Melá

Privacy Policy

Melá — Effective Date: May 17, 2026

This Privacy Policy ("Policy") describes how Melá ("the App," "we," "us," or "our"), operated by Santhosh Natesan, collects, uses, stores, and protects information obtained from users ("you" or "your") of the Melá mobile application and associated web services. By accessing or using the App, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must discontinue use of the App immediately.

1. Information We Collect

1.1 Account Information. When you authenticate via Sign in with Apple, Apple transmits to us your name and email address (which may be Apple's private relay address at your election). We collect and retain this information solely for the purpose of creating, identifying, and administering your user account.

1.2 User-Created Content. You may voluntarily provide personal information about individuals you add to the App, including but not limited to: full names, dates of birth, anniversaries, and other personally significant dates. You represent and warrant that you have the right to provide any third-party personal information you enter into the App.

1.3 Contact Information. With your express prior consent, the App may access your device contacts to facilitate the addition of persons to your account. You may also manually enter phone numbers. We store this data exclusively to enable invitation delivery and communication features within the App. We do not access, scan, or store your full address book without your affirmative opt-in.

1.4 Event Data. When you create events, we collect and store event details including event name, date, time, location, description, guest lists, RSVP responses, wishlist items, potluck contributions, and related metadata.

1.5 Photographs. If you choose to upload photographs to an event album, such media is stored on our servers and is accessible only to authenticated participants of that event.

1.6 Device Information. We collect your device's push notification token solely for the purpose of delivering notifications you have opted into. We do not collect device identifiers, IP addresses, or usage analytics.

2. Legal Basis for Processing

We process your personal data on the following legal bases:

Contractual necessity: Processing required to provide the App's core services to you
Consent: Where you have provided affirmative consent (e.g., contacts access, push notifications)
Legitimate interest: To maintain, secure, and improve the App, provided such interests are not overridden by your fundamental rights

3. Use of Information

We use the information collected strictly for the following purposes:

To provide, operate, and maintain the App's core functionality, including people management, event planning, and invitation delivery
To send push notifications for upcoming birthdays, events, and RSVP updates you have configured
To authenticate your identity and secure your account
To respond to your inquiries and provide customer support

We do not use your data for advertising, behavioral profiling, cross-app tracking, data brokering, or any purpose not expressly stated herein.

4. Disclosure of Information

We do not sell, rent, license, or trade your personal data to any third party. Disclosure is limited to the following circumstances:

Event participants: Persons you invite to an event may view event details and the guest list for that event, as an inherent function of the App
Service providers: We engage the following sub-processors, each bound by data processing agreements and obligated to implement appropriate technical and organizational safeguards:
- Supabase, Inc. (database hosting and authentication)
- Vercel, Inc. (web hosting and serverless compute)
- Apple, Inc. (authentication via Sign in with Apple; push notification delivery)
Legal compliance: We may disclose information if required to do so by law, regulation, subpoena, court order, or other governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others

5. Data Storage, Security, and Retention

Your data is stored in encrypted databases hosted by Supabase with servers located in the United States. All data transmitted between the App and our servers is encrypted using TLS 1.2 or higher. Authentication credentials are managed through Apple's secure identity services and are never stored in plaintext on our servers.

We retain your personal data for as long as your account remains active. Upon account deletion, all associated data is permanently and irreversibly removed from our production systems within thirty (30) days. Residual copies in encrypted backups are purged in accordance with our backup retention schedule, not to exceed ninety (90) days.

6. Your Rights

Subject to applicable law, you have the following rights with respect to your personal data:

Right of access: You may view all data associated with your account within the App at any time
Right to deletion: You may delete individual records or your entire account through the App's Settings screen, or by contacting us directly
Right to data portability: You may request a machine-readable export of your personal data by emailing us
Right to withdraw consent: You may revoke contacts access or push notification permissions at any time through your device settings
Right to rectification: You may correct inaccurate personal data through the App at any time

To exercise any of these rights, contact us at jusgiftd@gmail.com. We will respond to verified requests within thirty (30) days.

7. International Data Transfers

If you access the App from outside the United States, you acknowledge and consent to the transfer of your data to the United States, where our servers are located. We take appropriate measures to ensure that your data receives an adequate level of protection in accordance with applicable data protection laws.

8. Children's Privacy

The App is not directed to, and we do not knowingly collect personal information from, children under the age of thirteen (13), or the applicable age of digital consent in your jurisdiction. If we become aware that we have inadvertently collected personal data from a child under the applicable age, we will take prompt steps to delete such information. If you believe a child has provided us with personal data, please contact us immediately.

9. Third-Party Links and Services

The App may contain links to third-party websites or services (e.g., gift card providers). We are not responsible for the privacy practices of such third parties. We encourage you to review their privacy policies before providing any personal data.

10. Changes to This Policy

We reserve the right to modify this Policy at any time. Material changes will be communicated through the App or via email to the address associated with your account. Your continued use of the App following the posting of a revised Policy constitutes your acceptance of such changes. The "Effective Date" at the top of this Policy indicates when it was last revised.

11. Governing Law

This Policy shall be governed by and construed in accordance with the laws of the State of New Jersey, United States, without regard to its conflict of law provisions.

12. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Santhosh Natesan
Melá
Email: jusgiftd@gmail.com