Data Protection & Security

Blobly collects only the personal data strictly required to deliver, secure, and operate the event platform:

• Account and identity data: Your email address, chosen username, display name, authentication credentials (managed securely via Firebase Authentication), and your profile avatar (including image provided by Google if you choose Google Sign-In).
• Profile information: Optional details you provide to personalize your verse, such as a biography, custom header banner, and links to public social profiles.
• Age and consent records: Confirmation of whether you are 18 years of age or older, parental or guardian consent records where applicable, and your cookie preference selections.
• Event and organization data: Information submitted by event organizers to create and manage events, including event titles, descriptions, categories, dates, venue locations, ticket/pass definitions, and custom registration questionnaires.
• Registration and attendance data: Records created when an attendee RSVPs or registers for an event, including ticket pass selections, QR code check-in timestamps, and responses submitted to organizer questions for that event.
• Technical and security metadata: IP addresses, request timestamps, and strictly necessary session cookies utilized solely for authentication and protecting the platform against automated attacks and abuse.

We process personal data only for lawful, clearly defined purposes connected directly to Blobly's event services:

• Delivering event services: Enabling organizers to publish events and manage attendees, and enabling attendees to discover events, register, receive passes, and check in smoothly.
• Account authentication and security: Verifying user identity, maintaining active sessions, preventing unauthorized access, and protecting accounts from credential stuffing.
• Event-specific communication: Delivering critical transactional messages, such as RSVP confirmations, digital ticket passes, waitlist status updates, and organizer announcements regarding venue or schedule changes.
• Platform safety and integrity: Enforcing our Terms of Service, preventing spam, stopping fraudulent registrations, and resolving technical errors.
• Legal and statutory compliance: Adhering to applicable regulatory obligations and responding to lawful requests from Indian authorities.

Personal data entrusted to Blobly is processed with strict adherence to purpose limitation and data minimization:

• No data brokering or sales: Blobly does not sell, rent, monetize, or trade user personal data or attendee lists to advertisers, data brokers, or commercial third parties.
• No behavioral advertising: We do not deploy cross-site tracking pixels, behavioral advertising networks, or third-party profiling scripts.
• Direct, functional communication: We only send transactional emails and essential product notifications directly related to your account or events you organize or attend. We do not send unsolicited marketing blasts.
• Algorithmic transparency: Automated processing is restricted to explicit, functional product rules (such as priority waitlist sorting for active Attendee Plus subscribers or promotional code validation). We do not conduct automated profiling that produces legal or discriminatory effects on individuals.

Blobly maintains clear demarcations of responsibility regarding data access and processing roles:

• Blobly as Data Fiduciary: Under Indian data protection principles, Blobly acts as the Data Fiduciary. We determine the purpose and means of processing personal data on the platform, establish security protocols, and remain directly accountable to you (the Data Principal).
• Authorized platform staff: Access to user databases is limited to authorized engineering and operations personnel under strict role-based access control, granted only when required for maintenance, security monitoring, or resolving user support inquiries.
• Event organizers: Organizers can access only the specific registration details submitted by attendees for their specific events, strictly for running those events.
• Third-party Data Processors: Contracted infrastructure vendors that process data on Blobly's behalf under binding data processing terms and confidentiality obligations.
• Regulatory and legal authorities: We disclose personal data only when strictly required by applicable Indian law, a valid summons, or a binding court order.

Blobly relies on trusted, specialized infrastructure providers to host and run the platform. These entities act as Data Processors and process data strictly according to our documented instructions:

Note on payments: Automated payment processing is not connected on Blobly. Paid ticketing and plan activations are arranged directly over verified email communication, meaning no payment card or banking numbers are processed or stored on our servers.

When you register for or RSVP to an event, the event's organizer receives access only to the information necessary to organize, communicate with, and admit attendees:

• Information visible to the organizer:
  • Your display name, username, and public profile photo.
  • Your registered email address (to contact you regarding event logistics and passes).
  • Your selected pass tier, registration timestamp, and QR check-in status.
  • Answers you submitted to custom registration questions configured for that event.
• Information NEVER visible to organizers:
  • Your account password or authentication security tokens.
  • Your date of birth, age verification details, or parental consent records.
  • Your event history or registrations with other organizers on Blobly.
  • Your private account settings, saved events, or billing records.

