Privacy Notice
Creator Goose Private Limited · Effective: 2 September 2026 · Version 1.0
This notice explains what personal data Creatorgoose collects, why, and the rights you have over it. It applies to the Creatorgoose platform at app.creatorgoose.com and creatorgoose.com, operated by Creator Goose Private Limited, Innov8 UCP Tower D, Floor 9, Sadar Bazar, Gurgaon — 122001, Haryana, India ("Creatorgoose", "we").
1. Who we are, and the two roles we play
- For brands and creators using Creatorgoose (your account, KYC, campaign and payment data), we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") — we decide how and why that data is processed.
- For a brand's customers and audience (comments, messages, and contact details processed through campaign tools), we act as a data processor on the brand's behalf, under our Data Processing Addendum. The brand is the fiduciary for that data.
2. What we collect
Account & profile data: name, email address, phone number, role (brand/creator), organisation details (company name, entity type, GSTIN).
Creator KYC & payout data: PAN, bank account or UPI details. Collected because tax law (TDS) and payment regulations require them; a missing PAN attracts a higher statutory TDS rate (Sec. 206AA, Income-tax Act).
Campaign & contract data: briefs, deliverables, agreements and their signature records (including e-sign audit trails), escrow and payout records, TDS computations.
Data from Instagram (via Meta's Instagram API), only after you connect your account:
| Permission | What we access | Why |
|---|---|---|
instagram_business_basic |
Your profile (username, account type, follower count) and your media (posts/reels: caption, permalink, timestamp) | To display your connected account and automatically verify that a campaign post is live and carries the required advertising disclosure |
instagram_business_manage_comments |
Comments on your posts | To power the comment inbox: classify comments (order queries, purchase intent, spam, abuse), hide/unhide, and reply — at your or the brand's direction |
instagram_business_manage_messages |
Direct messages to your professional account | To power creator-configured DM automation (e.g., comment-keyword → automatic reply) and support conversations |
We store Instagram access tokens encrypted (AES-256-GCM) and use them only for the functions above.
End-user contact data (phone numbers): collected only when a person shares their number in a DM conversation after an opt-in prompt. Every capture stores a consent record (what was shown, when, in which conversation). Replying STOP in the conversation suppresses all further processing.
Technical data: log data, IP addresses, and cookies strictly necessary for authentication and security. We do not use advertising or cross-site tracking cookies.
3. What we do NOT do
- We do not sell personal data — anyone's, ever.
- We do not use data obtained from Instagram for advertising, profiling unrelated to the service, or building audiences across brands.
- We do not combine one brand's customer data with another's in identifiable form.
- We do not process data of children; the platform is for users 18+.
4. Why we process (purposes & legal grounds)
Processing rests on your consent (collected at signup and at each connection/opt-in) and on legitimate/legal necessity for: operating campaigns and contracts; holding and releasing escrowed payments; computing and documenting TDS and GST as required by tax law; verifying advertising disclosures (ASCI); comment moderation and messaging tools you enable; security, fraud prevention and audit; and complying with law and lawful requests.
5. Who we share data with (sub-processors)
We share data only with service providers needed to run the platform, each bound by contract:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication, file storage | All platform data (hosted region: Mumbai, India) |
| Vercel | Application hosting | Technical/log data |
| Cashfree Payments India | Escrow collections, splits, payouts | Payment, payout and KYC data |
| Leegality (Grey Swift Pvt. Ltd.) | Electronic signatures & audit trails | Agreement PDFs, signer name/email/phone |
| Resend | Transactional email delivery | Email address, email content |
| OpenRouter (AI processing) | Contract drafting assistance, comment classification, contract Q&A | Campaign briefs, comment text, agreement terms (no payment credentials, no Aadhaar/PAN) |
| Meta Platforms | Instagram API | As described in Section 2, under Meta's Platform Terms |
We do not transfer personal data outside India except where a listed provider processes it in another region under contractual safeguards, consistent with Section 16 of the DPDP Act.
6. How long we keep data
- Account, campaign, contract, and payment records: for the life of your account, then up to 8 years where tax and company law require retention (e.g., TDS records), after which they are deleted or anonymised.
- Instagram data (tokens, comments, messages): while your account remains connected. Disconnecting Instagram (or removing Creatorgoose in your Instagram settings) deletes stored tokens immediately; associated Instagram content data is deleted within 30 days.
- End-user contact data: until consent is withdrawn (STOP) or the brand instructs erasure, whichever is earlier.
7. Your rights & how to delete your data
Under the DPDP Act you may access a summary of your data, correct it, have it erased, nominate a representative, and raise grievances.
Delete Instagram data: Portal → Instagram → Disconnect, or remove Creatorgoose from Instagram (Settings → Website permissions → Apps and Websites) — removal triggers automatic deletion on our side. You can also use the instructions at /data-deletion.
Delete your account: email privacy@creatorgoose.com from your registered email. We erase personal data not subject to statutory retention within 30 days and confirm completion.
Withdraw DM consent (end-users): reply STOP in the conversation — processing halts immediately.
8. Security
Encryption in transit (TLS) and at rest; Instagram tokens additionally encrypted at the application layer; row-level access controls; tenant isolation per brand; least-privilege internal access; audit logging. Personal data breaches are handled per the DPDP Act and, where Instagram data is involved, Meta's Platform Terms.
9. Grievance Officer & contact
Grievance Officer: Naman Jain, Creator Goose Private Limited, Innov8 UCP Tower D, Floor 9, Sadar Bazar, Gurgaon — 122001, Haryana, India. Email: privacy@creatorgoose.com. We acknowledge complaints within 24 hours and resolve within 15 days (IT Rules, 2021) and in any case within DPDP timelines.
10. Changes
We'll notify registered users of material changes by email and update the version/date above. Continued use after the effective date constitutes acceptance; where consent is required for a new purpose, we will ask for it.