Privacy Policy

Gigahat operates on the principle of data minimization. We collect only the data explicitly necessary for the execution of marketplace services. 1.1. Data Collected from Creators • Identity & Contact Data: Full name, email address, and phone number. Purpose: OTP verification, account security, and essential communication. • Taxation Data: Permanent Account Number (PAN) card details. Purpose: Mandatory statutory compliance for Tax Deducted at Source (TDS) under Section 194-O of the Income Tax Act. • Financial Data: Bank account details. Purpose: Routing and processing of campaign payouts. • Social Metrics & Profile: Instagram/YouTube handles, follower counts, engagement rates, location (state and city), and profile photos. Purpose: Algorithmic brand-creator matching and public profile display. • Content: Any media submitted within the Platform workspace. Purpose: Campaign execution and Brand approval workflow. 1.2. Data Collected from Brands • Corporate Identity: Company name, authorized person details, and GST number. Purpose: Tax-compliant invoice generation and identity verification. • Campaign Data: Campaign briefs, brand assets, and logos. Purpose: Facilitating Creator briefs and Platform marketing. • Payment Information: Processed entirely via Razorpay. Purpose: Campaign funding. Gigahat does not collect, store, or process raw payment card data. 1.3. Data Collected Automatically (Both Users) • Technical Data: Device information, IP addresses, usage patterns, and workspace chat messages. Purpose: Platform optimization, fraud prevention, and dispute resolution.

Where a Creator connects their Instagram account through the official Instagram API (a Meta Platforms, Inc. service), the following applies in addition to the rest of this Policy: 2.1. What We Receive from Meta • Instagram username and app-scoped user ID • Profile-level statistics: follower count, following count, and media count • Aggregate media metrics (such as average likes, comments, and views) used to display verified creator statistics We do NOT receive or store Instagram passwords, direct messages, the personal data of a Creator's followers, or the content of private accounts. Gigahat never posts, comments, or takes any action on a Creator's Instagram account. 2.2. Purpose of Processing Instagram data is used solely to (a) verify that self-reported creator statistics are accurate, (b) display a "Verified" badge on the creator profile, and (c) power brand-creator matching and reach projections. It is never sold, never shared with advertisers, and never used to build advertising profiles. 2.3. Retention and Deletion Instagram-sourced data is retained only while the Instagram connection is active. Disconnecting Instagram (from Gigahat settings or by removing Gigahat in Instagram's "Apps and Websites" settings) deletes all Instagram-sourced data. When a deletion request reaches us through Meta's Data Deletion Callback, it is processed automatically and a confirmation code is issued. Full instructions: gigahat.in/legal/data-deletion 2.4. Platform Terms Our use of Instagram data complies with the Meta Platform Terms and Developer Policies. Nothing in this Policy overrides a user's rights under those terms.

Gigahat explicitly DOES NOT sell, rent, or lease personal data to third-party advertisers or data brokers. Data is shared exclusively to facilitate platform operations: • Razorpay: Financial data is shared securely for the processing of payments and automated TDS deductions. • Government Authorities: Data is shared with law enforcement or tax authorities only when legally compelled via a valid statutory demand. • Third-Party Processors: Cloud hosting providers bound by strict Data Processing Agreements (DPAs) ensuring they process data solely for specified purposes.

In compliance with Indian statutory laws, data is retained according to the following schedule: • Active Accounts: Data is retained as long as the user's account remains active. • Tax and Payment Records: Retained for a mandatory period of seven (7) years post-transaction to comply with the Income Tax Act, 1961, and GST auditing regulations. • Post-Deletion Data: Upon account deletion, standard personal data is retained for three (3) years for tax compliance and dispute resolution, after which it is permanently deleted or anonymized. • Chat Messages: Retained for one (1) year for dispute mediation.

Data Principals (Users) possess the following rights: • Right to Access: Users may request a summary of the personal data being processed. • Right to Correction: Users may update inaccurate data at any time. • Right to Erasure: Users may request the deletion of their data (subject to overarching tax retention laws). • Right to Grievance Redressal: Users have the right to readily available grievance mechanisms. • Timeline for Response: Gigahat will respond to all rights requests within thirty (30) days.

Security Architecture: All data in transit is encrypted using HTTPS/TLS protocols. Passwords are cryptographically hashed using bcrypt. Razorpay handles all card data, ensuring RBI Card-on-File Tokenization compliance. Breach Notification: In the event of a personal data breach, Gigahat will notify the Data Protection Board of India and all affected users within seventy-two (72) hours, outlining the nature of the breach and specific incident response remediation steps, as mandated by the DPDP Rules, 2025.

Gigahat is strictly restricted to individuals aged 18 and above. The Platform does not knowingly collect data from minors. If a minor is detected attempting to use the Platform, the account and all associated data will be immediately and permanently deleted to comply with the DPDP Act.

In accordance with the DPDP Act, 2023, and IT Rules, 2021: Name: Rakshith Kumar B Email: hello@gigahat.in Response Timeline: Acknowledgment within 48 hours; resolution within 30 days.