1. Who this policy is from
MADOOZA is hosted by The Elden Heights School, Hazaribagh, Jharkhand 825301, India, and is organised and operated by FLYKRAFT SYNERGIES PRIVATE LIMITED (Event Organizer). In the text below, "we", "us" and "the organisers" mean the school and the Event Organizer together. "You" means anyone who uses this site, buys a pass, enters the cosplay contest, pre-orders merch or comes to the fest.
This policy covers this website and the sign-up, pass and pre-order forms on it. It does not cover other websites we link to — Razorpay's checkout, a sponsor's site, a social media page — each of which has a privacy policy of its own.
2. What we collect
Only what a form on this site asks you to type, and nothing behind your back:
- Fete Pass purchases — your name, your school (optional), your phone number, how many passes you bought, the amount paid, the Razorpay order and payment reference, and the pass code we issue you.
- Cosplay contest entries — your name, your school (optional), your phone number, whether you are walking solo or as a squad, your category, and the entry fee payment reference.
- The concert interest list — your name, one contact detail you choose to give, who you are hoping the act is, how many seats you would want, and the queue number we give you.
- Merch orders — your name and phone number, the items and quantities you bought, the amount paid, the Razorpay payment reference, and the collection code we issue you.
- Anything you send us — the contents of an email, a message or a phone call, if you start one.
3. What we never collect
Card numbers, UPI IDs, bank details, CVVs and passwords never reach our servers. Payments are entered on Razorpay's own checkout and stay with Razorpay; all we are told is that a payment succeeded, for how much, and under which reference.
This site has no visitor accounts and builds no analytics profile of you. The only cookie we set ourselves is the sign-in cookie for the council's own admin panel and gate scanner, and only for a council member or volunteer who signs into one.
4. Measurement and advertising
The public pages carry two measurement tags: the Meta Pixel, so that when the fest pays to advertise on Instagram or Facebook it can tell whether the advertising worked, and Google Analytics, so the council can see which pages people actually read. Both record that a page was viewed, that a checkout was opened, and that a purchase was completed along with its amount, and both set cookies of their own to do it.
Your name, your email address, your phone number and your pass codes are never sent to either of them. Nor are the tags on the pages where those things appear: your own pass page, the gate scanner and the admin panel carry no measurement at all.
What Meta and Google do with what they collect is governed by their own privacy policies, not ours. Blocking them is entirely your right and costs you nothing on this site — a browser set to refuse third-party cookies or trackers, or any of the usual blocking extensions, will stop both, and every page, pass and payment goes on working exactly as before.
5. Why we use it
- To issue your pass code and check it at the gate on the day.
- To run the cosplay contest — your category, your slot, and calling your name out.
- To hold a seat for you when concert passes open, and to tell you first when they do.
- To have the merch you paid for waiting at the tent when you come to collect it.
- To reach you if something changes: a time, a date, a stage, a cancellation.
- To count how many passes, entries and pre-orders there are, so the fest can be planned and accounted for.
We do not use your details to advertise to you, and we do not use them for anything you did not hand them over for.
6. Who can see it
- A small number of student council members and the supervising staff of The Elden Heights School, through a password-protected panel that is not linked from this site.
- FLYKRAFT SYNERGIES PRIVATE LIMITED, as the event organizer, for running the event and its accounts.
- Razorpay Software Private Limited, which processes payments and holds the payment details we never see.
- Google Firebase (Firestore), where the records are stored, and Vercel, where the site runs.
- A government authority, police or court, where the law requires us to hand something over.
That is the whole list. Your details are never sold, rented or traded, and they are not passed to sponsors, vendors or anyone else who asks nicely.
7. Students and anyone under 18
This is a school fest, so many of the people filling in these forms are children. If you are under 18, fill in a form only with your parent's or guardian's knowledge, and give a contact number they can be reached on.
A parent or guardian can ask to see, correct or delete anything we hold about their child by writing to contact@madooza.com or by asking at the fest office at The Elden Heights School, Hazaribagh, Jharkhand 825301, India, in person during school office hours on any working day. We will act on it without arguing about it.
8. How long we keep it
- Pass, cosplay and merch records — through this edition of the fest and the school's accounting of it, and no more than 12 months after the fest, after which they are deleted or stripped of names.
- The concert interest list — until the concert is over, or until you ask to be taken off it, whichever is sooner.
- Payment references — for as long as tax and audit law requires us to be able to show what was paid.
9. What you can ask us to do
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or ask to be taken off the interest list. Write to contact@madooza.com from the contact you signed up with, or come to the fest office at The Elden Heights School, Hazaribagh, Jharkhand 825301, India, in person during school office hours on any working day. We will answer within 30 days.
Deleting a pass record before the fest means the pass can no longer be checked at the gate, so we will say so before we do it and let you decide.
10. How it is kept
The site is served over HTTPS. Every key that can read or write the records is held on the server and never sent to a browser. The admin panel is behind a school-issued account, an allow-list of addresses, and a session that is re-checked on every request. No method is perfect, but nothing about this site asks you to trust a browser with anything private.
11. Changes to this policy
If this policy changes, the new version goes up on this page with a new date at the top. If a change affects what we do with details you have already given us, we will say so on the site rather than quietly swapping the text.