Privacy Policy

Last updated: 5 October 2026

Pending legal review. This is interim text kept to what is true of the service today. It will be replaced by a reviewed version.

GUAPD PRIVATE LIMITED (“Guap’d”, “we”). Registered office: Plot No 307, Kh. No. 137/9, 1st Floor, Ishwar Colony, Bawana, Delhi, North West Delhi – 110039, Delhi, India.

Grievance Officer / Data protection contact: Palak Jain, contact@guapd.com

Support: help@guapd.com

This policy is framed under India’s Digital Personal Data Protection Act, 2023. We are the Data Fiduciary.

What we collect

Creators: name, phone number (used for OTP login), email, Instagram/YouTube handles and profile links, self-reported audience statistics, rate card and pricing, profile photo, content samples uploaded to the platform, city, state and age bracket, a profile bio (including any you ask our AI assistant to draft), a UPI ID if you add one to receive payments, deal history, messages sent through the platform, uploaded deliverable files.

Creators who connect an Instagram account: connecting is optional and separate from signing in, which stays on phone OTP. When you connect, we read and store your Instagram username, account type, follower and following counts, number of posts, your name, biography and profile picture, and your audience figures: age bands, gender split, top cities, reach over the last 30 days and interactions over the last 30 days. We store an access token so these can refresh once a day; it is encrypted before it is written and no browser ever receives it. We do not post on your behalf, read your direct messages, or access anyone else’s account.

You can disconnect at any time from Settings, or revoke our access from Instagram itself under Settings → Website permissions → Apps and websites. Either one deletes the token and the stored Instagram figures. Your Guapd account, your deals and any figures you entered yourself are unaffected, because none of those came from Instagram. Disconnecting Instagram is not the same as closing your Guapd account; to do that, email contact@guapd.com.

Brands: name, work email, company name, team member names and emails, deal history, messages, invoices and payment status records, and the text of searches you run with AI creator search.

Anonymous visitors to a creator’s shopfront: if you begin an offer and choose to sign up, the details you entered are carried into your new account. We do not store anything you type before you create an account.

Automatically: IP address, device and browser information, pages viewed, and product analytics events (see Cookies).

Payments: we do not process payments. Brands pay creators directly, outside the platform, and we record the status. We do not collect card numbers or bank account details. If a creator adds a UPI ID, we store it; only that creator and Guapd can see it.

Why we collect it

Operating the deal workflow; verifying identity and vetting creators; sending notifications about your deals over WhatsApp, email and in the app; generating invoices and meeting tax obligations; maintaining an audit record of every change to a deal so that disputes can be resolved fairly; improving the product; security and fraud prevention; complying with law.

Legal basis

We process personal data on the basis of your consent, given when you create an account and when you take specific actions (publishing a storefront, sending an offer), and for legitimate uses permitted under the DPDP Act, including performing our contract with you and complying with legal obligations.

Public information

If a creator publishes a storefront, the information on that page (name, photo, handle, bio, categories, self-reported statistics, and, if the creator enables it, rates and past brand collaborations) becomes publicly visible to anyone with the link. Publishing is off by default and entirely the creator’s choice. A brand’s name appears on a creator’s storefront only if that brand has separately opted in to public attribution. Creators can unpublish at any time, though pages already viewed or cached elsewhere may persist outside our control.

Who we share it with

We do not sell personal data. We do not share your data with other users except as required to run a deal you are party to, or as published on a storefront you have chosen to make public.

Where data is stored

Primarily in India (Mumbai). Some processors listed above may process data outside India; where they do, we rely on their contractual safeguards. Specifically, if you consent to analytics, PostHog stores that analytics and session-replay data in the European Union (Frankfurt), and Anthropic processes the AI requests described above in the United States.

Retention and deletion

You may request deletion of your account by emailing contact@guapd.com. On deletion we remove your profile, storefront, contact details and uploaded content.

We retain records of completed transactions: deal terms, invoices, payment status and the associated audit log, for as long as required by tax, accounting and legal obligations, and to resolve any dispute between the parties to that deal. This is because a deal is an agreement between two people: one party cannot erase the shared record of it. Retained records are dissociated from your profile where possible.

Your rights under the DPDP Act

Access a summary of the personal data we hold about you; correct or complete inaccurate data; request erasure (subject to the retention terms above); nominate another person to exercise these rights in the event of death or incapacity; withdraw consent, which will end your ability to use the platform; and file a grievance with our Grievance Officer.

To exercise any of these, email contact@guapd.com. We will respond within the timelines required by law.

Grievance redressal

Grievance Officer: Palak Jain, contact@guapd.com. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

Cookies and analytics

We use essential cookies to keep you signed in. These are required for the platform to work and cannot be switched off. With your consent we also use PostHog for product analytics, to understand how the platform is used and improve it. Analytics cookies are not set until you accept them, and you can change your choice at any time using the link in our footer.

If you accept analytics, PostHog also records session replays, a reconstruction of how pages were used, such as clicks and navigation. What you type is masked: passwords, one-time codes, email and phone fields are never captured, and screens showing personal details are hidden from recordings. Replays are stored in the EU and are used only to diagnose problems and improve the product. Decline analytics and no replay is recorded at all.

Children

Guapd is not intended for anyone under 18. We do not knowingly process the personal data of children.

Security

Access to data is restricted by row-level security policies enforced at the database layer; uploaded files are stored privately and served only through short-lived signed links; we do not process card or bank payments. No system is perfectly secure, and we will notify affected users and the Data Protection Board of any personal data breach as required.

Changes

We will update the “Last updated” date and, for material changes, notify you in the product or by email.