This is how Fans Show ("we", "us") handles information about you when you use the site. We are the data controller (in India, the data fiduciary) for it.
Operator
FANSSHOW (OPC) PRIVATE LIMITED
Registered office: Pamarr 32, Yalakur, Elakurru, Guduru, Krishna - 521156, Andhra Pradesh
CIN U79900AP2026OPC128212
Grievance officer · point of contact
SPVNJ Butchaiah
support@fansshow.in · +91 78422 75557
Complaints are acknowledged within 24 hours and resolved within 15 days of receipt, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require. Requests about your data are answered within 30 days.
1. What we collect, and why
| What | Why (purpose) | Legal basis |
|---|---|---|
| Account: name, email, phone, WhatsApp, username, date of birth, password (hashed) | To open and secure your account; to know you are 13 or over and whether a screening for adults is open to you | Contract; legal obligation (age) |
| Bookings and orders: shows, seats, amounts, payment references, delivery address | To sell and deliver tickets and merchandise, issue receipts, prevent fraud | Contract; legal obligation (tax, accounts) |
| Payment proof screenshots you upload | To verify a transfer you made outside a gateway | Contract. Deleted 90 days after verification |
| Crew and vendor verification: government ID number (encrypted; only the last four digits are ever shown), PAN, bank details (encrypted), a selfie | To confirm a person working a show or trading at it is who they say, and to pay them | Your explicit consent, asked for at upload. ID and bank numbers are sealed; every read is logged. The selfie is deleted 30 days after the last show it was used for, or on request |
| Messages we send you and whether they arrived | Tickets, reminders, replies to you; announcements only if you asked | Contract; consent (announcements) |
| Device and usage data: IP address, browser, pages viewed, timings | To keep the site up and safe, rate-limit abuse, and - only with your consent - measure performance | Legitimate interest (security); consent (analytics) |
| What you post: reviews, wall posts, requirements, applications | To show it where you posted it | Contract |
2. Children
You must be 13 or older to hold an account; we do not knowingly collect information from anyone under 13, and an account found to belong to a child is closed and its data erased. Between 13 and 18 you may book, but not for a screening certified for adults, and you may not apply for crew or vendor work. A parent or guardian may book for a child on their own account. If you are in the EU and under 16, ask a parent to open the account.
3. Who we share it with
Only the processors that run the service, under contracts that bind them to this policy: Supabase (database and authentication), Vercel (hosting), our email, SMS and WhatsApp providers (delivery of the messages above), the payment gateway you choose (Razorpay - card and UPI details go to them, not to us), and delivery partners for merchandise. The theatre and the host of a show see the bookings for that show - name, seats, contact - to run the night. We do not sell personal information and we do not share it for cross-context behavioural advertising.
4. Where it is kept
Our servers are in the region the operator has chosen with Supabase and Vercel. Where data leaves the EU or India, the transfer is covered by standard contractual clauses or an adequacy decision, and by the cross-border rules of the DPDP Act.
5. How long
- Booking, order and ledger records: 7 years, for tax and accounts.
- Payment proof screenshots: 90 days after the payment is verified.
- Selfies for verification: 30 days after the last show you worked, or on request.
- ID and bank numbers: sealed while you hold a crew or vendor card; erased when it closes.
- Messages and delivery logs: 12 months.
- Security logs (IP, rate limits): 90 days.
- Your account: until you close it. Closing it erases the profile and pseudonymises the records we must keep.
6. Your rights
You can see, correct, export and erase your data, withdraw consent, object to processing, and ask that a decision be reviewed by a person. From your profile you can download everything we hold about you and close your account yourself, at once. For anything else write to support@fansshow.in; we answer within 30 days (DPDP, GDPR, CCPA), and we never treat you differently for exercising a right. Residents of the EU may complain to their supervisory authority; residents of India to the Data Protection Board; residents of California may ask us to confirm we do not sell or share personal information - we do not.
7. Cookies and storage
Strictly necessary cookies keep you signed in and hold your place in a queue; they need no consent. Performance measurement (Vercel Speed Insights) loads only after you accept it on the banner, and "reject" is one click, the same as "accept". Your choice is stored on your device and can be changed from the footer at any time. We do not use advertising cookies.
8. Security
Encryption in transit (TLS) and at rest. Passwords are hashed. Government ID numbers and bank details are encrypted with a key held outside the database and can only be read through the site, with every read logged. Payment references are hashed for tamper evidence. Access is by named role; every staff action is written to an audit log.
9. If something goes wrong
A breach affecting your data is reported to the authorities as the law requires (within 72 hours in the EU; to CERT-In within 6 hours in India) and to you without undue delay, with what happened and what to do.
10. Announcements
We send announcements by email, SMS or WhatsApp only if you ticked the box, and every one carries a way to stop them: a one-click link in email, STOP by SMS or WhatsApp, or the switch on your profile. Messages about your own bookings are not announcements and continue.
11. Changes
When this policy changes in a way that matters, we tell you by email before it takes effect. The date at the top is the date of the current version.