Privacy Policy

Your account. Your email address, name and profile photo when you sign in, and anything you add to your profile: a bio, phone number, company, job title and social media handles.

Events you host. The event name, description, cover image, date and time, location (address and map coordinates), settings and the registration questions you ask, plus announcements and updates you send to guests.

Events you register for. The name, email and, if the host asks, phone number you enter, your answers to the host’s questions (which can include a signature or acceptance of the host’s terms), your registration status, your ticket code and when you were checked in.

Tickets you buy. The ticket, the amount, the payment status and the payment reference. Tickets are paid by Fonepay QR in your own banking or wallet app, so we never see your bank login or card details.

Payouts and refunds. The bank account details (account name, account number, bank and branch) that hosts give us for payouts and guests give us for refunds. Our staff use them to send the money by bank transfer themselves. We don’t use a transfer partner.

Photos. Profile pictures, Page and event covers, and event photos uploaded by hosts and guests. If you use Find my photos, the selfie you take (see section 2).

Pages and listings. Pages you run and the venue and service listings you publish, including the contact name, email and phone number shown on them.

Chat messages. The messages you send and receive in Mela.

Reports and blocks. Content or people you report, why, and who you block.

Invites. When a host invites you, we receive the name, email address or phone number they entered, and whether you accepted, declined or told us you don’t recognise the invite.

Information from your device, only with your permission. In the mobile app you can allow:

• Location, to show events near you and to pin where your event is. We use your approximate location for nearby events, and we don’t track your location in the background. Without it, we estimate a rough area from your activity or IP address.
• Camera and photos, for profile pictures, covers, event photos, Find my photos selfies and scanning tickets at the door.
• Notifications, to tell you about your events and registrations.

Technical information. Sign-in session records, and the logs our servers keep when you use Mela (such as IP address, browser or device type and the pages requested), which we use to keep Mela secure and working.

Find my photos helps guests find themselves in an event’s photos. It is off unless you turn it on.

• We only use face data when you opt in by taking a selfie.
• Your selfie is turned into a face signature, a set of numbers that describes your face.
• Faces in that event’s photos are matched only against guests who opted in.
• Matching is done by Amazon Web Services’ Rekognition service. AWS processes face data only to provide this service for us, and does not use it to train its models.
• You can choose to keep your selfie and face signature on your account. It is used only to find you in photos of your events.
• We never use face data for marketing, ads or analytics, and we never sell it.
• Turning matching off, deleting your selfie or face data, or deleting your account removes your face data, including from Rekognition.

• To provide Mela: sign you in, publish events, Pages and listings, take registrations, sell tickets, run check-in, deliver chat messages, find you in event photos if you ask, and show your notifications.
• To send payouts to hosts and refunds to guests.
• To send messages you need: sign-in links, confirmations, tickets, invites and updates from hosts of your events.
• To show public events in Explore, on city pages and in search engines and link previews, when the host makes them public.
• To keep Mela safe: review reports, prevent fraud, spam and abuse, and enforce our terms.
• To fix problems and improve Mela.
• To comply with the law.

Where the law asks for a legal basis, we rely on performing our agreement with you, our legitimate interest in running a safe and useful service, your consent (for device permissions, which you can withdraw in your device settings) and legal obligations. For face data, we rely on your explicit consent.

• Hosts. When you register for an event, its host sees the information you entered and your answers, and can contact you about the event. Hosts are responsible for how they use it.
• Other guests and the public. Public event pages, Pages and listings, and your public profile (name, photo, bio and social handles), can be seen by anyone. If a host shows the guest list, other guests can see that you are going. The host sees their event’s photos and which opted-in guests were found in them; a guest sees the photos they were found in. Chat messages can be seen by the people in the chat.
• Service providers who run parts of Mela for us, under contracts that limit them to doing so:
  • WorkOS, for sign-in: your name, email and sign-in details.
  • Resend, for email: your email address and the message.
  • Aakash SMS, for texts in Nepal: your phone number and the message.
  • Firebase Cloud Messaging by Google, for push notifications: your device’s push token and the notification.
  • Fonepay, for ticket payments: the amount and payment reference.
  • Amazon Web Services, for our servers, file storage and Rekognition face matching: the information Mela stores, and, if you use Find my photos, your selfie, face signature and the event’s photos.
  • Cloudflare, for image storage and delivery: the images uploaded to Mela.
  • Vercel, for running the website: the pages you request and technical information.
  • Google Maps and Apple Maps, for maps and place search: the places you search for and the map areas you view.
  Each provider must protect personal data to at least the standard of this policy.
• Authorities and others, when the law requires it or when it is needed to protect someone’s safety or rights.
• A buyer or successor, if Mela is merged, sold or reorganised, under this policy.

We do not sell personal information, and we do not share it with advertisers.

We use a small number of cookies and similar storage that Mela needs to work: a secure session cookie that keeps you signed in, and settings such as your light or dark theme. We don’t use advertising or cross-site tracking cookies.

We keep your account information while your account is open. Event and registration records are kept so hosts can see their history and guests can see their tickets, until the account that owns them is deleted.

• Selfies and face signatures: until you turn matching off, delete them, or delete your account. An event’s face collection is deleted when the event is deleted.
• Chat messages: while your account is open.
• Payment and payout records: as long as the law requires.
• Reports: as long as we need them to enforce our terms.

When you delete your account, we delete or anonymise your information within 30 days, except for copies in backups that expire on their own schedule and records we must keep by law or to resolve disputes.

• Edit your profile in the app at any time.
• Delete your account yourself in Account settings → Delete account, on the web or in the app. See how to delete your account.
• Delete your face data at any time. This removes your selfies and face signatures.
• Withdraw your consent at any time: turn off Find my photos or face matching, or change device permissions in your phone’s settings.
• Block a person or Page, and report content or people, in the app.
• Decline an invite, or tell us you don’t recognise it, from the invite link.
• Ask us for a copy of your information, to correct or delete it, or to object to or restrict how we use it, by writing to hello@mela.so. We will reply within 30 days.

If you registered for someone’s event and want your information removed from it, you can also ask the host. You have the right to complain to your local data protection authority.

We protect information with encryption in transit, access controls and by keeping only what we need, such as storing sign-in tokens as hashes. No service is perfectly secure; if a breach affects you, we will tell you as the law requires.

Mela is run from Nepal, and our service providers may store and process information in other countries, including the United States and the European Union. When we transfer information, we use providers that protect it to the standards described here.

Mela is not meant for children under 16, and we don’t knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

We will update this policy when Mela changes. We will change the date at the top and, for significant changes, tell you in the app or by email first.

Questions or requests about your privacy: hello@mela.so