Privacy Policy

This Privacy Policy explains how Kolabl (“we”, “us”, “our”) collects, uses, stores, shares and deletes information when you use our website and services (the “Service”) — as a creator, as a brand, or as a visitor. Kolabl is operated from India. You see this policy, linked, before you sign in; continuing past that notice means you have read it.

1. Information we collect

Account information

• From Google Sign-In: your name, email address, profile photo and Google account identifier. We never receive your Google password.
• Profile details you add: bio, tagline, city, niches, languages, content styles, rate card, timezone and notification preferences.
• Brands: your name, work email and company, the briefs you send (goals, budget, niches, platforms, locations, timeline, notes), messages and inquiries you send to creators, and the picks and notes you leave on shortlists.
• The date you agreed to our Terms and which version of these documents you saw.

Information from the platforms you connect

Connecting a platform is optional and read-only: we can read what the platform lets you share with us, and we can never post, comment or message on your behalf. We never receive your platform passwords — you sign in on the platform's own page.

Instagram

When you connect an Instagram Business or Creator account with Instagram Login, we receive only what you authorise through these permissions:

• instagram_business_basic — your username, account ID, profile picture, biography, follower count, media count, account type, and your posts and reels (captions, thumbnails, links and their like, comment and view counts).
• instagram_business_manage_insights — aggregate insights: reach, impressions, engagement, story performance, when your audience is online, and audience demographics (age ranges, gender split, top countries and cities).

We no longer ask for Instagram's comment permission. If you granted it when you connected in the past, we also read the comments on your recent posts, as described for YouTube below.

YouTube (YouTube API Services)

Kolabl uses YouTube API Services. When you connect a YouTube channel with Google, we request two read-only permissions — youtube.readonly and yt-analytics.readonly — and read:

• your channel's ID, name, handle, picture and description, and its subscriber, view and video counts;
• your recent videos (titles, thumbnails, links) and their view, like, comment and share counts;
• YouTube Analytics for your channel: audience age ranges and gender split, top countries and cities, devices, subscriber growth, and views from subscribers versus non-subscribers;
• comments on your recent videos: each comment's text, like count and time, and the commenter's public display name and channel ID. We keep these only for private engagement insights in your own dashboard (such as who engages with you most). Commenters' details are never shown on your public media kit, never shared with brands, and never used to contact the commenter.

By connecting YouTube you also agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Kolabl's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke Kolabl's access at any time from Kolabl (Settings → Connected accounts → Disconnect) or from your Google Account security settings.

TikTok

Kolabl does not currently offer TikTok connections. If you connected a TikTok account while it was available (permissions user.info.basic, user.info.stats and video.list), we hold only its access token and the basic profile and engagement details TikTok shared, until you disconnect it or delete your account — either of which also revokes our access at TikTok. TikTok's own practices are described in its Privacy Policy.

Deal records

• Deals you log yourself (brand, deliverables, amount and currency) and the posts you link to a campaign report.
• Scope-of-work records, deliverables, change requests and issues raised in a deal — see Deal records & scope-of-work acceptance.
• Discount-code redemptions a brand logs against a deal.

Information collected automatically

• Log data: IP address, browser type, pages and API requests, and timestamps — used to run the Service, limit abuse and keep it secure.
• Cookies that keep you signed in, and the one described next. We set no advertising cookies, and no cookie of ours is shared with another company.
• How you found Kolabl. On your first visit we store a small cookie of our own (kolabl_ft, kept for 90 days) holding: the campaign tags on the link you arrived by (utm_source, utm_medium, utm_campaign), a creator's referral code if the link carried one, the first page you opened, and the website that sent you — the domain only, never the page. It holds no identifier, no profile and nothing that could join up your visits, and it is not set on private or link-shared pages. Where you first arrived is never rewritten; the one thing that can change is that if your first visit carried no campaign tags at all and a later Kolabl link does, we fill those in and the 90 days start again from that day. If you go on to create a creator account, it is saved to that account once, at creation, and never updated afterwards; we use it only to understand which channels bring creators to Kolabl. It is not set, not read and nothing is sent when your browser sends Do Not Track or Global Privacy Control, and you can clear it at any time in your browser.
• Media-kit views: a daily view count and the website a visitor came from (the domain only). We do not record who viewed a kit.
• Product analytics (PostHog): anonymous page views and a few named actions (for example “signed in”, “published a kit”, “sent a brief”). No cookies, no profile tied to you, no session recordings, with private links removed from recorded addresses. It does not run when your browser sends Do Not Track or Global Privacy Control.
• Error reports (Sentry): technical details of a failure, such as the page, browser and error message, with sign-in and private-link tokens removed.

