Skip to content
Influj

Legal

Privacy policy

Effective 27 August 2026 · Applies to Credible Arena (OPC) Private Limited

In plain words

We collect what a marketplace needs to work: who you are, the channels you connect, the campaigns you run, and the money that moves. We read your social channels only with your permission and only to show numbers you and your counterparty both see. We do not sell personal data, and we do not use your channel data to train models. You can withdraw consent, export your data, or delete your account — see deleting your data.

01Who is responsible for your data

The data fiduciary (the term the Digital Personal Data Protection Act, 2023 uses for the party that decides why and how your data is processed) is:

EntityCredible Arena (OPC) Private Limited
Registered address[Registered address — to be published before launch]
Data protection contact[Named contact — to be published before launch] — privacy@influj.com

02What we collect, and why

Grouped by why we need it, because that is the part that actually matters.

To create and secure your accountName, email address, phone number, password (stored only as a hash), and the times and devices you sign in from. Sign-in alerts for a new device are sent to you, not shared.
To verify who you are (KYC)For brands: business registration details, GSTIN, and the identity of the person acting for the business. For creators: PAN, and bank or UPI details to pay you. Identity numbers are encrypted at rest; we store a keyed hash of PAN and payout identifiers so we can detect the same account being used by two parties to a deal, without keeping the number in readable form for that purpose. We also screen identity details against public sanctions and watchlists, as the law and our payment partners require.
To show verified channel dataWhen you connect a social channel, we receive the account's public profile, follower or subscriber counts, per-post metrics, and — where the platform provides them and you permit it — aggregated, anonymous audience demographics such as age bands, gender split and top cities. We never receive your social password, your direct messages, or the identity of individual followers.
To run campaigns and pay peopleBriefs, applications, messages between brand and creator, drafts and files you upload, the agreements you sign, the OTP events that signed them, and the money movements: wallet funding, escrow, payouts, TDS and GST records.
To measure campaign performanceWhen someone clicks a tracked campaign link we record the click with a timestamp, coarse location derived from IP, device and browser type, referring page, and a hashed device fingerprint used for fraud detection. We set a first-party cookie so a later purchase can be attributed to that click.
Because the law requires itTax records, invoices, TDS certificates and the audit trail of consents and approvals. We keep these for as long as Indian tax and company law requires, even after you close your account.

03Data from Meta, Google, TikTok and other platforms

This is the part platform reviewers care about most, so it is stated precisely. A fuller breakdown by permission is on the platform data & API use page.

  • We request the narrowest permissions that let us read a channel’s own public profile and its own insights. We do not request permission to publish, to message anyone, or to moderate comments, and the product contains no code that does those things.
  • Platform data is used for exactly two purposes: showing you your own channel analytics, and showing a brand you are working with the performance of the specific content they paid for. It is not used for advertising, not sold, not shared with data brokers, and not used to train machine-learning models.
  • Google / YouTube: Influj uses YouTube API Services. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time at Google security settings, and you are also subject to the YouTube Terms of Service.
  • Meta: you can disconnect a channel inside Influj, or remove Influj from your Instagram, Threads or Facebook settings. Meta notifies us when you do, and we mark the channel disconnected and stop refreshing its data.
  • TikTok: Influj uses TikTok’s Login Kit and Display API to read a connected account’s own public profile, its follower count and its own public videos with their view, like, comment and share counts. TikTok does not make audience demographics available to any connected app, so we show none for a TikTok channel. You can remove Influj at any time under Manage app permissions in TikTok; TikTok notifies us, and we mark the channel disconnected and stop refreshing it.
  • When you disconnect a channel we stop collecting from it immediately. Metrics already attached to a completed campaign are retained as part of that campaign’s record, because both you and the brand relied on them and they may be evidence in a dispute.

04What we never do

  • Sell or rent personal data to anyone.
  • Use your channel data or your content to train AI models.
  • Show a brand a number about your channel that you cannot see yourself.
  • Post to your social accounts, or read or send your direct messages.
  • Share your bank or UPI details with a brand. Brands never see how you are paid.

