Privacy Policy

CollabKeep is an escrow-backed influencer-marketing marketplace connecting Brands, Agencies, and Creators in India. This policy explains what we collect, why, and your rights. We follow India's Digital Personal Data Protection Act, 2023 (DPDP).

1. Data we collect

• Account: name, email, phone, role (brand/agency/creator/operator).
• Business & tax (brands/agencies): company name, GSTIN, PAN, billing city — used to issue GST invoices and enable Input Tax Credit.
• Creator KYC: PAN and payout details (UPI/bank) — required to compute 194-O TDS and release payouts. Stored encrypted; never shown to brands.
• Connected social data (with your consent): if you link Instagram (Business/Creator) or YouTube, we read read-only profile, media list, and insights (reach, engagement, views, subscribers). See Section 4.
• Campaign data: briefs, applications, messages, proof URLs, ratings, escrow and payout records.
• Delivery address (product deals only): when a deal includes a product, the creator shares a delivery address after accepting the deal — name, street address, city, state, PIN code and a mobile number for the courier. It is used only to ship that deal's product, is shown only to the creator and that deal's brand, is stored encrypted (AES-256-GCM), and is deleted when the deal closes (released, completed, cancelled or refunded). CollabKeep staff can read it only through a reason-tagged, audit-logged reveal.
• Store visits (visit deals only): when a brand asks creators to visit one of its outlets, the brand lists each outlet's name, address, city, opening hours and an optional map link — that is the brand's business information and is shown on the public brief. The creator picks an outlet, a day and a time; we store only that booking (which outlet, the date and time, whether it was confirmed, and whether the visit happened) with the deal record. We never collect a creator's location — there is no GPS or check-in; the brand's "visited" tap or the creator's submitted content is the record.

2. How we use it

• Run the deal-payment workflow — hold the deal amount, release it only after verified proof and approval, compute GST/TDS.
• Show creators' verified stats to brands and power the analytics and fair rate-card.
• Confirm a sponsored post is live (proof verification).
• Fraud prevention, dispute resolution, and legal/tax compliance.

3. Escrow & payments

Brands pay through Razorpay, a payment aggregator authorised by the Reserve Bank of India. Card, UPI and net-banking details are entered on Razorpay's checkout — CollabKeep never sees or stores them. The deal amount is received by Untitled Adflux Private Limited (CollabKeep), held for that deal, and paid to the creator after the brand approves the published work or after the 48-hour auto-approve. If a deal is cancelled before work is accepted, or a dispute is decided for the brand, it is refunded to the original payment method through Razorpay.

What “escrow” means on CollabKeep: this payment-protection step, run by CollabKeep. It is not a bank escrow account or a trust arrangement, and CollabKeep is not a bank or a wallet. We store the transaction references, amounts and payout records needed to pay creators, issue refunds, reconcile, and file GST/TDS.

4. Instagram & YouTube data (Meta & Google)

When you connect Instagram (Instagram API with Instagram Login) or YouTube (Google OAuth, scope youtube.readonly), you grant read-only access to your own account. CollabKeep uses it only to:

• Display your follower/subscriber count, engagement, reach, views, saves, posting activity (post dates and formats), audience cities and age bands, your channel's creation date, and your recent posts and videos on your media kit and to signed-in brands and agencies on CollabKeep (creator cards and your creator profile). Your public CollabKeep profile page (collabkeep.com/c/your-handle, visible to anyone with the link) shows only your Instagram follower count, engagement rate and top three Instagram posts, and no YouTube data.
• Confirm that a campaign post or video is live (proof for escrow release). When you submit a proof link we may check, in the background and using only your own connected account, that the link is a post or video on that account, when it was published, and whether a disclosure tag appears in its caption or description (or YouTube's paid-promotion flag is on). Our servers never open the pasted link itself. We keep only those facts with the deal record — the post ID, your account ID and handle or channel name, the publish time, whether a YouTube video is unlisted, and which disclosure tag was found (or that none was). The check never stores the caption, and a check that cannot tell never blocks, delays or reduces your payout.

We never post, edit, delete, comment or message on your behalf, and we never read other people's accounts. We access your account only after your explicit consent on Meta's or Google's own consent screen. You can disconnect any time inside the app (Settings → Connections → Disconnect) or revoke access in your Meta / Google account. On disconnect we delete the access token immediately and all cached platform data within 30 days.

