Privacy Policy

This Privacy Policy explains how Kodeac Software Solutions Private Limited ("Kodeac", "MomentFolk", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you use the MomentFolk website, Android application, iOS application, and related services.

Kodeac Software Solutions Private Limited is the operator of MomentFolk and, where applicable, acts as the relevant data fiduciary, controller, or business responsible for personal information processed through the Platform.

Our registered office is:
Door No. 43-76-16, Block: 76, Ajith Singh Nagar, Vijayawada – 520015, Andhra Pradesh, India.

MomentFolk is operated from India and may be made available to users in India, the United Kingdom, and the United States.

1. Information We Collect

The information we collect depends on how you use MomentFolk.

1.1 Account Information

When you create or maintain an account, we may collect:

• name;
• email address;
• account identifiers;
• profile information;
• authentication information; and
• account preferences.

1.2 Provider Information

Providers may supply:

• name;
• phone number;
• email address;
• business or studio name;
• city or service area;
• profile photograph;
• service categories;
• business descriptions;
• experience;
• pricing;
• portfolio photographs and videos;
• social-media information;
• Instagram account information made available through authorized integration; and
• other profile information.

Because Provider profiles are designed for discovery, information intentionally published on a Provider profile may be publicly accessible without login.

1.3 Enquiries

When a Customer submits an enquiry, we may process information such as:

• Customer identity and contact details;
• selected Provider;
• service requirements;
• event or project details;
• city or service location;
• dates;
• messages;
• reference materials; and
• enquiry status.

1.4 Communications

Where communications occur through MomentFolk, we may store message and chat history. Communications and personally identifiable information stored by MomentFolk are protected using encryption and other security controls appropriate to the relevant system and data.

We may retain communications for service operation, security, fraud prevention, support, enforcement, evidence, and legal compliance.

1.5 Customer Reference Content

Where enabled, Customers may upload photographs, files, descriptions, inspiration, or other reference material.

Customers should only upload material they have the right to share.

MomentFolk does not treat submission of reference content for an enquiry as automatic permission to use that material in public advertising. Additional authorization may be sought for promotional use where appropriate or legally required.

1.6 Provider Portfolio Content

Providers may upload photographs, videos, text, and other portfolio content.

Providers are responsible for ensuring they have appropriate rights, permissions, releases, and consents for identifiable individuals and other protected material appearing in their uploads.

1.7 Technical and Usage Information

When you use MomentFolk, we may automatically collect information such as:

• IP address;
• browser type;
• operating system;
• device type;
• app version;
• session information;
• timestamps;
• pages or features used;
• diagnostic information;
• security logs;
• network information; and
• cookie or similar technology identifiers where applicable.

1.8 Location Information

MomentFolk may process the city, service area, or event location that you select or provide. MomentFolk does not currently require precise GPS/device location for its ordinary service-discovery functionality.

If precise location functionality is introduced later, we will provide appropriate notice and obtain permission where required.

1.9 Social-Media Information

Providers may connect an Instagram account through an authorization process.

Where this feature is used, we may receive information permitted by the Provider and made available by the relevant platform according to the permissions requested.

We do not receive a Provider's social-media password through a standard OAuth authorization process.

2. Why We Use Personal Information

Depending on the context and applicable law, we use personal information to:

• create and administer accounts;
• authenticate users;
• create and display Provider profiles;
• allow Customers to discover Providers;
• process enquiries;
• enable Customer–Provider communication;
• disclose Provider contact details after approval where configured;
• operate Platform functionality;
• provide support;
• send service-related communications;
• administer Provider subscriptions;
• investigate reports and complaints;
• detect fraud, spam, scams, abuse, plagiarism, and security threats;
• enforce our Terms and policies;
• protect users and Platform integrity;
• maintain records;
• diagnose technical problems;
• monitor performance;
• improve MomentFolk;
• comply with legal obligations;
• establish, exercise, or defend legal claims; and
• send marketing communications where permitted by applicable law.

We will obtain consent where consent is required by applicable law.

3. Legal Bases Where Applicable

Depending on the jurisdiction and activity, our processing may rely on one or more legally recognized grounds, including:

• your consent;
• processing necessary to provide a service you requested or perform a contract with you;
• compliance with legal obligations;
• legitimate interests where recognized by applicable law and not overridden by your rights;
• prevention and investigation of fraud or security incidents; and
• establishment, exercise, or defence of legal claims.

For individuals protected by UK data-protection law, we assess the appropriate legal basis for relevant processing under applicable UK law.

