PRIVACY & COOKIE POLICY

RGossips — Influencer Marketing Platform

Operated by Rude Labs Private Limited

Effective Date: 01.06.2026

1. Introduction

Rude Labs Private Limited ("Rude Labs", "Company", "we", "us", or "our") is committed to protecting the privacy of everyone who uses RGossips, our influencer marketing platform accessible at rgossips.com and through our associated mobile applications, subdomains, and APIs (collectively, the "Platform"). We support a policy of openness about how we collect, use, share, and safeguard your personal data.

This Privacy & Cookie Policy ("Policy") explains what personal data we process when you use the Platform as an influencer/creator ("Influencer") or as a brand, business, or agency ("Brand"), how we use cookies and similar technologies, and the choices and rights available to you. It should be read together with our Terms of Service, the Influencer Consent Policy, and the Brand Consent Policy (collectively, the "Platform Agreements").

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It constitutes an electronic record and does not require any physical or digital signature.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where required by law, we process your personal data on the basis of the consent you provide at signup and at relevant points within the Platform.

2. Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, also referred to as personal information.
• "Data Principal" means the individual to whom the personal data relates (for example, an Influencer, or the authorised representative of a Brand).
• "Data Fiduciary" means the person who, alone or with others, determines the purpose and means of processing personal data. For data processed through the Platform, Rude Labs Private Limited is the Data Fiduciary.
• "Data Processor" means any person who processes personal data on our behalf, such as our payment gateway, cloud hosting, and communication providers.
• "Processing" means any operation performed on personal data, including collection, storage, use, sharing, disclosure, or erasure.

3. Our Role

Unlike platforms built around fan or subscriber pages, RGossips is a two-sided marketplace that connects Brands with Influencers. We determine the purposes and means of processing the personal data of both Influencers and Brands in connection with operating, hosting, and providing the Platform. Accordingly, we act as the Data Fiduciary for such processing.

We engage trusted third parties to process personal data on our behalf and on our instructions — for example, to process escrow payments, host data, and send communications. These parties act as our Data Processors and are contractually bound to protect your personal data and to use it only for the purposes we specify.

4. Personal Data We Collect

The personal data we may collect when you access or use the Platform — including during registration and the ongoing administration of your account — falls into the following categories:

5. How We Collect Personal Data

• Directly from you — when you register, complete your profile, set your rate card, fund or receive payments, apply to or post campaigns, contact support, or otherwise interact with the Platform.
• From connected social accounts — when you authorise a connection (for example, Instagram), we access certain data through that platform’s official API, as described in Section 7.
• Automatically — through cookies and similar technologies, and from your device and browser, when you use the Platform (see Section 8).
• From third parties — such as identity/KYC verification partners and public registries used to verify PAN, GSTIN, or business registration.

6. How We Use Personal Data and Our Legal Bases

We process your personal data on the basis of your consent and, where applicable, the legitimate uses recognised under the DPDPA, for the following purposes:

• Account & verification — to create and administer your account and verify your identity, social handle, and (for Brands) business details.
• Campaign matchmaking & the approval flow — to match Influencers with relevant campaigns and to operate the application, approval, rate-card negotiation, draft submission, feedback, and final acceptance workflow.
• Escrow & payments — to fund and manage escrow, release payouts, process refunds, and comply with accounting and audit requirements, through our regulated payment partners (currently Razorpay or Cashfree).
• Creator features — to generate and display your AI Media Kit and real-time analytics, and to provide the AI Creator Tools (such as captions, hashtags, scripts, rate cards, hook ideas, and brief helpers).
• Brand Trust Score — to compute, display, and update a Brand’s trust score from the relevant signals (reviews, campaign execution, verification, communication, and engagement), as described in our Brand Consent Policy.
• Data-driven insights — to surface relevant information from the creator side of the Platform to the brand side, supporting informed collaboration decisions.
• Product analytics & improvement — to understand how the Platform is used, identify improvements, and enhance the user experience.
• Communications & marketing — to send transactional messages, and, where you have opted in, marketing and promotional communications. You may opt out at any time.
• Legal & tax compliance — to comply with applicable law, including TDS under Sections 194R, 194H, and 194O of the Income Tax Act, 1961, and GST obligations.
• Safety & fraud prevention — to detect and prevent fraud, fake engagement, content scraping, and other prohibited conduct, and to enforce our Platform Agreements.

7. Connecting Your Social Media Accounts

To build your media kit and verify your reach, you may connect your social media account(s) to the Platform. We access only the data necessary to provide our services, through the relevant platform’s official API, and only after you grant permission. You may revoke this access at any time.

7.1 Instagram

When you connect your Instagram account (via the Instagram Graph/Insights API, governed by Meta’s own policies), we may access and use:

• Account identification — your account ID and username, to identify your account and verify that you manage it.
• Performance metrics — post and story insights such as likes, comments, reach, and the unified views metric, used to calculate and display your engagement rate and average performance.
• Media content — selected posts and stories, displayed on your RGossips media kit.
• Audience insights — audience demographics and accounts reached within the period made available by the API, displayed on your media kit.

We do not post any content to your Instagram account, and we do not store your private Instagram information beyond what is described in this Policy. You can revoke access at any time by disconnecting Instagram from your RGossips settings or from your Instagram/Meta settings.

