Privacy Policy

This Privacy Policy explains how Zuzu Made ("Zuzu Made", "we", "us") handles personal data when you use the Zuzu Made website and the gifts made on it. We wrote it to be read, not skimmed past. If anything is unclear, write to zuzumade.support@gmail.com.

1. Who we are

Zuzu Made is operated by Zuzu Made. We decide how your personal data is used, so under India's Digital Personal Data Protection Act, 2023 we are the "Data Fiduciary" for it.

2. What we collect

When you make an account

• Your name and email address.
• If you sign in with Google: your Google account ID, name, email address, whether Google has verified that email, and your profile picture (avatar). We ask Google only for basic profile and email. We never see your Google password.
• If you sign up with email: a password, which we store only as a one-way hash. We cannot read it.

When you build a gift

• Everything you put into it: names, messages and letters, dates, answers, photos, voice notes and the music or artwork you choose. Building and previewing work on your device first. When you choose to share, the gift is saved to your account so it can be sent.
• The private link (and custom link name) you pick, and an optional passcode. Passcodes are stored only as a one-way hash.

When you pay

• Payments are processed by Razorpay. We receive and keep payment references: the Razorpay order and payment IDs, the amount, currency, status and time, and which gift it was for.
• We do not receive or store your card number, CVV, UPI PIN, net-banking password or full bank details. Razorpay handles those under its own privacy policy and the rules that apply to payment companies.

When someone opens or replies to a gift

• A recipient can send a reaction, a short message and a name back to the person who made the gift. We keep the reply for the gift's owner.
• To stop spam and abuse of replies and passcodes, we keep a keyed hash of the IP address and browser (user agent) involved. A hash cannot be turned back into the original IP address.

When you contact us

• The name, email address and message you send through our contact form or by email, plus a keyed hash of your IP address and browser to limit spam.

Automatically

• Basic technical logs (such as request times, errors and the pages requested) to keep the service secure and working.

3. Why we use it

• To run your account and let you sign in.
• To save, publish and deliver your gift to the person you share the link with, and to show you replies.
• To take payment, send receipts, publish confirmations and expiry reminders (30, 7 and 1 days before a gift's link ends), and to recover a payment that did not complete.
• To keep the service safe: passcode lockouts, rate limits, spam checks, and removing content that breaks our Terms.
• To meet legal duties, such as keeping payment and tax records.

We do not sell your personal data, and we do not use the content of your gifts for advertising.

4. Cookies and similar storage

We use a small number of cookies and browser storage:

• Session and security cookies, which keep you signed in and protect forms (CSRF). They are needed for the site to work.
• "Keep me logged in", only if you tick it.
• Gift access cookies, set when someone enters a gift's passcode, so they do not have to type it again on that device for up to 30 days.
• Your browser's local storage, which keeps your draft on your device while you build, before you share.

5. Who we share it with

We share personal data only with the companies that help us run Zuzu Made, and only what they need:

• Razorpay, to process payments.

We may also share data when the law requires it (for example a valid request from a government authority or court), or to protect people from harm or fraud.

6. Private links and passcodes

A gift is not public. It opens only through its private link, and search engines are told not to index gift pages. Anyone who has the link can open the gift, so share it only with the person it is meant for. For extra privacy you can add a passcode and share it separately. Photos and voice notes are served through short-lived signed links, not public web addresses.

7. How long we keep it

• Gifts: while the link is live (the validity period you paid for). After it ends, the link stops working. You can renew within 90 days. After that the gift is archived: recipients cannot open it, and it stays in your account until you delete it or ask us to.
• Account: until you ask us to delete it.

8. Your choices and rights

You can:

• Revoke a live gift at any time from your account. Its link stops working straight away.
• Change or remove a passcode, and archive gifts you no longer want.
• Ask for a copy, a correction or the deletion of your personal data, and withdraw consent where we rely on it. Write to zuzumade.support@gmail.com or on WhatsApp. We will reply within 30 days. Some records (such as payment records) we must keep by law.
• Nominate someone to exercise your rights if you die or become unable to, as the Digital Personal Data Protection Act, 2023 allows.
• Complain to us at zuzumade.support@gmail.com or on WhatsApp, and, if you are not satisfied with our answer, to the Data Protection Board of India.

9. Children

Zuzu Made is for people aged 18 and over. Someone under 18 may use it only with a parent or guardian who agrees to these terms for them. We do not knowingly collect personal data from children without that consent.

10. Security

We use HTTPS, hash passwords and passcodes, keep gift photos and voice notes in private storage behind short-lived signed links, limit repeated attempts, and restrict staff access. No system is perfectly secure, so please keep your account details safe. If we learn of a breach that affects you, we will tell you and the authorities as the law requires.

11. Questions, requests and complaints

For anything about your personal data, including access, correction, deletion and complaints, write to zuzumade.support@gmail.com or on WhatsApp. We aim to reply within 2 working days and to resolve requests within 30 days.

12. Changes to this policy

If we change this policy, we will update the date at the top of this page, and tell you by email or on the site if the change is significant.