LEGAL

Privacy Policy

Last updated: September 10, 2026

This Privacy Policy explains how Crackerjack IT Solutions Private Limited("Crackerjack", "we", "us", "our"), operating the booking platform and mobile application at www.crackerjack.live (the "Platform"), collects, uses, discloses, and protects personal data belonging to artists, managers/agencies, event organizers, and other visitors ("you", "users"). It is written to comply with India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025, and, for users in the European Economic Area and UK, the General Data Protection Regulation (GDPR).

Review notice: This policy has not yet been reviewed by qualified counsel. It should be, before it is relied on in production — particularly the description of how payments are held between a booking being paid for and an artist being paid out (see our Refund Policy), which depends on a confirmation from our payment processor that has not yet been obtained.

1. Who this policy covers

This policy applies to anyone who visits the Platform, creates an artist or organizer profile, books or is booked through Crackerjack, or otherwise interacts with our services. If you are under 18, Section 10 below explains the additional protections that apply to you.

2. What we collect

2.1 Information you give us

Account details: name, email, phone number, password (hashed, never stored in plain text).
Profile data: artist category (DJ, dancer, musician, magician, photographer, model, etc.), bio, portfolio media, rates, availability, city, and reviews.
Identity verification: a government-issued ID photo and a selfie, collected once during artist onboarding to confirm you are who you say you are. Stored in a private, access-controlled file store — never shown publicly, viewable only by you and by Crackerjack staff handling fraud prevention or a verification issue, and deletable by our team on request. Deleted from our file store when your account is deleted.
Precise location (artists only, optional): your device's GPS coordinates, only if you turn on location sharing in Settings > Profile — never tracked continuously, and never shown to another user in raw form. See Section 3 for exactly how this is protected and the visibility levels you control.
Booking data: gig details, dates, venues, contract terms, and messages exchanged between artists and organizers.
Payout details: for artists, the bank account number, IFSC code, and account holder name (or UPI ID) you provide so we can pay you out, and your GST number if you add one — it decides whether tax is withheld from a cash-out. These are stored directly in our database, access-restricted to you and to Crackerjack staff cross-checking a payout against your verification ID (see above) — not shared with any processor until a payout is actually made. Card payment details (from Organizers paying for a booking) are collected and stored by our PCI-DSS compliant payment processor, not by Crackerjack directly.
Ticket purchases: if you buy a ticket to an event, your name, email address and phone number, the tickets you bought and what you paid.
Video calls: if you use in-app calling, the call is connected through our video provider (see Section 5).
Push notification credentials: if you enable notifications, we store the browser/device subscription details needed to deliver them — not readable as a way to identify or locate your device beyond that.
Support requests and correspondence with our team.
Messages you send other users through the Platform, including any images you attach. These are stored so both sides keep a record of what was agreed, and are automatically screened as described in Section 3A.

2.2 Information collected automatically

Device and log data (IP address, browser type, operating system, pages viewed, timestamps) — collected for security and to keep the Platform running as a Necessary function.
Cookies and similar technologies as described in our Cookie Policy. Analytics and marketing cookies are only set after you give explicit consent through our cookie banner or preference center — never before.
Approximate location, derived from IP address, used to show artists and gigs near you.
Basic usage analytics (which features you use) tied to your account — recorded only if you enable Analytics in the cookie banner, and never sold or shared with advertisers. Error reports needed to keep the Platform working are recorded either way.
Online/last-active status, shown to people you're messaging unless you turn this off in Settings > Privacy.

2.3 Information from third parties

If you sign in via a third-party identity provider (e.g. Google), we receive the profile information you authorize that provider to share (typically name, email, and profile photo). Our payment processor shares booking and payout status with us so your dashboard stays accurate.

3. Artist location data — how it's protected

Crackerjack may use location information to help organizers discover suitable artists and to facilitate confirmed events. For your safety, we do not publicly display an artist's exact real-time location, home address, private accommodation, or movement history to organizers or other users under any circumstances.

