Privacy Policy

This Privacy Policy explains how [Company legal name] collects, uses, shares and protects personal data when you use Hyppe (https://hyppe.in), an online marketplace where brands hire Instagram and YouTube creators for paid content. It also explains the browser storage we use, the rights you have over your data, and how to contact us or raise a grievance.

Effective date: [effective date]

1. Who we are

Hyppe is operated by [Company legal name] ("Hyppe", "we", "us" or "our"), whose address is [Registered office address]. For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), [Company legal name] is the Data Fiduciary for the personal data described in this policy. This means we decide why and how that data is processed. [Company legal name] is also the entity that collects and retains it.

We handle personal data in line with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (the "IT Rules"), and the DPDP Act and the rules made under it as they come into force.

This policy applies to everyone who visits https://hyppe.in, creates a Brand or Creator account, or contacts us. Please read it together with our Terms of Service. You can ask us for this policy in any language listed in the Eighth Schedule to the Constitution of India.

2. Personal data we collect

When you create an account

• Email sign-up: your email address and password. Passwords are handled by our authentication provider, Google Firebase, and stored only in hashed form, so Hyppe staff cannot see them.
• Google sign-in: your name, email address and profile photo, as shared by Google. We never receive your Google password.
• Account type: whether you joined as a Brand or a Creator.

If you are a creator

• Profile: your name, photo, headline and bio, city and state, niches and languages.
• Social media details: your Instagram handle, follower count, average views and engagement rate, and your YouTube channel, subscriber count and average views. You enter these numbers yourself. We do not currently connect to your Instagram or YouTube account to collect them. If we introduce verification in future, we will update this policy first.
• Rates and portfolio: your rates per deliverable (in INR) and your portfolio links.
• Payout details: the details you choose to share so that brands can pay you, such as your UPI ID or bank account details (account holder name, account number and IFSC). This is financial information, and we treat it as sensitive personal data under the SPDI Rules. We never collect debit or credit card details.

If you are a brand

• Profile: company name, logo, website, industry, city and state, a description of the business, and the name of the contact person.
• Campaigns: the campaigns you post, including deliverables, pay and campaign terms.
• Payment records: the payment method and transaction reference you record for payments made to creators.

When you use Hyppe

• Applications, pitches, invitations and hiring decisions.
• Collaboration records: the agreed terms (frozen at the time of hire), submissions (post links and uploaded files), approvals, change requests, due dates and time stamps.
• Messages and files shared in a collaboration's private chat, including anything you choose to share there, such as a shipping address for a product.
• Payment records, confirmations of receipt, overdue flags, and the track-record figures calculated from them.
• In-app notifications, and your communications with us, such as support requests, reports and grievances.

When you use our contact form

Our public contact form collects your name, email address and message. You do not need an account to use it.

Collected automatically

When you use Hyppe, our hosting and authentication providers automatically process technical information needed to deliver the service and keep it secure. This includes your IP address, browser and device type, the pages or functions requested, and the date and time of requests and sign-ins. We also keep a small amount of information in your browser to keep you signed in (see section 10). We do not use analytics tools. When we advertise Hyppe, our website uses Meta's and Google's ad measurement tags, described in sections 5 and 10.

Information about other people

If you share information about someone else, for example a person who appears in your content, you must have their permission. For a child, you need the permission of a parent or lawful guardian.

3. How we use your data and why

We use personal data only for these purposes:

• To create and secure your account, sign you in and keep you signed in.
• To show your profile to other signed-in users, so that brands and creators can find each other.
• To let brands post campaigns, and to let creators apply, be invited and be hired.
• To record the agreed terms of each collaboration, and to enable submissions, approvals, change requests, chat and file sharing.
• To show a creator's payout details to brands that have hired that creator, so that they can pay the creator directly.
• To record payments and confirmations, flag overdue payments to both parties, and calculate the track records shown on profiles.
• To send in-app notifications and service messages about your account, your collaborations, and changes to our terms or policies.
• To respond to support requests, contact-form messages, reports and grievances, and to help resolve disputes between users when asked.
• To keep Hyppe safe: preventing fraud, impersonation, misrepresented numbers and misuse, enforcing our Terms of Service and Content & Disclosure Guidelines, and investigating reports.
• To maintain the service, fix problems and keep it secure.
• To comply with the law, including the IT Rules, tax and record-keeping requirements, and lawful orders or requests from courts and government authorities.

Some of these steps happen automatically, based on rules set by the brand or by us. For example, in a campaign with instant hiring, creators who meet the campaign's requirements are hired in the order they accept its terms until the slots are filled. A payment that is not recorded within 3 days of approval is flagged as overdue, and track-record figures are calculated from the records on the platform.