What we do not collect: passwords for any platform, your followers' own accounts or activity (only the aggregate figures and, where described above, comments on your own posts), your private messages on any platform, or payment card details — Kolabl does not take payments.

2. How we use your information

• To create and run your Kolabl account and keep it secure
• To build your private analytics dashboard (Studio) and, if you publish one, your public media kit
• To deliver briefs, inquiries, messages and deal records between creators and brands
• To send service emails and notifications (sign-in links, inquiries, deal updates, digests you can turn off)
• To match creators with brand briefs and curated shortlists — only for creators who turn on Brand matching (off by default; see Campaign matching)
• To understand, in aggregate, how the Service is used, and to fix errors
• To detect, investigate and prevent fraud and abuse, and to comply with the law

We do not sell your personal data, and we do not use platform data for advertising or to build advertising profiles.

AI features

Some features for brands (drafting a brief, ranking suggested creators, suggesting an offer) use Google's Gemini AI models. When a brand uses one, we send Google the brand's own input, plus: for creator suggestions, the name, niches, platforms, total follower count and lowest listed rate of creators who have Brand matching turned on; for an offer suggestion, the name, niches and published rates of the creator whose public kit the brand is viewing. We never send creators' email addresses, bios, messages or audience demographics. The models only rank and describe creators our own matching already selected; they never decide who is eligible.

3. How we share your information

We share personal data only in these cases.

Your public media kit (data you choose to publish)

A media kit is a page at a public link (for example kolabl.com/@your-username) that you can send to brands. Publishing one is optional and under your control. If you publish, the information you select becomes visible to anyone with the link: your name, handle, photo and bio; aggregate metrics from your connected accounts (such as follower count, average reach, engagement rate and audience demographics); the rates you set; and posts you choose to feature. You can edit or unpublish it at any time. We never publish your private dashboard, your followers' or commenters' details, or a metric you chose to hide.

Campaign matching (optional, off by default)

If you turn on Brand matching in Settings, our team and the AI features above may consider you when a brand sends a brief, and we may include you in a shortlist shared with that brand. A shortlist can contain your name and handle, a link to your public media kit, aggregate account metrics (follower count, average reach, engagement rate, top audience locations), your niches and your rates. We never share your login credentials, private messages or your followers' details.

You can turn it off at any time, which excludes you from every future shortlist. Shortlists already delivered to a brand are not withdrawn. We record when you change this setting as evidence of your choice.

Founding-creators showcase (optional, off by default)

If you turn on Feature me as a founding creator in Settings, we may show you on Kolabl's public pages (the founding-creators showcase on our landing pages) with your name, handle, photo, niches and total audience figure — as shown on your published media kit — linking to that kit. Only creators with a published public kit are shown.

If you have also set a city and are listed in the creator directory, you are counted towards that city's total on the public creator map. We publish city-level counts only, only for cities on a fixed list, and only once at least five creators share a city. Your city is never shown next to your name. You can turn this off at any time; you leave the showcase as our caches refresh (at most about 10 minutes). We also use the city you saved to choose which campaign-brief emails we send you; it is not shared with brands.

Creator directory (optional, off by default)

If you turn on List me in the public creator directory, your published kit is listed and searchable at /discover, where anyone can filter creators by niche and platform. A listing shows your name, handle, photo, niches and total audience figure, linking to your kit. This is separate from Brand matching and from the showcase: turning one on never turns on another.

Deal records & scope-of-work acceptance

When a creator sends a scope of work through Kolabl, the brand contact reviews it at a private link. If they accept, we record the acceptance as evidence of the agreement: the name they enter, their company's legal name, the date and time, the document's fingerprint (a cryptographic hash), and the IP address and browser signature of the accepting device. Before they accept we tell them that their name, IP address and browser signature will be recorded. If they decline with a note, the note becomes part of the deal record and is shared with the creator.

As a deal progresses we also keep the deliverable links and notes the creator submits, change requests the brand sends, and any issue either side raises — shared with the other party and with Kolabl. If Kolabl mediates, the outcome is recorded and shared with both parties. These records exist so both parties can prove what was agreed; we keep them for as long as either party may need them as evidence of the contract, even after the other party deletes their account. Kolabl does not process payments for any scope of work.

