Privacy Policy

1. Introduction

Welcome to Collaffy ("we," "our," or "us"). Collaffy is operated by Zenffy Solutions Private Limited, a company incorporated in India (CIN U62013KL2026PTC106027), which is responsible for your personal information. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our creator collaboration platform.

Collaffy is a professional platform that helps content creators manage brand partnerships through structured intake forms, secure messaging, and collaboration management tools. We understand that privacy is crucial for creators and brands alike.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, profile information, and authentication data
• Creator Profile Data: Handle, display name, bio, avatar, contact preferences, and customization settings
• Collaboration Requests: Brand partnership details, budgets, timelines, deliverables, and project briefs
• Communications: Messages, attachments, and files shared through our platform
• Brand Information: Company details and contact information for brand partners, and what we use to verify a brand (their website, their sign-in email's domain and our review notes)

2.2 Automatically Collected Information

• Usage Data: How you interact with our platform, features used, and time spent
• Device Information: Device type, operating system, browser information, and IP address
• Analytics: Performance metrics, error logs, and platform optimization data
• Cookies: Authentication tokens, preferences, and session data

2.3 Instagram Data

Creators can connect an Instagram professional account so that brand inquiries sent by direct message appear in their Collaffy inbox. When you connect an account, we receive the following through Meta's Instagram API:

• Your account: Your Instagram user ID, your username, and an access token, which we store encrypted
• Messages you receive: The text of direct messages sent to your account, and an identifier for each message
• Sender details: For each person who messages you, their name, username, follower count, verification status, and whether you and they follow each other

We use this data only to identify brand partnership inquiries and help you manage them. Message text and sender details are processed by our AI model provider (currently Anthropic) for that purpose. Conversations that are not partnership inquiries are not added to your inbox, and we do not keep their text. We do not post content or send messages from your Instagram account, we do not sell Instagram data, and we do not use it to train AI models.

If you send a direct message to a creator who uses Collaffy, your message and the sender details listed above are processed in the same way, on that creator's behalf.

Disconnecting and deleting your data: You can revoke Collaffy's access at any time by removing Collaffy under Apps and websites in your Instagram settings. Once access is revoked, we can no longer receive messages from your account. To delete your Instagram connection and the messages imported from Instagram, email privacy@collaffy.com from the email address on your Collaffy account. We will delete the data within 30 days and confirm by email. Deleting your Collaffy account also deletes your Instagram connection.

3. How We Use Your Information

We use your information to:

• Provide and maintain our collaboration platform services
• Facilitate secure communication between creators and brands
• Prevent fraudulent activities and verify that brands are who they say they are
• Send important notifications about collaborations and platform updates
• Analyze platform usage to improve features and user experience
• Provide customer support and respond to your inquiries
• Comply with legal obligations and enforce our terms of service
• Detect, prevent, and address technical issues and security vulnerabilities

4. Information Sharing and Disclosure

4.1 With Your Consent

We share information when you explicitly authorize us to do so, such as when you engage in collaborations with brands through our platform.

4.2 Service Providers

We work with trusted third-party service providers who help us operate our platform, including cloud hosting, email delivery, file storage, analytics, and AI model services. These providers are contractually bound to protect your information.

4.3 Legal Requirements

We may disclose information if required by law, legal process, or to protect the rights, property, or safety of Collaffy, our users, or others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the business transaction, with appropriate notice provided.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit and at rest
• Secure file upload and virus scanning
• Access controls and authentication systems
• Regular security audits and monitoring
• Signed URLs for file downloads with expiration times
• Brand verification to help prevent fraud

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We continuously work to improve our security practices.

6. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request copies of your personal information
• Rectification: Correct inaccurate or incomplete information
• Erasure: Request deletion of your personal information
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your information
• Objection: Object to certain types of processing
• Withdraw Consent: Revoke consent for data processing where applicable

To exercise these rights, please contact us at privacy@collaffy.com. We will respond to your request within 30 days.

7. Data Retention

We retain your information only as long as necessary for the purposes outlined in this policy:

• Account information: Until you delete your account or request removal
• Collaboration data: For the duration of partnerships plus 3 years for business records
• Communications: Until the associated collaboration is completed or archived
• Analytics data: Aggregated and anonymized data may be retained indefinitely

8. International Data Transfers

Collaffy operates globally, and your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and adequacy decisions.

9. Children's Privacy

Our platform is intended for users who are at least 16 years old (or the age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under this age. If we become aware that we have collected information from a child under the required age, we will delete it promptly.

10. Cookies and Tracking

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for platform functionality and security
• Analytics Cookies: Help us understand platform usage and improve features
• Preference Cookies: Remember your settings and customizations

You can control cookie settings through your browser, though disabling certain cookies may affect platform functionality.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email or through our platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

13. Specific Provisions by Region

13.1 European Union (GDPR)

For users in the EU, we process your data based on legitimate interests for platform operation, contractual necessity for service provision, and consent where applicable. You have additional rights under GDPR, including the right to lodge a complaint with supervisory authorities.

13.2 California (CCPA)

California residents have additional rights including the right to know what personal information is collected, sold, or disclosed, and the right to opt-out of the sale of personal information. We do not sell personal information.