Legal basis

We process your personal data on the basis of your consent, which you give through a clear action such as creating an account, filling in your profile, applying to or accepting a campaign, sharing payout details, or sending us a message. Where the law allows, we also rely on the legitimate uses recognised by the DPDP Act. For example, we may use data that you have voluntarily given us for a specific purpose, as long as you have not told us that you do not consent to that use, and we may process data where we must comply with a law, a judgment or order, or a lawful request from a government authority. We collect sensitive personal data, such as payout details, only with your consent and only for the purpose described above.

We ask only for data we need. You can choose not to give some information, but certain features may then not work. For example, a brand cannot pay you if you have not shared payout details.

We do not sell your personal data, and we do not use it for advertising.

4. Who can see your information

• Creator profiles (name, photo, headline and bio, city and state, niches, languages, Instagram and YouTube details and numbers, rates and portfolio links) are visible to all signed-in users, both brands and creators. So is a creator's track record: the number of collaborations, deliverables approved, and the share delivered on time.
• Brand profiles (company name, logo, website, industry, city and state, description and contact person's name) are visible to all signed-in users. So is a brand's track record: the number of creators hired, the total amount paid to creators, and the share of payments made on time.
• Campaigns are visible to all signed-in users.
• Applications and pitches are visible to the brand that posted the campaign. Invitations are visible to the creator invited.
• Collaboration chats, files, submissions and payment records are visible only to the brand and the creator in that collaboration.
• Payout details are visible only to brands that have hired that creator.
• Your email address and password are not shown on your profile.

Anyone who meets our eligibility rules can create an account, so treat your profile as information that many people can see. Share personal details in chat only when the other party needs them for the collaboration.

Hyppe staff access personal data only where needed for support, safety, investigating reports, resolving disputes or meeting legal obligations, and must keep it confidential.

5. How we share personal data

• With the other party to a collaboration. When a brand hires a creator, each can see the information needed to work together, and the brand can see the creator's payout details. A user who receives your information through Hyppe becomes responsible for handling it lawfully and using it only for that collaboration. For example, a brand that has paid you may keep your payout details in its own payment records.
• With service providers. We use Google Firebase and Google Cloud, provided by Google, for hosting, authentication, database, file storage and server functions. Google processes this data on our behalf and on our instructions. If we add other service providers that process personal data, we will update this policy.
• With advertising platforms, to measure our ads. When we advertise Hyppe on Facebook, Instagram, Google or YouTube, our website uses the Meta Pixel and the Google Ads tag. They tell Meta and Google when someone visits a page of our website, taps a sign-up button on one of our ad pages, sends our contact form or creates an account (and whether it is a brand or a creator account), together with technical data such as cookies, browser and device information and IP address, so that we can measure and improve our ads. We do not send your name, email address, phone number or anything from your account. Meta and Google handle this data under their own privacy policies (https://www.facebook.com/privacy/policy and https://policies.google.com/privacy). You can turn this off for your device at the end of this page, and manage your ad preferences in your Facebook, Instagram and Google settings.
• For legal reasons. We may disclose personal data where required by law, a court order, or a lawful request from a government agency authorised under law. We may also do so where reasonably necessary to enforce our terms, prevent fraud or security threats, or protect the rights and safety of our users, the public or Hyppe.
• Business transfers. If [Company legal name] is involved in a merger, acquisition, restructuring or sale of all or part of its business, personal data may be transferred to the successor as part of that transaction, subject to applicable law. We will tell you before your data becomes subject to a different privacy policy.

We do not share sensitive personal data, such as payout details, with anyone except as described above, unless you consent or the law requires it.

6. Where your data is stored

Our database, file storage and server functions are hosted by Google Cloud in its Mumbai, India region (asia-south1). Sign-in (authentication) and website hosting run on Google's global infrastructure, so some personal data, such as sign-in details and technical data about your requests, may be processed outside India.

When personal data is processed outside India, we do so in line with Indian law, including any restrictions notified by the Government of India under the DPDP Act, and only through service providers that are bound to protect it to the standard required under Indian law.

7. How long we keep your data

• Account and profile data: for as long as your account is active. After your account is deleted, we delete or anonymise this data within a reasonable time, except as described below.
• Registration information: kept for 180 days after your account is deleted or cancelled, as required by the IT Rules.
• Collaboration and payment records: completed collaborations, submissions, approvals and payment records are shared records with the other party. We may keep them for as long as needed for legal, tax, dispute-resolution or fraud-prevention purposes.
• Removed content: if we remove or disable access to content under the IT Rules, we keep it and the related records for 180 days, or longer if a court or an authorised government agency requires it.
• Contact-form messages and support correspondence: for as long as needed to deal with your request and keep a record of it.
• Technical logs: for limited periods needed for security and troubleshooting, or as required by law.

