Privacy Policy — MyBrandBae

1. Who We Are

MyBrandBae ("we", "our", "us") is an influencer marketing marketplace that connects Instagram content creators with brands for paid collaborations. The platform is operated by the partners of MyBrandBae, a firm registered under the Indian Partnership Act, 1932, with its principal place of business at 15/A Debesh Mukherjee Lane, P.O. Khagra, Berhampore, Murshidabad – 742103, West Bengal, India.

Our platform is accessible at mybrandbae.com and its subdomains.

2. Data We Collect

We collect data in two ways — information you give us directly and information we collect automatically.

From Creators:

Full name, email address, phone number
Password (stored as an irreversible hash — we never see your password)
Instagram handle, niche, city, state, languages
Audience demographics (age groups, gender split, top locations)
Follower count, average likes, average comments, average reel views
Content links (Instagram reels and posts you share with us)
Profile photo (uploaded to Cloudinary)
Pricing (reel, story, post rates)
Bio, past collab history

From Brands:

Company name, contact name, email address
Password (stored as an irreversible hash)
Collab briefs, deliverable details, offer prices
Messages sent to creators through the platform

3. How We Use Your Data

Purpose	Data used
Operating the platform	All account data — to create your profile, authenticate you, and enable platform features
Creator discovery	Niche, city, followers, engagement, pricing, content links — shown to brands browsing the marketplace
Application review	All creator data — reviewed by our team before a profile goes live
Transactional emails	Email address — for signup confirmation, application status, collab requests, and messages
Fetching public Instagram data	Instagram handle — we use Apify to fetch publicly available stats (followers, engagement) to keep your profile accurate
Platform security & fraud prevention	Login history and authentication tokens
Payments (upcoming)	Payment data handled entirely by Razorpay — we never store card or bank details

4. Who We Share Your Data With

We do not sell your data. We share it only with the following third-party services that are necessary to operate the platform:

Service	What they receive & why
Cloudinary	Your profile photo is stored on Cloudinary's CDN. Privacy policy: cloudinary.com/privacy
Resend	Your email address and name are shared to send transactional emails (confirmations, notifications). Privacy policy: resend.com/privacy
Railway	Our server and database run on Railway's infrastructure. All data in our database is hosted on Railway. Privacy policy: railway.app/legal/privacy
Apify	Your Instagram handle is shared to fetch publicly available Instagram statistics. No private data is accessed. Privacy policy: apify.com/privacy-policy
Razorpay (upcoming)	Payment information will be processed by Razorpay. We never store card or UPI credentials. Privacy policy: razorpay.com/privacy
Google Fonts	Font files are loaded from Google's CDN. Google may collect limited usage data. Privacy policy: policies.google.com/privacy

Note on creator profiles: When a brand browses the marketplace, they can see your niche, city, follower count, engagement rate, pricing, and content samples. Your email address, phone number, and exact follower/audience stats are only visible after a brand unlocks your profile or initiates a collab.

5. Data Retention

Creator and brand accounts are retained for as long as the account is active
If you request deletion, we will remove your account and all associated data within 30 days
Collab and message history may be retained for up to 1 year after account deletion for dispute resolution purposes

6. Cookies & Browser Storage

We use minimal browser storage:

Authentication cookie: A secure, HTTP-only cookie stores your login session. It expires after 7 days or on logout.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 (India) and the Information Technology Act, 2000, you have the following rights:

Right to access: Request a copy of the personal data we hold about you
Right to correction: Update or correct your personal data at any time from your dashboard
Right to erasure: Request deletion of your account and all associated data
Right to withdraw consent: You can withdraw consent for data processing at any time, which will result in account deletion
Right to grievance redressal: Contact our grievance officer (details below) for any complaints

To exercise any of these rights, email us at admin@mybrandbae.com with the subject line "Privacy Request".

8. Data Security

Passwords are hashed using bcrypt (industry standard, never stored in plain text)
All data is transmitted over HTTPS (TLS encryption)
Authentication tokens are stored in HTTP-only cookies, inaccessible to JavaScript
Each login is verified against a logout timestamp to prevent session replay attacks
Database access is restricted to our application server only

While we implement industry-standard security measures, no system is 100% secure. If you discover a vulnerability, please report it to admin@mybrandbae.com.

9. Children's Privacy

MyBrandBae is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered on our platform, please contact us and we will delete the account immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users via email. Continued use of the platform after a policy update constitutes acceptance of the new policy.

11. Contact & Grievance Officer

For any privacy-related questions, concerns, or requests, contact our grievance officer:

Koustav Majumder
Grievance Officer, MyBrandBae
15/A Debesh Mukherjee Lane, Berhampore, Murshidabad – 742103, West Bengal, India

admin@mybrandbae.com

We will respond to all privacy requests within 30 days as required under Indian law.