Privacy Policy

What we collect

To create and deliver a page, we collect only what the page needs:

• The recipient’s name and your message.
• Your email when you sign in or send a contact or build request. Signed-in activity is associated with your account.
• Photos you upload, their descriptions and captions, and optional external media links. We re-encode new uploaded photos and remove embedded metadata before storing them privately.
• Payment is handled entirely by Razorpay. We never see or store your card or UPI details.

How we use it

• To build, publish, and deliver your surprise page.
• To email you about your order — or, for a “build it for me” request, to email our team your brief.
• To process your payment through Razorpay.
• To keep the service secure and prevent abuse, including rate-limit records and restricted audit records of administrative actions and PIN changes.

Who processes your data

We rely on a small number of trusted providers, each receiving only what it needs:

• Supabase — manages account authentication and hosts order and page content.
• Vercel — hosts the application and processes incoming requests.
• Razorpay — processes payments.
• Resend — sends transactional email (such as order and request notifications).

Cookies

Our site uses essential authentication, draft, checkout and gift-unlock cookies. This browser stores only a draft identifier for resuming; it does not store the PIN or draft content in local storage. New uploaded photos are private. Older pages may contain external photos or audio; those hosts receive connection information when media loads. YouTube and Instagram videos load only when you choose to load them and follow their own policies.

How long we keep it

Unsubmitted builder drafts expire after seven days. Scheduled cleanup removes expired drafts and orphaned uploads when enabled. Published pages have no automatic age-based deletion at present; this is not a lifetime hosting guarantee. Signed-in owners can take a page offline immediately or queue deletion of its content. Content deletion runs separately from removing access. Payment and audit records may be retained for security, legal or accounting purposes; backup copies follow the operator’s backup expiry schedule.

Your choices

Signed-in owners can use My pages to take a page offline or request content deletion. To request a data export, exercise another privacy right or get help with a guest order, email hello@surprisepages.in or use the contact page.

Children

Do not include another person’s personal information or photographs without the appropriate permission, including permission from a parent or guardian where required. Contact support if a page includes information about a child that should be removed. We review requests before disclosing information or changing ownership.

Changes to this policy

If we change how we handle your data, we will update this page and revise the “last updated” date above.

Contact

Questions about your privacy? Email hello@surprisepages.in.