Privacy & Data Protection Policy

To facilitate brand-creator partnerships, verified transactions, and secure milestone escrow payouts, we collect the following categories of information:

• Account Identifiers: Name, business name, registered email address, WhatsApp mobile number, and encrypted password credentials.
• Public Social Media Metrics: Connected Instagram handle, YouTube channel statistics, follower counts, engagement ratios, and public category tags parsed via official platform APIs.
• Campaign & Contract Data: Sponsorship briefs, uploaded content drafts, chat messages, deal valuations, and delivery confirmation timestamps.
• Billing & Payout References: GSTIN number, corporate billing address, bank IFSC and account number, or UPI VPA (for creator payouts).

We process collected data exclusively for legitimate operational purposes:

• To authenticate user sessions and secure creator dashboard logins.
• To display verified creator portfolios in public and regional search directories (e.g. Top Cities, Niches).
• To enforce milestone escrow protection and disburse funds to creators upon milestone acceptance.
• To generate automated, B2B tax-compliant GST invoices for registered corporate brands.
• To screen for fraudulent activities, fake followers, or abusive spam behaviors using automated API audits.

We do not sell, rent, or trade your personal data to telemarketers or third-party advertisers. Information is disclosed solely in the following controlled contexts:

• Mutual Deal Counterparties: When a brand utilizes their contact unlock quota or books a campaign, the creator's verified WhatsApp handle and email are made available to fulfill the deal.
• Authorized Payment Infrastructure: Razorpay Software Private Limited processes subscription and escrow transactions in compliance with PCI-DSS Level 1 specifications.
• Legal & Regulatory Mandates: Where required by valid subpoenas, court orders, or statutory Indian tax enforcement authorities.

All user credentials, database records, and communication packets are guarded with industry-grade security protocols:

• TLS 1.3 / 256-bit SSL encrypted transit for all HTTP requests and API payloads.
• Bcrypt hashing with 12 computational rounds for password storage.
• Firewalled cloud database clusters hosted within Indian data center regions to meet data residency best practices.
• Role-based administrative access controls with comprehensive activity audit logging.

We employ essential HTTP session cookies and CSRF protection tokens strictly to remember your authentication session, maintain cart/order state, and safeguard against cross-site request forgery attacks. You can configure your browser to reject cookies, though certain marketplace functions may be limited.

Under the Digital Personal Data Protection Act (DPDP), you enjoy full rights over your data:

• Right to Rectify: Update your profile photos, bio, social links, or phone numbers at any time from your Creator or Brand Settings.
• Right to Erasure: Request permanent account deletion and removal from public search indices by emailing our Grievance Desk.
• Statutory Retention Exception: Accounting ledgers, tax invoices, and escrow disbursement proof must be retained for 7 financial years to comply with Indian GST and Companies Act regulations.