Privacy Policy

XclusiveContent (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy describes how we collect, use, share, and safeguard your information when you use the XclusiveContent platform (“Platform”).

This Policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. By using the Platform, you consent to the data practices described in this Policy.

2.1 Data you provide directly:

• Name, display name, and username
• Email address and password (hashed — we never store plaintext passwords)
• Profile photo and bio
• UPI ID or bank account details (for creator payouts)
• Identity verification documents (if required for age or KYC verification)
• Content you upload (photos, videos, text)
• Messages sent via the Platform's DM system

2.2 Data collected automatically:

• IP address, device type, browser type, and operating system
• Pages visited, features used, and time spent on the Platform
• Transaction data including amounts paid, timestamps, and UPI reference numbers
• Log data and error reports
• Cookies and similar tracking technologies (see Section 7)

2.3 Data from third parties:

• If you register via Google OAuth, we receive your name, email address, and profile photo from Google as permitted by your Google account settings.
• Payment processors may provide us with transaction status and fraud risk signals.

We process your personal data for the following purposes:

• To create, maintain, and secure your account
• To facilitate subscription payments and creator payouts via UPI
• To display your content to your subscribers
• To send transactional emails (account verification, payment receipts, security alerts)
• To enforce our Terms of Service and Creator Guidelines
• To detect and prevent fraud, abuse, and illegal activity
• To comply with legal obligations under Indian law, including court orders and law enforcement requests
• To improve the Platform through aggregate usage analytics
• To communicate Platform updates, feature announcements, and policy changes

We do not sell your personal data to third parties for marketing purposes.

Under the DPDP Act, 2023, we process your data on the following lawful bases:

• Consent: You provide consent when you register and accept these policies.
• Contract: Processing is necessary to fulfil our agreement with you (e.g., processing payments, delivering content).
• Legal obligation: We may be required to process or disclose data to comply with Indian law, court orders, or law enforcement.
• Legitimate interest: Platform security, fraud prevention, and product improvement, where these interests are not overridden by your rights.

We share your data only in the following circumstances:

• Service providers: We use Supabase (database and authentication infrastructure) and UPI payment processors. These providers process data solely on our behalf under data processing agreements.
• Law enforcement: We will disclose data when required by a valid court order, subpoena, or legal process under Indian law, or where we reasonably believe disclosure is necessary to prevent imminent harm, fraud, or illegal activity.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different Privacy Policy.
• With your consent: In any other case, we will ask for your explicit consent before sharing.

We do not share your private messages or personal contact details with other users without your explicit consent.

We retain your personal data for as long as your account is active or as needed to provide services:

• Account data is retained for the duration of your account plus 3 years after deletion for legal compliance.
• Transaction records are retained for 7 years as required by Indian financial regulations.
• Content you delete is removed from public display immediately but may persist in backups for up to 90 days before permanent deletion.
• If your account is terminated for a policy violation, we may retain records indefinitely for fraud prevention and legal purposes.

We use cookies and similar technologies (local storage, session tokens) to:

• Authenticate your session and keep you logged in
• Remember your preferences
• Protect against CSRF attacks
• Measure Platform usage through anonymised analytics

We do not use third-party advertising cookies. You can disable non-essential cookies in your browser settings, though this may affect Platform functionality.

As a data principal under the DPDP Act, 2023, you have the right to:

• Access: Request a summary of your personal data that we hold.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Grievance redressal: Lodge a complaint with our Grievance Officer (see Section 11) or with the Data Protection Board of India.
• Nomination: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email us at privacy@xclusivecontent.in with your registered email address. We will respond within 30 days.

We implement industry-standard technical and organisational measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Bcrypt hashing for all passwords
• Row-level security on our database
• Signed URLs with expiry for all private media access
• Regular security audits and vulnerability assessments
• Strict access controls — only authorised personnel can access production data

Despite these measures, no system is completely secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities as required by law within 72 hours of becoming aware.

The Platform is strictly for users aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we have collected data from a minor, we will immediately delete that data and terminate the associated account. If you believe a minor has registered, please contact us at safety@xclusivecontent.in.

As required under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, we have appointed a Grievance Officer:

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a prominent notice on the Platform at least 14 days before the changes take effect. Your continued use of the Platform after the effective date constitutes your acceptance of the updated Policy.

For any privacy-related questions, contact us at privacy@xclusivecontent.in.