Privacy Policy

Ads By Creators ("ABC") is a managed influencer-marketing service operated by Voicedraw Labs ("Voicedraw Labs", "we", "us", "our"), a sole proprietorship of Ajay Panthagani, Hyderabad, Telangana, India.

This Privacy Policy covers our marketing site at adsbycreators.com and the creator platform at app.adsbycreators.com (together, the "Platform"). It explains what personal data we collect, why we collect it, how we use, share, store and delete it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Information Technology Act, 2000.

For the purposes of the DPDP Act, Voicedraw Labs is the data fiduciary and you are the data principal. This Policy serves as our notice to you. You may access this notice in English or in any of the languages specified in the Eighth Schedule to the Constitution of India — write to hello@adsbycreators.com and we will provide a translation. This Policy stands on its own: your contractual relationship with us is governed by our Terms of Service and, if you are a Creator, our Creator Terms, both available on adsbycreators.com.

By connecting your Instagram account or otherwise providing personal data to us, you consent to the processing described in this Policy. You may withdraw that consent at any time, as described in Sections 10 and 12.

• "Creator" — a person who signs in to the creator platform with their Instagram professional account to participate in campaigns.
• "Brand" — an advertiser whose campaign is run through ABC.
• "Instagram Data" — the data we receive about your Instagram professional account through Meta's API, described in Section 3. Under Meta's Platform Terms this is "Platform Data".
• "Platform" — adsbycreators.com and app.adsbycreators.com together.
• "Creator Terms" and "Privacy Policy" — the documents of those names published on adsbycreators.com.

We collect three categories of personal data, and nothing beyond them.

(a) Instagram Data, received through Meta's API. When you sign in with Instagram using Meta's "Instagram API with Instagram Login" (available to Instagram professional accounts only) and grant the instagram_business_basic and instagram_business_manage_insights permissions, we receive:

• Your basic professional-account details covered by instagram_business_basic (such as your username and account ID);
• Approximately the last 12 months of your Reels;
• Media insights for that content: views, reach, likes, comments, shares and saves;
• Audience demographics in aggregated form: age ranges, gender split, and top cities and countries.

We refresh this Instagram Data weekly for as long as your account remains connected.

(b) Information you provide on the creator platform. Your contact email address, which we use for account and campaign notices, payment communications and grievance handling; and your campaign preferences: content categories, your city, the languages you create in, and topics you will not promote. If you accept a paid campaign, we also collect the details needed to pay you and to comply with Indian tax law: your UPI ID or bank account details, your PAN, and, if you are GST-registered, your GST details.

(c) Session and security data. An essential session cookie named "abc_session" (see Section 13), and your IP address and browser user agent, which we record in security logs to protect accounts and detect abuse.

• We never see or store your Instagram password. Sign-in happens on Instagram through Meta's OAuth flow; you enter your password with Instagram, not with us. We receive only a limited access token, which we encrypt (Section 6).
• We access only what the two permissions above allow. We do not receive your direct messages or your followers' individual identities — audience demographics reach us only in aggregated form.
• We never post to your Instagram account or act on it. Our access is read-only.
• We use no advertising trackers, no marketing pixels, and no third-party analytics anywhere on the Platform.
• We never sell personal data — yours or anyone else's — and we never share it with data brokers or advertising networks.

The DPDP Act recognises two grounds for processing personal data: consent (section 6) and certain legitimate uses (section 7). We rely on both, as follows — and on nothing else.

(a) Consent. We process your Instagram Data, your profile and preference data, and your contact email address on the basis of your consent under the DPDP Act, given when you connect your Instagram account and provide those details. That consent supports only these purposes:

• Creating and operating your creator account on the platform;
• Understanding your content and audience so we can match you with suitable Brand campaigns;
• Presenting limited, campaign-specific creator cards to Brands — only with the further express consent described in Section 7;
• Measuring campaign delivery (for example, the views a campaign deliverable earns during its measurement window) and calculating and paying your compensation;
• Keeping the Platform secure and preventing fraud and abuse.

