Privacy policy

ScanMyPass lets organisations and clubs publish events, issue tickets, and check attendees in at the door. We understand that handing over your name, your number and your payment is a big responsibility, and we work to protect that information and keep you in control of it. What we collect, and how it gets used, depends on how you use the service — as someone buying a ticket, or as someone running an event.

For anything in this policy, including a request to see or delete your data, write to info@scanmypass.com.

1. Who is responsible for your data

For the personal data you give to ScanMyPass itself, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the body corporate responsible under the Information Technology Act, 2000 and its rules.

For the data an organiser receives about you when you register for their event, that organiser is responsible in their own right. Section 4 explains exactly what they get and what that means for you. It is the most important section on this page — please read it before you register for anything.

2. Information we collect

Information you create or give us. When you create an account, register for an event, or list one:

• Your name, email address and, on many events, your phone number — to identify your account, issue tickets in your name, and email them to you.
• Your Google account name, email and profile picture, if you choose to sign in with Google instead of a password or an emailed code.
• Answers to the organiser's own registration questions — whatever that particular event asks, which can include details like gender, marital status, dietary preference, a T-shirt size, or a question specific to their event.
• Organiser business details, if you run events: business name and address, contact details, PAN, and bank account details for receiving payouts. Bank details are encrypted at rest and decrypted only when a payout is actually being executed.

Information we collect as you use ScanMyPass.

• Your orders, tickets, ticket codes and check-in records — to sell you a ticket, admit you at the door, and stop the same ticket being used twice.
• Payment identifiers and amounts from Razorpay — to confirm your payment succeeded, issue your ticket, and keep the financial records the law requires.
• Clubs you have joined — to show you their events, including members-only ones.
• How you use the site, such as the events and pages you view, and server logs including IP address and browser type — to keep the service working, investigate faults, and detect abuse. We also use cookies; see section 9.

We never collect or store your card number, CVV, UPI PIN, or bank credentials. Those are entered on Razorpay's own checkout and never reach our servers.

3. Why we collect it

• To provide the service — processing your purchase, issuing and emailing your ticket, letting the organiser admit you at the door.
• To maintain and improve it — making sure things work as intended, tracking outages, and troubleshooting problems you report.
• To communicate with you — sending your ticket, your sign-in link, a receipt, or notice of a change to an event you registered for or to this policy.
• To protect users, organisers and the platform — detecting and responding to fraud, duplicated tickets, abuse, and security or technical problems.

Under the DPDP Act we rely on your consent, given when you create an account or register for an event; on the legitimate uses the Act permits, including data you voluntarily gave us for a purpose you would reasonably expect; and on legal obligation for tax and financial records. You can withdraw consent at any time, as easily as you gave it, by writing to info@scanmypass.com. Withdrawing it does not undo processing already carried out lawfully, and we may still have to keep records the law requires us to keep.

4. What the organiser of your event can see — and download

Registering for an event means handing your details to whoever is running that event. That is not a side effect; it is the point. An organiser cannot admit you at the door, seat you, cater for you, or contact you about a change of venue without knowing who you are. So when you register, understand that you are choosing to give your information to that organiser, and that the decision to register is yours.

For every event you register for, that organiser can see and use:

• Your name, email address and phone number, and your ticket type, order amount and payment method.
• Your answers to their registration questions, including details like gender or marital status where their form asks for them.
• Whether and when you arrived, and which of their staff scanned you in.

Once this data reaches an organiser it is on their systems and outside our technical control.

This means, in plain terms: the organiser holds their own copy of your data and is responsible for it. They decide independently what they do with it. Our terms of use require them to handle it lawfully, to use it only for running their event, and forbid them from selling it — but their internal privacy practices are theirs, not ours.

What an organiser cannot see: your card, UPI or bank credentials; your account password; anything about events you registered for with a differentorganiser. Each organisation is separated at the database access layer, so one organiser cannot read another's attendees, orders or revenue.

If you want an organiser to delete what they hold about you, contact that organiser directly. If you cannot reach them, write to us and we will help.

5. What is public, and what is not

ScanMyPass has no public user profiles. There is no username, no avatar and no follower list for anyone to find, and search engines cannot index you as an attendee.