Location sharing is off by default and entirely optional. If an artist turns it on, they choose one of four visibility levels in Settings > Profile:

City only — just the city name, no map pin, no distance figure. The default for every artist.
Approximate area — a map pin randomized within roughly 0.4–1.9 km of the real location, recalculated per artist so it never reveals the true point.
Approximate distance — a rounded distance figure only (e.g. "~7 km away"), no map pin at all.
Exact — only for confirmed bookings — the artist's real coordinates are shared with an organizer only once a specific booking with that organizer is confirmed (paid and locked in), and only with that one organizer. This is checked against our booking records on every request, not taken on trust from either party.

Whichever level applies, we reduce precision before it ever leaves our servers — a fan-facing search or map never receives a raw GPS coordinate, even internally, for any level except a genuinely confirmed booking under "Exact". An artist can change their level or turn location sharing off entirely at any time; turning it off deletes the stored coordinates.

You must not attempt to obtain an artist's precise or private location outside what this Platform deliberately shows you, track an artist before, during, or after a booking, or use location information to identify an artist's home, hotel, or other private location. See our Terms of Service for the full prohibited-use clause and the consequences of violating it.

3A. Automated screening and AI features

Two parts of the Platform process your content automatically. Both are described here in full because neither is obvious from using the product.

3A.1 Message screening

Messages you send through the Platform — and images you attach to them — are automatically screened for attempts to move a booking off-platform, such as phone numbers, email addresses, or messaging handles. This exists because an off-platform booking loses the payment protection, dispute process, and booking record that the Platform provides.

Screening is automated in the first instance. A message containing an unambiguous contact identifier may be rejected and a strike recorded against your account; repeated strikes can lead to suspension. Weaker signals — an external link, or ambiguous phrasing — only produce a reminder and never a strike. If you believe a message was wrongly blocked or a strike wrongly recorded, you may contest it by contacting our Grievance Officer (Section 12), and a person will review it. You are not subject to a permanent restriction on your account on the basis of automated processing alone.

3A.2 The in-app assistant, and image screening

Our in-app assistant, and the image half of the message screening above, are powered by a third-party AI provider (currently Groq, Inc., based in the United States). When you use the assistant, the messages you send it and the context needed to answer are transmitted to that provider. When you attach an image to a message, that image may be transmitted to the same provider for the narrow purpose of the screening described above. When you submit a screenshot as proof of views for a creator reward, that screenshot is sent to the same provider to read the view count, and a person checks the result before anything is paid.

This is a transfer of personal data outside India, and — where you are in the EEA or UK — outside those regions. We do not authorise the provider to use your content to train its models. Do not send the assistant information you would not want processed by a third party. You can avoid this processing entirely by not using the assistant and not attaching images to messages.

4. Why we process your data (purpose & legal basis)

To provide the Platform — creating your profile, matching artists with organizers, processing bookings and commission-based payouts. (Contractual necessity / DPDP consent.)
To communicate with you — booking confirmations, payout notices, security alerts, and support responses. (Contractual necessity.)
To improve the Platform — records of which features you use, tied to your account, and page-performance measurement, only if you opt in to Analytics; plus an anonymous count of home page visits that carries no personal data. (Consent — opt-in through the cookie banner.)
To market to you — product updates and promotions. (Consent — marketing cookies/emails only, opt-in, with unsubscribe in every message.)
To keep the Platform safe — fraud prevention, dispute resolution, enforcing our Terms of Service and Trust & Safety standards. (Legitimate interest / legal obligation.)
To meet legal obligations — tax, accounting, and regulatory record-keeping tied to payments processed through the Platform.