(b) Legitimate uses — compliance with law. Section 7 of the DPDP Act separately permits processing needed to comply with Indian law. We rely on this ground — not on your consent — to deduct tax at source under the Income-tax Act, 1961, to collect and hold your PAN and GST details for that purpose, and to retain the financial and campaign records described in Section 9. Because this processing rests on legal obligation rather than consent, it continues even after you withdraw consent.

We do not use your data for any secondary purpose, such as advertising profiles or training unrelated systems, and we do not process it beyond what these purposes require. If we ever need your data for a new purpose, we will ask for your consent first.

Connect. You sign in on the creator platform with Instagram via Meta's OAuth flow. Meta issues us an access token scoped to instagram_business_basic and instagram_business_manage_insights. We encrypt that token at rest using AES-256-GCM.

Initial sync. Using the token, we import approximately the last 12 months of your Reels, their media insights, and your aggregated audience demographics.

Weekly refresh. We re-sync this data from Meta's API weekly so your profile and metrics stay current. During an active campaign, we also read the views reported by Instagram's API for your campaign deliverable across the campaign's measurement window, because your compensation is calculated from that figure under the Creator Terms.

Disconnect. If you remove ABC's access in Instagram's settings, Meta notifies us through its deauthorize callback and we stop all access and syncing. Section 10 explains this, and full deletion — including the 30-day deletion timeline — step by step.

What Brands see. When we propose you for a specific campaign, the Brand sees only a campaign-specific creator card: your Instagram handle, publicly visible profile figures, the performance metrics relevant to that campaign, and summaries of your audience demographics. We share a creator card only with your express consent, which we ask for and record as a separate, affirmative step on the creator platform — it is never inferred merely from your acceptance of this Policy. Brands never receive your contact details, never see your individual rates, and cannot browse our full creator pool. Brands receive creator cards under obligations to us to use them solely to evaluate the specific campaign, to keep them confidential, not to contact you outside the Platform, and not to build databases from them. We may also give a campaign's Brand reporting about the campaign in anonymised, aggregated form.

Service providers. Our infrastructure providers process data on our behalf, under contract and only on our instructions: Supabase (hosted PostgreSQL database) and Railway and Vercel (application hosting).

Legal requirements. We may disclose personal data where a law, court order, or competent government authority validly requires it.

That is the complete list. We do not sell personal data, and we do not share it with advertising networks, data brokers, or anyone else not described above.

Your data is stored in hosted databases and infrastructure — currently PostgreSQL hosted with Supabase, with application hosting on Railway and Vercel. We prefer the India region (ap-south-1) for storage. Some processing may occur outside India with our providers; where it does, we require safeguards equivalent to those described in this Policy.

Security measures include:

• Instagram access tokens encrypted at rest with AES-256-GCM;
• Data encrypted in transit over HTTPS (TLS);
• Security logging of IP address and user agent to detect unauthorised access;
• Access to personal data limited to what operating the service requires.

Personal data breaches. If a personal data breach affecting your personal data occurs, we will intimate you and the Data Protection Board of India in the form and within the timelines prescribed under the DPDP Act and the rules made under it.

No system is perfectly secure. If you believe your account or data has been compromised, contact us immediately at hello@adsbycreators.com.

• Instagram Data: kept while your Instagram account remains connected, refreshed weekly. When you disconnect or request deletion, we delete it — and all data derived from it — within 30 days (Section 10).
• Profile and preference data: kept while your creator account is active, and deleted on request.
• Security logs (IP address, user agent): retained for 90 days and then deleted, unless a specific record is needed for an active security or abuse investigation, in which case it is kept until that investigation concludes.
• Financial and campaign records (including payment, PAN, TDS and invoicing records): retained as required by Indian tax law — up to 8 years — in de-identified form where possible. These records must be kept even after you delete your account, on the legal-obligation ground described in Section 5.

You can withdraw ABC's access to your Instagram account, and have your data deleted, through any of these routes:

• Disconnect via Instagram. In Instagram's own settings, remove Ads By Creators from your connected apps and websites. Meta sends us a deauthorize callback and we immediately stop all access to and syncing of your Instagram Data.
• Request deletion via Instagram. If you request deletion of your data through Instagram's settings, Meta sends us its data-deletion callback. In line with Meta's flow you receive a confirmation code, and you can track the status of your deletion request at app.adsbycreators.com/data-deletion.
• Email us. Write to hello@adsbycreators.com from your registered details and ask us to disconnect your account, delete your data, or both.

