| Version | 1.2 |
| Effective date | 2 November 2026 |
| Data Fiduciary | Tatvata (the "Company", "we") |
| Platform | Tatvata, at www.tatvata.com |
1. Who we are and what this policy covers
1.1 This policy explains how the Company collects, uses, stores, shares and protects personal data of visitors, Creators, Brands and Team Members who use the Platform. It forms part of the User Agreement described in the Terms of Use.
1.2 The Company decides why and how the personal data described here is processed and is the Data Fiduciary for it, as that term is used in the Digital Personal Data Protection Act, 2023 (the "Act").
1.3 A separate DPDP Notice sets out, purpose by purpose, the specific data and the consent we ask for. That notice is complete in itself and is understandable without reading this policy. This policy gives the wider account of our practices.
2. Personal data we collect
| Category | What it includes | Source |
|---|---|---|
| Account data | Email address, mobile number, a hash of your password (never the password), the identifier issued by Firebase Authentication, your role (Creator, Brand or administrator), account status, and records of your sessions | You, and Firebase Authentication |
| Creator profile data | Display name, optional bio, optional location, optional profile image, optional LinkedIn address, languages, the opt in setting for availability for brand collaboration, your Tatvata ID and, once issued, your public handle | You, and the Platform |
| Brand and organisation data | Company name, optional company website, optional company country, optional company logo, the Team Members you add and their login details, and a referral reference if you arrived from a Creator's public profile | You |
| Social Account data | The account identifier, handle and profile link of each Social Account you connect (an Instagram account or a YouTube channel), an encrypted authorisation credential, and measurements collected through the official interface, which are audience size, content views, reach, likes, comments, shares and saves, and aggregate audience information by country and by age and gender band. The Data Deletion Policy section 2 says which of these each platform provides | The third party service (Instagram or YouTube), with your authorisation |
| Derived data | Niche selections and the niche relevance assessment, Impact Scores and their version, integrity flags and integrity score, verification layer records and history, match results, and reputation summaries | Generated by the Platform from the data above |
| Relationship data | Campaigns, applications and proposals, invitations, Agreement versions and acceptances, Passes and their history, feedback, disputes, concerns, and documents you upload | You and the other party to the relationship |
| Messages | Messages you and the other party to a Campaign or Agreement send each other on the Platform, who sent each one and when, the Campaign it is about, read markers, blocks, and reports you make about a message | You and the other party |
| Communications data | One time codes sent to your email or mobile number (stored only as a hash), password reset requests, support and grievance messages, and notices we send you | You, and the Platform |
| Technical data | IP address, browser and device type, request logs with a correlation identifier, security and audit logs of administrator actions, and the IP address and browser recorded when you send or accept an offer | Your device, and the Platform |
| Consent and acceptance records | The version of each document you accepted, the consent you gave or withdrew, and the time | The Platform |
2.2 We do not collect government identity documents, financial account details, payment card details, precise location or the contents of private messages on any Social Account. Messages you exchange with another User on the Platform are covered in sections 6.5 and 13.
2.3 Audience information about the followers of your Social Account is aggregate. We do not receive or store the identity of an individual follower.
3. Why we use personal data
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your Account, sign you in, recover access | Account data, technical data | Consent, and legitimate use for the purpose you provided the data |
| Provide the Platform, meaning profile, connection, scoring, verification, discovery, matching, Campaigns, Agreements, Passes, reputation | Account, profile, Social Account, derived and relationship data | Consent, and legitimate use for the purpose you provided the data |
| Show a public profile and a public Campaign page you choose to publish | Profile data, Campaign data | Your consent, which you may withdraw by unpublishing |
| Let a Brand and a Creator message each other about their Campaigns and Agreements, notify them of new messages, and act on reports of misuse | Messages, account data | Consent, and legitimate use for the purpose you provided the data |
| Keep evidence of an Agreement: who sent and who accepted each offer, when, from which IP address and browser, and a fingerprint of the exact terms | Relationship data, technical data | Legitimate use, and the establishment of legal claims |
| Detect inauthentic activity and protect the Platform and its Users | Social Account, derived, technical and audit data | Legitimate use, and legal obligation |
| Respond to grievances, requests, orders and legal claims | Communications, relationship and technical data | Legal obligation, and legitimate use |
| Send notices about your Account, the User Agreement, security and the matters we are required to tell you | Account data, communications data | Legal obligation, and legitimate use |
| Improve the Platform and the accuracy of scores and matches | Derived and relationship data, in aggregate where practicable | Consent where required |
3.2 We do not sell personal data. We do not use personal data for advertising, for behavioural profiling for advertisers, or to track or monitor the behaviour of children.
4. Google sign in, Instagram data and YouTube data
4.1 Sign in. If you sign in with email, mobile number or a Google account, Firebase Authentication, provided by Google, processes the identifier you use and a Firebase user identifier. If you use a mobile number, the number is sent to Google for abuse prevention. From a Google account we receive only the Firebase identifier, your email address and whether the email is verified. We do not request or store your Google profile photo, locale or other Google account data.
