PrivacyPolicy.

U Creator is operated by [Registered entity name: not filled in yet], a Private Limited Company registered in India at [Registered address: not filled in yet], GSTIN [GSTIN: not filled in yet]. We are the Data Fiduciary for the personal data described below, within the meaning of the Digital Personal Data Protection Act, 2023. This policy explains what we collect, why, and what control you have over it.

The service is currently available to users in India only, and all data is processed in connection with transactions between Indian brands and Indian creators.

Account data. When you sign up we receive your email address and a unique identifier from our authentication provider (Google Firebase Authentication), plus whether your email is verified. We never receive or store your password.

Profile data. Whatever you choose to publish: display name, biography, services offered, niches, languages, state, remote availability, portfolio links and work samples. This is intended to be seen by brands, and public creator profiles are visible to signed-out visitors.

Transaction data. Briefs you post or apply to, messages and files exchanged on a brief, ratings, and a record of amounts held and released. Payment instrument details are handled by our payment provider and never reach our servers.

Payout data. If you are a creator, the UPI ID you provide so that you can be paid.

Connecting Instagram is optional and nothing about it happens unless you explicitly authorise it. If you do, we request only the permissions needed to show verified audience figures on your profile: basic business account information and insights.

We store your Instagram user ID, username, account type, and a snapshot of follower, following and media counts. Your Instagram access token is encrypted at rest and is used only to refresh those figures. It is never shared, and it is never exposed through our API: the public projection of your account is defined so that the token cannot be included in it.

You can disconnect Instagram at any time from your profile. Disconnecting deletes the stored token and the cached metrics.

To operate the marketplace: to let brands discover creators, to run the brief and application flow, to carry messages and delivered files between the two parties, to hold and release payment, and to show ratings after a project completes.

We do not sell your personal data. We do not use your messages or delivered files for advertising.

Service providers who process data on our behalf: our authentication provider, our cloud hosting and file storage provider, and our payment aggregator. Each receives only what their function requires.

The other party to a transaction: if you apply to a brief, the brand sees your profile and your application; if you post a brief, applicants see it.

Law enforcement or regulators where we are legally required to disclose.

Profile and account data is retained while your account exists. Transaction and payment records are retained for 8 years after your account closes, because the Companies Act and the Income Tax Act both require financial records to be kept for a minimum period and the longer of the two governs.

Deleting your account removes your profile, portfolio, uploaded files, Instagram connection and payout details. Records of completed transactions are retained in the form required by law.

To delete your account and associated data, email privacy@ucreator.in from the address on your account, or use the deletion option in your profile once available. We will confirm and complete the request within 30 days.

To remove only your Instagram data, disconnect Instagram from your profile. This is immediate and does not require contacting us.

Access to files exchanged on a brief is restricted to the two parties to that brief. Instagram access tokens are encrypted at rest. Sessions are carried in HTTP-only cookies. No system is perfectly secure, and we encourage you to report anything you find to security@ucreator.in rather than disclosing it publicly.

Under the Digital Personal Data Protection Act, 2023 you have the right to obtain a summary of the personal data we hold about you and how we process it, to have inaccurate data corrected or incomplete data completed, to have your data erased where we no longer need it, to nominate someone to exercise these rights if you die or become incapacitated, and to withdraw a consent you previously gave.

You can access and correct most of your data directly in your profile, and withdraw Instagram consent by disconnecting it there. For anything else, including a copy of your data or a deletion request, email privacy@ucreator.in. We respond within 30 days, and we do not charge for it.

Withdrawing consent does not undo processing already carried out, and we may still need to retain transaction records for the statutory period described above.

Grievance Officer, as required under the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, 2021: [Grievance Officer name: not filled in yet], grievance@ucreator.in, [Grievance Officer postal address: not filled in yet]. If we do not resolve your complaint, you may escalate it to the Data Protection Board of India.

We will update this page when our practices change and revise the date above. Questions go to privacy@ucreator.in or via our contact page.