What we hold, why, and what we do not have.
Starting here because it is the shorter list and the more useful one.
| Your phone number | It is how you sign in. There are no passwords. If you lose your SIM or change networks and Mehfil support moves your account to a new number, we keep the numbers you had before, with when, why and who moved it, so that an old number still finds your account when you write to us. They are kept while your account exists, deleted with it, and in the copy of your record you download. |
| A display name | Shown to the other party on a booking. |
| Bank transfers | If you pay the Mehfil fee by bank transfer, we keep your transaction reference, any receipt image you submit, the account instructions you saw, and the owner's bank statement check, with the name and account your transfer came from as Mehfil's bank statement shows them, so that a refund can go back to that account. They are removed when your account is deleted. Only the owner can view receipt images; they have no public address. Receipt images are removed 90 days after review, or when your account is deleted, unless a bank refund is still owed. The transaction and refund references stay with the payment record. A submitted receipt is not proof of cleared funds. Bank refunds are handled manually and recorded only after the money has been sent. |
| Your bookings | Which space, which hours, what was charged, and whatever you told the host about the evening — how many are coming, what the occasion is, anything you wanted them to know. That last part is shown to the host, which is what it is for. If you add co-organisers to a booking, we keep the phone numbers you add and the names you give them, so they can see the booking and write to the host; the host sees their names, never their numbers. A number is let go when you take it off, when either of you deletes your account, and a month after the evening. |
| Messages | What you and the other party wrote about a booking, and any question you asked a host about a space before booking it. Phone numbers and messaging links written in a question are hidden before it is stored. If a host answers with their own price, we keep the price a host offered you, for which hours, and what became of it. If you ask to come and see a space, we keep the times you offered to visit and the one the host picked; once a host agrees, the guest is shown the address until a day after the visit. If the space is a banquet hall’s, the people on the hall’s team who look after its guests read and answer the conversation for the hall, and each message they send carries their name. |
| Codes you use | If you give a code off the Mehfil fee when you book, we keep which code, the booking it was used on, the fee before it and what it took off, so that a code is used once by each person and the fee you paid can be checked. It is kept with the booking it was used on, for as long as the booking is, and it is in the copy of your record we give you when you ask for one. |
| Photos you upload | Of your space, and before-and-after photos at the start and end of a booking. |
| Reviews | What you wrote, and what was written about you. |
| Your prices | Hosts only. The hourly rate, surcharges and discounts you set, the prices you give particular dates, a record of every change to your prices and who made it, and what you did with each price Mehfil suggested to you. Prices are shown to guests. The record is not shown to anybody: it is how we answer a question about what a date cost and who set it. |
| Your listing's location | Hosts only. The pin you place, and the address you type. Guests see the neighbourhood before booking and the exact address once confirmed. |
| A note from whoever met you | Hosts only: it is how a host is verified. Somebody from Mehfil can confirm your identity in person; we keep who they were, when, and what they saw — in their words. No documents are collected on this route and nothing is sent to a partner. The note is deleted with your account. |
| Where you are signed in | For each phone or browser you sign in on, what kind it is — an iPhone, an Android phone, or which browser — and when it was last used, so that you can see them in Profile, then Devices, and sign the others out. When somebody signs in to your account, your other devices are told. Nothing else about the device is kept. |
| A notification token | Per device, so we can tell you a booking was confirmed. In a browser that you let send notifications, it is the address its push service gave us and the keys to encrypt for that browser alone. Removed when you sign out on that device or browser, or sign it out from Profile, then Devices. |
