Privacy Policy

Last updated: May 26, 2026

Note: This document is a template and will be reviewed by legal counsel before go-live. This policy is designed to comply with India's Digital Personal Data Protection Act, 2023 (DPDPA 2023).

1. Data We Collect

Account Data

Email address, phone number, name, and role (Brand or Creator).

Profile Data

Company name, bio, location, languages, social media links, and profile photo.

KYC Data

PAN card, GST certificate, Aadhaar (optional). All KYC documents are stored encrypted in secure object storage (MinIO).

Financial Data

UPI ID and payment history. Credit/debit card details are handled exclusively by Razorpay and are never stored on our servers.

Usage Data

Pages visited, actions taken, timestamps, and general platform interaction patterns.

Device Data

User agent, IP address (for security and rate limiting purposes only).

2. Cookies & Analytics

• Google Analytics: Loaded only after explicit cookie consent. IP anonymization enabled.
• Essential cookies: httpOnly authentication tokens. No consent needed for functional cookies.
• We do not use third-party advertising cookies.

3. How We Use Your Data

• Provide platform services (matching brands with creators, processing payments, generating agreements)
• Verify identity through KYC process
• Communication (OTP authentication, notifications, platform emails via Brevo)
• Analytics (aggregate, anonymized usage patterns)
• Legal compliance

4. Data Sharing

• Razorpay: Payment processing
• Brevo: Email delivery (transactional emails)
• Google Analytics: Anonymized usage data (only with consent)
• YouTube API: Creator channel verification (public data only)
• Law enforcement: If legally required under Indian law

Your data is never sold to third parties.

5. Data Retention

• Active accounts: Data retained while your account exists
• Deleted accounts: Personal data removed within 30 days. Anonymized records kept for legal/financial compliance.
• KYC documents: Retained for 5 years per Indian financial regulations
• Payment records: Retained for 7 years (tax compliance)

6. Your Rights (DPDPA 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: Request a copy of your personal data
• Right to correction: Request correction of inaccurate data
• Right to erasure: Request deletion of your data (with exceptions for legal retention periods)
• Right to grievance redressal: File complaints about data handling
• Right to nominate: Nominate a person to exercise your rights in case of death or incapacity

7. Data Protection

We implement appropriate technical and organizational security measures including encryption of sensitive data, secure API authentication, and regular security audits.

8. International Data Transfers

Our servers are located in the EU (Hetzner). Cloudflare CDN may cache content globally. All data is processed in accordance with DPDPA 2023 standards.

9. Children

The Platform is not intended for users under 18 years of age. We do not knowingly collect data from minors.

10. Changes to This Policy

We will notify you via email 30 days before any material changes to this Privacy Policy.

11. Contact

For data-related queries or to exercise your rights, contact our Data Protection Officer at support@collabverse.in.