Privacy Policy

Last updated: March 2026

⚠ Company registration is in progress. CIN will be updated on this page once incorporation is complete. Contact legal@xpego.com for any queries in the interim.

1. Who We Are

Xpego Tech Private Limited ("Xpego", "we", "our", or "us") operates the Xpego platform available at xpego.com and via our mobile applications. We connect consumers with curated experience brands in India.

Our registered office is in Bengaluru, Karnataka, India.

For privacy-related queries, contact us at privacy@xpego.com.

2. What Data We Collect

We collect the following personal data:

Account information:

Phone number (required for OTP login)
Email address (optional)
Full name (optional)
Profile photo (optional)

Interest and usage data:

Experiences you express interest in
Your preferred timing and group size
Any notes you provide with your interest
Pages you visit and features you use

Location data:

City (used to show relevant experiences)
Neighbourhood (optional, provided by you)
Device location (only if you grant permission, used for distance filtering)

Communications:

WhatsApp messages sent by us to you
Your responses to those messages

Waitlist data (if you joined our waitlist):

Phone number, name, email, neighbourhood, and preferred experience categories

3. How We Use Your Data

We use your data to:

Provide and improve the Xpego platform
Connect you with experience brands through our concierge service
Send you booking confirmations and reminders via WhatsApp
Notify you of new experiences matching your preferences
Personalise your experience discovery
Analyse demand to help brands understand what consumers want
Comply with legal obligations

We do not use your data for automated decision-making that significantly affects you.

4. WhatsApp Communications

By providing your phone number and expressing interest in an experience, you consent to receiving WhatsApp messages from Xpego. These messages include:

Booking confirmations and updates
Slot confirmation from our concierge
New experience notifications
Platform updates

You can opt out at any time by replying "STOP" to any WhatsApp message from us.

5. Data Sharing

We share your data with:

Experience brands: When you express interest in an experience, we share your name and phone number with the relevant brand to facilitate your booking. We do not share your data with brands without your interest.

Service providers: We use Supabase (database), Twilio/Interakt (WhatsApp), Resend (email), and Razorpay (payments — when enabled). These providers process data on our behalf under data processing agreements.

Legal requirements: We may disclose data where required by law, court order, or government authority.

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data only as long as necessary to provide our service or as required by law.

Account data is deleted when you request account deletion (see Your Rights below).
Transaction records (bookings) are retained for 1 year from the date of the transaction as required under DPDP Rule 8 and applicable tax laws.
Waitlist data is retained for 12 months from signup or until you request deletion.

7. Your Rights Under DPDP 2023

As a data principal under India's Digital Personal Data Protection Act 2023 (DPDP Act), you have the following rights:

Right to Access — Request a copy of the personal data we hold about you
Right to Correction — Request correction of inaccurate personal data
Right to Erasure — Request deletion of your personal data. You can initiate this directly from Account & Privacy Settings
Right to Withdraw Consent — Revoke previously given consent at any time
Right to Grievance Redressal — File complaints about data handling

To exercise any of these rights, email privacy@xpego.com with your registered phone number and the specific right you are exercising. We will acknowledge your request within 72 hours and action it within 30 days.

Data Fiduciary: Xpego Tech Private Limited
Grievance Officer: privacy@xpego.com

8. Data Security

We implement appropriate technical and organisational measures to protect your data including:

Encrypted data transmission (HTTPS/TLS)
Row-level security on our database
Access controls limiting who can view your data
Regular security reviews

No method of transmission over the internet is 100% secure. We will notify you promptly if a data breach affects your personal data.

9. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

10. Children's Privacy

Xpego is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact privacy@xpego.com and we will delete it promptly.

For experiences marked "Adults only", users must confirm they are 18 or older.

11. International Users

Xpego is operated from India and your data is stored on servers within India and the European Economic Area (via our service providers). If you access Xpego from outside India, your data may be transferred internationally under appropriate safeguards.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via WhatsApp or email. Continued use of Xpego after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy queries: privacy@xpego.com

For legal notices: legal@xpego.com

Xpego Tech Private Limited
Bengaluru, Karnataka, India
CIN: [Pending incorporation]