1. Information We Collect
We collect information you provide directly:
- Account information: name, email address, password (hashed)
- Profile information: bio, location, social media handles
- Business information: company name, GST number, bank account details
- Transaction data: campaign details, offer amounts, payment history
- Identity verification: government-issued ID, PAN card (KYC)
2. How We Use Your Information
We use collected information to:
- Operate and improve the Ryppl platform
- Process payments and payouts
- Verify your identity (KYC) as required by law
- Send transactional emails and platform notifications
- Detect and prevent fraud
- Comply with legal obligations
3. Data Sharing
We do not sell your personal data. We share it only with:
- Payment processors (Razorpay, Stripe) for transaction processing
- Cloud infrastructure providers (Supabase, Vercel) for hosting
- Email providers (Resend) for transactional emails
- Law enforcement when legally required
4. Data Security
Sensitive fields (bank account numbers, government IDs) are encrypted at rest using AES-256-GCM. All data is transmitted over TLS. Access to production data is restricted to authorised staff.
5. Data Retention
We retain account data for as long as your account is active. After account deletion, transaction records required for tax compliance are retained for 7 years. KYC documents are retained as required by applicable law.
6. Your Rights
You have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion (subject to legal retention obligations)
- Export your data in a portable format
To exercise these rights, email privacy@viralx.in.
7. Cookies
We use session cookies for authentication only. We do not use tracking or advertising cookies.
8. Social Media Platform Data (Meta / Instagram & YouTube)
To show creators' verified reach to brands, we connect to social platforms:
- Instagram & Facebook (Meta):With your explicit consent, we use Meta's official login to connect your Instagram Business account and its linked Facebook Page. We request read-only access to your profile, follower and media counts, and Page insights, solely for creator-brand matching. We never post, comment, send messages, or otherwise change your account. Access tokens are encrypted at rest, and you can disconnect at any time from your Social settings. Where a connection has not been made, we may instead look up publicly available Instagram Business Discovery data (username, follower count, post count) for the handle you provide on your profile.
- YouTube: Using the YouTube Data API, we retrieve public channel statistics (subscriber count, view count) for the channel handle you provide.
Remove connected accounts anytime from your Social settings, or email privacy@viralx.in.
9. Government and Law Enforcement Requests
We only disclose personal data to a public authority in response to a legally valid request, such as a court order, subpoena, or other compulsory legal process. Before responding to any such request, we review it for legal validity and jurisdiction. Where a request is not legally valid, is overly broad, or is not properly served, we will challenge it or seek to narrow its scope before any data is disclosed. When disclosure is legally required, we limit what we share to the minimum information specifically compelled by that request. We keep a record of each request received — including the requesting authority, the legal basis cited, and our response — for our own compliance record-keeping.
Questions about a specific request can be directed to privacy@viralx.in.
10. Contact
Privacy questions? Email privacy@viralx.in. Our Data Protection Officer can be reached at the same address.