Privacy Policy

Last updated: June 2026

1. Who We Are

Xpego Tech Private Limited ("Xpego", "we", "our", or "us") operates the Xpego platform available at xpego.com and via our mobile applications. We connect consumers with curated experience brands in India.

For privacy-related queries, contact us at privacy@xpego.com.

2. What Data We Collect

We collect the following personal data:

Account information:

Phone number (required for OTP login)
Email address (optional)
Full name (optional)
Profile photo (optional)

Interest and usage data:

Experiences you express interest in
Your preferred timing and group size
Any notes you provide with your interest
Pages you visit and features you use

Location data:

City (used to show relevant experiences)
Neighbourhood (optional, provided by you)
Device location (only if you grant permission, used for distance filtering)

Communications:

WhatsApp messages sent by us to you
Your responses to those messages

Booking and payment data:

Booking reference, experience name, slot date and time, number of guests
Payment status and Razorpay transaction ID
Card, UPI, and bank details are handled directly by Razorpay and are not stored by Xpego

Waitlist data (if you joined our waitlist):

Phone number, name, email, neighbourhood, and preferred experience categories

3. How We Use Your Data

We use your data to:

Provide and improve the Xpego platform
Process bookings and payments on the Platform
Send you booking confirmations, payment receipts, and reminders via WhatsApp
Notify you of new experiences matching your preferences
Personalise your experience discovery
Analyse demand to help brands understand what consumers want
Comply with legal obligations

We do not use your data for automated decision-making that significantly affects you.

4. WhatsApp Communications

By providing your phone number and expressing interest in an experience, you consent to receiving WhatsApp messages from Xpego. These messages include:

Booking confirmations, payment receipts, and booking updates
Slot reminders before your experience
New experience notifications
Platform updates and policy changes

You can opt out at any time by replying "STOP" to any WhatsApp message from us.

5. Data Sharing

We share your data with:

Experience brands: When you make a confirmed booking, we share your booking reference, guest count, and slot details with the relevant brand to facilitate delivery of the experience. We do not share your phone number or payment details with brands.

Payment processor: Payments are processed by Razorpay. Your card, UPI, and bank details are submitted directly to Razorpay and are governed by Razorpay's Privacy Policy. Xpego receives only a transaction ID and payment status.

Other service providers: We use Supabase (database), Twilio/Interakt (WhatsApp), and Resend (email). These providers process data on our behalf under data processing agreements.

Legal requirements: We may disclose data where required by law, court order, or government authority.

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data only as long as necessary to provide our service or as required by law.

Account data is deleted when you request account deletion (see Your Rights below).
Transaction records (bookings) are retained for 1 year from the date of the transaction as required under DPDP Rule 8 and applicable tax laws.
Waitlist data is retained for 12 months from signup or until you request deletion.

7. Your Rights Under DPDP 2023

As a data principal under India's Digital Personal Data Protection Act 2023 (DPDP Act), you have the following rights:

Right to Access — Request a copy of the personal data we hold about you
Right to Correction — Request correction of inaccurate personal data
Right to Erasure — Request deletion of your personal data. You can initiate this directly from Account & Privacy Settings
Right to Withdraw Consent — Revoke previously given consent at any time
Right to Grievance Redressal — File complaints about data handling

To exercise any of these rights, email privacy@xpego.com with your registered phone number and the specific right you are exercising. We will acknowledge your request within 72 hours and action it within 30 days.

Data Fiduciary: Xpego Tech Private Limited
Grievance Officer: privacy@xpego.com

8. Data Security

We implement appropriate technical and organisational measures to protect your data including:

Encrypted data transmission (HTTPS/TLS)
Row-level security on our database
Access controls limiting who can view your data
Regular security reviews

No method of transmission over the internet is 100% secure. We will notify you promptly if a data breach affects your personal data.

9. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

10. Children's Privacy

Xpego is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact privacy@xpego.com and we will delete it promptly.

For experiences marked "Adults only", users must confirm they are 18 or older.

11. International Users

Xpego is operated from India and your data is stored on servers within India and the European Economic Area (via our service providers). If you access Xpego from outside India, your data may be transferred internationally under appropriate safeguards.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via WhatsApp or email. Continued use of Xpego after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy queries: privacy@xpego.com

For legal notices: legal@xpego.com

Xpego Tech Private Limited
Bengaluru, Karnataka, India
CIN: U63120KA2026PTC219401

This Policy is effective from the date stated above and supersedes all prior privacy policies published by Xpego Tech Private Limited.