Where processing is based on consent, you may withdraw that consent as provided by applicable law. Withdrawal does not ordinarily make prior lawful processing unlawful.

4. Public Provider Profiles

Provider profiles are intended to be publicly discoverable.

Information a Provider chooses to publish may therefore be accessible to:

• Customers;
• other visitors;
• search engines where indexing is permitted;
• persons who receive links to the profile; and
• other internet users.

Providers should not publish information they do not want publicly accessible.

Contact details designated for approved enquiries may be restricted to the relevant Customer rather than publicly displayed.

5. How We Share Information

We may disclose information in the following circumstances.

5.1 Between Customers and Providers

Information necessary to facilitate an enquiry or approved connection may be shared between the relevant Customer and Provider.

5.2 Service Providers and Infrastructure Partners

We use third-party technology and service providers to operate MomentFolk.

Current or planned providers include services used for:

• database, authentication, and backend infrastructure, including Supabase;
• networking, security, delivery, or infrastructure, including Cloudflare;
• transactional and other email services, including Brevo;
• push notifications, including Firebase; and
• technical monitoring and observability, including Grafana-related services/infrastructure.

The precise provider, processing location, and role may change as our technical infrastructure develops.

We require service providers to process information for authorized purposes and subject to appropriate contractual and security protections where required.

5.3 Legal and Safety Reasons

We may disclose information where reasonably necessary to:

• comply with law, regulation, court orders, or lawful governmental requests;
• protect rights or safety;
• investigate fraud or abuse;
• enforce agreements;
• respond to intellectual-property claims; or
• establish, exercise, or defend legal claims.

5.4 Business Transactions

Information may be disclosed in connection with a merger, acquisition, financing, restructuring, sale of assets, insolvency process, or similar corporate transaction, subject to applicable law.

6. We Do Not Sell Personal Information

MomentFolk does not sell users' personal information to advertisers.

We do not share Customer or Provider personal information with advertisers for cross-context or targeted advertising as part of our current business model.

If our practices materially change, this Privacy Policy and any legally required choices or notices will be updated before such processing is introduced.

7. Analytics and Cookies

MomentFolk may use cookies, SDKs, local storage, or similar technologies for functions such as:

• authentication;
• security;
• session management;
• preferences;
• essential Platform functionality;
• performance; and
• analytics, where implemented.

Where non-essential analytics or similar technologies require consent under applicable law, MomentFolk will provide an appropriate consent mechanism before activating them for affected users.

Because MomentFolk is approaching beta and its analytics configuration may evolve, the production cookie/SDK implementation should be reflected in the live cookie notice or consent interface before launch.

8. Marketing Communications

MomentFolk may send promotional email, push, or other marketing communications where permitted by applicable law.

Where consent is required, marketing will be sent only on an appropriate consent basis.

You may unsubscribe from marketing emails using the unsubscribe mechanism provided in the communication or change available communication preferences.

Service, security, account, legal, and transactional communications may still be sent where necessary even if you opt out of marketing.

9. Promotional Use of Content

Provider portfolio content may be used, subject to the Provider Terms and applicable law, to promote the Provider's MomentFolk profile and MomentFolk itself.

Customer-submitted reference material is treated differently. MomentFolk will not treat ordinary submission of Customer reference content as blanket authorization for unrelated public advertising.

Where MomentFolk wishes to feature Customer content, testimonials, photographs, or identifiable Customer material in public marketing, we may request separate permission where appropriate or required.

10. International Processing and Transfers

MomentFolk is maintained from India but uses technology providers that may operate infrastructure in multiple countries.

Accordingly, personal information may be processed or stored outside the country in which a user resides.

Where applicable data-protection law imposes requirements on international transfers, we will use legally recognized safeguards or other permitted transfer mechanisms as required.

For users in the United Kingdom, this may include applicable UK international data-transfer safeguards where required.

The location of individual infrastructure components may change as vendors and hosting configurations change.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, security, fraud prevention, dispute handling, legal compliance, and establishment or defence of claims.

When a user deletes an account, MomentFolk aims to delete or anonymize ordinary account information from active systems within 90 days, unless longer retention is reasonably necessary or legally required.

Certain information may be retained for longer where necessary for:

• fraud or abuse prevention;
• security;
• financial or tax records;
• legal compliance;
• pending disputes;
• enforcement records;
• intellectual-property complaints;
• litigation or regulatory matters; or
• other lawful purposes.

Backups

Deleted information may remain temporarily in encrypted or access-restricted backups after removal from active systems.

MomentFolk will maintain a defined backup-retention and purge process designed to remove deleted data from ordinary backup cycles within a reasonable period, subject to security, disaster-recovery, and legal-hold requirements.

