Privacy Policy

Virunnu Technologies (“Virunnu”, “we”, “our”) operates the Virunnu platform for booking convention halls, wedding venues, and connecting with catering services across Kerala. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it.

This policy applies to all users of the platform — customers, venue owners, and caterers. By using Virunnu, you consent to the practices described here.

Information you provide

• Mobile number: Collected at registration; used for OTP authentication and account identification. This is your primary identifier on the platform.
• Name: Collected during onboarding; displayed on booking confirmations and shared with venue owners when you make a booking.
• Venue & hall details: Provided by venue owners — business name, address, city, hall descriptions, capacity, amenities, and slot pricing.
• Hall photos: Images uploaded by venue owners to describe their halls. These are displayed publicly to all visitors.
• Caterer details: Provided by caterers — business name, service area, cuisine type, menu items with prices, and contact information.

Data generated by platform use

• Booking records: Venue, hall, date, slot, amount paid (advance and remaining), payment method, and booking status for every reservation.
• Session data: An encrypted, HTTP-only session cookie that identifies your account across requests. It contains your user ID and role; it does not contain personal data in readable form.
• Access logs: IP address, browser type, pages accessed, and time of access — retained for security, fraud detection, and debugging.

Data from third parties

• Razorpay: When you pay online, Razorpay returns a payment reference ID and a status (success / failure). We do not receive or store your card number, UPI ID, bank account number, or CVV. Those are handled by Razorpay under their own privacy policy and PCI-DSS certification.

We do not use your data for advertising, retargeting, or any form of commercial profiling. We do not create inferred attributes or interest categories about you.

Virunnu uses one-time passwords sent to your registered mobile number as its only authentication method. There are no passwords stored on the platform. OTP codes are generated fresh for each login request, expire after 10 minutes, and are permanently deleted after use or expiry — whichever comes first.

OTPs are currently delivered via SMS. The SMS delivery service receives only your mobile number and the OTP code; it does not receive any other personal data.

We share personal data only when necessary and only as described below. We never sell or share data with advertisers, data brokers, or marketing companies.

Venue owners

When you make a booking at a venue, the venue owner receives your name, mobile number, booking date, slot, and amount. This is the minimum required for them to manage and honour your reservation. Venue owners may not use this information for any purpose beyond serving your booking.

Caterers

Virunnu does not share customer personal data with caterers automatically. Caterer listings are publicly visible. If a customer contacts a caterer through a phone number or contact detail published on the listing, that engagement is direct and outside Virunnu's data-processing scope. Caterers who receive customer inquiries through Virunnu may not use contact details for unsolicited marketing.

Razorpay (payment processing)

When you initiate a payment, Virunnu passes your booking amount and a unique order reference to Razorpay. Razorpay collects and processes your payment credentials directly and independently under their own privacy policy. Virunnu receives only a payment status confirmation and reference ID in return.

Legal requirements

We may disclose personal data if required by Indian law, a court order, or a direction from a lawful government authority. We will, where legally permitted, attempt to notify the affected user before disclosure.

Business transfers

If Virunnu Technologies is acquired by or merges with another entity, personal data held by us may be transferred to the successor, subject to equivalent privacy protections. You will be notified of any such transfer.

We retain your data for as long as your account is active, or as required to deliver services, meet legal obligations, resolve disputes, and enforce our agreements.

After account deletion, we may retain anonymised or aggregated data that cannot be linked back to you for the purpose of analytics and platform improvement.

Under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, you have the following rights in relation to your personal data:

• Access: Request a summary of the personal data we hold about you and how it is being used
• Correction: Ask us to correct data that is inaccurate or incomplete
• Erasure: Request deletion of your account and associated personal data, subject to our legal retention obligations (e.g., tax records cannot be deleted early)
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time; this will not affect processing already carried out
• Grievance redressal: Lodge a complaint with our Grievance Officer if you believe your data rights have not been respected

To exercise any of these rights, email privacy@virunnu.in with your registered mobile number and a description of your request. We will respond within 30 days as required under Indian law.

We protect your data with the following technical and organisational measures:

• HTTPS / TLS encryption for all data transmitted between your device and our servers
• HTTP-only, Secure session cookies — inaccessible to browser scripts, preventing client-side theft
• No password storage — OTP-only authentication eliminates the risk of password breaches
• Database access restricted to application services within a private network
• Payment credentials handled entirely by Razorpay under PCI-DSS Level 1 compliance — Virunnu never touches your card or banking details
• Regular security reviews of application code and infrastructure

No system can guarantee absolute security. If you discover a security vulnerability in Virunnu, please report it responsibly to security@virunnu.in before public disclosure. We take all reports seriously and will respond promptly.

Virunnu uses a single session cookie (vr_session) to maintain your authenticated session. It is:

• HTTP-only — cannot be accessed or modified by JavaScript running in your browser
• Secure — transmitted only over HTTPS connections
• Scoped to this domain — not shared with any third-party site
• Session-lived — automatically expires after 7 days or when you log out

We do not use advertising cookies, tracking pixels, analytics cookies (including Google Analytics), or any third-party cookie. Blocking the vr_session cookie will prevent you from logging in, as it is strictly necessary for authenticated platform use.

Virunnu is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal data from minors. If you believe that a person under 18 has created an account, please notify us immediately at privacy@virunnu.in and we will delete the account without delay.

Catering listings may include links to external websites or social media profiles. We have no control over these third-party sites and their privacy practices. Clicking such links takes you outside Virunnu's platform and this Privacy Policy no longer applies. We encourage you to review the privacy notice of any third-party site you visit.

Razorpay is our sole payment processing partner. Their data practices are governed by the Razorpay Privacy Policy, which is available on their website.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. The effective date at the top of this page shows when the current version came into effect.

Material changes — those that significantly affect how we handle your data — will be communicated to your registered mobile number or displayed prominently when you next log in. Minor clarifications may be made without explicit notice.

Continued use of Virunnu after any update constitutes your acceptance of the revised policy.