| When the app breaks | If a screen stops working or the app closes, the app sends us what broke: the error, where in the app’s code it happened, which screen it was on (“a space’s page”, never which space), and which version of the app on which kind of phone. Nothing about you is kept with it — not your account, your number or your internet address — and numbers, links and email addresses are taken out of the error before we keep it. Deleted thirty days after it arrives. |
| What we told you | Every notification we sent you, so you can go back to one you missed — and so somebody who turned notifications off is still told. When our moderators choose you by name to be told something, we keep that you were one of those chosen, with the announcement, so it reaches you once and can be counted. Kept while your account exists, and deleted with it. |
| Cities you are waiting for | If you ask us to tell you when Mehfil opens in a city it has not opened in yet, we keep which city and when you asked, so that we can tell you when it opens and our moderators can see how many people are waiting for each city. It is deleted 30 days after we tell you, as soon as you say you no longer want to hear, when your account is deleted, and in any case after 18 months. It is in the copy of your record we give you when you ask for one. |
| Our notes about you | Short notes and labels our moderators keep about your account and the spaces you host — who rang, what was agreed, “photographed” — so whoever helps you next knows what was said. When one of us goes to see your space, we keep the day and what they saw; your space shows the month we went, and never who it was or what they wrote. They are never shown in the app, they are kept until your account is deleted, and they are in the copy of your record we give you when you ask for one. |
| Words our moderators are asked to read | Our moderators keep a list of words — abuse, a phone number spelled out, paying outside the app, another site’s name. When a review you write, a reply to one, or your space’s title or description has one of them in it, we note which words and where, so that one of us reads it. Nothing is hidden or held back because of it. Only our moderators see these notes; they go when the review or the space does, are otherwise kept until your account is deleted, and are in the copy of your record we give you when you ask for one. |
| Files we add to a ticket | When you or the other party send us something about a ticket another way — photos of damage, a receipt, a screenshot of a WhatsApp chat — our moderators may add it to the ticket with a line saying where it came from, so a decision is made on what the ticket holds and can be checked afterwards. These are files our moderators add to a ticket, and only our moderators see them: they are never shown in the app, to you or to the other party, and never have a public address. They are kept as long as the ticket is, which is after an account is deleted too, as before-and-after photos are, because they are what a decision between two people was made on. A file our moderators take off is deleted from storage. They are listed, without the files, in the copy of your record we give you when you ask for one. |
| Photos you send with a ticket | If you add photos to a message you sent us, we keep them with that message for our moderators deciding it, beside the files they add. They are never shown in the app, to the other party or back to you — the app says only how many you sent — and never have a public address. You can send up to ten with one message. They are kept as long as the ticket is, after an account is deleted too, because they are part of what a decision was made on. |
| A shortlist you share | If you send your saved spaces to family as a link, we keep the link and, for each person who opens it, the first name they give and which spaces they like or not. They need no account; their browser keeps a random key so they can change their mind, and nothing ties it to a phone. Everybody with the link sees those names and your first name. Stopping the link deletes it and every name on it, and so does deleting your account. |
Banquet halls, marquees and other venues can use Mehfil to keep their whole
diary, including bookings taken at the counter, on the phone or on WhatsApp
from people who have never used Mehfil. That record is the hall’s, and we
keep it for them.
