1. Introduction and Scope
GETCOLLAB TECHNOLOGIES PRIVATE LIMITED ("GetCollab", "we", "us"), registered office Manikonda, Hyderabad 500089, Telangana, India, operates the GetCollab website and web application (the "Platform"), an online marketplace that connects Brands and Creators. This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and related rules.
By using the Platform you confirm that you have read this Policy. Where the law requires your consent for a purpose, we ask for it separately, and you can withdraw it (Section 11).
2. Key Terms
- Data Fiduciary: GetCollab, which decides the purpose and means of processing your personal data on the Platform.
- Data Principal: You, the individual to whom the personal data relates.
- Personal Data: Any data about an individual who is identifiable by or in relation to that data.
- Processing: Any operation on personal data, including collection, storage, use, sharing and erasure.
- Grievance Officer and Consent Manager: Our Grievance Officer is named in Section 12. GetCollab does not currently use a Registered Consent Manager.
3. Personal Data We Collect
3.1 Account and Organization Data
- Account information: Name, email address, phone number (where you provide it), password (stored only as a hash), sign-in method (for example Google sign-in or passkey) and account role (Brand or Creator)
- Organization data: For Brands, organization name, business details, tax/GST information, billing address, and the Admin and Member seats of team members you invite
- Creator profile information: Profile picture, bio, category, languages, portfolio links and connected social media handles
- Payment and payout information: Billing details, and bank or UPI details needed to receive payouts, collected by us and our payment processors (Section 7). We do not store full card numbers
- Communications: Messages exchanged on the Platform, deal briefs, agreements, support requests and feedback
3.2 Campaign, Deal and Payment Data
- Campaign details created by Brands, including briefs, budgets and deliverable requirements
- Deal and workflow data, including proposals, negotiation history, milestones, submissions and approvals
- Payment records, including amounts funded, held, released or refunded, fees charged, and related payment references
- Dispute evidence and communications submitted by either party
3.3 Information We Collect Automatically
- Usage data: Pages visited, features used and actions taken on the Platform
- Device and log data: IP address, browser type, operating system and device identifiers
- Cookies and analytics: Session data, and product analytics where you consent, as described in Section 13
3.4 Information from Third Parties
- Profile, engagement and audience data from Instagram (Meta) and YouTube (Google) when you connect an account (Sections 5 and 6)
- Publicly available profile data for social accounts that are added to the Platform without a connected login, collected through a data-collection provider (Section 7)
- Payment and settlement status from our payment processors
- For Brands that connect an online store, order and product data from that store
4. Purpose of Processing and Consent
We process personal data only for specified, lawful purposes, relying on your consent or on another ground the DPDP Act allows (such as performing the service you asked for, legal obligations, or legitimate uses). The purposes are:
- Account and organization management: Creating and authenticating your account, managing seats and roles, verifying identity
- Campaigns and deals: Letting Brands create campaigns, letting Creators discover and respond to them, and running the deal workflow
- Payments: Processing payments, recording and instructing release of funds, calculating and collecting fees, subscription billing and payouts
- Support and safety: Responding to requests, resolving disputes, detecting fraud and abuse, securing the Platform
- AI-assisted features: Generating campaign drafts and suggestions from the text you submit to those features (Section 7)
- Analytics and improvement: Understanding usage to improve the Platform, with your consent where required
- Legal compliance: Meeting obligations under tax, accounting, anti-fraud and other law
You can withdraw consent at any time by writing to the Grievance Officer (Section 12) or, for analytics cookies, through the cookie controls. Withdrawal is as easy as giving consent, does not affect processing done before withdrawal, and may mean we can no longer provide a feature that depends on the data.
5. Instagram / Meta Data Usage
When you connect Instagram through Facebook Login, we ask Meta for the following permissions: email, public_profile, pages_show_list, pages_read_engagement, pages_manage_metadata, instagram_basic and instagram_manage_insights. We use them to read, and we store:
- Profile data: Username, profile picture, biography and follower count
- Posts: Your published posts and their details
- Insights: Engagement metrics for your content, and audience demographics (such as age, gender and location breakdowns)
- Facebook Page access: The list of Facebook Pages you manage and the Instagram professional account linked to them, which is how Instagram data is reached. We do not currently publish content to your accounts
- Access tokens: Meta access tokens, stored encrypted (AES-256-GCM) and used only to fetch the data above
Purpose: We use this data to:
- Display your profile in the marketplace so Brands can find Creators
- Show Brands performance and audience insights relevant to campaigns and deals
- Verify that an account is authentic
- Support collaboration between Brands and Creators
We do not sell Meta data and do not use it for advertising. To stop this, disconnect the account in GetCollab Settings, which deletes the stored token and the data we hold for that account, or follow our Data Deletion Policy. Removing GetCollab in Facebook or Instagram settings stops new data being fetched but does not by itself delete data we already hold.
6. YouTube / Google Data Usage
If you connect YouTube, we request read-only access (youtube.readonly and yt-analytics.readonly). We access and store your channel profile, subscriber and video statistics, and YouTube Analytics reports, and an encrypted access token, to show your profile to Brands and report campaign performance. If you sign in with Google, we receive your basic Google account details (such as name and email) to create and secure your account.
GetCollab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described here. We do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where it is aggregated and anonymized for internal operations.
