Privacy Policy
Last updated: October 20, 2026
This policy explains how Crackerjack IT Solutions Private Limited ("Crackerjack", "we", "us"), which runs the website and app at www.crackerjack.live (the "Platform"), handles your personal data. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") we are the Data Fiduciary and you are the Data Principal.
1. Notice: what we collect and why
This is the notice we show you before you agree, on the sign-up screen. It is available in English and Hindi.
What we collect and why
- Name, email, phone number, username · To create your account, sign you in and contact you about your bookings.
- Profile: photo, bio, category, media you upload, your price · To show your profile to people looking to book or follow you.
- City, and your map location if you turn it on (artists) · To show you, or people near you, in search and on the map. The map never shows an exact spot.
- ID type and its last 4 characters (artists) · To check you are a real person before you can be booked and paid.
- Bookings, messages, tickets and payment records · To run your bookings, hold and release payments, refund, settle disputes and keep tax records.
- Bank account or UPI ID, GST number (artists and hosts) · To pay you out and withhold tax where the law requires.
- Device, IP address and activity logs · To keep the platform secure and working. Kept for at least 1 year, as the law requires.
- Usage analytics (only if you allow them) · To improve the app. Off unless you turn it on.
Withdraw consent any time: turn off analytics under Cookie preferences, or delete your account in Settings. It is as easy as giving it. Your rights: see, correct, download or erase your data in Settings, nominate someone to act for you, or complain to our Grievance Officer at admin@crackerjack.live. If we don't resolve it, you can complain to the Data Protection Board of India. We never sell your data.
2. The data in more detail
- Account: name, email, phone number, username and password (stored only as a hash). If you sign in with Google, we receive the name, email and photo you allow Google to share.
- Profile: photo, bio, category, posts, videos and other media you upload, your price, availability and city. Your public profile is visible to everyone, because that is how people find and book you.
- Identity check (artists): at sign-up you choose an ID type and type its number. The number's format is checked on our own servers and never sent to anyone else; we keep only the ID type and its last 4 characters. If an existing account applies to become an artist from Settings, we also take an ID photo and a selfie, which only you and the staff member reviewing them can see, and which are deleted 5 minutes after the decision.
- Location (artists, optional): your device's position, only if you turn on location in Settings. See section 3.
- Bookings and messages: event details, dates, venues, quotes, cancellations, disputes, and the messages and images you send other users.
- Payments: what you paid or were paid, refunds, and, for artists and hosts, the bank account or UPI ID you add for payouts and your GST number if you add one. Card details are collected by our payment processor (Razorpay), never by us.
- Tickets: your name, email, phone number and the tickets you bought. The event's host sees these so they can run their guest list.
- Technical: IP address, device and browser type, pages viewed, error reports, and push-notification tokens if you turn notifications on.
- Analytics: which features you use, only if you allow analytics (section 9).
We collect only what each purpose needs. We do not use your data for anything not listed in section 1 without asking you first.
3. Artist location
Location is off unless an artist turns it on, and an exact position is never shown to anyone browsing. The artist chooses how they appear: city only (the default), an approximate area (a pin moved 0.4 to 1.9 km from the real spot), an approximate distance (for example "~7 km away"), or exact, only for a confirmed booking, and then only to that one organiser. Precision is reduced on our servers before anything is sent to a phone. Turning location off deletes the stored position. Misusing an artist's location is banned under our Terms.
4. Automated checks and AI
Messages and attached images are checked automatically for phone numbers, emails and handles used to take a booking off the Platform, where it would lose payment protection. A clear contact detail can block the message and add a strike; a person reviews any strike you contest (section 7). No account is permanently restricted on an automated decision alone.
The in-app assistant, image checks, and reading the view count on a creator-reward screenshot use an AI provider, Groq, Inc. (United States). Only what is needed is sent, and Groq may not use it to train its models. You can avoid this by not using the assistant and not attaching images to messages.
5. Who we share it with
- Other users, as the Platform works: your public profile; booking details with the other side of the booking; ticket-holder details with that event's host.
