Privacy & Data Policy

Welcome to Thayyal. Thayyal is a digital platform that connects businesses, brands, and marketing agencies with social media influencers and content creators for influencer marketing collaborations, campaign management, analytics, and payment facilitation.

This Privacy & Data Policy explains how we collect, use, process, store, share, and protect personal data when users access or use our website, mobile applications, APIs, and related services.

This policy is designed to align with:

• European Union General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA/CPRA)
• United States privacy standards
• India Digital Personal Data Protection Act (DPDP Act)
• Meta Platform Terms & Developer Policies
• Applicable international privacy and cybersecurity principles

By using Thayyal, you acknowledge that you have read and understood this Privacy Policy.

DEFINITIONS

“Personal Data”
Any information that identifies or can reasonably identify an individual.

“Influencer”
A social media creator or content publisher registered on the platform.

“Business User”
A business, agency, startup, or individual using Thayyal to create influencer campaigns.

“Processing”
Any operation performed on personal data including collection, storage, organization, transfer, analysis, or deletion.

“Third-Party Services”
External providers including payment gateways, cloud providers, analytics tools, and social media APIs.

INFORMATION WE COLLECT

Information You Provide

Influencer Accounts
We may collect:

• Full name
• Username
• Email address
• Phone number
• Country and city
• Profile photograph
• Social media profile links
• Influencer category/niche
• Portfolio and media kit
• Audience demographics
• Payment and bank details
• Tax information where legally required

Business Accounts
We may collect:

• Company name
• Business registration information
• GST/VAT information
• Billing address
• Contact information
• Campaign requirements
• Payment information

Information Collected Through APIs

When users connect social media accounts through authorized integrations, we may collect:

Instagram & Facebook (Meta APIs)

• Username
• Followers count
• Engagement metrics
• Reach and impressions
• Public profile information
• Media statistics
• Audience insights authorized by the user

YouTube API Data

• Channel name
• Subscriber count
• Video statistics
• Public engagement metrics

We do NOT collect:

• Passwords
• Private messages
• Sensitive private content
• Unauthorized personal communications

Automatically Collected Information

We may automatically collect:

• Browser type
• Operating system
• IP address
• Usage activity
• Cookies and analytics data
• Session information
• Referral URLs

LEGAL BASIS FOR PROCESSING (GDPR)

Under GDPR, we process personal data based on:

• User consent
• Contractual necessity
• Legal obligations
• Legitimate business interests
• Fraud prevention and platform security

Users may withdraw consent at any time.

HOW WE USE PERSONAL DATA

We use collected information for:

• Account registration and authentication
• Influencer discovery and matching
• Campaign management
• Analytics and reporting
• Payment processing and escrow handling
• Fraud prevention and fake engagement detection
• Customer support
• Platform optimization
• Security monitoring
• Legal and regulatory compliance
• Marketing communications (with consent)

We only process data necessary for legitimate platform operations.

COOKIES & TRACKING TECHNOLOGIES

Thayyal uses cookies and similar technologies to:

• Maintain user sessions
• Improve platform functionality
• Understand user behavior
• Analyze traffic and performance
• Personalize experiences

Users can control cookie preferences through browser settings. Where required by law, cookie consent banners will be displayed.

DATA SHARING & DISCLOSURE

We do not sell personal data. We may share data only under the following circumstances:

Between Platform Users
Businesses may view influencer information including:

• Public analytics
• Engagement statistics
• Portfolio content
• Audience demographics authorized by the influencer

Influencers may access:

• Campaign details
• Business information necessary for collaboration

Service Providers
We may share limited information with:

• Cloud hosting providers
• Payment processors
• Analytics infrastructure providers
• Identity verification services
• Customer support tools

All third-party vendors are required to maintain confidentiality and security.

Legal Requirements
We may disclose data if required to:

• Comply with laws or legal requests
• Prevent fraud or abuse
• Protect user safety
• Enforce agreements
• Defend legal claims

INTERNATIONAL DATA TRANSFERS

Because Thayyal operates globally, user data may be processed in multiple jurisdictions. Where required, we implement safeguards including:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements
• Secure infrastructure controls
• Encryption and access restrictions

Users from the European Economic Area (EEA) acknowledge that data may be transferred outside their country.

PAYMENT & ESCROW DATA

Payments are processed using licensed third-party payment providers. Thayyal may facilitate escrow-based transactions between businesses and influencers.

We do not store:

• Full credit/debit card numbers
• Payment PINs
• Banking passwords

Payment providers maintain PCI-DSS compliant systems.

DATA RETENTION

We retain personal data only as long as necessary for:

• Platform functionality
• Legal obligations
• Tax and financial compliance
• Fraud prevention
• Dispute resolution

Users may request deletion of their account and associated data. Certain records may be retained where legally required.

USER RIGHTS

Depending on applicable laws, users may have rights including:

GDPR Rights (Europe)

• Right to access
• Right to correction
• Right to deletion
• Right to restrict processing
• Right to data portability
• Right to object
• Right to withdraw consent

CCPA/CPRA Rights (California)

• Right to know collected information
• Right to request deletion
• Right to opt out of data sharing
• Right against discrimination

India DPDP Rights

• Right to access information
• Right to correction and erasure
• Right to grievance redressal
• Right to nominate another person

Requests may be submitted to: Email: privacy@thayyal.com

DATA SECURITY

We implement administrative, technical, and organizational safeguards including:

• HTTPS/SSL encryption
• Secure server infrastructure
• Database access restrictions
• Token encryption
• Security monitoring systems
• Multi-layer authentication controls
• Periodic security reviews

Despite our efforts, no system is completely secure. Users are responsible for maintaining account confidentiality.

CHILDREN’S PRIVACY

Thayyal services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware of such collection, the information will be deleted.

THIRD-PARTY LINKS & SERVICES

The platform may contain links to third-party websites and social media services. We are not responsible for the privacy practices of external platforms. Users should review the policies of:

• Meta Platforms
• YouTube/Google
• Payment providers
• External services connected through integrations

META & SOCIAL MEDIA API COMPLIANCE

Thayyal uses official APIs provided by Meta and Google. We comply with:

• Meta Platform Terms
• Meta Developer Policies
• Google API Services User Data Policy

We only request permissions necessary for platform functionality. Users may disconnect connected accounts at any time.

DATA DELETION REQUESTS

Users may request deletion of personal data by:

• Accessing account settings
• Disconnecting social media accounts
• Contacting support
• Using the data deletion request page

Data Deletion Contact
Email: privacy@thayyal.com
Meta Data Deletion Endpoint: https://thayyal.com/data-deletion

Deletion requests will be processed within legally required timelines.

BUSINESS CONTINUITY & INCIDENT RESPONSE

In the event of: Cybersecurity incidents, Data breaches, or Unauthorized access

We may:

• Notify affected users
• Notify regulators where required
• Temporarily suspend systems
• Conduct investigations and remediation

CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. Material changes will be communicated through:

• Email notifications
• Dashboard notices
• Website updates

Continued use of the platform after updates constitutes acceptance.

GOVERNING LAW

This Privacy Policy shall be governed by applicable laws of:

• India
• European Union privacy regulations where applicable
• United States state privacy regulations where applicable

Disputes may be resolved through arbitration or competent courts as legally applicable.