You can revoke access at any time at myaccount.google.com/permissions or by disconnecting in GetCollab Settings. Use of YouTube is also subject to the YouTube Terms of Service and the Google Privacy Policy.
8. Organization Seats and Team Visibility
In a Brand organization, Admins can see and manage the organization’s campaigns, deals, payment activity and team members, and Members see what the organization grants them. Information you submit as part of an organization account may be visible to other seat holders in that organization.
9. Cross-Border Data Transfer
Some of our providers are located in, or process data in, countries outside India, including the United States and the European Union (for example PostHog, Sentry, Anthropic, OpenAI, Meta, Google, Cloudflare, Dodo Payments and Bright Data). We transfer personal data outside India only to the extent permitted by the DPDP Act, subject to any restriction the Government of India notifies, and we require our providers to protect it under contract.
10. Data Retention
We keep personal data only as long as needed for the purposes in this Policy and for legal retention. In particular:
- Account and profile data: kept while your account is active, and until you delete your account
- On account deletion: your account identity is anonymized and certain connections are removed, as described in our Data Deletion Policy. Other content linked to the account (such as messages, deal content and analytics) is not automatically deleted and is kept as long as needed for the purposes above and legal retention, unless you ask us to remove specific content and the law allows
- Social media connections: tokens and the data collected from your connected accounts are kept until you disconnect the account (which deletes them) or we remove them on your request
- Sign-in security records: expired verification codes and expired or revoked session tokens are purged after 7 days
- Financial, tax and ledger records: kept, with identity anonymized on account deletion, for as long as Indian tax, accounting and company law requires. As general guidance only (not legal advice), certain books of account and tax records are commonly required to be kept for around eight years
- Dispute and fraud records: kept as long as needed to resolve disputes, investigate fraud or meet a legal hold
For logs, support requests and analytics we keep data for as long as needed for the purposes above and legal retention.
11. Your Rights as a Data Principal
Subject to applicable law, you have the right to:
- Access: a summary of the personal data we process about you and the processing we do
- Correction and completion: of inaccurate or incomplete personal data (you can correct most account data in Settings)
- Erasure: of personal data no longer needed for its purpose, subject to the retention described in Section 10
- Withdraw consent: for processing based on consent, at any time
- Grievance redressal: about how your personal data is handled, as described in Section 12
- Nominate: another person to exercise your rights if you die or become incapacitated, in line with the DPDP Rules
To exercise a right, write to the Grievance Officer in Section 12 from your registered email address. We respond within 30 days of receipt, and verify your identity before acting.
12. Grievance Officer and Grievance Redressal
In accordance with the DPDP Act, the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer handles questions, requests and complaints about personal data and the Platform:
- Name: Lokesh Jha
- Designation: Grievance Redressal Officer & Data Protection Lead
- Email: grievance@getcollab.in
- Address: GETCOLLAB TECHNOLOGIES PRIVATE LIMITED, Manikonda, Hyderabad 500089, Telangana, India
We acknowledge every grievance within 48 hours of receiving it and resolve it within 30 days of receipt.
If you are not satisfied with our response you may approach the Data Protection Board of India once it is operational, or any other forum available to you under law.
14. Children's Privacy and Age Restriction
The Platform is for people aged 18 or over. We do not knowingly collect personal data of anyone under 18, and we do not track, profile or target advertising at children. If we learn that we hold personal data of a person under 18, we will delete or anonymize it. If you believe this has happened, write to the Grievance Officer.
15. Data Security and Personal Data Breaches
We use reasonable technical and organizational safeguards, including:
- Encryption in transit, and encryption of connected-account access tokens at rest (AES-256-GCM)
- Access controls and authentication, including organization seat-based access for Brands
- Rate limiting and bot protection on sign-in and public forms
No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will inform you without undue delay, explaining what happened, the data involved, the likely consequences, what we have done and what you can do. We will also notify the Data Protection Board of India and CERT-In as and when the law requires.
16. Supplementary Notice for EEA and California Users
The Platform is mainly intended for users in India. If you access it from the European Economic Area, our legal bases under the GDPR include performance of a contract, legitimate interests, your consent and compliance with legal obligations. If you are a California resident, you may have rights to know and delete personal information; we do not sell personal information. You can send GDPR or CCPA requests to the Grievance Officer in Section 12, and we will address them under applicable law in addition to your rights under the DPDP Act.
17. Third-Party Links
The Platform may link to third-party websites, including payment processor pages. We are not responsible for their privacy practices and encourage you to read their policies.
18. Changes to This Policy
We may update this Policy to reflect changes in our practices or the law. We will tell you of material changes by:
- Posting the updated Policy on the Platform with a revised "Last updated" date
- Sending an email or in-product notice for material changes
If a change adds a new purpose that needs your consent, we will ask for it before using your data for that purpose.
19. Data Deletion Instructions
You may ask us to delete your personal data at any time. See our Data Deletion Policy for how to request it, what is removed, what we must retain, and timelines.
20. Contact Us
For questions about this Policy or your personal data:
- Support email: contact@getcollab.in
- Privacy and Grievance Officer email: grievance@getcollab.in
- Address: GETCOLLAB TECHNOLOGIES PRIVATE LIMITED, Manikonda, Hyderabad 500089, Telangana, India