Whichever route you use, deletion means this: within 30 days of Meta's callback or your request, we delete the Instagram Data we hold about you and all data we have derived from it — including computed metrics, matching profiles and creator-card summaries built from it.

Deletion has two limits: financial and campaign records that Indian tax law requires us to retain are kept for the period described in Section 9, in de-identified form where possible, and are then deleted; and truly aggregated, de-identified reporting that does not identify you may be retained.

As a data principal under the DPDP Act, you have the right to:

• Access: obtain a summary of the personal data we hold about you and how we have processed it, including the identities of those it has been shared with and the categories shared;
• Correction and updating: have inaccurate or incomplete personal data corrected, completed or updated;
• Erasure: have your personal data erased when it is no longer needed for the purpose it was collected for, subject to legally required retention (Section 9);
• Withdrawal of consent: withdraw your consent at any time, as easily as you gave it — withdrawal does not affect processing already carried out, and we will stop the processing that rested on that consent;
• Grievance redressal: have your complaint heard and addressed through our Grievance Officer (Section 17);
• Nomination: nominate another person to exercise these rights on your behalf if you die or become incapacitated.

• Access, correction, or erasure: email hello@adsbycreators.com from your registered account details, stating which right you are exercising. We may ask you to verify your identity before acting. You can also update your campaign preferences directly on the creator platform at any time.
• Withdrawing consent for Instagram Data: use either Instagram-side route in Section 10, or email us. Withdrawing consent ends the processing that rested on it; if that processing is necessary to run your creator account, your account will be closed. The limited processing that rests on legal obligation rather than consent (Sections 5 and 9) continues for its retention period.
• Nomination: email hello@adsbycreators.com with the name and contact details of your nominee.
• Grievances: raise them with our Grievance Officer (Section 17). We will acknowledge and respond within the timelines prescribed under applicable law. If you remain unsatisfied after our response, you may complain to the Data Protection Board of India.

The Platform uses exactly one cookie, and it is strictly necessary for the service to work:

• Name: abc_session
• Purpose: essential — keeps you signed in to app.adsbycreators.com and protects your session against hijacking
• Lifetime: session — it expires when you sign out or your session ends

We set no advertising cookies, no analytics cookies, and no third-party cookies of any kind, on either the marketing site or the creator platform.

The Platform is for adults aged 18 and over. We do not knowingly collect or process the personal data of anyone under 18. If you believe a person under 18 has created an account or that we hold a child's data, contact us at hello@adsbycreators.com and we will delete it.

ABC is built for creators in India and this Policy is written to Indian law. If you access the Platform from outside India, the law of your country may give you additional rights; nothing in this Policy limits any such right that applies to you. To exercise a right under your local law, contact us at hello@adsbycreators.com.

We may update this Policy as the service, our providers, or the law changes. The effective date at the top always shows the current version.

For material changes — anything that expands what we collect, how we use it, or who we share it with — we will give you notice in advance, by email or a prominent notice on the Platform, and where the DPDP Act requires fresh consent we will ask for it before the change applies to you. Continued use of the Platform after notice of a non-material change means the updated Policy applies.

Our Grievance Officer under applicable Indian law, and the contact point for all privacy requests, legal notices and grievances, is:

• Email: hello@adsbycreators.com

We will acknowledge grievances and respond within the timelines prescribed under the DPDP Act and other applicable law.

This Policy is governed by the laws of India. If you are bound by our Terms of Service or, as a Creator, our Creator Terms, any dispute arising from or relating to this Policy is resolved under the dispute-resolution provisions of those documents: good-faith negotiation first, then arbitration under the Arbitration and Conciliation Act, 1996 before a sole arbitrator appointed by agreement of the parties — failing agreement within 30 days, appointed in accordance with section 11 of that Act — with seat at Hyderabad, Telangana and proceedings in English. Subject to the above, the courts at Hyderabad, Telangana have exclusive jurisdiction. Nothing in this Section limits your right to approach the Data Protection Board of India or any non-waivable right you hold under Indian consumer law.