Privacy Policy

This policy applies to everyone who creates an account or otherwise interacts with the Platform, across every role — creator, brand, sponsor, judge, and CreBlix's own internal staff (campaign managers, finance, administrators). Where an obligation applies to only one role, that's called out explicitly below.

Account & identity data. Name, email address, password (stored as a salted hash, never in plain text), account role, and email-verification status (via one-time password, OTP).

Creator profile & application data. Bio, city, university, content category/niche, social media handles and URLs, follower counts, average reach, content-start date, and a record of past brand collaborations you report — all collected when you submit or update a creator application.

Brand & sponsor data. Company name, and campaign briefs, budgets, and prize pools you create or fund.

Campaign & submission content. Content you submit to campaigns, judging scores and feedback, points earned, leaderboard standing, and blacklist status (if applicable).

Financial data. Payout records including bank/UPI reference details you provide for receiving prizes, wallet balance, invoices, and referral codes/history. We do not store full payment card numbers.

CRM & document data. If you're a prospective or existing brand/sponsor lead, internal notes on your sales pipeline stage. Documents (contracts, invoices, campaign briefs, brand assets, legal files, reports, media) uploaded to the Document Center, including file version history.

Communications. Emails we send you (OTP codes, welcome messages, campaign updates, application approval/rejection notices) and any support correspondence.

Usage & device data. IP address, browser/device type, pages visited, and timestamps of activity, collected automatically for security (e.g. rate-limiting abuse prevention) and analytics.

• Operating the Platform: creating and authenticating your account, verifying your email via OTP, and enforcing role-based access.
• Reviewing creator applications, including automated plausibility checks on self-reported follower/reach figures to prioritize applications for human review (see our Terms of Service, Section 4).
• Matching creators to campaigns, running judging, publishing winners, and processing payouts.
• Managing our sales pipeline for prospective brand and sponsor relationships (CRM), and storing campaign-related documents.
• Sending transactional email — OTP codes, welcome and approval/rejection emails, campaign notifications — via our email delivery provider.
• Detecting and preventing fraud, abuse, and violations of our Terms of Service, including rate-limiting and blacklist enforcement.
• Improving the Platform, and communicating updates, unless you've opted out of non-essential communications.
• Complying with legal, tax, and regulatory obligations, including retaining payout records as required by law.

Where applicable law requires a stated legal basis (e.g. GDPR for EU users), we process your data on the basis of: performance of a contract (operating your account and campaigns), your consent (e.g. marketing communications, where separately requested), our legitimate interests (fraud prevention, Platform security and improvement), and compliance with legal obligations (tax and financial record-keeping). Under India's DPDP Act, our primary basis is your consent given at account creation, and performance of the services you've requested.

With brands and sponsors. When you submit to a campaign, the campaign-owning brand (and any sponsor co-funding it) can see your submission content, your public creator profile, and aggregate performance metrics for that campaign.

With judges. Judges appointed to a campaign can see submissions and associated creator profile information necessary to score them.

Within CreBlix. Internal staff (campaign managers, finance, administrators) access account, application, campaign, and payout data as needed to operate the Platform, review applications, and process payments.

We do not sell your personal data to third parties, and we do not share it with advertisers for their own marketing purposes.

We may disclose information where required by law, to enforce our Terms of Service, to protect the rights and safety of CreBlix or its users, or in connection with a merger, acquisition, or sale of assets (with notice to you where required).

We rely on the following categories of third-party providers to operate the Platform:

• Email delivery (Resend) — to send OTP codes and transactional emails.
• Hosting & infrastructure (Render for the backend, Vercel for the frontend) — to run and serve the Platform.
• Database hosting — to store account, campaign, and application data.

[List any additional processors as they're added — e.g. a payment gateway once automated payouts are introduced, analytics tools, or file storage providers for the Document Center.] Each provider processes data only as necessary to provide their service to us and is bound by contractual confidentiality obligations.

We retain account and profile data for as long as your account is active, and for a reasonable period after closure to comply with legal obligations (e.g. tax records for payouts), resolve disputes, and enforce our agreements. Rejected creator applications and their supporting data are retained to prevent repeat fraudulent submissions. [Define specific retention periods per data category with counsel — e.g. financial records per applicable tax law, typically 6–8 years in India.]

Passwords are stored as salted hashes, never in plain text. Account access uses signed JWT tokens with role-based access control, and sensitive actions are rate-limited to reduce abuse. Access to internal admin tooling (CRM, Document Center, payout processing) is restricted by role.

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and any relevant regulator as required by applicable law.

You can, by contacting us at the email below:

• Request a copy of the personal data we hold about you.
• Request correction of inaccurate profile or application information (or edit most of it directly in your account settings).
• Request deletion of your account and associated personal data, subject to our right to retain data required for legal, tax, or fraud-prevention purposes.
• Withdraw consent for non-essential communications at any time.
• If you're in the EU/UK, request data portability or object to certain processing based on legitimate interests.

We'll respond to verified requests within [30] days.

The Platform is not directed at individuals under [18]. We do not knowingly collect personal data from children. If we learn a minor has created an account, we will take steps to delete it.

Our infrastructure providers may process or store data outside your country of residence. Where we transfer personal data internationally, we rely on appropriate safeguards required by applicable law (e.g. standard contractual clauses for GDPR transfers). [Confirm specific hosting regions with your infrastructure providers and update this section accordingly.]

We use essential cookies/local storage to keep you signed in and remember your session. [Define: any additional analytics or marketing cookies in use, and provide a cookie consent mechanism if targeting EU users, per ePrivacy/GDPR requirements.]

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-Platform notice before taking effect.

For privacy questions or to exercise the rights above, contact [email protected].

[If serving Indian users: the DPDP Act requires a named Grievance Officer with published contact details. Add Grievance Officer name, designation, and contact information here.]

Creblix · Bengaluru, Karnataka