| Version | 1.1 |
| Effective date | 4 October 2026 |
| Operator | Tatvata (the "Company", "we") |
| Platform | Tatvata, at www.tatvata.com |
This policy explains what happens to the data we receive from YouTube and Instagram, and to the rest of your personal data, when you disconnect a social account or delete your Tatvata Account. It explains how to have data deleted, what we keep and why, and which rules of Google, YouTube and Meta we follow. It is also our data deletion instructions for Meta and for Google. It forms part of the Privacy Policy.
At a glance
| If you | What happens to the data from YouTube and Instagram |
|---|---|
| Delete your Account | Deleted at once, in the same job that deletes the Account. The job starts straight after your request is confirmed and normally finishes within minutes. |
| Disconnect YouTube | Access is revoked with Google and our stored credential is erased at once. The data collected is deleted within 7 days. |
| Disconnect Instagram | Our stored credential is erased and collection stops at once. The data collected stays out of sight of everyone, then is deleted after no more than 90 days. Delete your Account to have it removed at once instead. |
| Revoke Tatvata in your Google Account settings | Our access ends. If the connection stays expired, the data collected from YouTube is deleted within 30 days. |
| Write to us and ask | We act within 7 days of confirming it is you, and confirm in writing. |
| Do nothing | Instagram data is deleted automatically 90 days after it was observed, whatever else happens. |
1. What this policy covers
1.1 YouTube. If you connect a YouTube channel, Tatvata uses YouTube API Services, meaning the YouTube Data API and the YouTube Analytics API. We ask for two permissions, both read only: youtube.readonly and yt-analytics.readonly. We do not ask to upload, edit or delete anything on your channel and we do not ask for any revenue or monetisation data.
1.2 Instagram. If you connect an Instagram account, Tatvata uses Instagram's platform. We ask for two permissions: instagram_business_basic and instagram_business_manage_insights. We do not post, message or change anything on your account.
1.3 In this policy "platform data" means the data we receive from YouTube, Google or Instagram about a social account you connect, as listed in section 2, and data we hold only because we received it that way.
1.4 By connecting a YouTube channel you also agree to be bound by the YouTube Terms of Service. The Google Privacy Policy describes how Google handles your data.
2. What we receive from the platforms, and what we do not
| Data | Platform | What we use it for |
|---|---|---|
| Channel or account identifier, handle and profile link | YouTube, Instagram | To know which account you connected and to link to it |
| Authorisation credential (YouTube: a refresh token. Instagram: a long lived access token) | YouTube, Instagram | To collect your measurements for as long as you stay connected |
| Audience size (subscribers or followers). A YouTube channel can hide its subscriber count, in which case we do not receive it | YouTube, Instagram | To show your reach and to calculate your Impact Score |
| Content views, likes and comments, as counts. For YouTube, the average over your most recent public videos (at most ten) | YouTube, Instagram | To calculate your Impact Score and integrity checks |
| Shares as a count. Reach and saves as counts | YouTube (shares only), Instagram | To calculate your Impact Score |
| Where your audience is, and its age and gender, as percentages for the whole audience. On YouTube this describes the people who watched your videos in the last 90 days, not your subscribers | YouTube, Instagram | To describe your audience to you and, where you allow it, to Brands |
2.1 We do not receive the identity of any individual follower, subscriber or viewer. We receive counts and percentages, not the text of comments or messages, and we do not collect your videos, their titles or descriptions, or your private messages. We do not keep the raw responses we get from the platforms. We keep only the values in this section.
2.2 Each value is recorded with the time it was observed. A new value is a new record, which is how we show you how fresh the data is.
3. How we use platform data
3.1 We use platform data only to provide the features you can see on Tatvata: your connection status, your Impact Score for each niche and each platform, your analytics, the verification and integrity checks that sit behind them, and, where your profile allows it, the limited view of you that Brands see and the matching of you to Campaigns. The Privacy Policy section 6 lists exactly what a Brand can see.
3.2 We do not sell, rent, license or lend platform data. We do not use it to show advertising, to target or retarget advertising, or to build advertising or interest profiles. We do not give it to advertising platforms, data brokers or information resellers. Tatvata shows no advertising.
3.3 We hand platform data to others only (a) to the providers that host and protect Tatvata and act on our instruction, which the Privacy Policy section 5.2 names, (b) to a Brand as described in section 3.1, (c) when the law or a lawful order requires it, and (d) to protect the security of Tatvata and its Users.
3.4 Our team does not read platform data about an individual except to investigate abuse or a security problem, to give support you ask for, or to meet a legal duty. Otherwise it is used in aggregate.
3.5 Tatvata's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. How we protect platform data
4.1 Your authorisation credential is encrypted when stored, is never sent to your browser, and is never written to a log. Data travels over encrypted connections. Our systems are hosted in India (Mumbai region) with access controls, and administrator actions are logged.
