Privacy Policy
Last updated: 18 September 2026
This policy explains what personal data Jack Stephen Tucker ("we", "us") collects through www.hijack.co.in ("Hijack"), why we collect it, and what rights you have over it. Most of it concerns guests at a performance; section 7 covers performers, who have an account and about whom we hold more.
We are the Data Fiduciary for this data under the Digital Personal Data Protection Act, 2023 (DPDP Act). Our contact details are at the end of this policy.
1. Our approach
Hijack is designed to collect as little personal data as possible. As a guest you do not need an account to use it, you do not need to give us your name, and we never see your payment credentials. Performers do have an account, because we have to pay them — see section 7.
2. What we collect
Data you give us
| Data | When | Why |
|---|---|---|
| Song request details (song title, artist) | When you submit a request | To display and fulfil your request |
| Optional message | When you submit a request | To display alongside your request |
| Display name or nickname, if you choose to enter one | When you submit a request | To attribute your request publicly |
| Email address or mobile number, if you choose to enter one | When you submit a request | To confirm payment and notify you of the outcome |
| A photograph you take or upload, and any name(s) and comment you enter with it | Only if you choose to sign the Wall | To display publicly on the Wall, permanently and attributed to the name you give |
Data collected automatically
| Data | Why |
|---|---|
| Venue and performance session identifier (from the QR code you scanned) | To route your request to the correct performance |
| Device and browser type, approximate region derived from IP address | Security, fraud prevention, and diagnosing faults |
| Interaction logs (requests submitted, pages viewed, timestamps) | To operate the request queue and investigate problems |
Payment data we do not collect
Payments are processed by Razorpay, a payment aggregator authorised by the Reserve Bank of India. Your card number, UPI PIN, bank credentials and other authentication data are collected and processed by them directly. We never receive or store them. We receive only a transaction reference, the amount, and whether the payment succeeded, failed, or was refunded.
3. Consent
We process your personal data on the basis of your consent, which you give when you submit a request. Before you submit, you will see a clear notice describing what data is collected and for what purpose.
You may withdraw your consent at any time by contacting us using the details below. Withdrawing consent is as easy as giving it. Withdrawal does not affect processing carried out before withdrawal, and we may retain data where we are legally required to (see Retention below).
Where your data is needed to complete a payment or refund already in progress, we will complete that transaction before deleting the associated records.
4. Purposes — and what we will not do
We use your data only to:
- display and manage your song request;
- process your payment and any refund;
- notify you of the outcome of your request;
- prevent fraud and abuse;
- comply with legal and tax obligations.
We do not sell your personal data. We do not share it with advertisers. We do not use it for behavioural advertising or profiling. We do not use it to train machine learning models.
5. Photographs on the Wall
The Wall is an optional feature. You are never required to use it, and nothing else about your request depends on it.
A photograph you post to the Wall is public and permanent. It is visible to anyone who opens this site, including people who have never attended a performance and people who were not present. It is not limited to the night you posted it, and it stays up after the performance ends.
Before you post
- Only post a photograph you took yourself, or that you have the right to post.
- If other people appear in the photograph, ask them first. By posting, you confirm that everyone identifiable in it is aware and has agreed to it appearing publicly.
- Do not post a photograph of anyone under 18.
- Do not post anything you would not be comfortable being seen indefinitely, by anyone.
Review before publication
Every photograph is reviewed by Jack Stephen Tucker before it appears. Submitting one does not guarantee publication, and a photograph may be declined or removed at any time without notice — for example if it shows someone who has not agreed to appear, or is otherwise unsuitable. If you edit a published post, it returns to review and is hidden again until re-approved.
Removing a photograph
You can ask us to take your photograph down at any time, and we will remove it from public view. Write to info@hijack.co.in. You do not have to give a reason. If you appear in someone else's photograph and did not agree to it, contact the same address and we will remove it — you do not need to have used this service yourself to make that request.
What we cannot undo
Because the Wall is public, we cannot control copies made by others while a photograph was visible — for example screenshots, or copies cached or indexed by search engines. Removing a photograph stops us from displaying it and deletes it from our storage, but it cannot retrieve copies already taken by third parties. Please take this into account before posting.
6. Who we share data with
| Who | What | Why |
|---|---|---|
| Razorpay | Transaction amount, reference, contact detail if provided | To process payment and refunds |
| Supabase (database and file storage) | Data stored and served through their infrastructure | To host the Service |
| None | Aggregated usage data | To understand how the Service is used |
| Law enforcement or regulators | As legally required | To comply with a valid legal obligation |
Requests and display names you submit may be shown publicly on screens at the venue and in the request queue visible to other guests. Do not include anything in a request or message that you do not want to be public.