Google API Services User Data Policy. CollabKeep's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data (YouTube channel name, subscriber and view counts, video list and statistics, and the channel's creation date) is used only to provide the user-facing features described above: showing your statistics on your media kit and to signed-in brands and agencies on CollabKeep, and the proof check. It is never shown on your public profile page, never used for advertising, never sold, never shared with data brokers, never used to train AI or machine-learning models, and never read by humans except with your consent, for security or abuse investigation, or as required by law.

YouTube API Services. CollabKeep uses YouTube API Services to read the YouTube data described above. By connecting YouTube you agree to be bound by the YouTube Terms of Service. Google's own handling of your data is covered by the Google Privacy Policy. You can revoke CollabKeep's access at any time from your Google security settings.

How Google and Meta data is protected (sensitive data safeguards).

• In transit: every connection between your browser, our servers and the Google / Meta APIs uses TLS 1.2 or higher (HTTPS). No platform data is ever sent over an unencrypted channel.
• At rest: OAuth access and refresh tokens are encrypted with AES-256-GCM using a key that lives only in our backend's secret store (never in the app bundle or source code). Plaintext tokens are never stored. Synced statistics are stored in an access-controlled database (Convex, hosted in the United States) that is encrypted at rest by the provider.
• Access control: tokens are readable only by the server functions that refresh your statistics and run the proof-link check; no employee can view them. Operator access to any sensitive record (KYC, tokens, contact details) requires a named admin seat, a stated reason, and is written to an immutable audit log.
• Minimisation and retention: we request only the read-only scopes listed above, store only the fields shown on your media kit or to signed-in brands and agencies on CollabKeep, plus the minimal proof-check facts described in Section 4, and refresh your statistics nightly and when you tap Re-sync. Tokens are deleted the moment you disconnect; cached statistics within 30 days; the post ID, account ID and handle kept by a proof check are removed from your deals when you disconnect that account (the check's yes/no result and timestamps stay with the deal's financial record); everything is deleted on account deletion (see Data Deletion).
• Incident response: if we become aware of unauthorised access to platform data we will revoke the affected tokens, notify affected users and the relevant platform without undue delay, and notify the Data Protection Board of India as required under the DPDP Act, 2023.

5. Sharing

We do not sell personal data. We share only with: the payment aggregator Razorpay (to collect payments and issue refunds), tax authorities (GST/TDS filings), our identity provider Clerk (sign-in) and our hosting/database provider Convex, each under contract and only for the purpose named. Google and Meta platform data is never shared with any third party except these processors as needed to run the service, and never for advertising. Operator access to sensitive data is audit-logged. Within a product deal, the creator's delivery address is shown to that deal's brand so it can ship the product — and to no one else.

6. Safety reports

When you report content or a user, we record what you reported, your reason and note, and a snapshot of the reported content, so a person can review it. This is used only for moderation, is visible only to authorised staff (access is audit-logged), and is kept for up to 180 days after the report is closed, then the note and snapshot are deleted. If you delete your account, the notes on reports you filed are removed. Reach us any time at we@collabkeep.com.

7. Retention

We keep account and transaction records as required by Indian tax and accounting law (typically 8 years for tax records). Connected-social tokens are deleted immediately on disconnect, cached platform statistics within 30 days, and KYC and all other personal data on request or on account closure, subject to legal retention of financial records. A delivery address is deleted when its deal closes; the shipped and received dates and any tracking reference stay with the deal record.

8. Your rights (DPDP 2023)

• Access, correct, or delete your personal data.
• Withdraw consent for connected social accounts at any time.
• Grievance redressal — contact our Data Protection point of contact below.

To delete your data, see our Data Deletion page.

9. Security

• Encryption: all traffic over TLS (HTTPS only); PAN, GSTIN, bank/UPI details, contact details and social-platform tokens are encrypted at rest with AES-256-GCM under a backend-only key; the database is additionally encrypted at rest by our hosting provider.
• Access: least-privilege server functions; role-based admin seats; two-admin approval for every money action; every operator view of sensitive data is reason-tagged and audit-logged; no credentials or keys are ever placed in client code or source control.
• Authentication: passwordless one-time-code sign-in through a managed identity provider (Clerk), with bot protection, lockout and device checks.
• Data minimisation: we collect only what a workflow needs and request only read-only platform scopes.
• Testing and monitoring: independent penetration testing of the backend, automated tests on every money path, and provider-level monitoring and backups.
• Breach notification: affected users, the relevant platform (Google / Meta) and the Data Protection Board of India are notified without undue delay.

10. Contact

Safety & abuse reports · we@collabkeep.com (reviewed within 24h).

Brijesh · CollabKeep (Untitled Adflux Private Limited) · Brijesh@untitledad.in · +91 94282 73686