- Data Processors that run parts of the Platform for us, under contract, only for that purpose: Supabase (database, storage, sign-in), Vercel (hosting), Razorpay (payments and payouts), Resend (email), Groq (AI, section 4), Daily (video calls), Cloudflare Turnstile (bot check at sign-in), OpenStreetMap Nominatim and Komoot Photon (turning a typed address into a map point), MapLibre/OpenStreetMap (maps), Google (only if you sign in with Google), Spotify (music search when a host adds music to an event) and Vercel Speed Insights (only if you allow analytics).
- Authorities, when the law requires it.
- A buyer of the business, if Crackerjack is merged or sold, under this same policy.
We never sell your data and never share it with advertisers.
6. Data stored outside India
Some processors above store or handle data outside India (for example Vercel, Resend and Groq in the United States). The DPDP Act allows this except to countries the Government of India restricts; we will stop any transfer to a country that is restricted.
7. Your rights and how to use them
Under the DPDP Act (sections 11 to 14) you can:
- See a summary of your data and who it was shared with: tap Download my data in Settings, or ask us.
- Correct, complete or update it: edit it in Settings, or ask us.
- Erase it: delete your account from Settings. Your profile, posts and media are deleted; what the law makes us keep is set out in section 8.
- Withdraw consent at any time, as easily as you gave it: switch analytics off under , unsubscribe from any marketing email with its link, or delete your account. Withdrawing doesn't affect what was done before, and we stop the processing, and make our processors stop, within a reasonable time.
- Nominate someone to use these rights for you if you die or become unable to. Email us their name and contact details from your account email.
- Raise a grievance with our Grievance Officer (section 12).
To identify you we may ask you to write from your account email. We acknowledge every request within 24 hours and resolve it within 15 days, well inside the 90 days the DPDP Rules allow. If you're not satisfied, you may complain to the Data Protection Board of India (details on the Ministry of Electronics and IT website). The Act asks you to come to us first.
8. How long we keep it
- Your account and profile: while your account is open. Deleting your account deletes your profile, photos, posts, media and ID-check files.
- Booking, payment, invoice, payout, tax, ticket, reward and dispute records: the law (tax and company law) requires us to keep these, so on deletion they move to a locked archive only authorised staff can open, and are deleted automatically after 8 years. Dispute evidence is deleted 6 years after the dispute closes.
- Security and activity logs: at least 1 year, as Rule 6 of the DPDP Rules requires, then deleted unless needed for an investigation.
- ID photo and selfie (become-an-artist applications): 5 minutes after the decision.
When a purpose is over and no law needs the data, we erase it.
9. Cookies
Until you choose, only necessary cookies run: keeping you signed in, remembering your cookie choice (cj_cookie_consent, up to 180 days), and the Cloudflare bot check. Analytics (which features are used, page speed) and marketing cookies are off until you switch them on in the cookie banner. Change your choice any time from or the link in the footer; it takes effect straight away. No third-party tracking script loads before you agree.
10. Security, and if something goes wrong
Data is encrypted in transit, passwords are hashed, access is limited to the staff who need it and is logged, and backups are kept. Our processors are bound by contract to the same standard. If a personal data breach happens, we will tell every affected user without delay (what happened, when, the likely effect on you, what we're doing, what you can do, and who to contact), tell the Data Protection Board straight away with a full report within 72 hours, and report it to CERT-In within 6 hours.
11. Children
Crackerjack is only for people aged 18 or over; everyone confirms this at sign-up. We don't knowingly hold data about anyone under 18, don't track or target ads at children, and close any account we find belongs to a minor and delete its data. We do not currently support minor artist profiles, including ones run by a parent, guardian or agency. Tell our Grievance Officer if you think a child has an account.
12. Grievance Officer and contact
Our Grievance Officer, who also answers any question about your personal data, is NIKHIL GUPTA: admin@crackerjack.live, +91-8757850115. Registered office: B-76, Dayanand Nagar, Lajpat Nagar IV, New Delhi 110024, India.
13. Changes to this policy
If we change what we collect or why, we'll tell you in the app or by email before it applies, and ask again where the law requires your consent. The date at the top shows the latest version.