7. If you perform on Hijack
Everything above concerns guests at a performance. Performers — artists, DJs and venues — have an account, and we hold more about them. This section is only about that.
What we hold
| Data | Why |
|---|---|
| Your name and email address | To identify your account and contact you about it |
| Stage name, biography, photographs, links, song list | These are published on your public page — that is their purpose |
| Your performances, the requests made at them, and what was paid | To run the service and to report your earnings to you |
| The last four digits of your bank account and the account holder’s name | So you can confirm which account you are being paid into |
| A record of which automated emails we have sent you | So the same message is never sent to you twice |
Your full bank account number is not kept. Where your details are set up by hand, the account number and IFSC are held only until that is done, and are erased in the same step — not by a later clean-up. Where your account is opened automatically, they are sent straight to Razorpay and never stored by us.
Your PAN and registered address are never stored by us at all. They are required by Razorpay to open your payments account and are passed directly to them.
Emails we send you
If you have an account, we send you:
- a monthly summary of what you earned, the shows you played and what was requested; and
- reminders to finish setting up, if you signed up but have not yet added your songs, your page or your bank details.
Every one of these carries a link to stop them, and stopping them takes effect immediately. Notices about the account itself are not affected — if your account is about to be closed we will still tell you, because not telling you would be worse.
We do not send you marketing, and we do not give your email address to anyone else for theirs.
If you sign up and never set anything up
An account that is never used is personal data we have no reason to keep. If you sign up and add nothing — no songs, no performances, no requests — we will email you about it, and if it is still empty seven days after that warning we close the account and delete it.
This only ever applies to an account with nothing in it. If you have added songs or played a performance, your account is not closed this way, whether or not you finished every setup step.
Afterwards we keep a record that an account was closed and when. That record contains no name, no email address and no other personal data.
8. Where data is stored
Your data is stored on servers located in Singapore. This is outside India. Under the Digital Personal Data Protection Act, 2023, personal data may be transferred outside India except to territories the Central Government has notified as restricted, and Singapore is not currently notified as restricted. Your rights under this policy apply in full regardless of where your data is stored. We do not receive or store card, UPI or bank credentials at all — those are handled by Razorpay.
9. Retention
| Data | Retained for |
|---|---|
| Song requests and messages | 12 months after the performance |
| Contact detail provided for payment notification | 12 months after the transaction |
| Payment and refund records | 8 years, as required under Indian tax and accounting law |
| Wall photographs, names and comments | Until you or we remove them — these are published indefinitely by design |
| Security and access logs | 90 days |
| A performer’s account and public page | Until the account is closed, by you or by us |
| Bank account number and IFSC, where set up by hand | Erased the moment the account is set up or rejected |
| Record of automated emails sent to a performer | Deleted with the account |
After these periods, data is deleted or irreversibly anonymised.
10. Security
We protect your data with encryption in transit (HTTPS/TLS), encryption at rest, access controls limiting access to those who need it, and regular review of our systems. No system is perfectly secure, but we take reasonable safeguards as required under the DPDP Act. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by law.
11. Your rights
Under the DPDP Act, you have the right to:
- Access — obtain a summary of the personal data we hold about you and how it is processed;
- Correction — have inaccurate or incomplete data corrected or completed;
- Erasure — have your data deleted, unless we are legally required to retain it;
- Nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity;
- Grievance redressal — raise a complaint with us and receive a response.
To exercise any of these rights, contact us at info@hijack.co.in. We will respond within 2 days.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.
12. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it. We do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.
13. Cookies and similar technologies
We use only what is necessary to operate the Service: a session identifier to keep your request associated with your device during a performance. We do not use advertising or cross-site tracking cookies.
14. Changes to this policy
We may update this policy. The current version is always available at this page with the "Last updated" date above. Where changes are significant, we will make them prominent before they take effect.
15. Contact and Grievance Officer
Data Fiduciary: Jack Stephen Tucker
Address: 179, Lane 2A, Alto Bella Vista, Sangolda, Porvorim, Bardez, Goa 403511, India
Grievance Officer: Jack Stephen Tucker
Email: info@hijack.co.in
Phone: +91 70211 95951
We acknowledge privacy enquiries within 48 hours and respond substantively within 2 days.
For any other enquiry, see our Contact Us page.
← Back to Hijack