, pool payment or RSVP, and to recognise a browser a family has blocked from sending gifts (a random id we store only in a scrambled form). No advertising or tracking cookies.
How long we keep it
- Guests' phone numbers are removed 12 months after the registry's last event, and so are the records of who saw a delivery address.
- The family's gift book stays in their account until they delete it.
- When you delete your account, your personal data is deleted. A registry you shared with a co-owner stays with them; one you owned alone is deleted, and its link name is never given to anyone else.
Your rights
- See, correct or delete your data. Families can delete their account in Account → Delete account.
- Withdraw your consent at any time; it doesn't affect what was done before.
- Nominate someone to act for you if you can't.
- Complain to our Grievance Officer (see the Grievance page), and if you're not satisfied, to the Data Protection Board of India.
Children
Only adults (18 or older) can create an account. A registry for a child's birthday or ceremony is made by a parent or guardian; we don't use analytics on those pages, and the child's photo isn't shown in WhatsApp previews by default.
Changes
We'll tell families in the app before any important change. Last updated 1 November 2026.
Last updated 1 November 2026.