Privacy policy

Last updated: 25 October 2026

Snehpatrika lets you make festive invitations and greetings, share them on WhatsApp and collect RSVPs. This page explains what personal data that involves, why we use it, who else handles it, how long we keep it and what you can ask of us.

Who we are

Snehpatrika is a product of CodeSierra Tech Private Limited (“we”, “us”), which decides how your data is used.

For anything on this page, email [email protected].

No accounts

You don’t sign up or log in. Each card has a private edit link; we store only a scrambled form (a hash) of the secret in it, so only that link opens your card’s settings and replies. We don’t use advertising trackers, and we never sell personal data. We count visits with Google Analytics (see below). When you come from one of our ads or links, we note which one, so we know which ads work (see Cookies below).

If you make a card

We store what you put on the card:

• the design, language, colours and options you choose;
• which of our ads or links brought you, if you came from one in the 7 days before;
• the names, title, message, date, time, venue and map link you type;
• any photo or logo you add;
• your WhatsApp number, if you give it (Invite Plus needs it). We use it only to send you your edit link and the updates you ask for, and to fill in the payment form for you.

Anyone with the link to your card can see it and its event page, including any photo on it, so share the link only with the people you invite. Event pages are hidden from search engines. When a card’s link is shared on WhatsApp, WhatsApp fetches its preview image to show in the chat.

If you reply to an invite

We store your reply: the name you type, whether you are coming, how many people, your food preference if the host asks, and your wish if you write one. Your reply goes only to the host, and to anyone the host gives a view-only guest list (an Invite Plus feature; it doesn’t show wishes). Your wish appears on the event page, with your name, only if the host has turned that on and the form told you so when you sent it. A host can also add a reply they received from you by phone.

Photos and logos

Photos and logos are converted on our server when you upload them, which removes hidden details such as the camera and the location where a photo was taken. Those for a card are used only on that card, its event page and the images and PDF made from it, and in its video if it is a video invite; photos for an AI family video only to make that video. Please add photos only of people who agree to it, and of children only with a parent’s or guardian’s consent.

Payments

Payments are handled by Razorpay. You enter your UPI, card or netbanking details on Razorpay’s payment screen; we never see or store them. We keep a record of each order: what was bought, the amount, Razorpay’s order and payment IDs, and whether it was paid. Razorpay’s own privacy policy covers what you give them.

WhatsApp messages

If you give us your number, we send your edit link, and any updates you ask for, through the WhatsApp Business Platform, which Meta runs. Meta processes your number and the message to deliver it. When you share a card yourself, you use your own WhatsApp; we see none of it.

If you write to our WhatsApp number, or tap a button in one of our messages, we use what you send only to answer you, about the cards made with your number. If you have bought something from us, what you type there goes, with your number and the card or order it is about, to our team on Telegram, so that a person can read it and answer you on WhatsApp; we delete it there within 30 days. Apart from that, we don’t store your messages. If you send us the code of a free video invite, we start that video and your number becomes the invite’s number. Our answers can include your card’s video, its private link, the number of replies and, for a paid card, the names of the latest guests who replied. To avoid answering the same message twice and to limit repeated messages, we keep your number in memory for about an hour and each message’s ID for about a day; while a customer who bought something is talking with our team, we keep their number in memory for 2 hours after their last message, so our automatic answers stay out of the conversation. We also store your number with the time of your last message for up to a day, so that a “your invite is ready” message can reach you as an ordinary reply.

Before we make a paid video (a video invite, an AI family video or a business video pack), you send a short code to our WhatsApp number instead of typing your number. The number we use for that order is the WhatsApp number you send the code from, and it is kept with the order. So that you don’t have to send a code again, the browser you used stays verified for 24 hours (see the sp_wa cookie below); after that we delete the record of the verification.

AI family videos and business greetings

If you order an AI family video, we use the photos you upload only to make your video; the message, the occasion, the event’s date, time and venue and anything you ask us to include only to make it; and your WhatsApp number to send you your video’s private link and tell you when the video is ready. The video clips are generated with Google Flow (Google’s AI video tool), which receives your photos for making your video only, under Google’s privacy policy. We delete the photos within 7 days after we deliver your video (or refund you).

Your video is 18–20 seconds long and is ready within 48 hours of payment. It plays on your private link for 2 months after it is ready. If you send it with “Send on WhatsApp”, the people you send it to get the video itself or its watch link, which shows the video and your message to anyone who has it. If you link your Snehpatrika invite, we store which invite it is; the video shows on the invite’s event page, to everyone with the invite’s link, only if you choose to show it there, and you can hide it again. After the 2 months, the video and both its links stop working, and we delete the video and your order’s details.

