Cloutspire (“Cloutspire”, “we”, “us”) is an influencer-marketing workspace operated by Cloutspire ED, Bodhan, Nizamabad district, Telangana, India. Agencies use it to manage creators, campaigns, content approvals, client review links, invoices and creator payouts. This Privacy Policy explains what personal data we handle, why, who we share it with, and the choices you have. It applies to our website, web app and related services (the “Service”).
1. Who is responsible for your data
- Agency workspace data. An agency (our customer) decides which creators, brands and campaigns it records and why. For that data the agency is the “data fiduciary” (controller) and Cloutspire acts as its “data processor”, handling it only on the agency’s instructions and under our Terms.
- Account, security and service data. For sign-in, security, billing, support, and product operation, Cloutspire is the data fiduciary.
If you are a creator or brand contact and want to exercise rights over data an agency holds about you, please contact that agency first; we will help them respond. You can also write to us (section 15).
2. Data we collect
Account and identity
Name, work email, role, hashed credentials handled by Firebase Authentication, and sign-in/sign-out events. Creators and brand clients may enter through a private link instead of a password.
Creator information (entered by the agency or the creator)
Name, contact details, social handles and audience statistics, niche, location, rate card, relationship notes, availability, and compliance documents such as PAN, GSTIN, agreements and media kits. Payment details (bank account or UPI ID) are stored in a restricted record visible only to the agency owner and that creator.
Brand and client information
Brand name, logo, contact names and emails, campaign briefs, guidelines, approvals, comments and review decisions.
Content and files
Drafts, videos, images, captions, post links and feedback. Files are uploaded to the agency’s own Google Drive; we keep references (such as file IDs), not a copy of your files.
Agreements and acceptance records
When someone accepts or declines an agreement, we record their typed name, time, IP address, browser details and a cryptographic fingerprint of the exact text, to evidence the acceptance.
Financial records
Invoices, GST calculations, payout amounts, TDS calculations and payment references recorded by the agency. Cloutspire does not move money or hold payment-card data; it records payments the agency makes itself.
Public social data
Public profile and post metrics (such as follower counts and public posts) retrieved from YouTube and Instagram for creators, using the platforms’ official APIs. We do not ask creators to log in to their Instagram or YouTube accounts through Cloutspire. If that changes, we will ask for explicit permission and update this policy first.
Google Forms responses
If an agency connects Google Forms, we read the form structure and the responses submitted by respondents (for example a creator applying to a campaign): respondent email and the answers given. Sensitive identifiers such as PAN, GSTIN and bank numbers are masked in what we store. This data is used only to show the agency a review queue and to create records the agency approves.
Technical and usage data
IP address, device/browser type, request logs, error reports, notification and email-delivery logs, and audit-trail entries (who did what and when), used for security and reliability.
Communications
Messages you send us and in-app notifications; transactional emails we send (invitations, approvals, payment notices, sign-in links).
3. How we use data
- To provide the Service: authenticate users, enforce role-based access, run campaigns, review content, produce invoices and payout records, and send notifications.
- To keep the Service secure: rate limiting, abuse prevention, audit trails and fraud/misuse investigation.
- To support you, fix bugs, and improve the product using aggregated or de-identified information where practical.
- To meet legal obligations (for example tax and accounting records) and to establish or defend legal claims.
We do not sell personal data, rent it, or use it for third-party advertising or profiling.
4. Google user data
Some features connect to Google services after you grant permission on Google’s consent screen. You can revoke access at any time at myaccount.google.com/permissions or by disconnecting inside Cloutspire.
| Google permission (scope) | What we use it for |
|---|---|
openid, email | Identify the Google account that connected Drive, and display it in settings. |
drive.file | Create folders and files, and read or manage only the files and folders Cloutspire itself creates or that you open with it, to store creator documents, drafts and the asset vault in the agency’s Drive, and to preview, download and export them. We cannot see the rest of your Drive. |
forms.body, forms.responses.readonly | (Only if the agency owner connects Google Forms, as a separate permission from Drive) Read, create and edit forms used for creator onboarding, campaign applications or brand enquiries, and read the responses so the agency can review them and turn approved ones into records. |
drive.metadata.readonly | (Only if you choose “Browse my forms”) List the names of your existing Google Forms so you can pick one. Pasting a form link works without it. We read names and IDs, not file contents. |
How we handle it. Google data is used only to provide and improve these user-facing features. The Google refresh token is stored encrypted on our servers and used only to act on the agency’s behalf. We do not use it for advertising, we do not sell it, and we do not transfer it to others except as needed to provide the feature, for security or abuse prevention, to comply with law, or with your consent. Humans at Cloutspire do not read Google user data unless you ask for support and consent, it is necessary for security investigation, or the law requires it.
