Your privacy at T&P Connections Tour

1. Who we are and what this policy covers

Xcape Reality Private Limited ("Xcape", "we", "us", or "our") provides the invite-only T&P Connections Tour event apps and related support services. This policy covers the Bengaluru and Hyderabad editions, including the T&P Connections Tour 2026 – Hyderabad app.

We process information to operate the relevant event on behalf of, and in coordination with, the event organiser and authorised event team. The event organiser may separately explain how it uses registration or event information outside these apps.

2. Information we collect

Information you or the event organiser provides

• Invitation and account details: business email address, name, Firebase account identifier, event membership, role, and authentication records.
• Profile details: company, job title, industry or other event-profile information, plus an optional phone number, profile photo, and contact-sharing preferences.
• Event activity: QR credentials and authorised scans, check-ins, session attendance, booth or passport progress, points, leaderboard status, bookmarks, poll or quiz responses, questions, and feedback.
• Networking and user content: connection requests, accepted connections, chat messages, feed posts, comments, reactions, blocks, and reports. Your profile is not exposed to another attendee through networking until the applicable connection is accepted; phone sharing is separately optional.
• Support information: help-desk messages and information you include in a support or privacy request.

Information collected automatically

• App activity and diagnostics: pages or features used, notification opens, app version, platform, operating-system version, update status, crash or failure signals, timestamps, and limited technical logs.
• Device and notification data: push-notification token and a pseudonymous or hashed installation identifier used for notification delivery, secure updates, reliability, and fraud prevention.
• Service logs: network address and request metadata may be processed by our hosting, security, and cloud providers to deliver and protect the service.

3. Device permissions

The app may request camera access for QR scanning and, when you choose, taking a profile photo. It may request photo-library access when you choose an existing photo, and notification permission for event alerts. The app does not require precise location, contacts, microphone, Bluetooth, or an advertising identifier for its core operation.

4. How we use information

• verify invitations, authenticate users, maintain accounts, and assign event roles;
• provide agendas, QR entry and scanning, session and booth activity, networking, chat, feedback, notifications, help, and other selected event features;
• calculate verified attendance, passport progress, and approved points;
• moderate user content, investigate reports, prevent duplicate or fraudulent scans, secure the service, and maintain audit records;
• measure aggregate event engagement, troubleshoot issues, and maintain safe, compatible app updates; and
• respond to support, privacy, legal, and account-deletion requests.

We do not sell personal information. We do not use app information for third-party advertising or cross-app tracking.

5. When information is disclosed

We disclose information only as needed for the purposes above:

• Event organiser and authorised staff: to administer the event, provide support, review attendance and engagement, moderate content, and maintain safety.
• Other attendees: only through features you use, such as accepted connections, profile sharing, chat, feed posts, comments, and leaderboard participation.
• Service providers: including Google Firebase and Google Cloud for authentication, databases, file storage, functions, hosting, and notifications; Apple or Google for operating-system notification delivery and app distribution; and other approved infrastructure providers acting for us.
• Integrated services: if an event enables an external participation service such as Slido and you choose to open it, that service processes your interaction under its own privacy terms.
• Legal and safety reasons: when reasonably necessary to comply with law, enforce terms, protect users, investigate abuse, or establish and defend legal claims.
• Corporate changes: in connection with a merger, reorganisation, financing, or sale, subject to appropriate confidentiality and legal safeguards.

We require service providers handling personal information for us to apply protections that are at least equivalent to the commitments in this policy and applicable law.

6. Storage, security, and international processing

We use access controls, encryption in transit, restricted server-side operations, signed event credentials, audit logging, and other organisational and technical safeguards appropriate to the information and service. No system is completely secure, so we cannot guarantee absolute security.

Information may be processed in India and in other countries where our approved service providers operate. Where required, we use appropriate contractual or legal safeguards for cross-border processing.

7. Retention

We keep identifiable information only for as long as needed to run and support the relevant event, provide a post-event support window, meet legal or contractual obligations, resolve disputes, and protect the service. Event interaction records are generally scheduled for deletion or anonymisation within 90 days after the event ends and required event exports are complete. Configuration, aggregate statistics, security records, and audit evidence that no longer identify attendees may be kept longer.

Deletion may be delayed where information must be preserved for legal compliance, security, fraud prevention, dispute resolution, or the rights of another person. When retention is no longer necessary, information is deleted or anonymised.

8. Your choices and rights

• You can choose whether to provide an optional photo or phone number and whether to share optional contact information.
• You can decline camera, photo-library, or notification permission in device settings, although the related feature may then be unavailable.
• You may ask to access, correct, or delete your personal information; withdraw consent where processing depends on consent; or raise a privacy concern.
• You can request account and associated-data deletion using our account deletion page.

We may need to verify your identity, usually through the email address connected to the invitation or account. Your rights can vary by location, and lawful exceptions may apply. You may also have the right to contact the competent data-protection authority.

9. On-device and offline data

The app may temporarily store profile caches, content, bookmarks, pending scans, feedback, or recovery information on your device so event features can work reliably with limited connectivity. Signing out clears disposable account caches. You can remove remaining local app data by clearing the app's storage or uninstalling it; pending records that already synchronised with our servers remain subject to this policy.

10. Children

These are invitation-only business-event apps and are not intended for anyone under 18. We do not knowingly invite or create attendee accounts for children. Contact us if you believe a child has provided personal information through an app.

11. Changes to this policy

We may update this policy when the apps, event features, providers, or legal requirements change. We will update the effective date and provide additional notice where required. Material changes apply prospectively unless law permits otherwise.