| If you booked a hall | The hall may have written down your name, your phone numbers, what you booked — which hall, which day, for how many, the bill line by line — and each receipt for money you paid or were paid back. A hall that collects the functions tax is required by law to report each payer’s CNIC or NTN, so it may record one of them. A CNIC we store encrypted and show only masked. An NTN is a business’s tax number, printed on its own invoices, and is kept as written; a person’s NTN is their CNIC, so we take that only as a CNIC. We use either for nothing else. We never market to you, never show you another hall, and never join this to a Mehfil account that happens to share your number. |
| Who at the hall sees it | Everybody on the hall’s team sees its diary: what is on, under whose name, in which hall, for how many. The owner, managers, clerks and accountants also see the bill, what has been paid and how to reach you. Kitchen and operations staff do not. |
| Downloads | The owner, managers, clerks and accountants can download the hall’s bookings as a spreadsheet, to keep or to give the hall’s accountant, and the owner and accountants can download its money. A download carries what they already see in the app — your name, number, booking and payments — and never your CNIC or NTN. Each one is noted in the record the owner reads. We do not keep the file; once it is on the hall’s computer, it is theirs to look after. A hall bringing its old register in sends us its file the same way: we read it into the diary and keep nothing of the file. |
| Calendars | Anybody on the hall’s team can put its diary in their own calendar. That calendar shows the halls, the hours, the function and how many guests — never your name or your number. |
| Other systems | The hall’s owner can connect its diary to another system they use, such as Zapier, Make or their own software. We tell that system when something changes — only what kind of change, and which booking — and it can then read that booking with a key the owner made: your name, your number, the booking and its payments, never your CNIC or NTN. The owner can stop a connection or a key at any time. What that system has already read is the hall’s to look after, as a download is. |
| Your receipts | The hall can send you a link to each receipt. Anybody holding that link can open it, and it shows your name, the hall, the function, the money and the name of whoever at the hall wrote it down — the name on their Mehfil account, or the one the team gave them. Pass it on only as you would the paper slip. |
| Correcting it | Ask the hall to correct your name, numbers or notes, or ask us. Money is different: a payment once written down is never rewritten or removed. A mistake is put right by a reversal beside it, which says who made it and why, because the hall’s receipts have to add up. |
| If you asked a hall about a date | It may have noted your name, your number, what you wanted, and when and how you first got in touch. A question asked on Mehfil about a hall’s listing is noted with the name you use here and without your number, which stays hidden as it does in any question. |
| If you work at a venue | Your phone number, the name the team gave you, your role, whether you are on the team for Mehfil, and whether you want to be told about the hall’s Mehfil guests. Every change to the diary, the money and the hall’s spaces on Mehfil keeps who made it — who took each payment, who moved or repriced a booking, who changed a price or answered a guest — and the owner can read that record. An invitation nobody signs in to within 14 days lapses. It stays after you leave the team, because it is the hall’s account of its money. |
| How long | A hall’s records stay for as long as the hall keeps its diary on Mehfil. They are its books, and a business has to be able to show its books for years after the money moved. |
Profile, then Delete my account. It happens there and then, not by asking
somebody: your phone number and any you had before, your name and your profile photo go, and so do the
note from whoever met you and the record of when you started an identity check.
Some things stay, and it is fairer to say which than to promise otherwise.
We keep a record of completed bookings and their payments, because we are
required to be able to account for money that moved, and reviews you left stay
up without your name attached. Messages stay on the booking they were sent
about: they are half of somebody else’s record of what was agreed.
Questions you asked about a space you never booked do not stay —
nothing was agreed and no money moved, so there is no record for them to be
half of — and they go from the host’s side as well as yours. So do
the photos of a space you listed that somebody booked — those
belong to bookings that happened. A space nobody ever booked is deleted with
your account, photographs and all, because there is no such booking for it to
be half of. And
the before-and-after photos a damage claim would be decided on, and
the files our moderators added to a ticket, for the same reason. An account with a
booking still to come is not deleted until those are settled — somebody
is expecting you — and we say which ones. Nor is an account with a damage
claim or a report still being decided: one you made, one about you, or one about
a space you host. Somebody is owed a decision about it, and there must be
somebody to tell. Once our moderators have decided it, you can delete your
account. A question you asked us does not hold it up.
If we have blocked your phone number — for fraud, or for threatening
somebody — we keep the number and why we blocked it after your account is
deleted, so that the same number cannot simply sign up again. Nothing else
about you is kept with it.
If you are on a hall’s team, deleting your account takes your seat off
it, with your number and the name the team gave you; the hall’s record of
what you did stays with the hall, and your receipts say “staff”. The only owner
of a hall with bookings ahead is asked to make somebody else an owner first,
because the families who paid advances are owed somebody who can see them.
Profile, then Download my data. Your browser saves a file of everything in
the tables above that is about you, at once and without asking anybody: the
link it opens works once, for ten minutes, and we keep only a scrambled copy
of it until it is used or a day after it lapses. What our moderators noted
about you, the labels they keep on your account and the words they were asked
to read in what you wrote are not in that file. They are in the copy we send
when you ask us for one, below.