In addition, we:
- do not use Google user data for advertising, retargeting or interest-based ads, or to decide creditworthiness or lending eligibility;
- do not sell Google user data to advertisers, data brokers or information resellers;
- allow human access to Google user data only with your specific consent, for security investigation or abuse prevention, to comply with law, or where the data is aggregated and de-identified for internal operations;
- transfer Google user data to a service provider only as needed to deliver the feature you asked for, and require that provider to meet the same restrictions;
- will not ask for additional Google permissions merely for possible future use, and will ask again, with a clear explanation, before adding any new Google permission;
- keep Google user data only while the Google account stays connected and the feature is in use. When you disconnect Google or close your account, we delete the stored Google access token immediately and other stored Google data within 30 days, except where the law requires us to keep it. Revoking access in your Google Account stops all further access by us; deleting data already stored is done by disconnecting in Cloutspire or by writing to us under section 8A;
- may transfer Google user data in a merger, acquisition or sale of assets only with your prior consent where Google’s policy requires it.
YouTube data is retrieved through YouTube API Services; by using that feature you also agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy. You can revoke Cloutspire’s access to your data via the Google security settings page.
5. AI features
Some features (campaign briefs and report summaries) send the text needed for that request—for example campaign details and performance figures—to Google’s Gemini API. For a brief, this is the campaign name, brand name, platform, niche, objective, guidelines and budget you type in; for a summary, the campaign’s performance figures. We do not send bank details, PAN, passwords or Google user data. Output is a draft for a person to review. Data sent through the Gemini API is not used by us to train our own models.
6. Who we share data with
We share data only with service providers that help us run the Service, under confidentiality and security obligations:
| Provider | Purpose |
|---|---|
| Google Cloud (Cloud Run, Secret Manager, Artifact Registry), Firebase (Authentication, Firestore) | Hosting, database, sign-in |
| Google Drive and Google Forms (agency’s own account) | File storage and optional forms |
| Google Gemini API | AI-generated briefs and summaries |
| YouTube Data API, Meta Graph API (Instagram) | Public creator profile and metrics |
| Email provider (SMTP, e.g. Zoho) | Transactional email delivery |
We may also disclose data (a) to other users in the same agency workspace as permitted by their role, (b) if required by law or a valid legal process, (c) to protect rights, safety or security, or (d) in a merger, acquisition or asset sale, with notice to you. Agencies decide what to share with their own creators and clients.
7. What each role can see
- Brand clients see a filtered view of their own brand’s campaigns and drafts; margins, payouts, TDS, PAN and phone numbers are not shown.
- Creators see only their own briefs, drafts, agreements and payments—not the client’s budget, agency margin or internal notes.
- Agency staff see what their role allows; bank details and finance data are limited to owners.
Access rules are enforced by database security rules and by our server, and each agency’s data is kept separate from other agencies’.
8. Retention and deletion
- We keep workspace data while the agency’s account is active.
- Users can download their data and sign out of all devices from account settings. Agencies can erase a creator’s personal data (contact details, payment details and documents); payout and tax records may be kept where the law requires.
- When an agency closes its account, we delete or irreversibly anonymise its data within 90 days, except records we must keep for legal, tax or dispute purposes. Backups expire on their normal cycle.
- If you disconnect Google, we delete the stored Google refresh token. Files already in the agency’s Drive remain there under the agency’s control.
8A. How to request deletion of your data
Email hello@cloutspire.com from the address linked to your account (or ask your agency), stating what you want deleted. We will verify your identity and confirm within 30 days. To remove Google access yourself, disconnect Google in Cloutspire settings or revoke access at myaccount.google.com/permissions; this stops further access immediately. This section is also the data-deletion instruction for Meta/Instagram data.
9. Security
We use encryption in transit (HTTPS), encryption of stored credentials and refresh tokens, role-based access control, tenant isolation, signed short-lived file links, rate limiting, audit logging and automated tests of our access rules. No system is perfectly secure; if a personal-data breach affects you, we will notify affected parties and authorities as required by law.
10. Your rights
Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may ask to access your personal data, correct or update it, erase it, withdraw consent, nominate another person to exercise your rights, and raise a grievance. Where we act for an agency, we will pass your request to the agency or help it respond. Write to us at the address in section 15; we aim to respond within 30 days.
11. International transfers
Our primary database and application are hosted in Google Cloud’s Mumbai region (India). Some providers (for example Google’s AI service or email delivery) may process limited data outside India. Where that happens, we rely on contractual and technical safeguards and on transfers permitted by applicable law.
12. Cookies and local storage
We use only what is essential: cookies/local storage to keep you signed in and secure, and to remember preferences. We do not use advertising or cross-site tracking cookies. If we add analytics, we will update this section.
13. Children
The Service is for businesses and professionals and is not directed to anyone under 18. Agencies must not onboard minor creators without lawful parental consent and must not use the Service to track or target children. If you believe a minor’s data was entered improperly, contact us and we will act on it.
14. Changes
We may update this policy. We will post the new version here with a new date and, for material changes, notify account owners by email or in the app. Continued use after the effective date means you accept the update.
15. Contact and grievances
Grievance / Data Protection contact: Ashish
Email: hello@cloutspire.com
Address: Cloutspire ED, Bodhan, Nizamabad district, Telangana, India
If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, or any authority competent under applicable law.