We protect attendee privacy from other attendees and the public across all event pages:

• Public event details: All visitors and attendees can view the public event page, including the title, schedule, venue, description, ticket options, and organizer profile.
• Public attendee lists (“Who's Going”): Only if the event organizer has explicitly enabled public attendee visibility on the event, confirmed attendees' public profiles (name, username, avatar, and verification badge) are shown.
• Private contact information: Other attendees can never see your email address, your answers to custom registration questions, your check-in history, or any private profile details.

We employ multi-layered technical, administrative, and physical safeguards to defend your data against unauthorized access, loss, or alteration:

• Encryption in transit: All data exchanged between your browser and Blobly is encrypted using modern Transport Layer Security (TLS/HTTPS).
• Encryption at rest: Application data and uploaded media are stored on encrypted cloud infrastructure managed by Google Cloud and Cloudinary.
• Database access control: Data access is governed by granular server-side rules and Firebase security rules, verifying that only authenticated users can read or write authorized resources.
• Brute-force and rate protection: Sensitive authentication, OTP, and promo endpoints are guarded with automated rate limiting to prevent credential stuffing and automated attacks.

Blobly adheres to storage limitation principles, retaining personal data only for as long as needed to fulfill the purposes for which it was collected:

• Active accounts: Profile, event, and registration records remain active as long as you maintain your account on Blobly.
• Short-lived data: Ephemeral data such as one-time passwords (OTPs) and expired system notifications are automatically purged on fixed lifecycle schedules.
• Account closure: When you delete your account, your personal profile data, credentials, and private identifiers are permanently deleted or anonymized from active databases within standard operational timelines, retaining only records required by law.

As a user and Data Principal under Indian digital data protection principles, you are entitled to exercise the following rights regarding your personal data:

• Right to access: You have the right to request a summary of the personal data processed by Blobly and the identities of third-party processors with whom data has been shared.
• Right to correction and updating: You can edit and update your name, avatar, bio, social links, and account details directly in your profile settings at any time.
• Right to erasure: You have the right to request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected.
• Right to grievance redressal: You have access to a readily available grievance mechanism to resolve questions or concerns regarding your privacy and data processing.

You have full authority to request the deletion of your account and all associated personal data at any time:

• How to submit a request: Send an email from your registered Blobly account address to support@blobly.in with the subject line “Data Deletion Request”.
• Verification: To safeguard against unauthorized deletion, we may verify account ownership before executing the request.
• Execution timeline: Confirmed deletion requests are executed promptly, erasing profile details, uploaded assets, and personal identifiers from active platform storage.

Blobly maintains documented procedures to detect, contain, investigate, and mitigate any potential security incident or personal data breach:

• Detection and containment: Continuous platform monitoring allows our team to identify anomalous activity, isolate affected components, and halt potential exposure immediately.
• Mandatory notification: In the event of a verified personal data breach, Blobly will notify the Data Protection Board of India and affected users without undue delay, in accordance with the applicable reporting rules under the Digital Personal Data Protection framework.
• Transparency and remediation: Breach notifications will clearly describe the nature of the incident, the categories of personal data involved, potential risks, and actionable remediation measures taken to protect users.

For any inquiry, question, request to exercise data rights, or privacy grievance, contact our dedicated data protection point of contact:

Blobly operates within the jurisdiction of India and structures its data handling practices in alignment with the primary statutory frameworks established by the Government of India:

• Digital Personal Data Protection Act, 2023 — Ministry of Electronics and Information Technology (MeitY)
• Digital Personal Data Protection Rules, 2025 — Ministry of Electronics and Information Technology (MeitY)

Transparency Disclosure: This document serves as a factual, transparent disclosure of Blobly's actual technical and organizational data protection practices. It is an informational resource published for our community, not an independent formal data audit report. Blobly is not described as “DPDP certified” or “DPDP audited,” as no independent third-party statutory certification or audit has been conducted.