Privacy Notice
1. Who we are and how to reach us
ClipMissions is operated by [Registered legal name], [Registered address] ("we" or "us"). We decide why and how your personal data is processed for ClipMissions, which makes us the Data Fiduciary under the Digital Personal Data Protection Act 2023 (the "DPDP Act").
For any question about this notice or your personal data, write to [privacy email]. For complaints, you can also contact our Grievance Officer, [Grievance Officer name], at [grievance email]. The Grievance Redressal and Contact page has full details.
2. The law and the status of this notice
This notice is written to meet the DPDP Act and the Digital Personal Data Protection Rules 2025. The Government notified those Rules in November 2025 and brought the law into force in phases. As we understand the notified schedule, most duties of Data Fiduciaries, including the rules on notice, consent and individual rights, take effect on 13 May 2027. We follow this notice now, as good practice, rather than waiting.
Until the DPDP Act fully replaces it, section 43A of the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 also apply to us, as do the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021. Where these laws differ, we try to follow the stricter rule.
This notice has two parts. Part A covers the ClipMissions website and interest form as they work today. Part B covers the platform once accounts and payouts go live, and does not apply until then. Sections 5 to 11 apply to both parts.
3. Part A: the website and interest form today
At present, the ClipMissions website is an information page with an interest form. There are no user accounts and no payments.
What you give us in the interest form
| Data | Details |
|---|---|
| Role | Whether you are interested as a brand or as a clipper. |
| Name | The name you enter. We store up to 80 characters. |
| Email address | So we can reply. We store up to 120 characters. |
| Note (optional) | Anything you choose to tell us. We store up to 800 characters. Please do not include sensitive information such as bank, health or identity document details. |
What we record with your submission
- the date and time you sent the form; and
- a two-letter country code that Cloudflare, our hosting provider, detects from your network connection. It shows the country only, not your precise location.
We also give each submission a random reference so we can find it again.
What we use briefly to stop abuse
- Rate limiting. When you send the form, our code uses your IP address to create a short-lived record that allows only one submission per minute from the same address. That record contains your IP address, is kept separately from your submission and expires automatically after about two minutes. We do not store your IP address with your submission.
- Bot trap. The form contains a hidden field that people cannot see. Automated bots often fill it in. If it is filled in, we discard the submission without storing it.
- Origin check. Our server accepts form submissions only from pages on our own website. This blocks forged requests and does not involve any personal data.
What our hosting and font providers receive
- Cloudflare. Our website is hosted and delivered by Cloudflare, and form submissions are stored in Cloudflare's Workers KV storage service. To deliver and protect the website, Cloudflare processes technical data about your visit, such as your IP address, browser details and the page requested. Cloudflare may set strictly necessary security cookies, for example to manage bots. See our Cookie Notice.
- Google Fonts. Our pages load fonts from Google's servers. When they load, your browser sends Google your IP address, browser details and the address of the page you are viewing. Google handles this data under its own privacy policy. If we start serving fonts from our own servers, we will update this notice.
What we do not do
- We run no analytics tools, tracking pixels, advertising tags or session recording on the website.
- Our own code sets no cookies and stores nothing in your browser's local storage.
- We do not sell your personal data, rent it out, or share it with anyone for their marketing.
- We do not build profiles of you or make automated decisions about you from the form.
Why we use it and our legal basis
- To reply to you about ClipMissions, including answering your note.
- To plan the launch waitlist, for example to understand how many brands and clippers are interested and from which countries, and to tell you when ClipMissions opens for your role.
- To protect the form from spam and abuse.
We rely on your consent, which you give by sending the form after seeing this notice. The DPDP Act also allows a Data Fiduciary to use personal data that a person has voluntarily provided for a specified purpose, unless that person has said they do not consent. We will not send you newsletters or general marketing unless you separately agree.
Who receives it
- Cloudflare, as our hosting and storage provider, which processes the data on our instructions;
- Google, which receives the font request directly from your browser, as described above;
- the people in our team who need to read and reply to submissions;
- our professional advisers, such as lawyers or accountants, if needed, under a duty of confidentiality; and
- courts, regulators or law enforcement agencies, but only where the law requires us to share it.