• Private: your email address, your phone number, your orders, what you paid, and which events you are attending. These are visible to you, to the organiser of each event you registered for (section 4), and to the ScanMyPass staff who operate the service.
• Public:event listings themselves, and the organising entity's name on them. Nothing about an individual attendee appears on a public page.
• Secret: your ticket code. Treat it like cash — anyone holding it can use it, and a ticket admits once.

6. When we share your information

We never sell your personal data. We share it only in these cases:

• With the organiser of an event you register for — as described in section 4.
• With your consent — we will ask first for anything beyond what this policy describes.
• For external processing — trusted providers who process data on our instructions and under confidentiality and security obligations: Razorpay for payments and organiser payout verification, Resend for transactional email, and our hosting and database providers. Razorpay is an independent controller of the data it collects; see their own privacy policy.
• For legal reasons — where we have a good-faith belief that disclosure is required by law, regulation, legal process or an enforceable government request, or is necessary to establish or defend a legal claim.
• To an acquirer — if ScanMyPass is sold or merged, this policy continues to apply to the data transferred until it is replaced with notice to you.

Some providers process data outside India. Where that happens we rely on the DPDP Act's permission to transfer personal data outside India, except to countries the Central Government has restricted.

7. Protecting your information

We protect your information with strong, industry-standard encryption — in transit between your device and our servers, and at rest for the most sensitive things we hold. Passwords are never stored in a form anyone can read back, and organiser bank details stay encrypted until the moment a payout is actually being executed.

Alongside encryption:

• Each organisation's data is separated at the database access layer, so one organiser cannot read another's attendees, orders or revenue.
• Ticket codes are long random values — holding one valid code tells you nothing about any other.
• We never store your card, UPI or bank credentials; those go straight to Razorpay.
• Access to production data is limited to the people who need it to operate the service.

We keep these measures under review and strengthen them as standards move, including as guidance on post-quantum cryptography matures.

No system is perfectly secure. If a breach affects your personal data we will notify affected users and the Data Protection Board as the DPDP Rules require, including a detailed report to the Board within 72 hours.

8. How long we keep it

• Account data: while your account exists, and for a reasonable period after closure to handle disputes.
• Tickets and check-in records: kept after the event as the record of who bought and who attended, which is what refunds and disputes are settled against.
• Payment and financial records: as long as tax and accounting law requires — currently up to eight years for certain records.
• Server logs: a short operational period, then deleted or aggregated.

When data is no longer needed for any of these purposes we delete it or irreversibly anonymise it. Deleting your ScanMyPass account does not reach copies an organiser already holds — for those, contact the organiser.

9. Managing and deleting your information

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, how we process it, and who we have shared it with.
• Correction and completion — to have inaccurate or incomplete data corrected, completed or updated. You can edit most of it yourself in your account settings.
• Erasure — to have your data deleted, unless we are required to keep it by law or still need it for the purpose it was collected for.
• Grievance redressal — to complain to us and get a response, before going to the Data Protection Board.
• Nomination — to nominate someone to exercise these rights for you if you die or become incapacitated.

To exercise any of these, write to info@scanmypass.com. We will respond within 30 days, and in any case within the 90 days the DPDP Rules allow. We may ask you to verify your identity first, so we do not hand your data to someone else. If you are unhappy with our response you may complain to the Data Protection Board of India.

10. Cookies

We use a small number of cookies that are necessary for the service to work, principally to keep you signed in. We also use Google Analytics to understand overall traffic and how the site is used, which sets its own cookies. We do not use advertising cookies and we do not build advertising profiles of individual visitors. Blocking essential cookies will stop you being able to sign in.

11. Email you get from us

We send transactional email — sign-in links, tickets, receipts, and messages about events you registered for. We do not add you to marketing lists without asking, and any marketing email we do send has a way to unsubscribe.

An organiser may contact you about their own event using the details they received under section 4. If you would rather they did not, tell them, or tell us and we will pass it on.

12. Children

We do not knowingly collect data from children under 18. If you believe a child has given us data, write to info@scanmypass.com and we will delete it.

13. Changes

If we change this policy the “last updated” date at the top changes, and we will give notice of material changes by email or in the product.

14. Contact

Questions, requests or complaints about privacy: info@scanmypass.com. For anything about a specific event, the organiser who published it is the faster route — see contact.