This policy explains what personal data Grunmech Technologies Private Limited collects through Cre8r.ai ("Cre8r", "we", "us"), why, who we share it with, and the choices and rights you have. We are the Data Fiduciary for this data under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Who this covers: creators who sign up, people at brands and agencies who use Cre8r, visitors to cre8r.ai, and creators whose public social media profiles appear in our discovery tool.
The short version
We collect what we need to match brands with creators, run campaigns, pay creators and report results.
When you connect Instagram or YouTube, we read your account statistics through the platforms' official tools. We never post for you or read your private messages.
We share creator profiles and campaign results with brands. We don't sell your personal data.
You can see, correct or delete your data, withdraw consent, and complain to us or to the Data Protection Board of India.
This policy is available in English.
What We Collect
| Who You Are | What We Collect | Where It Comes From |
|---|---|---|
| Creator who signs up | Name, email, phone, city, date of birth, gender (optional), languages, niche, profile photo, social handles, rates | You |
| Creator who signs up | Follower counts, audience age, gender and location, reach, impressions, engagement, post and video performance | Instagram and YouTube, when you connect your account (section 3) |
| Creator who signs up | PAN, bank account or UPI ID, GSTIN (if registered), delivery address | You, when you get paid or receive products |
| Creator who signs up | Briefs, drafts, messages, approvals, posting links, campaign results and payment history | Your use of the platform |
| Brand or agency user | Name, work email, phone, company, job title, billing and GST details, campaign briefs | You or your company |
| Creator in our discovery tool (not signed up) | Name or handle, public bio, public posts, follower counts, public engagement and contact details listed publicly for business | Public social media profiles (section 4) |
| Website visitor | IP address, device and browser type, pages viewed, referring site, cookie identifiers; anything you type into a demo or contact form | Your browser, cookies (section 11), and you |
Audience data. Audience statistics from Instagram and YouTube are aggregated, such as "62% of followers are aged 18–24". We don't collect the names or profiles of your individual followers.
Sensitive data. We don't ask for religion, caste, health, sexual orientation or political views. Please don't put them in your profile.
Why We Use It
| Purpose | Data Used | Legal Basis Under the DPDP Act |
|---|---|---|
| Create and run your account | Account and contact details | Consent, and data you gave us for this purpose |
| Show your creator profile to brands and match you with campaigns | Profile, audience and performance data | Consent |
| Run campaigns: briefs, approvals, shipping, messages | Contact details, address, campaign content | Consent, and data you gave us for this purpose |
| Measure and report campaign results to brands | Post links and performance data | Consent |
| Pay creators, deduct TDS, issue TDS certificates, keep tax records | PAN, bank or UPI details, GSTIN, payment history | Legal obligation under tax laws |
| Detect fake followers, fraud and misuse | Profile, audience and engagement data, device and log data | Consent, and legitimate uses permitted by the Act |
| Show brands public creator profiles in discovery | Publicly available profile data | Data the creator made public (section 4) |
| Reply to demo and contact requests | Contact details, message | Data you gave us for this purpose |
| Improve the website and platform | Usage and cookie data | Consent (non-essential cookies) |
| Send updates and marketing emails | Email, name | Consent. Unsubscribe any time |
| Meet legal requests and protect our rights | Any relevant data | Legal obligation |
Withdrawing consent. You can withdraw consent as easily as you gave it, from your account settings or by writing to us (section 12). Withdrawal doesn't affect what we did before. If you withdraw consent needed to run your account, we may have to close it. We will still keep records the law requires, such as tax records.
Automated matching. We use software, including AI, to suggest creators for a brief and to flag unusual engagement patterns. A person at Cre8r or the brand makes the final decision about who is offered a campaign. If you think a flag on your account is wrong, ask us to review it.
Public Creator Profiles in Our Discovery Tool
To help brands find creators, our discovery tool includes profiles built from information that creators have made public on Instagram and YouTube for promotion and business. This includes their handle, bio, public posts, follower counts, public engagement and any business contact details they list publicly.
We only use data that is publicly visible without logging in or passing a privacy setting. We don't include private accounts, and we use this data only to help brands find and evaluate creators for campaigns.
If your public profile appears in Cre8r and you don't want it to:
Write to our Grievance Officer (section 12) with your handle and we will remove it within 15 days and keep it out, or
Sign up as a creator to take control of your profile, correct it and add your own details.
If you change your account to private or delete it, we stop showing it when our next update runs.
