Privacy Policy

Effective date: 1 October 2026 · Last updated: 1 October 2026

1. Who we are

Blackcoffee Creator Network (the “Platform”) is owned and operated by Blackcoffee Media LLP, a limited liability partnership registered in India (LLPIN: AAT-1710) with its office at Blackcoffee Media LLP, 2nd Floor, Plot 264-265, WeWork Vaswani Chambers, Dr Annie Besant Road, Shivaji Nagar, Worli, Mumbai, Maharashtra 400030, India (“BCM,” “we,” “us” or “our”). The Platform is available at ugc.blackcoffee.media and connects content creators (“Creators”) with brands and businesses (“Brands”) for user-generated content engagements (“Mandates”).

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), BCM is the Data Fiduciary. For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), BCM is the controller of your personal data.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have. It applies to visitors to the Platform, Creators, and Brands and their authorised representatives (together, “you”). It should be read together with our Terms of Use.

2. Your consent

By creating an account or using the Platform, you confirm that you have read this Privacy Policy. Where we rely on your consent, we will ask for it through a clear notice and affirmative action (for example, a checkbox at sign-up or a cookie banner). You may withdraw consent at any time as described in Section 10. Withdrawal does not affect processing that took place before it.

3. Information we collect

3.1 Information you give us

Creators:

Identity and contact details: full name, display name, email address, phone number, date of birth (for age verification), city and country, and profile photograph.
Profile details: bio, content categories and niches, languages, gender (optional), portfolio samples, rate cards and past brand collaborations.
Social media details: handles and profile URLs for Instagram, YouTube and other platforms you list.
Verification and tax details: PAN, GSTIN (where applicable), and a government-issued ID for identity verification. Where you provide Aadhaar, we only accept a masked version showing the last four digits.
Payment details: bank account number, IFSC, account holder name and UPI ID, collected so that Brands can pay you directly for Mandates and for tax compliance.

Brands:

Business details: legal entity name, brand names, PAN, GSTIN, CIN or LLPIN, registered address, website and industry.
Representative details: names, designations, business email addresses and phone numbers of the people who use the Platform on the Brand’s behalf.
Mandate details: briefs, deliverables, timelines, budgets, target audience descriptions, product information and usage terms.

All users: messages and files exchanged on the Platform, feedback, support requests, survey responses and any other information you choose to submit.

3.2 Information from connected social media accounts

If a Creator connects a social media account (such as Instagram or YouTube) through the official API of that platform, we collect profile information, follower and subscriber counts, engagement metrics, aggregated audience demographics, and metadata and performance data for published content. We only access what you authorise on the connection screen.

Our use of YouTube data is governed by the YouTube Terms of Service and the Google Privacy Policy. You can revoke our access to your Google account at any time at security.google.com/settings/security/permissions. You can also disconnect any account from your Platform settings.

3.3 Information we collect automatically

When you use the Platform we collect device and usage data, including IP address, browser type, operating system, device identifiers, pages viewed, referring URLs, date and time of access, approximate location derived from IP address, and cookie and pixel identifiers. See Section 6 for details on cookies.

3.4 Information from third parties

We may receive information about you from publicly available social media profiles, identity and business verification providers, analytics and advertising partners, and people who refer you to the Platform.

4. How we use your information

Purpose	Data used	Basis
Creating and managing your account	Identity, contact, profile details	Performance of our agreement with you; legitimate use under DPDP Act
Vetting and verifying Creators and Brands before approval	Identity, verification, business and social data	Legitimate interests; legal obligation; consent
Matching Creators with Mandates and displaying profiles to approved Brands	Profile, social and performance data	Performance of our agreement; consent
Running Mandate workflows: briefs, applications, submissions, revisions and approvals	Mandate data, messages, files	Performance of our agreement
Enabling Brands to pay Creators directly and meeting tax requirements	Payment and tax details	Consent; legal obligation
Considering Creators for campaigns that BCM runs for its own clients outside the Platform	Profile, social and performance data	Consent
Sending opportunities, newsletters and marketing from BCM	Contact details, preferences	Consent (you can opt out at any time)
Showcasing Mandate content in BCM promotional material, as set out in the Terms of Use	Content, name, likeness, handle	Contract (licence under Terms of Use)
Security, fraud prevention and detecting fake engagement	Usage, device, social data	Legitimate interests; legal obligation
Analytics, advertising and improving the Platform	Usage and cookie data	Consent for non-essential cookies; legitimate interests
Complying with law, responding to lawful requests and enforcing our terms	Any relevant data	Legal obligation; legitimate interests

We do not use your personal data for automated decisions that produce legal or similarly significant effects on you. Our vetting decisions involve human review.

