Privacy Policy
Section 01
Introduction
KreatorHive LLP ("Company", "we", "our", "us") operates the Influight platform at influight.com. This Privacy Policy explains how we collect, use, store, disclose, and protect information when you use the Platform.
By using the Platform, you consent to the practices described in this Policy. If you do not agree, please discontinue use and contact us at info@influight.com to request deletion of your data.
This Policy applies to all users of the Platform including marketing agencies, brands, advertisers, market researchers, and any other business users.
Section 02
Information We Collect
- ·Full name and email address
- ·Company or organization name
- ·Phone number (if provided)
- ·Billing information (via third-party processor — we do not store card details)
- ·Account credentials (passwords stored in hashed/salted form only)
- ·Channels and URLs submitted for analysis
- ·Analysis reports generated and accessed
- ·Search queries and feature usage patterns
- ·Session duration, page views, and clickstream data
- ·Device type, browser, OS, and IP address
- ·Log files and error reports
- ·Channel metadata (name, handle, description, subscriber count, total views)
- ·Video metadata (titles, descriptions, view counts, like counts, comment counts)
- ·Publicly posted comments on YouTube videos
- ·Channel/video thumbnails and publicly available assets
- ·Emails and messages sent to our support team
- ·Feedback or feature requests submitted via the Platform
- ·Records of any formal notices or legal communications
Section 02B
Instagram Data We Collect
When you connect your Instagram Business or Creator account via Instagram OAuth, we collect the following data through the official Instagram Graph API:
- ·Username, display name, and biography
- ·Profile picture URL
- ·Follower count, following count, and media count
- ·Website URL (if provided)
- ·Media posts, reels, and carousels (captions, media type, timestamps)
- ·Engagement metrics (likes, comments count)
- ·Public comments on your media (text, username, timestamps)
- ·Media permalink and thumbnail URLs
- ·OAuth access tokens (long-lived, 60-day expiry)
- ·Token expiration timestamps
- ·Tokens are stored server-side only and never shared
- Automated request through our endpoint at
https://influight.com/api/instagram/data-deletion/while signed in to your Instagram account on Influight (immediate deletion). - Revoke from Instagram under Settings → Apps and Websites → Active; Meta will notify us and we will delete all your data within 30 days.
- Email request to info@influight.com with subject "Instagram Data Deletion Request" — completed within 30 days with confirmation.
Section 03
How We Use Your Information
| Purpose | Data Used | Basis |
|---|---|---|
| Provide the Service — process analysis requests, generate Influence Scores and reports | Account data, YouTube API data, usage data | Contract performance |
| Account Management — authentication, billing, support | Account data, communications data | Contract performance |
| Platform Improvement — analyze usage patterns to improve features | Usage data (aggregated, anonymized) | Legitimate interest |
| AI Model Enhancement — improve analytical models and scoring accuracy | Aggregated, anonymized YouTube data and outputs | Legitimate interest |
| Security — detect and prevent fraud, abuse, and unauthorized access | IP addresses, usage logs, account data | Legitimate interest |
| Legal Compliance — comply with applicable laws and lawful requests | As required by law | Legal obligation |
| Communications — service updates, product announcements | Email address | Consent / legitimate interest |
Section 04
YouTube API Data — Specific Disclosures
4.1 Purpose of Collection
YouTube Data is retrieved solely to provide influencer analytics to our users. We do not sell YouTube Data. We do not use it for advertising. We do not use it for any purpose beyond the analytics services described in this Policy.
4.2 Data Retention of YouTube Data
YouTube-sourced data is cached temporarily to improve Platform performance and reduce API call frequency. Cached data is periodically refreshed to reflect current publicly available information. We do not archive historical YouTube data beyond what is necessary to provide the Service.
4.3 Google's Privacy Policy
Use of the Platform is also subject to Google's Privacy Policy at policies.google.com/privacy. The Platform's use of YouTube API Services is governed by the YouTube API Services Terms of Service.
4.4 No Private Channel Owner Data
We do not request, collect, store, or process any private data belonging to YouTube channel owners or their viewers. All data is limited strictly to publicly available information accessible via the YouTube Data API without any OAuth authentication from channel owners.
Section 04B
Instagram API Data — Specific Disclosures
The Platform integrates with the Instagram Graph API via Instagram Business Login to access and analyze Instagram Business and Creator accounts. This section explains how Instagram data is handled.
4B.1 Purpose of Collection
Instagram Data is retrieved solely to provide influencer analytics to our users — including sentiment analysis, language detection, demographics, and engagement metrics. We do not sell Instagram Data. We do not use it for advertising. We do not use it for any purpose beyond the analytics services described in this Policy.
4B.2 OAuth Authentication & Token Storage
To access Instagram data, users authenticate via Instagram Business Login (OAuth 2.0). We store long-lived access tokens (60-day expiry) server-side in encrypted database fields. Tokens are used exclusively to make authorized API requests on your behalf. You may revoke access at any time from your Instagram account settings.
4B.3 Data Retention of Instagram Data
Instagram profile data and media metadata are cached to improve Platform performance and reduce API call frequency. Comment data and analysis results are retained for the duration of your account subscription. Upon account deletion or data deletion request, all Instagram data including OAuth tokens is permanently deleted within 30 days.
4B.4 Meta Platform Terms
Use of the Platform's Instagram features is also subject to Meta's Instagram Privacy Policy and the Meta Platform Terms.
4B.5 Data Deletion
You may delete all Instagram data associated with your account at any time through any of the following methods:
- Automated deletion endpoint (instant): Send an authenticated
POSTrequest tohttps://influight.com/api/instagram/data-deletion/using the Instagram session token issued to you after Login with Instagram. Only the holder of the Instagram account can trigger deletion of that account's data — the request is rejected if the token does not match the target Instagram user ID. Deletion is performed immediately upon a valid request. - Revoke access via Instagram (Meta-initiated): Visit Instagram Settings → Apps and Websites → Active and remove the Influight app. Meta will send a signed deletion callback to the same endpoint above (verified via HMAC with our App Secret), and we will purge your data within 30 days.
- Email request: Email info@influight.com with subject "Instagram Data Deletion Request". We will confirm completion within 30 days.
In every case we permanently delete your Instagram profile data, cached media metadata, comments, comment analysis results, and stored OAuth tokens. After deletion, your Instagram account cannot be recovered on Influight without re-authorising via Login with Instagram.
Section 05
Confidentiality of Client Analysis Activities
- Keep your identity and analysis activities strictly confidential
- Protect your analysis reports from access by other Platform users
- Notify you promptly of any data breach affecting your account
- Only share your data with trusted service providers bound by confidentiality obligations
- Respond to your data requests within 30 days
- Disclose to any influencer that you analyzed their channel
- Inform any agency or brand that you are a Influight client
- Share your analysis reports with other users
- Sell your personal data or usage data to third parties
- Use your data for advertising targeting
Section 06
How We Share Your Information
We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:
6.1 Service Providers
We work with trusted third-party providers for cloud hosting (GCP — Mumbai region), database services (Supabase — