Privacy Policy

2. Data Controller Information

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, password, and profile picture
• YouTube Data: Channel handle, public video metadata, and product mentions (read-only access)
• Payment Information: Billing address, payment method details (processed by Paddle, our Merchant of Record)
• Store Content: Products, descriptions, pricing, and media you upload
• Communications: Messages you send to our support team

3.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, features used, time spent on platform
• Cookies: Essential, analytical, and preference cookies (see Section 9)

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contractual Necessity: To provide our services and fulfill our agreement with you
• Consent: For marketing communications and optional analytics
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations

5. Purpose of Processing (DPDP Compliance)

Under the Digital Personal Data Protection Act, 2023, we process your data for:

• Providing and maintaining our creator monetization platform
• Processing transactions and sending related information
• Analyzing YouTube content to extract product recommendations
• Sending promotional communications (with your consent)
• Responding to your inquiries and support requests
• Detecting and preventing fraudulent activities
• Complying with legal obligations in India

6. Your Rights

6.1 Rights Under GDPR (EEA Users)

• Right of Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

6.2 Rights Under DPDP (Indian Users)

• Right to Access: Know what personal data we hold about you
• Right to Correction: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data
• Right to Grievance Redressal: File complaints about data processing
• Right to Nominate: Nominate someone to exercise your rights

To exercise any of these rights, please contact us at crew@gyata.ai. We will respond within 30 days.

7. Data Sharing and Transfers

We may share your data with:

• Service Providers: Paddle (payments and billing), YouTube API (content analysis), cloud hosting providers
• Legal Authorities: When required by law or to protect our rights
• Business Transfers: In connection with mergers, acquisitions, or asset sales

For international data transfers outside the EEA, we use Standard Contractual Clauses approved by the European Commission.

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Account Data: Until you delete your account, plus 30 days for backup recovery
• Transaction Records: 7 years for tax and legal compliance
• Analytics Data: 26 months in anonymized form
• Support Communications: 3 years after resolution

9. Cookies and Tracking

We use cookies and similar technologies:

• Essential Cookies: Required for platform functionality (no consent needed)
• Analytics Cookies: To understand how users interact with our platform
• Preference Cookies: To remember your settings and preferences

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect platform functionality.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• SSL/TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately at crew@gyata.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the"Last updated" date. For significant changes, we will provide additional notice via email or platform notification.

13. Grievance Officer (DPDP)

In accordance with the DPDP Act, we have appointed a Grievance Officer to address your concerns:

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: