Legal
Privacy Policy
Last updated: June 16, 2026
Creatora V1 — free collaboration marketplace
Creatora does not sell digital goods, subscriptions, paid access, or in-app financial services in V1. Creatora does not collect, hold, or distribute collaboration payments. Any commercial arrangement between a brand and a creator is handled independently by those parties.
Sections below that describe payments, wallets, escrow, payouts, subscriptions or commissions describe functionality that is currently unavailable in Creatora V1 and is kept here for transparency about future releases.
Data we collect
- Account & identity: name, email, phone, password hash, profile photo, date of birth, and (for verified accounts) government-issued ID and selfie.
- Profile content: bio, city, niches, languages, social handles, follower counts, portfolio uploads, rate cards.
- Collaboration data: campaigns, applications, deals, messages, submissions, reviews and ratings.
- Payment metadata (legacy / future features only): Creatora V1 collects no payments, so no new payment data is created. Where a creator optionally saves payout details (UPI ID or bank reference, PAN/GSTIN) for their own records, that data is stored securely. We never see or store full card numbers.
- Device & usage: IP address, device model, OS, browser, app version, push notification token, crash logs, and pages visited.
Data categories at a glance
For each category we list what we collect, why, and exactly where it lives in our Lovable Cloud (Supabase) backend — Auth (managed user records), DB (Postgres tables under row-level security) or Storage (private object buckets).
| Category | What | Why | Stored in |
|---|---|---|---|
| Account & login | Email, phone, password hash, Google OAuth identity, session tokens | Sign you in, secure your account, reset password | Supabase Auth |
| Profile | Full name, account type, bio, city, country, website, niches, languages, rate card | Display your public profile, power brand–creator matching | Supabase DB profiles, creator_profiles, brand_profiles |
| Profile media | Avatar, portfolio items, campaign assets | Show your work to brands / your campaign to creators | Supabase Storage avatars, portfolio, campaigns |
| KYC / verification | Government ID image, selfie, document number | Verify identity for payouts and trust badge (required by RBI/payment gateway) | Supabase Storage verifications (private) + DB verifications |
| Campaigns & applications | Brief, budget, deliverables, applications you submit/receive | Run the marketplace | Supabase DB campaigns, applications |
| Deals & submissions | Deal terms, deliverables, submitted content + files, status | Manage the work, escrow & approval flow | DB deals, submissions + Storage submissions |
| Messages & attachments | Direct messages between brand and creator, chat files | In-app communication on a deal | DB conversations, messages + Storage chat-attachments |
| Wallet & payments | Deposit/payout amounts, commission entries, transaction IDs, GSTIN, PAN, bank account reference (no card or full bank credentials) | Fund deals, pay creators, generate invoices, comply with tax law | Supabase DB brand_wallets, wallet_ledger, wallet_deposits, payouts |
| Reviews & ratings | Star rating, written review on completed deals | Build trust on the marketplace | Supabase DB reviews |
| Notifications | In-app notification rows + device push token (FCM/APNs) | Deliver chat, deal, payment and moderation alerts | Supabase DB notifications, email_preferences |
| Trust & safety | Reports, disputes, suspensions, moderation audit log | Investigate abuse, protect other users (retained even after deletion) | Supabase DB reports, disputes, user_suspensions, moderation_audit_log |
| Device & usage logs | IP, user agent, app version, crash logs, anonymous page views | Security, fraud prevention, debugging, aggregated analytics | Supabase Auth (audit log) + edge server logs |
All Supabase DB tables are protected by row-level security so each user can only read their own rows (or rows shared via a deal/conversation). All Storage buckets above are private and served through signed URLs. Hosting region: AWS ap-south-1 (Mumbai).
Third-party services we use
We disclose every processor that touches your personal data:
- Supabase (database, authentication & file storage) — operated by Supabase Inc. Stores your profile row, deals, messages, portfolio files, verification documents and session tokens. Data is hosted in the AWS ap-south-1 (Mumbai) region and encrypted at rest. Auth sessions are kept in the device's local storage so you stay signed in. See supabase.com/privacy.
- Google Sign-In (OAuth) — when you choose "Continue with Google", Google shares your name, email and profile picture with Creatora via the Lovable Cloud managed OAuth broker. We do not receive your Google password or any contact/calendar/drive scope. Revoke access any time at myaccount.google.com/permissions.
- Push notifications — delivered via your device's native push service (Google Firebase Cloud Messaging on Android, Apple Push Notification service on iOS, or Web Push in browsers). We send only a device token and the notification payload (chat message preview, deal update, payment alert). You can disable notifications in OS settings or in your in-app preferences.