Where it is processed
Cloudflare runs a global network, and Workers KV stores data across its network, so your data may be stored and processed outside India. Google's servers are also located around the world. The DPDP Act allows personal data to be transferred outside India except to countries the Government restricts by notification. We will follow any such restriction.
How long we keep it
- Interest form submissions: [retention period for interest form data], or sooner if you ask us to delete them.
- The rate-limiting record with your IP address: about two minutes, after which it expires automatically.
- Technical data processed by Cloudflare and Google: as set out in their own policies.
4. Part B: the platform, once accounts and payouts go live
This part applies only once ClipMissions opens accounts and starts Missions and payouts. Before then, we will update it, give you a clear notice at sign-up and ask for your consent where the law requires. It is published now so you can see in advance what we will need and why.
What we will collect
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email, phone number, role, password (stored in protected form), language, city or state, confirmation that you are 18 or over | To create and run your account and contact you about it |
| Social media details | Your declared handles, profile links, follower counts, the post links you submit | To verify account control, review Submissions and report to Brands |
| Performance evidence | View counts, insights screenshots or recordings showing views, audience location, age bands and traffic sources | To count Verified Views and detect artificial views |
| Payout details | UPI ID, account holder name, bank account details where needed, payout history | To pay Clipper Fees to an account in your own name |
| Tax details | PAN, name as per PAN, PAN status, tax deducted, GSTIN and address if you are GST-registered | To deduct and report tax at source, issue certificates and handle GST, as the law requires |
| Identity checks | Matching your name across PAN, UPI and bank records; age confirmation; any identity document we ask for after telling you why | To prevent fraud, confirm you are 18 or over and pay the right person |
| Fraud and security signals | Device type, operating system, browser, IP addresses, login times, account history, links between accounts, submission and view patterns | To keep the platform secure and enforce the Fair Play and Anti-Fraud Policy |
| Support and grievance records | Messages, complaints, appeals and our replies | To help you, resolve complaints and keep the records the law requires |
| Brand billing details | Business name, contact person's name, email and phone, billing address, GSTIN, PAN, payment records, Mission Orders and invoices | To agree Missions, invoice correctly, receive payments and process refunds |
We will never ask for your Aadhaar number. If a document you share with us shows it, please mask all but the last four digits first. We will ask for an identity document only when we genuinely need it, and we will tell you why at the time.
Passwords and financial information such as bank account and payment details are "sensitive personal data or information" under the 2011 rules mentioned in section 2. While those rules apply, we will collect them only with your consent given in writing, which includes electronic consent.
Our legal basis
We will rely on your consent for most processing in Part B, and on the legitimate uses the DPDP Act allows, including data you voluntarily provide for a specified purpose, data we must disclose to the Government under a legal duty (for example tax deducted at source and its reporting), and compliance with court orders and judgments.
Who will receive it
- Brands, for Missions you take part in: your public handle, post links, Verified View counts, disclosure status and, when needed to support a count, your evidence with unneeded details removed. Brands never receive your PAN, bank or UPI details, identity documents or contact details unless you choose to share them.
- Banks and regulated payment service providers that send payouts or receive payments: the details needed to make or receive the payment.
- Tax authorities: PAN, amounts paid and tax deducted, and GST invoice details, as the law requires.
- Service providers working for us, such as hosting, storage, email, customer support and PAN or bank verification services. They may use the data only on our instructions.
- Professional advisers, such as chartered accountants, auditors and lawyers, under a duty of confidentiality.
- Social media platforms, only when we report fraud or infringement, and only what is needed for the report.
- Government bodies, if the law requires registration of platform workers or other reporting.
- Courts, regulators and law enforcement agencies, when the law requires it.
- A successor business, if ClipMissions is transferred to another entity, which must protect your data as this notice describes. We will tell you before this happens.
How long we will keep it
- Account data: while your account is open, and for [account data retention after closure] after you close it, unless a longer period applies below.
- Registration information: for at least 180 days after your account is closed, as the IT Rules require.
- Information we removed or disabled because it was unlawful: for at least 180 days, or longer if a court or lawful authority requires, as the IT Rules require.