With our service providers

These companies process personal data on our behalf, only to provide their service to us:

• Supabase — database, file storage and authentication (United States, Singapore)
• Microsoft Azure — hosting for our application servers (United States)
• Vercel — website hosting and content delivery (United States, global edge network)
• Google — Google Sign-In, the YouTube APIs, and the Gemini AI models used by the AI features above (United States)
• Brevo — sending our emails: your name, email address and the message content (European Union)
• Sentry — error monitoring (United States)
• PostHog — anonymous product analytics (United States)

Meta (for Instagram) and Google (for YouTube) are also the sources of the platform data you choose to connect; their use of your data is governed by their own policies.

Meta Platform Data

We access Instagram data through Meta's official APIs, and our use of it is governed by Meta's Platform Terms. We do not sell, license or purchase Instagram data, and we pass it to service providers only to run the features described in this policy.

For legal reasons

We may disclose information when the law requires it, in response to a valid legal process, or to protect the rights, safety or property of Kolabl, our users or the public.

4. Your rights and choices

Under India's Digital Personal Data Protection Act, 2023 and other laws that apply to you, you can:

• Access a summary of the personal data we hold about you, what we do with it, and who we have shared it with
• Correct, complete or update it — most of it directly in Settings
• Erase it — see Deletion and our Data Deletion page
• Withdraw consent as easily as you gave it: disconnect a platform, or turn off Brand matching, the showcase or the directory in Settings. Withdrawing does not affect what was lawfully done before.
• Get a copy of your data in a structured, machine-readable format
• Nominate someone to exercise these rights for you if you die or become unable to
• Raise a grievance with our Grievance Officer (below), and if you are not satisfied with our answer, complain to the Data Protection Board of India

To use any of these rights, write to privacy@kolabl.com from the email address on your account.

If you are in the EEA or the UK: we rely on performing our contract with you to run your account and the features you use; on your consent for connecting platforms, Brand matching, the showcase and the directory; on our legitimate interests for security, abuse prevention, error monitoring and anonymous analytics; and on legal obligations where they apply. You may also object to or ask us to restrict processing, and complain to your local data-protection authority.

5. Deletion and retention

• Disconnecting a platform (Settings → Connected accounts → Disconnect) immediately deletes that account's access token and everything we synced from it — profile, posts, metrics, audience demographics, story insights and comments — and revokes our access at Google (YouTube) or TikTok. Instagram offers no revoke step we can call; you can also remove Kolabl in Instagram → Apps and websites.
• Deleting your account (Settings → Danger zone) does the above for every connected platform immediately, signs you out everywhere, and takes your kit and listings offline. The rest of your account — profile, kit settings and preferences — is kept for 30 days so you can change your mind by signing back in (your platforms stay disconnected). After 30 days it is permanently erased.
• Deal records the other party relies on as evidence (an accepted scope of work, its timeline, any dispute, and the inquiry thread) are kept after an account is erased, as described in Deal records.
• The IP addresses stored with briefs and inquiries are deleted after 90 days; used sign-in links a week after they expire.
• Aggregated statistics that cannot identify you (for example, typical engagement in a niche) may remain after deletion.
• Backups roll off within 30 days.

6. Security

We protect your data with encryption in transit (TLS) and at rest (platform access tokens are additionally encrypted by us), access control on a least-privilege basis, and monitoring for errors and abuse. No system is perfectly secure; please tell us straight away at privacy@kolabl.com if you suspect unauthorised access to your account.

7. Where your data is processed

Kolabl is operated from India. Our service providers store and process data in the United States, Singapore, the European Union and other regions where they operate, as listed above. Indian law permits these transfers unless the Government restricts a country, and we will follow any such restriction. For users in the EEA or the UK, transfers out of those regions rely on our providers' standard data-protection terms, including the European Commission's standard contractual clauses where they apply.

8. Children's privacy

Kolabl is not intended for children under 13. We do not knowingly collect information from children. If you believe a child has given us their information, contact privacy@kolabl.com and we will promptly delete it.

9. Changes to this policy

We will post material updates here, change the effective date above, and tell you by email or in the Service when practical. The next time you sign in you will see the updated policy linked before you continue.

10. Contact and Grievance Officer

Privacy questions and requests: privacy@kolabl.com

Grievance Officer, Kolabl
Email: grievance@kolabl.com
Mail: Kolabl, Surat, Gujarat, India

We acknowledge a grievance within 24 hours and resolve it within 15 days of receiving it. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.