Privacy policy

Last updated 2 November 2026

This policy explains how Xortal handles personal data.

When you buy a ticket we collect your name, email and phone number, and the details of your order. We share these with the organiser of the event you booked, who uses them to deliver your tickets, manage entry and contact you about that event. Payment card and UPI details are handled by Razorpay; we never see or store them. Apart from PAN for very large orders (see below), we don't ask for ID documents or ID numbers such as Aadhaar. At events with an age limit, gate staff may look at a photo ID, but the app doesn't record it.

If one order is above the limit set by India's income-tax rules (currently more than ₹2,00,000, or more than ₹1,00,000 paid in cash at the venue), we also ask for the buyer's PAN, because those rules require it for purchases of that size. We encrypt it before storage, never show it in full, and keep it only as long as tax law requires.

When organisers and their staff use the platform we store account details, activity logs (sales, scans, logins) and the data needed to run their events. Organisers choose whether buyers can see their email, customer care number and business address under Seller details on their event pages. Their other account details are never made public. When an organiser signs the Organiser Agreement, we keep the signed text, the signer's name and role, the time, and a masked network address and device type as proof of signing. To confirm an organiser's payout bank account, we may check it through our bank-verification provider, Cashfree (sometimes by sending ₹1 to it), which tells us the name the bank has on the account; we keep that name and the result with the account, and share the account details with Cashfree only for that check.

We use your data to provide the service, send tickets and service emails, prevent fraud and meet legal obligations. We don't sell personal data. We don't send marketing emails unless you agree to them.

Data is stored with our infrastructure providers (database, hosting and email delivery) under appropriate safeguards. We keep order records for as long as required for tax and accounting.

AI tools: searches on Explore are read by Xortal's own software on our servers and aren't shared with anyone. Organisers can choose to use optional AI tools that read an event poster or draft event text; only that poster and the event's own details are sent to our AI provider for that request, never buyers' names, contact details, orders or payment details, and the organiser reviews everything before it is published. Photos are redrawn in the organiser's browser before upload, which removes hidden data such as the phone's location. What the AI read from a poster is kept on our servers for up to a day, only for that organiser, so the same poster isn't read twice. Our AI provider handles requests under its commercial terms, which don't allow it to train its models on them. We don't use your personal data to train AI. If you use Ask Xortal, our AI assistant, on our pages, the questions you type (with email addresses, phone numbers, order numbers, card-like numbers and anything that looks like an OTP, PIN or password removed first), the public details of the event you're viewing and Xortal's public event listings are sent to our AI provider to answer you and suggest events; Xortal doesn't store the conversation. If you tap the microphone to speak instead of typing, your browser's own speech service turns your voice into text (for example Google's in Chrome or Apple's in Safari); Xortal receives only the text, never the recording. Organisers who use Ask Xortal in their dashboard send their questions (with the same details removed) together with their own account's setup, event details and sales totals, never buyers' names, contact details, orders or payment details. If you choose to send your question to our support team, it is emailed to us with the email address you give for the reply.

How we protect it: all connections are encrypted (HTTPS). Bank account and PAN details are encrypted before storage. Passwords and staff PINs are stored only as one-way hashes. Access to dashboards is limited by role, logins are rate-limited, and the platform owner's account uses 2-step login. Staff phones used for offline scanning hold only ticket codes and guest names, not emails or phone numbers.

Cookies and tracking: we use only the cookies needed to keep you logged in. Events you save, tickets bought on your phone and, if you choose, your name, email and phone for quicker booking are remembered in your browser's storage on that phone only. To suggest events you might like, your phone sends us which event pages you saved or booked; we use that only to answer, and don't store it or link it to you. We don't use advertising trackers or third-party analytics, and our fonts are served from our own site. To show organisers how their promotion works, we count visits to event pages and where they came from (for example Instagram or Google) as daily totals only: no cookies, no IP addresses and nothing about who visited. While you browse, your phone remembers that source for that browser tab, and it's saved with your booking. Ticket links are private and signed so they can't be guessed. Search engines can list only our public pages (events, help and these policies). Tickets, logins, My tickets and dashboards are marked so they never appear in search results, and we add no tracking code for search engines.

Retention: after an event, buyers' names, emails and phone numbers may be removed from our records after a set period, while the order amount, number and date are kept for accounts.

Your rights: under India's Digital Personal Data Protection Act, 2023 you can ask to see, correct or erase your personal data, or withdraw consent. In My tickets you can download your data and erase your details from orders for events that are over. For anything else, email hello@xortal.net