For business greetings, the customer or staff names you give us are used only to make your greetings: one image per name, in a ZIP file that only your private link can download. We delete the names and the ZIP file 30 days after your pack is ready (if we couldn’t make your pack, 30 days after that).

For business videos, the names you give us, with your business name, logo and greeting, are used only to make one video per name. To make them we send them to Google Cloud (Google), in its Mumbai, India region, which deletes them once each video is made (see Google’s privacy policy). The videos come to you in a ZIP file that only your private link can download. The WhatsApp number you verify when you order is kept with your pack, only to send you that link when your videos are ready. We delete the names, the number, the logo and the ZIP file 30 days after your pack is ready (if we couldn’t make your pack, 30 days after that).

Video invites

If you make a video invite, we use the title, message, date, time, venue, family name and photo you give, and the design you choose, only to make your video. To make it we send them to Google Cloud (Google), which runs our video maker in its Mumbai, India region. They are used there only for that, and deleted there once the video is made (and normally within a day in any case). Google handles them under Google’s privacy policy. We keep the finished video and a poster picture on our servers. They play on your card’s page, to everyone who has its link, and a free video ends with a Snehpatrika closing scene. We use your WhatsApp number to count the free videos made with it and to tell you when your video is ready. A free video starts only after you send us its code on WhatsApp. Until then we send nothing to the number you typed. We delete the video and the poster picture 30 days after the event (for a card with no event date, 30 days after it was made).

Google Analytics

We use Google Analytics, a service of Google LLC, to count visits and what is used on Snehpatrika: which pages are opened, which designs are chosen, how many cards are made, payments, downloads and shares, and the answers guests give (only coming, maybe or not coming). From your visit Google also gets what any website gets: your browser and device type, screen size, language and the site you came from. It uses your IP address only to work out an approximate location, such as your city, and doesn’t store it.

We never send it names, phone numbers, messages, invite titles or private links. Event pages and private pages are reported without their address (for example, as “an invite page”), and a link’s details are left out, except the tag of the ad or link that brought you.

In India, Google Analytics is on when you open our site: it sets its cookies (_ga and _ga_<id>) unless you choose No thanks in “Cookie settings”. Elsewhere, it sets them only if you choose Allow on the bar at the bottom of the page. They hold a random number, so that a returning browser is counted once. Without them it gets only signals without any identifier (Google’s consent mode), from which it estimates the number of visits.

We have turned off Google’s advertising features: the data isn’t used for ads, ad personalisation or remarketing, and Google signals are off. Google keeps the data for 14 months, then deletes it. Google may process it on servers outside India, under Google’s privacy policy.

You can change your choice at any time with “Cookie settings” at the foot of this page, of the other pages of our site (such as the home page) and of invite pages. Your choice applies to every page of the site, including the private ones (your card’s private page, guest lists and video pages), which have no such link. Choosing No thanks also deletes the Google Analytics cookies from your browser.

Who else handles data

• Razorpay, for payments.
• Meta (WhatsApp), for the messages we exchange with you on WhatsApp.
• Telegram, where our team reads what customers who bought something type to our WhatsApp number, with their number, to answer them (see Telegram’s privacy policy).
• Cloudflare, which our site runs behind to keep it fast and safe from attacks; it handles technical data such as IP addresses.
• Our hosting provider, whose servers store the data.
• For video invites and business videos, Google Cloud (Google), in Mumbai, which makes the videos from your photo, logo, names and text and deletes them afterwards (see Google’s privacy policy).
• Cloudflare Email Routing and our email provider, which receive the messages and orders you send to [email protected].
• For AI family videos, Google Flow (Google), which makes the video clips from your photos (see Google’s privacy policy).
• Google (Google Analytics), which counts visits and what is used on our site (see Google Analytics above).

They use it to provide their service, under their own terms and privacy policies. We don’t share personal data for advertising.

Cookies and storage on your device

We use what the site needs to work, one cookie that tells us which of our ads brought you, and Google Analytics’ cookies (in India unless you turn them off, elsewhere only if you allow them). Nothing goes to advertisers. Cookies:

• sp_src: set when you open the site from one of our ads or links that names itself (a tag such as “utm_source=meta” in the address). It holds only that tag, the same for everyone who used that link, and lasts 7 days. A card you make in that time is saved with it, so we can count which ads bring cards.
• sp_g_<card>: set when you reply to an invite, so you can change your reply later. It holds a random key and lasts as long as your reply is kept (until 30 days after the event).
• sp_o_<card>: set the first time you open an event page, so the host’s count of link opens counts you once. It holds only “1”, is sent only to that event page and lasts up to a year.
• sp_wa: set when you verify your WhatsApp number before a paid video. It holds a random key, is sent only to our server’s API, and lasts 24 hours and 30 minutes; with it, our server knows which number this browser verified, for 24 hours.
• sp_consent: your answer on the Google Analytics bar (Allow or No thanks), so we don’t ask again. It holds only that answer and lasts 6 months.
• sp_country: the country your connection comes from, as Cloudflare reports it (such as “IN”), so the site knows whether to ask about Google Analytics first. It holds only that code and is deleted when you close your browser.
• _ga and _ga_<id>: Google Analytics’ cookies, set in India unless you choose No thanks, and elsewhere only after you choose Allow. They hold a random number and last 6 months after your last visit.