4.2 How Google user data is used. We use the data in 4.1 only to authenticate you, link a verified sign in to your Account, secure and recover your Account, and send essential Account messages. We do not share it with others for their own purposes.
4.3 Instagram. If you connect an Instagram account we collect the data in section 2 through Instagram's official interface and only after you authorise it. We store the authorisation credential in encrypted form and never send it to your browser. Instagram measurements are retained for no more than ninety days from when they were observed. We use Instagram data only to provide the Platform to you and do not use it for advertising or sell it.
4.4 Disconnection and deletion. You may disconnect a Social Account at any time in your settings. On disconnection the connection leaves your view, the stored credential is cleared, and collection stops. When you delete your Account, the data from your Social Accounts is deleted at once. You may also ask us to delete data we hold from a Social Account by the route in section 12. The Data Deletion Policy sets out what is deleted, when and how, and what we keep. Data is retained after disconnection only as the table in section 13 states.
4.5 YouTube. If you connect a YouTube channel, Tatvata uses YouTube API Services, meaning the YouTube Data API and the YouTube Analytics API, and you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy describes how Google handles your data. With your authorisation we collect the data in section 2 with two read only permissions, youtube.readonly and yt-analytics.readonly, and we do not ask to change anything on your channel. We store the authorisation credential in encrypted form and never send it to your browser. We use the data only to provide the Platform to you, and we do not use it for advertising, sell it, or hand it to others except as section 5 and the Data Deletion Policy section 3 describe. Tatvata's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Tatvata's access to your data at any time in the Google security settings. You can contact us as section 12.4 describes.
5. Who we share personal data with
5.1 Other Users, as you direct. A Brand sees a limited Creator profile when exploring or matching, and the other party to an application or Agreement sees what that relationship requires, including the messages you send them and, on the Agreement record, the IP address from which each party accepted.
5.2 Service providers (processors). We use providers to run the Platform. They include Google (Firebase Authentication, which also sends the one time code by SMS for mobile sign in), Amazon Web Services (servers, Mumbai region), Supabase (database, Mumbai region) and Cloudflare (network protection and delivery), and Brevo (email delivery). They may process personal data only on our instruction.
5.3 Third party platforms. Meta, in respect of the Instagram connection you authorise, and Google, in respect of the YouTube connection you authorise.
5.4 Authorities. We disclose information to a government agency or a court when the law or a lawful order requires it, including within the time the Intermediary Rules prescribe.
5.5 Professional advisers and successors. We may share information with our legal, financial and security advisers under confidentiality, and with a successor to the business, who will be bound by this policy.
5.6 We do not otherwise disclose personal data. We will tell you the identities of the Data Fiduciaries and Data Processors with whom your data has been shared if you ask under section 12.
6. What other Users and the public can see
6.1 Public profile. After your Creator profile meets the Platform's verification conditions, a public handle may be issued. Your public profile shows only your Tatvata ID, handle, display name, bio, photo, location, LinkedIn address, verification status, professional status, whether you are available for brand collaboration, and the profile address. It never shows your email address, mobile number, account identifiers, authorisation credentials, score components or evidence.
6.2 Public Campaign page. A published Campaign page shows the Brand name and logo, title, a short description, target niches, the category of compensation, and the application deadline. It never shows amounts, documents or application data.
6.3 Pass. A Pass page shows the status, the Creator's Tatvata ID, the Brand, the partnership status, the validity dates and the entitlement text. It shows no other Agreement term.
6.4 Brand view of a Creator. A Brand exploring a Creator sees the Tatvata ID, display name, selected niches, connected platforms and their public links, the latest audience size, per niche Impact Score with its version and age, integrity score, eligibility status and reputation counts. It does not see the Creator's email, mobile number, bio, location, audience country or demographic breakdown, or score components.
6.5 Messages. A conversation is between a Creator and a Brand. The Creator and the Brand's active Team Members can read it. It is never public. Our staff read a message only when a User reports it, and every such reading is recorded. We may remove a message or close a conversation that breaks the Terms of Use. A User can block a conversation, which stops new messages and does not affect offers or Agreements.
7. Automated processing and scores
7.1 Impact Scores, integrity flags, verification layers and match results are generated by rules operated by us from the data in section 2. They may affect the visibility of a Creator to Brands and a Creator's eligibility to apply. The Ranking and Matching Notice explains the main parameters.
7.2 You may ask for a human review of a score, a flag or a match, and you may correct inaccurate data, by the route in section 12. We will give you reasons for our decision.
8. Transfers outside India
8.1 Firebase Authentication processes data in the United States and may process it in other countries. Amazon Web Services and Supabase store data in India (Mumbai region). Cloudflare handles traffic through its global network. Brevo, which delivers our emails, may process email data outside India. Google, which provides YouTube and Firebase Authentication, may process data outside India. We transfer personal data outside India only to the extent needed to provide the Platform, and subject to any requirement the Central Government specifies under rule 15 of the Digital Personal Data Protection Rules, 2025.