- Payments — in Creatora V1 the platform does not collect, hold, process or settle collaboration payments, and takes no commission. Brands and creators settle agreed amounts directly between themselves. The description below applies only if paid features are enabled in a future version: funds are held against an active deal, and on completion we release the agreed amount to the creator minus the platform commission disclosed at deal creation. The gateway receives card/UPI/bank details directly; Creatora only stores the transaction ID, amount, status and timestamps.
- Transactional email — order receipts, password resets and deal notifications are delivered via Supabase Auth's email provider. We do not send marketing email without opt-in.
- Aggregated analytics — privacy-friendly, no cross-site tracking and no advertising cookies.
How we use it
- To operate the marketplace and match brands with creators
- To prevent fraud, spam and abuse on the platform
- To send transactional and important service emails and push notifications
- To verify identity (KYC) for payouts and trust badges
- To improve our products with aggregated, non-identifying analytics
- To comply with legal, tax and accounting obligations
Sharing
We share data with the counterparty in a Deal (e.g. a brand sees creator contact details once a deal is signed), with the processors listed above strictly for the purpose described, and with law enforcement when legally required. We never sell your personal data and never share it with advertisers.
Cookies & local storage
We use essential cookies and local storage to keep you signed in (Supabase auth session) and to remember your preferences. We do not use third-party advertising cookies.
Your rights & controls
You can exercise the following at any time:
- Access & correct your data from Profile.
- Export your data — email privacy@creatora.in and we respond within 30 days.
- Delete your account — in-app via Profile → Danger zone, or follow the step-by-step process on our public Account Deletion page (also works without signing in). The page explains exactly what is removed and what we are legally required to retain.
- Manage notifications in your OS settings or in-app preferences.
- Revoke Google sign-in at myaccount.google.com/permissions.
Retention & deletion timelines
When you delete your account from Profile → Danger zone or via /account-deletion, we begin the timeline below. Backups containing residual copies are rotated out within 30 days.
| Category | Active retention | After account deletion |
|---|---|---|
| Account & login (Auth) | While account is active | Deleted within 24 hours |
| Profile & profile media | While account is active | Deleted within 24 hours (DB row + Storage objects) |
| KYC / verification documents | 5 years from last payout (PMLA / RBI rule) | Document image deleted within 24 hours; document number & verification status retained for the 5-year window against an anonymised reference |
| Campaigns & applications | While account is active, or until you delete the campaign | Deleted within 24 hours; counterparty-visible copies (e.g. an application a brand received) remain on the brand's side |
| Deals & submissions | Active deal: indefinitely. Completed/closed: 8 years (tax/contract record) | Your personal identifiers removed within 24 hours; deal record retained against an anonymised reference for 8 years |
| Messages & attachments | While the conversation exists | Message body replaced with [deleted] within 24 hours so the other party's thread stays coherent; attachments deleted from Storage within 24 hours |
| Wallet, deposits, payouts, invoices | 8 years from the financial year of the transaction (Income Tax Act §44AA, GST §36) | Contact identifiers removed within 24 hours; transaction rows retained for 8 years against an anonymised reference, then deleted |
| Reviews & ratings | While the deal record exists | Reviewer attribution anonymised within 24 hours; review text retained to protect counterparty's reputation history |
| Notifications & device push tokens | 90 days rolling for in-app notifications; push token until you uninstall or revoke | Deleted within 24 hours |
| Reports, disputes, suspensions, moderation log | 3 years from the event | Retained for the 3-year window to protect other users and prevent re-registration of banned accounts, then deleted |
| Device & usage logs, security audit log | 90 days (server logs), 12 months (Supabase Auth audit log) | Rolled off at end of window; not extended by deletion |
| Aggregated / anonymised analytics | Retained indefinitely | Cannot be linked back to you, so retention continues |
Legal holds: if a tax authority, court, or law-enforcement request is active against a record, we are required to retain it until the hold is lifted, even if the timelines above have expired.
Security
Data is encrypted in transit (TLS 1.2+) and at rest. Database access uses row-level security so each user only reads their own rows. Access by our team is restricted on a need-to-know basis. We will notify affected users of any material breach within 72 hours.
Children
Creatora is not directed to and not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has registered, email privacy@creatora.in and we will remove the account.
Grievance Officer (India)
Under India's Digital Personal Data Protection Act 2023 and IT Rules 2021, we have appointed a Grievance Officer who responds to data complaints within 15 days. Full details, scope and escalation path: /grievance.
Email: grievance@creatora.in
Contact
Data Protection Officer: privacy@creatora.in
Trust & Safety: trust@creatora.in
Legal: legal@creatora.in