4.2 We check regularly, and at least once a day, that each connection is still authorised. If the platform refuses our credential, because you revoked access with the platform or it expired, the connection is marked expired, collection stops, and you are asked to reconnect. We never collect from a connection the platform no longer authorises.
4.3 If a personal data breach occurs, the Privacy Policy section 10 describes how we tell you.
5. The platforms' rules we follow, and what we do
We follow the requirements of Google, YouTube and Meta listed here. They are contractual requirements of those companies and are enforced by them. This table states what we do. It is not a statement by Google or Meta that we meet their requirements, and it is not legal advice.
| Requirement | Source | What we do |
|---|---|---|
| Publish a privacy policy that explains what we access, collect and store, how we use, process and share it, that we use YouTube API Services, links to the Google Privacy Policy, explains that you can revoke our access in Google's security settings, and says how to contact us | YouTube API Services Developer Policies, section III.A.2 | The Privacy Policy and this policy cover each point. Section 6.5 gives the Google security settings link and section 11 gives our contact |
| Limit use of Google user data to providing or improving features users can see, with no advertising, no sale, and no human reading except as the policy allows | Google API Services User Data Policy, Limited Use | Sections 3.1 to 3.5 |
| When you revoke access through our product, revoke the token at once and delete the authorised data within 7 calendar days | YouTube API Services Developer Policies, section III.D.2.3.a | When you disconnect YouTube we ask Google to revoke the token and erase our copy of it at once, and delete the data within 7 days, as section 6.3 says |
| When you revoke access in Google's security settings, delete the data within 30 calendar days | YouTube API Services Developer Policies, section III.D.2.3.b | We find out when Google refuses our credential on the next collection. A YouTube connection that stays expired has its data deleted so that deletion is complete within 30 days |
| Check at least every 30 days that we are still authorised to hold the data | YouTube API Services Developer Policies, section III.E.4.b | We check at least once a day (section 4.2) |
| Give you a way to ask us to delete stored data, delete it within 7 calendar days, and make clear that deleting it from us does not change data held by YouTube | YouTube API Services Developer Policies, section III.E.4.g | Sections 6.1 to 6.4. Deleting data from Tatvata does not delete anything on YouTube, Google or Instagram. You manage that with them |
| Do not sell or redistribute YouTube API data, and do not place advertising on pages that show it | YouTube API Services Developer Policies, section III.G.1 | Sections 3.2 and 3.3 |
| Provide, maintain and comply with a public privacy policy that explains what data we process, how, why, and how you can ask for it to be deleted | Meta Platform Terms, section 4 | The Privacy Policy and this policy, which are public and readable by search engines |
| Delete platform data as soon as reasonably possible when you ask for it to be deleted or no longer have an account with us | Meta Platform Terms, section 3.d.i.2 (d) | Deleting your Account deletes your Instagram data at once. You can also ask us in writing (section 6.4) |
| Delete platform data as soon as reasonably possible when we no longer need it for a legitimate purpose | Meta Platform Terms, section 3.d.i.2 (a) | Instagram data is deleted automatically 90 days after it was observed. Data from a disconnected account is deleted after no more than 90 days |
| Delete platform data if we stop operating the product, or if Meta asks us to delete it to protect users | Meta Platform Terms, section 3.d.i.2 (b) and (c) | We will do so |
| Protect platform data with reasonable safeguards | Meta Platform Terms; Google API Services User Data Policy | Section 4 |
| Do not sell, license or buy platform data | Meta Platform Terms, section 3 | Section 3.2 |
The sources were read on 2 October 2026: the YouTube API Services Developer Policies (last updated 14 September 2026), the Google API Services User Data Policy (last updated 15 February 2024) and the Meta Platform Terms (last updated 3 February 2026). If a platform changes its rules we will update this policy and its date.
6. How to have your data deleted
6.1 Delete your Account
This removes everything in section 7 at once, including the data from YouTube and Instagram.
- Sign in and open the profile menu, then Account settings.
- Select Delete account.
- Confirm that it is you, with your password, a code sent to your mobile number, or your Google sign in, as your Account uses. If you are a Creator with a public handle you also see a box, Delete these immediately instead. By default we keep your handle, and the fingerprint described in section 8, for 30 days. Tick the box if you want both removed straight away. You then cannot get your handle back, and anyone can take it.
- We check that you have no unresolved obligations (section 6.2). If you have none, your request is accepted and we email you.
- You can cancel while the request is still only a request. Once processing starts it cannot be cancelled.
- We then delete the data as section 7 describes.
6.2 If we cannot delete your Account yet
We cannot delete an Account while it has a live Campaign, an application or Agreement that has not ended, an open concern, or a Pass that has not ended, because another person is relying on it. A Brand that owns an organisation with other team members must first remove them. We show you exactly what is in the way. When you have resolved it, you can delete your Account. Meanwhile you can disconnect each platform (section 6.3).
6.3 Disconnect one platform and keep your Account
- Sign in and open the profile menu, then Social Media Connections.
- Select Disconnect for the YouTube channel or the Instagram account.