9. Security
9.1 We apply reasonable security safeguards. They include encryption of authorisation credentials at rest, hashing of passwords and one time codes, and access controls on systems and data, with logging of administrator actions to help detect unauthorised access.
9.2 We keep logs and the personal data needed to detect, investigate and remediate unauthorised access for at least one year, as the law requires, and then erase them unless the law requires longer retention.
9.3 No system is perfectly secure. You should keep your credentials confidential and tell us promptly of any unauthorised access.
10. Personal data breaches
10.1 If a personal data breach occurs we will, without delay, tell each affected person through their Account or the contact details they gave us. The notice will describe the breach, its nature, extent and timing, the likely consequences for you, the measures we have taken, the steps you can take, and a contact who can answer your questions.
10.2 We will also inform the Data Protection Board of India and CERT-In as the law requires and within the periods it sets.
11. Children
11.1 The Platform is for persons aged eighteen or over. We do not knowingly process the personal data of a child. If we learn that we hold the data of a person under eighteen we will delete it and close the Account unless the law requires otherwise. We do not track or monitor the behaviour of children and do not direct advertising at them.
12. Your rights and how to contact us
12.1 You may ask us for a summary of the personal data we process and the processing activities. You may ask who else has received it, meaning the Data Fiduciaries and Data Processors with whom we have shared it. You may ask for correction, completion, updating or erasure, and you may withdraw any consent. You may nominate another person to exercise these rights for you. You may make a complaint to us and, if you remain dissatisfied, to the Data Protection Board of India.
12.2 Make a request, and find the identifier we need to verify you, as the Grievance and Data Rights Policy Part B describes. You can also close your Account and delete data in your settings, or ask for deletion by writing to the contact below.
12.3 We will respond within the period in the Grievance and Data Rights Policy, which is never more than ninety days.
12.4 Contact for questions about your personal data. Data contact, Tatvata, [email protected], Sai Nagar, Old Hafeezpet, Hyderabad, Telangana 500049, India. We repeat this contact in every reply to a rights request.
12.5 Grievance Officer. See the Legal and Contact Information page.
13. How long we keep personal data
| Data | How long | Reason |
|---|---|---|
| Account and profile data | While your Account is open, then as the next rows state | Provide the Platform |
| Registration information after you cancel | 180 days after cancellation | The Intermediary Rules |
| Information removed after a complaint or order, with associated records | 180 days or longer if a court or authority requires | The Intermediary Rules |
| Instagram measurements | No more than 90 days from observation | The platform's terms |
| Data from a disconnected Instagram account | No more than 90 days after disconnection, invisible to others, then deleted | Retention of data from a disconnected account |
| Data from a disconnected YouTube channel | Deleted within 7 days of disconnection | The platform's terms |
| Data from a YouTube channel whose access Google has withdrawn | Deleted within 30 days if the connection is not renewed | The platform's terms |
| Data from your Social Accounts when you delete your Account | Deleted at once | Your request |
| Authorisation credential | Cleared at disconnection | No longer needed |
| One time codes and password reset tokens | Hash only, until used or expired | Security |
| Logs and data needed to detect and remediate unauthorised access | At least one year | Rule 6 of the Rules and rule 8(3) |
| Agreements, versions, acceptances, Passes and their history, including the IP address and browser recorded with each offer and acceptance | For as long as needed for the relationship and for legal claims, and as the law requires | Records of the relationship and legal claims |
| Messages | Deleted 60 days after they are sent | Provide the Platform, keeping no more than needed |
| A message we removed, or one reported and not yet resolved | 180 days after it was sent, or longer if a court or authority requires | The Intermediary Rules |
| Audit records of administrator actions | For as long as needed for accountability and security | Accountability and security |
| Profile image | Until you remove or replace it, or close your Account | Provide the Platform |
13.2 You may ask us to close your Account in your account settings or by writing to us. We first check whether you have unresolved obligations, such as a live Campaign, application, Agreement, concern or Pass, and we tell you what must be resolved. Once there are none, we close the Account and delete or de-identify your personal data, except what the law or the table above requires us to keep for its period. You may cancel a closure request while it is still only a request. The Data Deletion Policy lists what is deleted and what is kept.
14. Cookies and similar technologies
14.1 The Platform stores your sign in session tokens and your colour theme preference in your browser. They are needed for the Platform to work and are not used to track you across other sites. We do not use advertising or analytics cookies or scripts.
14.2 If we later add analytics or any non essential technology, we will update this policy and ask for your consent first.
15. Changes and language
15.1 We will tell you of a change to this policy as the Terms of Use clause 22 describes and will remind you of this policy at least once a year.
15.2 This policy is in English. You may ask for the notice in an Eighth Schedule language.