Information retained only in backups will not ordinarily be restored to active use except where required for disaster recovery, security, or legal purposes.

12. Account Deletion

Customers and Providers may use available Platform settings to initiate account deletion or may contact us where assistance is required.

Deletion may not result in immediate erasure of every record where retention is legally permitted or required.

Public Provider profile information will be removed or deactivated within a reasonable operational period following valid account deletion, subject to legitimate retention exceptions.

13. Security

MomentFolk uses administrative, technical, and organizational safeguards designed to protect personal information.

Depending on the relevant system, measures may include:

• encryption in transit;
• encryption or equivalent protection for stored sensitive data where appropriate;
• authentication controls;
• restricted access;
• infrastructure security;
• monitoring and logging;
• security controls;
• backups;
• least-privilege access practices; and
• incident-response procedures.

No online system can be guaranteed completely secure.

If a personal-data breach occurs, we will assess and respond to it and provide legally required notifications to affected individuals or authorities where applicable.

14. Your Privacy Rights

Your rights depend on the laws applicable to you and may include rights to:

• obtain information about processing;
• access personal information;
• correct inaccurate information;
• update incomplete information;
• request deletion or erasure;
• withdraw consent where processing relies on consent;
• object to or restrict certain processing where applicable;
• request portability where applicable;
• complain or raise a grievance; and
• exercise other rights provided by applicable law.

Requests may be sent to info@momentfolk.app or, for formal grievances, to kamala@kodeac.in.

We may need to verify your identity before acting on certain requests.

Some rights are subject to lawful exemptions.

15. India

For users whose personal data is governed by Indian data-protection law, Kodeac will process personal data in accordance with applicable Indian legal requirements as they become operative and apply to the relevant processing.

Where legally required, users will be provided with appropriate notices, consent mechanisms, grievance channels, and rights mechanisms.

Nothing in this Privacy Policy is intended to reduce rights available under mandatory Indian law.

16. United Kingdom

Where UK data-protection law applies to MomentFolk's processing of individuals in the United Kingdom, we will process personal data in accordance with applicable requirements, including requirements relating to transparency, lawful processing, data-subject rights, security, retention, and international transfers.

UK users may also have a right to lodge a complaint with the competent UK data-protection supervisory authority.

Where applicable law requires MomentFolk to appoint a local representative or make additional jurisdiction-specific disclosures, MomentFolk will implement the required arrangement.

17. United States

Users in the United States may have additional privacy rights depending on their state of residence and whether the relevant statutory thresholds and conditions apply to MomentFolk.

Where an applicable U.S. state privacy law grants rights such as access, correction, deletion, portability, or rights concerning certain data disclosures, MomentFolk will provide those rights as required.

MomentFolk does not currently sell personal information or share it with advertisers for cross-context behavioral advertising.

Nothing in this section is intended to imply that every U.S. state privacy statute applies to MomentFolk regardless of its statutory scope or thresholds.

18. Children

MomentFolk accounts are intended for persons aged 18 or older.

MomentFolk does not knowingly permit children under 18 to independently create Customer or Provider accounts.

Provider portfolio content may depict children—for example, family or event photography—but the Provider is responsible for obtaining legally required parental, guardian, client, model, privacy, and publication permissions before uploading such material.

If you believe a child's personal information has been processed improperly, contact info@momentfolk.app.

19. Third-Party Platforms

MomentFolk may link to or integrate with third-party services such as Instagram, WhatsApp, or other external platforms.

Those services independently determine how they process information under their own privacy policies.

MomentFolk is not responsible for the independent privacy practices of third parties.

20. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in law, regulation, technology, vendors, Platform functionality, or our processing practices.

We will update the "Last Updated" date and provide additional notice or obtain consent where required by applicable law.

21. Grievance Officer

Privacy or Platform grievances may be addressed to:

Kamala Kanagala
Director / Grievance Officer
Kodeac Software Solutions Private Limited
Door No. 43-76-16, Block: 76, Ajith Singh Nagar, Vijayawada – 520015, Andhra Pradesh, India
Email: kamala@kodeac.in

22. Privacy Contact

For privacy requests, account-deletion assistance, data questions, and general privacy enquiries:

Email: info@momentfolk.app
Kodeac Software Solutions Private Limited
Door No. 43-76-16, Block: 76, Ajith Singh Nagar, Vijayawada – 520015, Andhra Pradesh, India
Website: momentfolk.app
© 2026 Kodeac Software Solutions Private Limited. All rights reserved.