Privacy

Privacy policy

Last updated 31 October 2026

Chalgo is run by Followcan Technologies Private Limited. This policy covers Chalgo: hosting, booking and attending events. The same company also runs FollowCan, a separate service for Link in Bio pages; if you use FollowCan too, its own privacy policy applies to that service.

This policy explains what personal data Chalgo collects, why, who sees it, how long we keep it and what you can do about it. It applies to the website and services run by Followcan Technologies Private Limited (“Chalgo”, “we”), at A-35, Brotherhood Society, H Block, Vikaspuri, New Delhi - 110018, who decide why and how your data is used (in the language of India’s Digital Personal Data Protection Act, 2023, the “Data Fiduciary”). It should be read with the Terms.

What we collect Why we use it Your ID Who sees it Cookies How long we keep it Your rights Security Age Contact and complaints

1. What we collect

  • Your account: name, email and mobile number, and for hosts a password (we keep only a scrambled form of it, never the password itself). We only use an email or mobile number that has been verified with a one-time code; a number you type and do not verify is stored but never used. Your gender is taken from your verified ID. If you choose Continue with Facebook, Facebook tells us your name, your email (if you allow it) and your Facebook ID; we keep the Facebook ID so you can sign in the same way next time. We do not receive your Facebook password, friends, posts or photos, and we never post to Facebook.
  • Bookings and attendance: the events you book, your seat, whether you checked in, reviews you write, and messages in an event’s group chat.
  • Hosts also give a brand name, city, bio, pictures, Instagram handle, payout UPI ID and their tax details: the kind of person they are, legal name, state, PAN (kept encrypted) and, if they have one, a GSTIN. We use these for the tax invoices we issue to hosts and for the tax records the law asks us to keep, and keep them for 8 years.
  • Reports and safety: reports you make or that are made about you, and what we decided.
  • Technical data: your IP address and device details when you sign in or when a code is sent, used to protect accounts and stop abuse.

2. Why we use it

We use your data only for the purposes you gave it for, or that the law allows:

  • to create and secure your account and sign you in (one-time codes, passwords);
  • to run bookings: check your ID, balance groups, confirm seats, check guests in, settle events and pay hosts;
  • to keep people safe: handle reports, remove people who break the rules, and stop a closed account from coming back;
  • to send you messages about your bookings, payouts and account, only by an email address or mobile number you have verified, by email, SMS or WhatsApp (WhatsApp only if you opted in);
  • to follow the law (tax, accounts, orders from authorities), and to find and stop fraud and misuse;
  • to improve the service, only if you allow it: we look at how the pages are used (which pages people open, what they tap, and recordings of visits) and fix what confuses people.

Where we need your consent we ask for it (for example, a tick box for WhatsApp updates), record when you gave it, and let you withdraw it at any time. We do not sell your data and we do not show ads.

3. Your ID

We do not store any government ID document (such as Aadhaar, PAN, driving licence or passport), any copy or photo of one, or your ID number. DigiLocker, the government’s ID service, confirms your identity after you sign in to it yourself, through our identity-verification partner, who gives us only the result: your name, date of birth, gender and an identifier. We keep a one-way fingerprint (so one ID cannot verify two accounts), your date of birth and the gender on the ID. The name on the ID is kept for 30 days so a reviewer can check it, and then removed.

You must verify your ID to book events, to host events, and and, for hosts, to be paid. If you do not verify, you can still use the parts that do not need it.

4. Who sees it

Only what each party needs to do its job:

