Privacy & Policy

CredFluence is a trust-scoring and review platform for the Indian creator economy — think CIBIL Score meets IMDb for influencer marketing. We operate as a data fiduciary under the DPDP Act 2023.

Registered Entity: CredFluence

Account & Identity

• Email address, full name, password (bcrypt hash — never plain text)
• Phone number (AES-256-GCM encrypted at rest)
• User role: Creator, Agency, or Brand

Social Platform Data (via OAuth)

• Google / YouTube — Google ID, email, name, YouTube channel ID, custom URL, subscriber count, video count, total views, thumbnail. Scope: youtube.readonly
• Instagram — User ID, username, biography, followers, media count, profile picture, website, account type. Scope: instagram_business_basic (Business & Creator accounts only)
• LinkedIn — LinkedIn ID, full name, profile picture, email. Scope: openid profile email

OAuth access tokens and refresh tokens are AES-256-GCM encrypted before storage.

Organisation & Verification Data

• Company name, GST number, CIN number, business website
• Verification documents — stored in encrypted private cloud storage, visible to platform admins only

Review & Transaction Data

• Review text, deal value (INR), collaboration type, recommendation
• Evidence files: contracts, invoices, screenshots, chat exports (private cloud, presigned URLs)
• Contact email and phone for off-platform delivery (AES-256-GCM encrypted)

Technical Data

• IP address — rate limiting and fraud detection; logged, not stored in user profile
• Browser local storage: session token and basic profile for login persistence
• Google Fonts: your IP is sent to Google servers on every page load

• Consent — explicit consent at registration by accepting these policies
• Contract performance — necessary to deliver the review and trust-scoring service
• Legitimate interest — fraud detection, platform security, trust score calculation
• Legal obligation — compliance with Indian laws and regulatory requirements

• Create and manage your account and organisation
• Calculate your Trust Score (300–900) from verified reviews
• Display your public profile, social stats, and verified reviews
• Send transactional emails: OTP, review notifications, dispute alerts, deletion warnings
• Detect and prevent fraud: review bombing, fake accounts, self-reviews
• Process and resolve disputes
• Comply with legal requirements

CredFluence uses algorithms to calculate Trust Scores (300–900) from verified review data, payment behaviour, evidence quality, and platform activity. A low Trust Score may reduce your platform visibility. Accounts detected as fraudulent may have their trust weight reduced to 0 (ghost-ban).

You have the right to request human review of any automated decision that significantly affects you. Contact our Grievance Officer at privacy@credfluence.in.

CredFluence uses the YouTube Data API v3 (provided by Google LLC) to display your YouTube channel statistics on your public profile — subscriber count, video count, total views, channel name, and thumbnail. We request only the youtube.readonly scope, which grants read-only access to public channel data.

Data collected via YouTube API

• Google Account ID and email (used for account linkage only)
• YouTube channel ID, custom URL, display name, and thumbnail
• Subscriber count, video count, and total view count
• OAuth access token and refresh token (AES-256-GCM encrypted at rest)

How we use this data

• Display your verified YouTube statistics on your CredFluence profile
• Contribute channel reach signals to your Trust Score calculation
• Periodically refresh stats to keep your profile current

We do not read, store, or analyse your private videos, watch history, playlists, comments, or any other YouTube data beyond the channel-level statistics listed above.

Retention and revocation

YouTube API data is retained while your CredFluence account is active. You may disconnect your YouTube account at any time via Settings → Connected Platforms → Disconnect, which permanently deletes your stored tokens and YouTube stats from our systems.

You can also revoke CredFluence's access to your Google account directly at Google Account Permissions. After revoking, your YouTube stats will be removed from your profile within 24 hours.

Limited Use of Google user data

CredFluence's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models. Google user data is never used for advertising, never sold, and never transferred to third parties except as required to operate the features described above or to comply with applicable law.

All uploaded files (profile photos, verification documents, review evidence) are stored in private cloud storage. Access is via time-limited signed URLs only. Verification documents are visible to platform administrators only and never publicly accessible.

• Active accounts — retained until you request deletion, then for 3 additional years for legal compliance
• Soft-deleted accounts — 30-day grace period; personal data hard-deleted after expiry
• Reviews — retained permanently on the platform unless removed by a platform administrator; pseudonymised after account deletion
• Evidence files — retained for 3 years from submission date
• Database backups — retained for 180 days

• Access — download all your data via Settings → Privacy → Download my data, or email privacy@credfluence.in
• Correction — update your name, phone, and profile in Settings
• Erasure — delete your account via Settings → Security → Delete Account (30-day grace)
• Grievance — file a complaint with our Grievance Officer below
• Withdraw consent — disconnect social accounts in Settings (may affect Trust Score)

In accordance with Section 13 of the DPDP Act 2023, we have designated a Grievance Officer:

Some subprocessors (Google, Meta, LinkedIn, AWS) operate servers outside India. By using CredFluence, you consent to your data being transferred to these countries for the purposes described above. All subprocessors maintain adequate data protection standards.

CredFluence is not directed at persons under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, contact us at privacy@credfluence.in and we will delete it promptly.

CredFluence does not use tracking cookies or advertising cookies. We store a session token in your browser’s local storage to keep you logged in — this is essential and cannot be disabled. We do not use Google Analytics, Meta Pixel, or any marketing tracking technology.

We protect your data with AES-256-GCM encryption for sensitive fields (phone, contact emails, OAuth tokens), bcrypt hashing for passwords, JWT RS256 for authentication, HTTPS for all data in transit, Redis-backed rate limiting, Content Security Policy headers, and regular security audits.

We may update this policy from time to time. We will notify you by email at least 7 days before material changes take effect. Continued use after the effective date constitutes acceptance.