Privacy Policy | ColabPetals

1. Who this policy covers

This policy explains how Kreatorhive LLP (“Kreatorhive”, “we”, “us”), operator of ColabPetals, collects, uses, and protects personal data when you use the Platform, whether as a Brand or a Creator.

2. Information we collect

Information you give us directly:

Account details: name, email address, phone number, password (stored as a salted hash, never in plain text).
Business details for Brand accounts: company name, website, and business verification information.
Payout details for Creators, encrypted at rest, when you set up payments.
Campaign content, messages, and any files you upload while using the Platform.

Information from connected accounts:

If you sign in with Google, we receive your name and email address from Google.
If you connect Instagram or YouTube, we receive public profile and audience/engagement metrics via that platform’s official API, used to verify your identity and show your reach to Brands.

Information collected automatically:

Basic technical logs (e.g. request timestamps, error logs) needed to operate and secure the Platform.
A session token stored in your browser’s local storage so you stay signed in — this is not a tracking cookie and isn’t shared with third-party advertisers.

We do not use third-party advertising trackers or analytics pixels on the Platform.

3. How we use your information

To create and secure your account, and verify your identity/business where required.
To operate campaigns: matching Brands and Creators, processing applications, and tracking deliverables.
To process payments and payouts through our payment processor.
To send account, security, and campaign-related emails (like OTP codes, invites, and approvals).
To investigate abuse, fraud, or violations of our Terms & Conditions.

4. Google user data

ColabPetals uses Google Sign-In and, for Creators, Google's YouTube Data API, under the openid, email, profile, and https://www.googleapis.com/auth/youtube.readonly scopes. This section is our required disclosure under Google's API Services User Data Policy and states, specifically:

what Google user data our app accesses,
how our app uses that Google user data,
with whom we share, transfer, or disclose Google user data,
the data protection mechanisms we apply to that data, and
how long we retain it and how it is deleted.

What Google user data our app accesses

Our app accesses the following Google user data, and nothing else:

From Google Sign-In (every user): your name, email address, and profile picture.
From the YouTube Data API (Creators who choose to connect a YouTube channel only): your YouTube channel ID, channel title, subscriber count, video count, and total view count.

We never access your Google account password, your Google Drive, Gmail, Calendar, or any other Google service, and we never access any YouTube data beyond the public channel statistics listed above (no video content, comments, watch history, or private playlists).

How our app uses Google user data

Your name, email address, and profile picture are used solely to create, identify, and secure your ColabPetals account, and to let you sign in without a separate password.
Your YouTube channel data is used solely to (a) verify that you are the genuine owner of the YouTube channel you are claiming as a Creator, and (b) display accurate, current subscriber/video/view statistics on your Creator profile, so that Brands evaluating you for a paid collaboration see real, up-to-date numbers instead of self-reported ones.
We do not use Google user data for advertising, ad targeting, or building any profile of you beyond your own ColabPetals account, and we do not use it to train any machine-learning or AI model.

With whom we share, transfer, or disclose Google user data

Brands using ColabPetals: if you are a Creator, your YouTube subscriber/video/view counts and channel identity appear on your own public Creator profile, visible to Brands considering you for a campaign — this is the sole purpose for which that data is collected, and it only ever includes data you have chosen to connect.
No other third party: we do not sell, rent, or transfer your Google user data to any advertiser, data broker, analytics company, or any other third party for any purpose. Google user data is never shared, transferred, or disclosed outside ColabPetals except as described in this paragraph, or where required by law (see Section 6).

Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data protection mechanisms for this data

Encryption in transit: every request to a Google API, and every request between your browser and ColabPetals, is made over HTTPS/TLS.
Encryption at rest: your Google OAuth access token is encrypted at rest in our database using industry-standard symmetric encryption (Fernet/AES) and is never stored or logged in plain text.
Restricted decryption: that token is decrypted only in server memory, only at the moment we need to refresh your connected YouTube statistics, and is never exposed to your browser or to any other user.
Access control: only the ColabPetals backend service itself can decrypt this data — it is not accessible to Brand accounts, other Creators, or any employee outside the engineering team, and only for maintaining the service.

Retention and deletion of Google user data

Retention period: we retain your Google Sign-In profile data for as long as your account is active, and your connected YouTube channel data for as long as that connection remains active.
You can delete it at any time, three ways: disconnect your YouTube account from your Creator dashboard, which immediately deletes your stored YouTube channel data and stops any further access; revoke ColabPetals' access directly from your Google Account's security settings at any time, which has the same effect; or request full account deletion via the Contact page (see Section 8), which permanently deletes your Google OAuth token and all associated Google/YouTube data along with the rest of your account, typically within 30 days.