- Tax, GST and accounting records, including payouts, invoices and PAN: for as long as tax, GST and company law require, which is usually several years.
- Fraud and enforcement records: for [fraud record retention], so we can prevent repeat fraud.
When a retention period ends, we will delete the data or make it anonymous so it can no longer identify you.
Automated checks and human review
We will use automated pattern checks to flag Submissions or accounts that may involve artificial views or fraud. A person will review the case before we make a final decision to reject a Submission, recover a payout or suspend an account. You can ask us to explain a decision and to have it reviewed by someone else, using the appeal route.
Showcasing Clips
We may show public Clips on our website and in presentations about ClipMissions, with credit to the Clipper's handle, as the Clipper Terms allow. Clippers can ask us to stop showcasing their Clips.
5. Security
We use reasonable security practices suited to the data we hold. These include encrypted connections to our website, limiting access to personal data to people who need it, keeping payout and tax data to the minimum needed, and using reputable providers. When payouts start, they will be made through banks or regulated payment service providers.
No system is completely secure. If you think your data or account is at risk, contact us straight away at [privacy email].
6. If a personal data breach happens
If a personal data breach affects you, we will tell you without undue delay, in clear language. We will explain what happened, the likely consequences, what we are doing about it, what you can do to protect yourself and whom to contact. We will report the breach to the Data Protection Board of India as the DPDP Act and Rules require once those duties apply, and to CERT-In where its directions require. We will keep a record of every breach and how we handled it.
7. Your rights
You have the following rights over your personal data. We will honour them now, even before the relevant provisions of the DPDP Act come into force.
- Access. Ask for a summary of the personal data we hold about you, how we use it, and the others we have shared it with.
- Correction and updating. Ask us to correct inaccurate or misleading data, complete incomplete data or update it.
- Erasure. Ask us to delete your data. We will do so unless we must keep it to meet a legal duty, such as tax records, or to finish something you asked us to do.
- Grievance redressal. Complain to us about how we handle your data, and get a response within the times below.
- Nomination. Name another person to exercise your rights if you die or become unable to do so.
- Withdraw consent. See section 8.
How to use your rights
Email [privacy email] from the address you gave us, or once accounts exist, use your account settings. We may ask for reasonable information to confirm it is you, so that we do not give your data to someone else. We do not charge for this.
We will acknowledge your request within 24 hours and aim to complete it within 7 days. If a request is complex, we will tell you within those 7 days what else we need and when we expect to finish, and we will always finish within the time the law allows.
Your duties
The DPDP Act also expects you to give accurate information, not to impersonate anyone, and not to make false or frivolous complaints.
8. Withdrawing consent
You can withdraw your consent at any time, as easily as you gave it. Email [privacy email] and say what you want to withdraw. For the interest form, a short message such as "please delete my interest form details" is enough.
When you withdraw consent, we will stop the processing that relied on it and delete the data within a reasonable time, unless the law requires us to keep it. Withdrawal does not make earlier processing unlawful. Once accounts and payouts exist, withdrawing consent to essential data, such as payout or tax details, may mean we cannot continue to pay you or provide the Services, and we will tell you if that is the case.
9. Children
ClipMissions is only for people aged 18 or over. Under the DPDP Act, a child is anyone under 18. We do not knowingly collect personal data from children, and we do not track or target advertising at children.
If we learn that we hold data from someone under 18, we will delete it and close any account. If you are a parent or guardian and think your child has given us their details, please contact [privacy email].
10. Complaints and the Data Protection Board
If you are unhappy with how we handle your personal data, please contact our Grievance Officer, [Grievance Officer name], at [grievance email]. We will acknowledge your complaint within 24 hours and resolve it within 7 days, as explained on the Grievance Redressal and Contact page.
If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner it prescribes, once the relevant provisions of the DPDP Act are in force. The Act expects you to use our grievance process first. For matters under the IT Rules, you may also appeal to the Grievance Appellate Committee, as explained on the grievance page.
11. Changes to this notice
We will update this notice when our practices change, and in any event before accounts and payouts go live. We will change the "Last updated" date each time. If a change materially affects how we use data we already hold, we will tell you directly where we can and, where the law requires, ask for your consent again.