Last updated: 17 April 2026
This policy applies to Creator Buddy (creatorbuddyhq.com) and describes how we collect, use, and protect your personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
1. Who we are
Creator Buddy is an invoicing tool for Indian content creators, operated at creatorbuddyhq.com. We are the Data Fiduciary under the DPDP Act, 2023.
For any data-related concerns: privacy@creatorbuddyhq.com
2. What data we collect
We collect only what is necessary to provide the service:
- Account: name, email address, mobile number
- Identity: PAN, GSTIN (only if you provide them)
- Financial: bank account number, IFSC code, bank name, UPI ID
- Address: address, city, state, pincode
- Signature: your digital signature image
- Invoice data: invoices you create, campaign names, fees, payment records
- Brand/client data: brand names, GSTINs, contacts you add
- Usage: login timestamps — no third-party tracking, no ads
3. Why we collect it
- To generate GST-compliant invoices on your behalf
- To auto-fill your details on invoices
- To track payment status of your invoices
- To send WhatsApp payment reminders — only when you tap Remind
We never sell your data. Ever.
4. Your rights under DPDP Act 2023
- Access: see all data we hold about you
- Correction: update any incorrect data via your Profile page
- Erasure: delete your account and all associated data within 7 days — use the Delete Account option in Profile or email us
- Withdraw consent: stop using the app and request deletion at any time
- Grievance: email privacy@creatorbuddyhq.com — we respond within 7 business days
5. How long we keep your data
- Active account: as long as your account exists
- After deletion: all data permanently deleted within 7 days
- Before deleting: you may request a data export by emailing us
6. Security
- Passwords are hashed using bcrypt — never stored in plain text
- Database is not publicly accessible
- Financial data stored with access controls
- We follow reasonable security practices under the DPDP Act 2023
7. Sub-processors
We use the following third-party services to operate Creator Buddy. Each only receives the data needed for its specific purpose.
ProcessorPurposeJurisdictionData shared
Google LLCSign-in (OAuth) — only if you choose "Continue with Google"USAYour Google account ID, name, email, profile picture; Google also learns you logged into Creator Buddy
Meta Platforms Ireland Ltd (WhatsApp)Payment reminder messages — only when you tap RemindIreland / EURecipient phone number and message text you approve before sending
Our serversPrimary storage of your account and invoice dataIndiaAll personal data listed in Section 2
We use no analytics, advertising networks, or data brokers.
8. Cross-border data transfers
Your Creator Buddy account data is stored on our servers in India. Two flows involve processing outside India, both disclosed below:
- Google sign-in (optional): if you click "Continue with Google", sign-in is processed by Google LLC in the USA. Google will see that you logged into Creator Buddy. To keep your data India-only, use email sign-up instead.
- WhatsApp reminders (optional): if you tap Remind on an invoice, the recipient's phone number and the message text are sent via WhatsApp (Meta Platforms Ireland Ltd). No reminder is sent unless you approve it.
These transfers comply with Section 16 of the DPDP Act 2023; neither destination is on the Government of India's restricted list at the time of this update.
9. Children
Creator Buddy is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has registered, please contact us immediately.
10. Changes to this policy
We will notify you via email if we make material changes to this policy. The last updated date is shown at the top of this page.