7.2 Sign-In Providers

Where you choose to register or sign in using Instagram or Facebook OAuth (Meta), we receive a limited dataset — typically a unique ID, email address, name, and profile picture — solely to create and authenticate your account. This is separate from connecting a channel for analytics: signing in with Facebook does not by itself grant us access to your Facebook Page metrics. We do not display your sign-in email publicly. You may disconnect a sign-in provider through your Meta account settings.

7.3 Other Platforms

We may add support for additional channels such as Facebook, YouTube, and TikTok. Where you connect any such channel, we will access only the data necessary to display your profile and calculate engagement (for example, profile identity, follower/subscriber counts, content, and performance metrics), we will not post on your behalf, and the same revocation rights described above will apply.

8. Cookies and Similar Technologies

We and our service providers use cookies and similar technologies to operate and improve the Platform. These include:

• Essential cookies — required for core functionality such as keeping you signed in and securing your session.
• Analytics cookies — used to understand how the Platform is used so we can improve it. We may use third-party analytics tools for this purpose.
• Preference cookies — used to remember your settings and personalise your experience.

You can control or disable cookies through your browser or device settings; however, disabling essential cookies may affect the functioning of the Platform.

9. How We Share and Disclose Personal Data

We do not sell your personal data. We share personal data only as described below:

• Between Brands and Influencers — to operate the marketplace, relevant profile, campaign, and performance information is shared between the parties to a campaign so they can evaluate, collaborate, and transact.
• Service providers & sub-processors — with trusted parties who perform services on our behalf (such as payment gateways, cloud hosting, identity verification, communication, and analytics providers), limited to what is reasonably necessary and under confidentiality obligations.
• Legal & regulatory authorities — where required by law, court order, or legal process, or to establish, exercise, or defend legal rights, or to prevent fraud.
• Business transfers — in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to appropriate safeguards.
• With your consent — in any other case, with your specific consent.

10. Data Retention

We follow the principle of data minimisation and retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. To determine the appropriate retention period, we consider the volume, nature, and sensitivity of the data, the risk of harm from unauthorised use, the purposes of processing, and applicable legal requirements.

In general, we retain account data for the duration of your account and for a period of three (3) years thereafter, to comply with obligations under the Income Tax Act, 1961, the Central Goods and Services Tax Act, 2017, and the Companies Act, 2013. Where a dispute or legal claim is pending, data may be retained until it is resolved. Data fetched from connected social accounts is retained only for as long as needed to provide our services and may be deleted on request or when you disconnect the account.

11. Data Security

We implement commercially reasonable technical and organisational measures proportionate to the risk, to protect your personal data against accidental or unlawful destruction, loss, or alteration, and against unauthorised disclosure or access. These measures include encryption of data in transit, access controls, and the use of regulated payment partners for financial transactions.

No method of transmission or storage is completely secure. In the event of a personal data breach, we will act in accordance with our obligations under the DPDPA, including notifying the Data Protection Board of India and affected Data Principals where required.

12. International Data Transfers

Personal data is stored on servers located in India. Where our service providers process data outside India, such transfers are subject to contractual safeguards and are limited to countries not restricted by the Central Government under Section 16 of the DPDPA.

13. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to access — to obtain a summary of the personal data we process about you and the processing activities.
• Right to correction and erasure — to correct, complete, update, or erase your personal data, subject to lawful retention obligations.
• Right to withdraw consent — to withdraw consent at any time; this will not affect the lawfulness of processing carried out before withdrawal.
• Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to grievance redressal — to raise a complaint with our Grievance Officer (see Section 18) and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact us using the details in Section 18. We may need to verify your identity before acting on your request.

14. Children’s Data

The Platform is intended for users aged 18 and above, except that Influencers between 13 and 17 years of age may use the Platform only with the verifiable consent of a parent or lawful guardian, in accordance with Section 9 of the DPDPA. For such minor users, we do not undertake behavioural monitoring, tracking, or targeted advertising, and payouts are routed to the parent or guardian. We do not knowingly process the personal data of children under 13; if we discover such data, we will delete it.

15. Marketing Communications

We send transactional communications necessary to provide the Platform. We will send marketing or promotional communications only where you have opted in, and you can withdraw your consent or unsubscribe at any time using the link in such communications or by contacting us.

16. Third-Party Links and Services

The Platform may contain links to, or embed functionality from, third-party websites and services (for example, social media players and sign-in providers). These third parties maintain their own privacy policies, and we are not responsible for their practices. We encourage you to review their policies before providing them with personal data.

17. Changes to this Policy

We may update this Policy from time to time. We will post the revised Policy on this page and, where appropriate, notify you by email or through an in-app notice at least seven (7) days before material changes take effect. Where a change materially expands the scope of processing, we will obtain fresh consent in accordance with the DPDPA. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

18. Grievance Officer and Contact

For any questions about this Policy, or to exercise your rights or raise a concern, please contact our Grievance Officer and Data Protection contact:

Grievance Officer & Data Protection Contact Rude Labs Private Limited Email: grievance@rgossips.com Response timelines: Acknowledgment within 24 hours; resolution within 15 days.

If you are not satisfied with our response, you may approach the Data Protection Board of India or any other competent authority.

19. Governing Law

This Policy is governed by the laws of India. Subject to any dispute-resolution mechanism in the Platform Agreements, the courts at Dehradun, Uttarakhand shall have exclusive jurisdiction.

— End of Privacy & Cookie Policy —

© Rude Labs Private Limited. All rights reserved.