Collection stops at once and our stored credential is erased at once. We ask the platform to revoke the credential, and if the platform cannot be reached at that moment the credential is still erased on our side. The connection disappears from your view and is not shown to any Brand. Then:
| Platform | When the data collected from it is deleted |
|---|---|
| YouTube | Within 7 days |
| After no more than 90 days. It is deleted sooner if you delete your Account or ask us in writing |
If you remove Tatvata in your Google Account settings or in your Instagram account settings, our access ends, and collection stops when the platform next refuses our credential. To have the data deleted, use section 6.1, 6.3 or 6.4.
6.4 Ask us in writing
Write to the Data contact in section 11 from the email address or mobile number registered to your Account. Say whether you want your YouTube data deleted, your Instagram data deleted, or your Account deleted. We confirm that it is you, delete what you ask within 7 days, and confirm in writing. If we cannot do something, because the law requires us to keep it or because of section 6.2, we say what and why.
6.5 Revoke access at the platform
You can revoke Tatvata's access to your Google data at any time at Google security settings, and to your Instagram data in your Instagram account settings. This is separate from deleting data from Tatvata.
7. What is deleted when your Account is deleted
Deletion completes in a single job. The Account moves to Deleted only after every step has succeeded, and if a step is interrupted the job continues where it stopped.
| Data | What happens |
|---|---|
| Everything we collected from YouTube and Instagram: audience size, views, reach, likes, comments, shares, saves, and audience location, age and gender | Deleted at once |
| The YouTube channel or Instagram account identifier and handle on each connection | Replaced at once with a value that names no one |
| The authorisation credential for each connection | Revoked with the platform and erased at once |
| Your email address, mobile number and sign in identifier. The scrambled form of your password (we never hold the password itself), the time you last signed in, and the times your email address and mobile number were verified | Removed from the Account |
| Your bio, location, LinkedIn address, languages and profile image. For a Brand, the company website and logo | Deleted |
| Your public profile and public handle | The public page stops working at once. The handle is held for 30 days so that you can have it back if you return, as section 8 describes. After 30 days anyone can be given it. If you ticked Delete these immediately, it is not held at all and anyone can be given it straight away |
| Your sign in sessions and any password reset in progress | Ended and cancelled |
Signing up again with the same email address, mobile number or Google account creates a new Account. Nothing from the deleted Account carries over, not your Tatvata ID, your scores, your verification, or your reputation. The one exception is your public handle: unless you ticked Delete these immediately, if you sign up again within 30 days of deleting your Account and are then verified within those 30 days, you are given the same handle.
8. What we keep after your Account is deleted, and why
We do not keep the data we collected from YouTube or Instagram. We do keep the following, and we say so plainly.
| What we keep | Why |
|---|---|
| Your display name (or, for a Brand, the company name) as it was when you left. Other people see it marked as a deleted account, with no profile, contact detail or link | Other people's records show who they dealt with |
| The records of your dealings with other users: Campaigns, applications, Agreements and their accepted versions, Passes and their history, concerns and feedback | The other party relies on them, and they are needed for legal claims and for the accuracy of the Pass |
| The Impact Scores, integrity assessments and flags, verification records and reputation figures we calculated about you, with the summary figures inside them that came from your platform data, such as audience size at the time. They are no longer connected to a profile you can be contacted through or to a public page | They are our own assessments and the other records above refer to them. You can ask us to erase them under the Grievance and Data Rights Policy Part B, and we will say what we can delete and why we cannot delete the rest |
| For 30 days only, unless you ticked Delete these immediately when you deleted your Account: your public handle, and a one way fingerprint of the email address, mobile number and sign in identifier your Account had. The fingerprint is made with a secret key we hold and cannot be turned back into your email address or number | So that you get the same handle back if you sign up again within 30 days. Nobody else can be given the handle during that time. After 30 days the handle is free and the fingerprint is deleted. If you ticked the box, none of this is kept |
| Records of administrator actions, which carry no copy of your personal data | Accountability and security |
| Information that a law or an order requires us to keep, for the period it requires. The Privacy Policy section 13 lists these periods, for example complaint and order records and security logs | The law |
9. Changes to what we do, and to this policy
9.1 We do not use data after we have deleted it.
9.2 A change to this policy is a new version with a new effective date, and we tell you of a change as the Terms of Use describes. We will not use platform data for a purpose this policy does not describe without first telling you and, where the platform's rules or the law require it, asking for your consent.
10. Your other rights
You may also ask for access to your personal data, correction, and to withdraw consent, and you may complain to us and to the Data Protection Board of India. The Grievance and Data Rights Policy describes how, and the periods within which we respond. The Privacy Policy describes the rest of what we collect and why.
11. Contact
Contact for data deletion and data requests. Data contact, Tatvata, [email protected], Sai Nagar, Old Hafeezpet, Hyderabad, Telangana 500049, India. We repeat this contact in every reply.
Grievance Officer. See the Legal and Contact Information page.