| Version | 1.2 |
| Effective date | 2 November 2026 |
| Data Fiduciary | Tatvata (the "Company", "we") |
| Platform | Tatvata, at www.tatvata.com |
This notice is presented on its own, before or with each request for your consent, and is meant to be understood without reading any other document. It gives the personal data we ask for, why, and what you can do. It is given under section 5 of the Digital Personal Data Protection Act, 2023 (the "Act") and rule 3 of the Digital Personal Data Protection Rules, 2025 (the "Rules").
Part 1. Who is asking
The Company asks for your consent to process the personal data listed below. Our contact for questions about your personal data is in Part 9.
Part 2. What we ask for, and why
Each row is a separate purpose. You give or refuse consent to each purpose that needs it. Where a row says "required", the Platform cannot provide that purpose without the data.
2.1 Purposes needed to have an Account
| No. | Personal data | Purpose and the service it enables | Required? | If you do not provide it |
|---|---|---|---|---|
| A1 | Email address or mobile number, and the sign in credential you choose | To create your Account, sign you in, recover access, and send essential Account messages | Required | You cannot create an Account |
| A2 | Identifier issued by Firebase Authentication, and the sign in method | To link a verified sign in to your Account | Required | You cannot sign in |
| A3 | Display name (Creator) or company name (Brand) | To identify you on the Platform and to your counterparties | Required | You cannot complete registration |
| A4 | IP address, browser and device type, session records | To keep your session secure and detect misuse | Required | The Platform cannot be secured for you |
2.2 Purposes that you may choose separately
| No. | Personal data | Purpose and the service it enables | Required? | If you do not provide it |
|---|---|---|---|---|
| B1 | Instagram or YouTube account identifier, handle and profile link, an encrypted authorisation credential, audience size, content views, reach, likes, comments, shares and saves, and aggregate audience information by country and by age and gender band | To collect your measurements, calculate your Impact Score, and run verification and integrity checks | Optional, and needed to receive a score | You will have no Impact Score and cannot meet the conditions to apply to Campaigns |
| B2 | Niche selections, and the assessment of your niches | To score you within a niche and to match you to Campaigns | Optional, and needed to receive a score | As for B1 |
| B3 | Bio, location, profile image, LinkedIn address, languages, and the availability setting | To complete your profile and, where you choose, to show it publicly and to Brands | Optional | Your profile shows less |
| B4 | Your public profile fields, as listed in the Privacy Policy section 6 | To publish a public profile page and an identity card at a public address | Optional, and you can unpublish | No public page is shown |
| B5 | Your Creator data as shown to a Brand in the Privacy Policy section 6.4 | To let Brands discover you and to rank and match you for Campaigns | Optional | You will not appear to Brands |
| B6 | Proposals, Agreement terms and acceptances (with the IP address and browser recorded when you send or accept an offer), documents you upload, feedback, disputes and concerns | To run applications, Agreements, Passes and reputation, and to keep evidence of who agreed to what | Optional, needed to use those features | You cannot apply or enter an Agreement |
| B7 | Company website, country, logo, and Team Member details (Brand) | To complete the Brand profile and organisation | Optional for website, country and logo. Required for Team Members you add | The profile shows less |
| B8 | Messages you send to the other party to a Campaign or Agreement, read markers, blocks and reports you make | To let a Brand and a Creator message each other, to notify you of new messages, and to act on reports of misuse | Optional | You cannot message the other party; offers and Agreements still work |
2.3 Purposes the law lets us pursue without your consent
We may process personal data without asking for consent where the Act permits a legitimate use, including for the specified purpose for which you voluntarily gave the data and have not objected, and to comply with a law or an order of a court or authority. We will say where we rely on this.
Part 3. Who receives your personal data
We share personal data with processors who act on our instruction (Google for Firebase Authentication including SMS codes, Amazon Web Services and Supabase for hosting in Mumbai, Cloudflare for network delivery, and Brevo for email delivery), with Meta for the Instagram connection and Google for the YouTube connection you authorise, with other Users as described in rows B4 to B6 and B8, and with authorities where the law requires. We do not sell personal data.
Part 4. Where it goes
Some processing happens outside India. The Privacy Policy section 8 names the countries.
Part 5. How long we keep it
We keep personal data while your Account is open and for the periods in the Privacy Policy section 13 after that. Instagram measurements are kept for no more than ninety days from observation. Messages are deleted sixty days after they are sent, except a message we removed or one reported and not yet resolved, which is kept for one hundred and eighty days. Data from a social account you disconnect, and data from your Account when you delete it, is deleted as the Data Deletion Policy says.
Part 6. How to withdraw consent
You can withdraw consent as easily as you gave it.
| Consent | How to withdraw |
|---|---|
| B1 and B2 (Instagram, YouTube and scoring) | Select "Disconnect" for the account in Settings. Collection stops at once. To have the data deleted at once, delete your Account, as the Data Deletion Policy describes |
| B3 and B4 (profile and public page) | Edit the field, or select "Unpublish" in your profile |
| B5 (visibility to Brands) | Write to the contact in Part 9 and we will act on your request |
| B6 (relationships) | Close the Account, subject to unresolved obligations |
| B8 (messages) | Block a conversation from its menu, which stops new messages, or close the Account. Messages already sent are deleted on the sixty-day rule |
| All | Write to the contact in Part 9 and we will act on it without charge |
Withdrawal does not affect processing done before it. If you withdraw consent we will stop processing for that purpose within a reasonable time and tell our processors to stop, unless the law requires or authorises the processing.
Part 7. Your rights
Under the Act you have the following rights.
- You may ask for a summary of the personal data we process and the processing activities, and for the identities of the Data Fiduciaries and Data Processors we have shared it with.
- You may ask for correction, completion, updating and erasure.
- You may have a grievance addressed by us and make a complaint to the Board.
- You may nominate another person to exercise your rights if you die or become incapacitated.
- You may withdraw consent at any time.
To exercise a right, follow the Grievance and Data Rights Policy Part B. We respond within the period stated there, which is never more than ninety days.
Part 8. Complaint to the Data Protection Board of India
If you are not satisfied with our reply you may make a complaint to the Data Protection Board of India. The Board receives complaints online.
Part 9. Contact
Data contact, Tatvata, [email protected], Sai Nagar, Old Hafeezpet, Hyderabad, Telangana 500049, India. We state this contact in every reply to a rights request.
Part 10. Language
You may read this notice in English or in any language specified in the Eighth Schedule to the Constitution. This notice is currently available in English.