5. Instagram (Meta) user data

ColabPetals uses Meta's official Instagram API with Instagram Login, under the instagram_business_basic and instagram_business_manage_insights scopes, when you connect an Instagram account as a Creator. This section is our required disclosure under Meta's Platform Terms and Developer Policies and states, specifically:

what Instagram user data our app accesses,
how our app uses that Instagram user data,
with whom we share, transfer, or disclose Instagram user data,
the data protection mechanisms we apply to that data, and
how long we retain it and how it is deleted.

What Instagram user data our app accesses

Our app accesses the following Instagram user data, and nothing else:

Account identity: your Instagram account ID and username, to confirm your identity.
Profile and audience data: your account name, profile picture, biography, follower count, following count, and media (post) count.

We never access your Instagram password, direct messages, the content of your posts or stories, or any data beyond the public profile fields listed above.

How our app uses Instagram user data

To confirm you are the genuine owner of the Instagram account you are claiming as a Creator, matching it against the handle you provided.
To display accurate, up-to-date follower count, post count, profile picture, and bio on your Creator profile, so Brands evaluating you for a paid collaboration see real, current numbers instead of self-reported ones.
We do not use Instagram user data for advertising, ad targeting, or building any profile of you beyond your own ColabPetals account, and we do not use it to train any machine-learning or AI model.

With whom we share, transfer, or disclose Instagram user data

Brands using ColabPetals: your Instagram follower/post counts, profile picture, and account identity appear on your own public Creator profile, visible to Brands considering you for a campaign — this is the sole purpose for which that data is collected, and it only ever includes data you have chosen to connect.
No other third party: we do not sell, rent, or transfer your Instagram user data to any advertiser, data broker, analytics company, or any other third party for any purpose. Instagram user data is never shared, transferred, or disclosed outside ColabPetals except as described in this paragraph, or where required by law (see Section 6).

Data protection mechanisms for this data

Encryption in transit: every request to Meta's APIs, and every request between your browser and ColabPetals, is made over HTTPS/TLS.
Encryption at rest: your Instagram OAuth access token is encrypted at rest in our database using industry-standard symmetric encryption (Fernet/AES) and is never stored or logged in plain text.
Restricted decryption: that token is decrypted only in server memory, only at the moment we need to refresh your connected Instagram statistics, and is never exposed to your browser or to any other user.
Access control: only the ColabPetals backend service itself can decrypt this data — it is not accessible to Brand accounts, other Creators, or any employee outside the engineering team, and only for maintaining the service.

Retention and deletion of Instagram user data

Retention period: we retain your connected Instagram data for as long as that connection remains active.
You can delete it at any time, three ways: disconnect your Instagram account from your Creator dashboard, which immediately deletes your stored Instagram data and stops any further access; revoke ColabPetals' access directly from the Apps and Websites section of your Instagram or Facebook account settings at any time, which has the same effect (and Meta automatically notifies us, triggering the same deletion); or request full account deletion via the Contact page (see Section 8), which permanently deletes your Instagram OAuth token and all associated Instagram data along with the rest of your account, typically within 30 days.

6. Who we share information with

We share data only where necessary to provide the service:

Other users, as part of the Platform’s function — e.g. a Creator’s public profile and audience metrics are visible to Brands considering them for a campaign; a Brand’s campaign details are visible to Creators who apply.
Razorpay, to process subscription payments and campaign payouts.
Google, Instagram (Meta), and YouTube, only to the extent needed to authenticate sign-in or pull the account data you’ve explicitly connected (see Sections 4 and 5).
Our email delivery provider, solely to send transactional emails on our behalf.
Law enforcement or regulators, only where required by law.

We do not sell your personal data.

7. Data retention

We keep account and campaign data for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and dispute-resolution obligations. You can request deletion of your account as described below.

8. Your rights

You can review and update most of your account information directly from your dashboard. You can request a copy of your data, or request that we delete your account and associated personal data (subject to what we’re legally required to retain), by contacting us through the Contact page.

9. Security

We use encryption in transit (HTTPS) and encrypt sensitive fields such as payout details and connected-account tokens at rest. No system is completely secure, and we can’t guarantee absolute security, but we take reasonable technical and organizational measures to protect your data.

10. Children’s privacy

The Platform isn’t directed at children under 18, and we don’t knowingly collect personal data from them.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll update the effective date above and, where appropriate, notify you by email.

12. Contact us

Questions about this policy or your data? Reach us via the Contact page.