5. How we share your information

With other users. Approved Brands can view Creator profiles, social data and performance metrics. When a Brand selects a Creator for a Mandate, the Brand receives the contact, tax and payment details reasonably needed to engage and pay that Creator. Creators can view Brand and Mandate details for Mandates they are eligible for.
With BCM’s clients. Where you have consented, we may share Creator profiles with BCM’s agency clients for campaigns run outside the Platform.
With service providers. We use vendors for hosting, cloud storage, email, CRM, analytics, identity verification and customer support. They process data on our instructions and under contractual confidentiality and security obligations.
With advertising and analytics partners, through cookies and pixels, as described in Section 6.
For legal reasons. We may disclose information to comply with law, court orders or requests from government authorities, or to protect the rights, property or safety of BCM, our users or the public.
In a business transfer. If BCM is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the successor, subject to this Privacy Policy.

Brands that receive Creator personal data are independently responsible for handling it lawfully and only for the relevant Mandate.

We do not sell personal data for money. Our use of advertising cookies and pixels may be treated as “sharing” or “selling” under certain US state privacy laws. You can opt out as described in Sections 6 and 10.

6. Cookies and similar technologies

We use cookies, pixels and similar technologies in the following categories:

Strictly necessary: required for login, security and core Platform functions. These cannot be switched off.
Functional: remember your preferences and settings.
Analytics: help us understand how the Platform is used (for example, Google Analytics).
Advertising: measure and improve our marketing (for example, Meta Pixel and LinkedIn Insight Tag).

Where required by law, we ask for your consent before setting non-essential cookies. You can change your choices through our cookie settings or your browser. We honour Global Privacy Control signals where required by law. Blocking some cookies may affect how the Platform works.

7. International data transfers

The Platform serves users globally. Your data may be stored and processed in India and in other countries where we or our service providers operate. When we transfer personal data out of the European Economic Area or the UK, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. We will not transfer personal data to any country restricted by the Government of India under the DPDP Act.

8. How long we keep your information

Account and profile data: for as long as your account is active, and up to 3 years after closure to handle disputes and enforce our terms.
Verification, tax and payment details: for as long as required under applicable tax, accounting and LLP laws, typically up to 8 years.
Connected social media data: refreshed periodically while connected, and deleted within 30 days of disconnection or revocation of access, unless we are legally required to keep it.
Server and security logs: at least 180 days, as required under Indian cybersecurity directions.
Email delivery records and campaign activity history: email records for 12 months and campaign activity for 24 months, then deleted automatically.
Marketing data: until you withdraw consent or unsubscribe.
Mandate content: as required under the Terms of Use, including BCM’s promotional licence.

When data is no longer needed, we delete or anonymise it.

9. Security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, restricted access to verification and payment details, and vendor due diligence. No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India, relevant supervisory authorities and affected users as required by law.

10. Your rights

All users have the right to:

access a summary of the personal data we process about you and the processing activities;
correct, complete or update inaccurate or incomplete personal data;
request erasure of your personal data, subject to legal retention requirements;
withdraw consent at any time;
nominate another person to exercise your rights in the event of your death or incapacity; and
have your grievances addressed by our Grievance Officer.

Users in the EEA and UK also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority.

Users in California and other US states with privacy laws also have the right to know what personal data we collect and disclose, to opt out of the “sale” or “sharing” of personal data and targeted advertising, and not to be discriminated against for exercising these rights.

To exercise any right, email sid@blackcoffee.media. We may need to verify your identity before acting on a request. We respond within the time required by applicable law, generally within 30 days. If you withdraw consent or ask us to erase data we need to provide the Platform, we may have to close your account.

11. Age restriction

The Platform is only for people aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it and close the account.

12. Third-party links and services

The Platform may link to or integrate with third-party websites and services, including social media platforms. Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on the Platform with a revised “Last updated” date. For material changes, we will notify you by email or through the Platform before they take effect.

14. Grievance Officer and contact

In accordance with the Information Technology Act, 2000, the rules made under it and the DPDP Act, our Grievance Officer is:

Siddarth Padmanabhan
Email: sid@blackcoffee.media
Address: Blackcoffee Media LLP, 2nd Floor, Plot 264-265, WeWork Vaswani Chambers, Dr Annie Besant Road, Shivaji Nagar, Worli, Mumbai, Maharashtra 400030, India

We will acknowledge your grievance within 24 hours and aim to resolve it within 15 days of receipt. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India or, if applicable, your local data protection authority.