05Who we share data with

Only where it is necessary to run the service, and only as described here.

Your counterpartyA brand you are working with sees your public profile, your channel metrics, the content you deliver and the analytics for it. A creator sees the brand's identity, the brief and the agreement. Neither side sees the other's payment instruments.
Payment partnersOur payment aggregator and payout partner receive what is needed to move money and to meet their own KYC and RBI obligations.
Service providersEmail and SMS delivery, cloud hosting, and error monitoring. They act on our instructions under contract and may not use your data for their own purposes.
AuthoritiesWhere we are legally required to disclose, or to establish or defend a legal claim. We will tell you unless we are prohibited from doing so.

06Where your data lives

Personal data is stored and processed on infrastructure located in India (Mumbai region). Some service providers — for example the social platforms whose APIs you ask us to read — necessarily process data outside India. Where that happens, it is because you have asked us to connect that service, and it is subject to that provider’s own terms.

07How long we keep it

Account and profile dataUntil you delete your account.
Channel metricsWhile the channel is connected, plus the record attached to any campaign that used them.
Campaign, agreement and dispute recordsAt least the life of the agreement plus the period in which a claim could be brought; agreements and their evidence are held in a write-once store for a minimum of 90 days and typically far longer.
Tax and financial recordsEight years, as Indian tax and company law requires.
Click and conversion logsTwenty-four months, after which they are aggregated and the identifiers dropped.

Retention of financial records follows Indian tax and company law wherever you live, because Influj is operated by an Indian company.

08Your rights

Under the Digital Personal Data Protection Act, 2023 you may do all of the following, free of charge, by writing to privacy@influj.com or from your account settings:

  • Ask what personal data we hold about you and get a copy of it.
  • Correct anything inaccurate, or complete anything incomplete.
  • Delete your data and your account — see deleting your data.
  • Withdraw a consent you gave, as easily as you gave it. Disconnecting a channel withdraws the consent to read it.
  • Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
  • Complain to us first, and then to the Data Protection Board of India if we have not resolved it. Our grievance route is on the grievance redressal page.

We respond to these requests within 30 days.

09If you are in the European Economic Area or the United Kingdom

Where the GDPR or the UK GDPR applies to you, this section describes how we meet it. It adds to the rest of this policy; it does not replace it.

Legal basesWe process your data to perform our contract with you (providing the marketplace), for our legitimate interests in fraud prevention and security, and with your consent where consent is required — for example when you connect a social channel.
Your rightsAccess, rectification, erasure, portability, restriction of processing, and objection. Send a request to the grievance and support contacts on the grievance redressal page — the same route as for any other request — and we respond within the timelines the law sets. You may also complain to your local supervisory authority.
International transferYour data is processed on infrastructure in India (Mumbai). Where the law requires safeguards for a transfer, we use safeguards such as standard contractual clauses.

10How we protect it

  • Everything travels over TLS. Passwords are hashed, never stored or recoverable.
  • Identity numbers, bank details and platform access tokens are encrypted at rest with per-record keys.
  • Uploaded files are virus-scanned before anyone can open them, and are readable only by the parties to the campaign they belong to.
  • Administrative access requires a second factor, and every administrative action is written to an audit log the acting admin cannot edit.
  • If a breach affects your personal data we will notify you and the Data Protection Board as the law requires.

11Cookies

We use the minimum needed to keep you signed in, remember your theme and language, and attribute a campaign click to a conversion. Details, including how to refuse them, are on the cookie policy page.

12Children

Influj is not for anyone under 18. We do not knowingly collect data from children, and we do not process children’s data for tracking or targeted advertising. If you believe a minor has created an account, write to privacy@influj.com and we will remove it.

13Changes to this policy

If we change something that materially affects you, we will tell you by email and in the product at least seven days before it takes effect, so you have time to object or leave. The effective date at the top of this page always reflects the current version.

Questions about this document? Write to legal@influj.com.