  • Anyone who opens a host’s page or event sees the host’s brand name and, next to “Hosted by”, the host’s first name, taken from their verified ID. This is on by default for every host whose ID is verified. A host can change it under Brand and theme to show their full name or no name. The name appears on the host’s page, on their events, on the booking page and in booking emails.
  • Hosts see the name, contact details and attendance history (check-ins only) of guests who book their events. The exact address of an event is shared only with confirmed guests. Guests in a group chat see each other’s first name and the first letter of the last name.
  • Your host’s contact: a guest with a confirmed seat sees the host’s email, and the host’s mobile number only if the host chose to show it. The host’s contact is shown to the signed-in guest, not to everyone who holds a booking link.
  • At the door, the host, or a helper the host gave the door link to, scans your pass or looks you up to check you in. They see your name, your seat type, your ticket and whether your ID is verified, never your phone number, email or ID details. Your pass holds only your booking reference. The time you were checked in is saved with your booking.
  • DigiLocker (Government of India) and Cashfree, our identity-verification partner: you sign in to DigiLocker yourself; the partner passes us the result.
  • Cashfree (payments, refunds, paying hosts their share, and checking a host’s payout account): your name, email, phone and the amounts and, for hosts, the PAN and payout account you give. We store references and amounts, not your UPI PIN, card or bank details.
  • Amplitude (product analytics and session recordings): a random identifier kept in your browser, the pages you open, what you tap and click, your device and browser, and recordings of your visit that can show what appeared on screen. This is on only if you click Allow on the analytics bar. We do not send your name, email or phone to Amplitude. Amplitude keeps this on servers in the United States.
  • MSG91 (SMS): your phone number and the one-time code or message.
  • WhatsApp (Meta): your phone number and the message, only if you opted in.
  • Facebook (Meta): only if you choose to continue with Facebook. Facebook sees that you signed in to Chalgo and shares your name, email and Facebook ID with us.
  • OpenStreetMap (maps): when a page shows a map, your browser loads it from OpenStreetMap, which sees your IP address and the area shown. A host’s place searches go to OpenStreetMap too.
  • Our email, hosting and infrastructure providers, to send email and run the service.
  • Authorities and courts, where the law or a valid order requires it. We check that a request has a legal basis, give only what it asks for, and keep a record of every request, who on our staff looked at the data and what we handed over. We do not keep ID documents, so anyone who needs one must ask DigiLocker or the issuing authority.

Some of these providers keep data on servers outside India. We use them only for the purposes above.

5. Cookies

The site needs two cookies to work: one to keep you signed in and one to protect forms from forgery.

With your permission we use Amplitude to understand how the site is used. Until you click Allow on the analytics bar nothing is stored or recorded. Once allowed it stores an identifier in your browser (cookies and local storage) and records the pages you open, what you tap and recordings of your visit. We use it only to improve Chalgo. We do not use advertising cookies and we do not show ads. We never record the ID check, booking, payment or account pages with readable text. You can change your choice at any time with (also in the page footer); saying no stops recording at once and removes what Amplitude stored in your browser. Your choice is kept in a cookie called cg_analytics for 12 months.

6. How long we keep it

  • Your account details and ID result: until you delete your account.
  • One-time codes (with the phone, email and IP they were sent to): 7 days.
  • Who a message went to and what it said: 90 days.
  • Group chat messages: 7 days after the chat closes.
  • Records of payments, invoices and payouts: 8 years, because the law requires it. After you delete your account they no longer carry your name or contact details.
  • Invites: if you ask for an invite we keep your email (and name, if you gave it) for 180 days, or until you sign up, and then delete it.
  • Requests from authorities: the request, its legal basis, the log of what we did and the outcome are kept for as long as the law requires, even after an account is deleted. An account cannot be deleted while a legal request about it is open.
  • Safety reports and closed accounts: we keep the report and our decision so we can act on repeat behaviour. If we close an account for safety reasons we keep a one-way fingerprint of that person’s ID (never the number) so the same ID cannot open another account. We keep these even after an account is deleted, and an account cannot be deleted while a safety report about it is being reviewed.

7. Your rights

You can, at any time:

  • see and correct your details, and download a copy of your data;
  • withdraw consent, for example turn WhatsApp updates off in Privacy & data (emails about your bookings continue either way), or remove Chalgo from your Facebook settings (Settings, Apps and Websites), after which we remove the link to your Facebook account;
  • delete your account. Deleting waits 7 days (signing in again cancels it) and cannot go ahead while a booking, refund, event or payout is still open;
  • nominate another person to exercise these rights for you if you die or cannot act;
  • complain to us (section 10) and, if you are not satisfied, to the Data Protection Board of India.

When you are signed in, you can do most of this yourself in Privacy & data. For anything else, write to [email protected]. We may need to confirm it is you, and we may keep what the law requires us to keep.

8. Security

We protect your data with encryption of sensitive items such as access tokens, limited staff access, and secure connections. No system is perfectly secure. If a breach affects your personal data we will tell you and the authorities as the law requires.

9. Age

Chalgo is for adults. You must be at least 18 to book or host, and your ID is checked. We do not knowingly collect children’s data; if you think a child has an account, tell us and we will remove it.

10. Contact and complaints

Questions about your data, or a complaint: write to Nidhi Manchanda, Grievance Officer, at [email protected]. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days.

We may update this policy. The version on this page, with the date above, is the one that applies; for a significant change we will tell you by email or on the site.