Other users — your public profile (name, category, portfolio, rates, availability, reviews) is visible to organizers and other artists as part of how the Platform works. If you buy a ticket, the event's host sees your name, email address, phone number and the tickets you bought, so they can run their guest list and contact you about that event.
Payment processors — to collect payment from organizers and to send cash-outs to artists. Between those two points the funds are held by Crackerjack, not by the processor; see our Terms of Service §5.
Service providers — each bound by contract to protect your data and use it solely to provide services to us. The ones that receive personal data today are: Supabase (database, file storage and authentication), Vercel (hosting and delivery), Razorpay (payments and payouts), Resend (transactional and notification email), Groq (the assistant and image screening described in Section 3A), Daily (in-app video calls), Cloudflare Turnstile (the security check at sign-up and sign-in), OpenStreetMap Nominatim and Komoot Photon (turning an address you type into a map position — the text you type is sent to them), MapLibre/OpenStreetMap tiles for maps, Google (only if you choose to sign in with Google), Vercel Speed Insights (page-load performance, only after you enable Analytics), and Spotify (catalogue search when a host adds music to an event — only the search text is sent). Analytics and marketing providers receive data only once you consent.
Legal & safety — law enforcement or regulators where required by law, or to protect the rights, safety, or property of Crackerjack, our users, or the public.
Business transfers — if Crackerjack is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to the same protections described here.

We do not sell personal data.

6. Where your data is stored and international transfers

Crackerjack operates primarily out of India (Goa, Delhi, Bangalore, Mumbai) and serves users internationally. Data may be processed on servers located outside your country of residence. Where we transfer personal data of EEA/UK users outside those regions, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. How long we keep your data

We retain account and booking data for as long as your account is active and for a reasonable period afterward to meet tax, accounting, dispute-resolution, and legal obligations. When you delete your account, your profile, avatar, posts, uploaded media, creator-reward screenshots and identity-verification documents are deleted from our file store. The records the law requires us to keep — bookings, payments, invoices, payouts, tax withheld, tickets, rewards and disputes — are moved into a separate archive that only authorised Crackerjack staff can access, and are deleted from it automatically after 8 years. We retain dispute-related evidence for 6 years after the dispute is closed, or longer if required by law or if proceedings are pending. You may request earlier deletion under Section 9, subject to records we are legally required to keep.

8. Security

We use industry-standard safeguards — encryption in transit, hashed passwords, access controls, and protected payment handling — to protect your data. No system is completely secure; in the event of a data breach, we will notify affected users and the Data Protection Board of India within 72 hours of becoming aware of the breach, as required by the DPDP Rules 2025.

9. Your rights

Subject to applicable law, you may:

Access, correct, or request a copy of your personal data.
Withdraw consent for analytics or marketing processing at any time via the "Cookie Preferences" link in our footer, or by contacting us.
Request erasure of your account and associated personal data ("right to be forgotten"), subject to records we must legally retain.
Object to or request restriction of certain processing.
Nominate a consent manager or file a grievance with the Data Protection Board of India (for DPDP-covered processing) or your local supervisory authority (for GDPR-covered processing).

To exercise any of these rights, contact our Grievance Officer, NIKHIL GUPTA, at admin@crackerjackj.live. We acknowledge grievances within 24 hours and resolve them within 15 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

10. Children's data

Crackerjack is for users aged 18 and over. Bookings are contracts and involve payment, so we do not offer accounts to minors. Everyone must confirm they are 18 or older when creating an account, and we do not knowingly collect personal data from anyone under 18.

We do not currently support minor artist profiles managed by a parent, guardian or agency. Until we do — which would require a verifiable parental consent mechanism under Section 9 of the DPDP Act, 2023 — no such profile should be created, and an account found to belong to a minor will be closed and its data deleted.

We do not enable behavioural tracking or targeted advertising directed at users we know to be minors. If you believe a minor has created an account, tell our Grievance Officer (Section 12) and we will act on it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or email before they take effect, and the "Last updated" date above will reflect the most recent revision.

12. Contact us

Questions about this policy or your data can be sent to admin@crackerjackj.live or +91-8757850115. Registered office: B-76, Dayanand Nagar, Lajpat Nagar IV, New Delhi 110024, India.