This Privacy Policy explains how dmforcollab("we", "us", "our") collects, uses, shares, and protects personal information when creators and fans use the platform at dmforcollab.com. By using the service you agree to this policy. This document is written to align with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
1. Who this policy covers
We serve two distinct user types and collect different data from each:
- Creators — influencers who build a booking page and list paid services.
- Fans— people who discover a creator's page and book a paid session.
2. Data we collect
From creators
- Account: email address, phone number (optional), hashed password, role.
- Profile: display name, username, bio, avatar URL, cover URL, chosen template, color theme.
- Social accounts: public handles and follower counts on Instagram, YouTube, X, TikTok (we store only what you explicitly connect or enter).
- KYC: PAN number and phone OTP verification, required by Cashfree for payout settlement.
- Service + availability: service titles, benefits, prices, duration, weekly hours, buffer rules.
- Bookings data you own (see next section).
From fans (bookers)
- Name, email address, and phone number — required to deliver the meeting link.
- Intake question answers you provide at checkout.
- Payment information is handled directly by Cashfree. We only receive an order ID, payment ID, and status — never your card number, UPI PIN, or bank credentials.
Automatic data
- Page view events: creator ID, timestamp, referrer URL, UTM source, country (coarse), device type.
- Server logs: IP address, user agent, request path, response status.
- Session cookie: a signed, HttpOnly token (
ib_session) to keep you logged in.
3. How we use it
- To operate the core service — render your page, deliver reminders, process bookings.
- To settle payouts to creators via Cashfree on a weekly schedule.
- To send transactional messages (confirmations, reminders, dispute updates) via email and WhatsApp.
- To show creators basic analytics — page views, conversion rate, earnings — only for their own page, never aggregated across creators in a way that identifies individual fans.
- To investigate fraud, abuse, or disputes and to comply with legal orders from Indian authorities.
4. Third-party processors
We share data with these processors strictly to operate the service:
- Cashfree — payments + payouts. Receives fan name, email, phone, amount.
- Google (OAuth, Calendar, Meet) — creator sign-in, calendar sync, meeting link generation. We store only the refresh token required to maintain the connection.
- Resend — transactional email delivery. Receives recipient email + message body.
- AiSensy / Gupshup — WhatsApp Business message delivery. Receives phone number + template variables.
- Instagram Graph API / YouTube Data API — fetching public follower counts, only for handles you connect.
- Supabase / Neon (managed Postgres) + Vercel (hosting) — store data and serve the application.
- PostHog — product analytics. Events are anonymized by device, not by name.
5. Data retention
- Account data: retained while your account is active. Deleted within 30 days of account closure.
- Booking and payment records: retained for a minimum of 7 years to comply with Indian tax and accounting requirements.
- Server logs: retained up to 90 days for security investigation.
- KYC documents: retained for the duration Cashfree requires under RBI guidelines.
6. Your rights under the DPDP Act
As a data principal, you have the right to:
- Access the personal data we hold about you.
- Correct or update inaccurate personal data.
- Request deletion (subject to the retention requirements in Section 5).
- Withdraw consent for non-essential processing (e.g., analytics).
- Raise a grievance with our Data Protection Officer.
Exercise any of these rights by emailing [email protected]. We aim to respond within 15 working days.
7. Cookies
We use a single first-party cookie, ib_session, to maintain your login session. It is HttpOnly, Secure (in production), SameSite=Lax, and expires in 30 days. We do not set advertising cookies, cross-site tracking pixels, or fingerprinting scripts.
8. Children
The service is not directed at users under 18 years. We do not knowingly process data from minors. If you believe a minor has created an account, email [email protected] and we will delete it.
9. Security
Passwords are hashed using scrypt with a unique salt per user. Payment processing is handled by Cashfree (PCI-DSS Level 1). Data is encrypted in transit via TLS. Our database is hosted in India-region infrastructure.
10. Changes to this policy
We will notify creators by email whenever we make a material change to this policy. Continued use of the service after the effective date constitutes acceptance of the new terms.
11. Contact
Grievance Officer: Rahul Srivastava
Email: [email protected]