Privacy policy.

1. Introduction

CERMO ("we", "us", "our") operates cermo.online and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. We comply with applicable data protection laws including India's Digital Personal Data Protection Act (DPDPA) 2023, GDPR (EU/UK), CCPA (California), and PDPA (Singapore).

2. Information we collect

Personal information you provide:

• Name, email address, phone number
• Account credentials (encrypted, never stored in plain text)
• Event details (date, type, guest count, budget)
• Payment information (processed securely by Razorpay — we never store card data)
• Messages sent through AI chat
• Reviews and ratings

Automatically collected:

• Device information (browser, OS, screen size)
• IP address and approximate geolocation (for showing local vendors)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies

3. How we use your information

• To provide and personalize our event planning services
• To power AI recommendations (your chat data helps us find better vendors for you)
• To process bookings and payments
• To connect you with verified vendors
• To send booking confirmations, updates, and support messages
• To improve our platform and develop new features
• To detect and prevent fraud or abuse
• To comply with legal obligations

4. AI chat data

When you use CERMO AI, your messages are processed by Google's Gemini AI to generate responses. We do not use your chat data to train AI models. Chat history is stored in your account for your convenience and can be deleted at any time.

5. Data sharing

We share your information only in these cases:

• With vendors: When you make a booking, the vendor receives your name, event details, and contact information
• Payment processor: Razorpay processes payments securely (PCI-DSS compliant)
• AI providers: Groq and Google Gemini process chat messages (no personal data sent beyond chat content)
• Legal requirements: If required by law, court order, or governmental authority

We never sell your personal data to third parties.

6. International data transfers

CERMO operates globally. Your data may be stored and processed in India (Firebase servers), the United States (Google Cloud), or other locations. We ensure appropriate safeguards are in place for all international transfers including Standard Contractual Clauses where required.

7. Your rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data
• Withdraw consent at any time
• Export your data in a portable format
• Object to or restrict processing
• Lodge a complaint with your local data protection authority

To exercise these rights, email us at cermosupport@gmail.com

8. Data retention

We retain your data for as long as your account is active. After account deletion, we remove personal data within 30 days, except where required by law (e.g., financial records retained for 7 years).

9. Security

We implement industry-standard security measures including encryption in transit (TLS 1.3), encrypted storage, role-based access controls, regular security audits, and secure authentication via Firebase Auth.

10. Contact

Data Protection Officer: cermosupport@gmail.com

General inquiries: cermosupport@gmail.com