Where Your Data Is Stored
We store data with established cloud hosting providers. Some of our service providers, such as email or analytics tools, may process data outside India. When that happens, we use providers with strong security commitments, and we will never transfer data to a country the Government of India restricts under section 16 of the DPDP Act.
How Long We Keep Data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.
| Data | How Long We Keep It |
|---|---|
| Creator account and profile | While your account is open; deleted within 30 days of closing it, except as below |
| Instagram and YouTube data | While connected; deleted within 30 days of disconnecting |
| Campaign content, results and messages | 3 years after the campaign, for brand reporting and disputes |
| PAN, payment, TDS and GST records | Up to 8 years, as tax laws require |
| Brand user contact and billing details | While the business relationship lasts, then 3 years |
| Demo and contact form enquiries | 2 years after the last contact |
| Public discovery profiles | Until removed on request or no longer public |
| Security and access logs | At least 1 year, as the DPDP Rules require |
| Marketing email list | Until you unsubscribe |
When the period ends, we delete the data or remove anything that identifies you.
Security and Data Breaches
We protect data with encryption in transit and at rest, access limited to staff who need it, multi-factor login for our systems, access logs and regular security reviews. Payment details are handled by our payment provider and are not stored in plain text.
No system is perfectly secure. If a personal data breach affects you, we will tell you without delay: what happened, what data was involved, what it could mean for you, what we are doing about it and what you can do. We will also report it to the Data Protection Board of India as the DPDP Rules require.
Keep your login private. Tell us straight away at gs@cre8r.ai if you think your account has been accessed by someone else.
Your Rights
Under the DPDP Act, you can:
Access: ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
Correct and update: fix anything inaccurate or incomplete. Most profile details can be edited directly in your settings.
Erase: ask us to delete your data when it's no longer needed for the purpose you gave it for, or when you withdraw consent. We will keep only what the law requires.
Withdraw consent at any time (section 2).
Nominate someone to exercise your rights if you die or become unable to act.
Complain to our Grievance Officer, and then to the Data Protection Board of India (section 12).
How to ask. Email gs@cre8r.ai or use the privacy option in your account settings. We may ask you to confirm your identity before acting. We will respond within 30 days. Exercising your rights is free.
Children
Cre8r is for people aged 18 and over. We don't knowingly create accounts for, or collect data from, anyone under 18. We don't track, profile or target advertising at children.
If we learn that someone under 18 has signed up, we will close the account and delete their data. If a parent or guardian believes their child has given us data, please contact our Grievance Officer.
Creators must have permission from a parent or guardian before showing a child in campaign content, and must follow our Creator Terms on content that features other people.
Contact, Grievance Officer and Complaints
For any question or request about your personal data, contact our Grievance Officer:
Name: Gaurav Sharma
Email: gs@cre8r.ai
Address: Grunmech Technologies Private Limited, AltF Coworking, Orchid Business Park, Badshahpur Sohna Road, Islampur Village, Sector 38, Gurugram, Haryana 122018
We acknowledge complaints within 24 hours and aim to resolve them within 15 days, and in all cases within the time the DPDP Rules allow.
If you're not satisfied with our response, you can complain to the Data Protection Board of India through its official website.
Changes to This Policy
We will update this policy when our practices or the law change, and show the new "Last updated" date at the top. For important changes, we will email account holders at least 15 days before they take effect. If a change needs your consent, we will ask for it.
Data From Instagram and YouTube
When you connect an account, you sign in on Meta's or Google's own page and choose what to allow. We never see your password.
What we read: your profile details, follower and subscriber counts, aggregated audience demographics, reach, impressions, views, likes, comments, saves, and the performance of your posts and videos, including campaign posts.
What we don't do: we don't post, comment, like or message on your behalf. We don't read your private messages, and we don't collect your followers' individual identities.
YouTube. Cre8r uses YouTube API Services. By connecting YouTube, you agree to the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy. You can revoke Cre8r's access at any time from your Google security settings.
Instagram and Facebook. We access Instagram data through Meta's official APIs, under Meta's Platform Terms and the Meta Privacy Policy. You can remove Cre8r from Instagram under Settings → Website permissions → Apps and websites, or from Facebook's Business Integrations settings.
When you disconnect an account, we stop collecting new data from it straight away. We delete the stored platform data within 30 days, except campaign results already reported to a brand and data we must keep by law. You can also ask us to delete it sooner (section 9).