If you withdraw your consent, or once the purpose for which data was collected is no longer being served, we will delete that data within a reasonable time unless the law requires us to keep it. Deleted data may remain in backups for a limited period before it is overwritten.

8. How we protect your data

We follow reasonable security practices and procedures, as required under the Information Technology Act, 2000 and the SPDI Rules, appropriate to the data we hold. These include:

• Encryption of data in transit (HTTPS), and storage on Google Cloud infrastructure that encrypts data at rest.
• Access controls so that users see only what they are meant to see. For example, payout details are shown only to brands that have hired a creator, and collaboration chats only to the two parties.
• Limiting staff access to what is needed for their role.
• Passwords handled by our authentication provider and stored only in hashed form.

No system is completely secure. You can help by using a strong password that you do not use elsewhere, never sharing your login, and telling us at once at admin.hyppe@gmail.com if you suspect unauthorised access. Never share OTPs, UPI PINs, passwords or card details with anyone. To receive a payment, a creator only needs to share a UPI ID or a bank account number and IFSC.

If a personal data breach occurs, we will notify affected users and the relevant authorities, such as the Data Protection Board of India and CERT-In, as required by law.

9. Your rights and choices

Subject to the DPDP Act and other applicable law, you have the right to:

• Access: ask for a summary of the personal data we process about you and our processing activities, and the identities of the other Data Fiduciaries and Data Processors with whom we have shared it, with a description of what was shared.
• Correction and updating: correct, complete or update your data. You can update most of your profile yourself. For anything else, ask us.
• Erasure: ask us to delete your personal data. We will do so unless we need to keep it for the purpose it was collected for or to comply with the law (see section 7). To delete your account, email admin.hyppe@gmail.com.
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it. If you withdraw consent that we need to run your account, we may have to close the account.
• Grievance redressal: raise a complaint with our Grievance Officer (see section 14).
• Nomination: nominate another individual to exercise your rights in the event of your death or incapacity.
• Complain to the Data Protection Board of India, in the manner the Board prescribes, after first using our grievance process, as the DPDP Act requires.

To exercise these rights, email admin.hyppe@gmail.com or [grievance email] from the email address linked to your account. We may need to verify your identity before acting on a request, and we will respond within the time required by law.

You also have duties under the DPDP Act: follow applicable law, do not impersonate anyone when giving us personal data, give only authentic information when asking for correction or erasure, and do not file false or frivolous complaints.

10. Cookies and browser storage

Hyppe uses essential browser storage, such as local storage and IndexedDB, to keep you signed in securely and to make the website work. You cannot sign in without it, so it cannot be switched off while you use your account.

• Ad measurement cookies. When we advertise Hyppe, the Meta Pixel and the Google Ads tag set their own cookies (such as _fbp and _gcl_au) and may read cookies Meta and Google have set before, to tell which of our ads led to a visit or a sign-up (see section 5). They are not needed to use Hyppe. You can turn them off for your device at the end of this page, and they don't load while they're turned off.
• We do not use analytics cookies.
• If you choose Google sign-in, Google may set its own cookies on its sign-in pages. These are governed by Google's privacy policy.
• You can clear browser storage in your browser settings at any time. This will sign you out.

If we add analytics or other non-essential cookies, we will update this policy before doing so and ask for your consent where the law requires.

11. Children

Hyppe is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18, and children may not create accounts, including as creators. If we learn that an account belongs to someone under 18, we will close it and delete the associated personal data, except where the law requires us to keep it. If you believe a child is using Hyppe, contact us at admin.hyppe@gmail.com.

12. Third-party links and services

Profiles and campaigns may link to Instagram, YouTube, brand websites and other third-party sites. Those services have their own privacy practices, and we are not responsible for them.

13. Changes to this policy

We may update this policy as the service or the law changes, for example if we introduce verification of creator numbers, payment processing or analytics. We will update the effective date above and, for material changes, give notice in the app, on the website or by email before they take effect. Where the law requires, we will ask for your consent again.

14. Grievance Officer and contact

If you have a question or complaint about how we handle personal data, contact our Grievance Officer:

• Name: [Grievance Officer name]
• Email: [grievance email]
• Address: [Company legal name], [Registered office address]

We will acknowledge your complaint within 24 hours and resolve it within 15 days of receiving it. Please include your name, the email address linked to your account (if any) and a description of the issue.

For anything else, contact us at admin.hyppe@gmail.com or [phone number].