While you make a card, your browser’s storage keeps:

• sp:draft:<design>: your unfinished card, so you don’t lose it;
• sp:created:<design>: the card you just made, until its ready screen opens;
• sp:cards: the cards made on this device, with their edit links and the number you gave, so you can open them again.

While Google Analytics runs, your browser also keeps, for the open tab only, a note of each payment and new card it has counted (sp:ga:…), so none is counted twice.

These stay on your device. You can delete them at any time in your browser’s settings.

When you pay, Razorpay’s checkout window may store its own data in your browser, under Razorpay’s privacy policy.

Technical data

Like any website, our servers and Cloudflare process technical data such as your IP address and browser to deliver pages. We keep IP addresses (and, for edit-link requests by WhatsApp and messages to our WhatsApp number, the phone number) in memory for up to a day to limit repeated requests and stop abuse. Server logs that record requests are kept for a limited time, for security and to fix problems.

How long we keep it

• Guest replies and wishes, photos on the card (and the images made with them) and the host’s WhatsApp number are deleted from our servers 30 days after the event (for a greeting, 30 days after it was made); cached copies expire.
• The card itself, its design and words, stays so that your links keep working. Email us and we will delete it from our servers; cached copies expire.
• Business greetings keep their logo and number until you ask us to delete them, so you can use them again.
• A business greeting pack’s customer names and ZIP file are deleted 30 days after the pack is ready, or 30 days after we couldn’t make it.
• A video invite’s video and poster picture are deleted from our servers 30 days after the event (for a card with no event date, 30 days after it was made); cached copies expire. The photo and text sent to Google Cloud to make it are deleted there once the video is made, and normally within a day in any case.
• The photos for an AI family video are deleted within 7 days after the video is delivered or the order is refunded.
• The time your number last wrote to our WhatsApp number is deleted after a day.
• A code to verify your WhatsApp number for a paid video is deleted once it expires (after 30 minutes) unused; the verified number is deleted from the verification record 24 hours after you sent the code (the order keeps its own copy, as described above). Our daily clean-up removes them within a day of that.
• What a customer who bought something types to our WhatsApp number is deleted from our team’s Telegram within 30 days.
• An AI family video is available for 2 months after it is ready. Then the video file is deleted, its private link and watch link stop working, and the order’s details are deleted: the WhatsApp number, the message, the event’s date, time and venue, what you asked us to include and the invite it was linked to. If the order is refunded, they are deleted 30 days after the refund. The record of the payment stays, without them.
• An AI family video order that is never paid is deleted with its photos 7 days after it was placed, and so are photos uploaded for a video that was never ordered. A business greeting pack that is never paid is deleted with its customer names 7 days after it was made. A photo or logo uploaded for a card that is never made, or that another photo replaced, is deleted 7 days after it was uploaded.
• Order records are kept as long as Indian tax and accounting law requires.
• Google Analytics keeps what it counts for 14 months, then deletes it.
• We keep daily copies of our database for 14 days, only so we can recover from a failure. Anything we delete, on schedule or because you asked, is gone from those copies within 14 days. We don’t use them for anything else.
• Launch list: the numbers on our pre-launch list are used only to send one WhatsApp message when Snehpatrika launches, and we delete the list within 30 days after that message goes out.

Your rights

You can ask what personal data we hold about you, ask us to correct or delete it, withdraw your consent (for example, to stop WhatsApp updates, or Google Analytics’ cookies with “Cookie settings”), and nominate someone to do this for you. Email [email protected] and tell us which card (its link) or which number it is about; we may need to check that the data is yours. We reply within 7 days. Withdrawing consent doesn’t affect anything we did before you asked.

If you have a complaint about how we handle your data, email the same address and we will respond within 7 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Children

Snehpatrika is meant for adults. Please don’t make a card if you are under 18.

Security

The site works only over HTTPS, private links are stored as hashes, and uploads lose their hidden details. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Changes to this policy

We will update the date at the top of this page whenever this policy changes. See also our terms and refund policy.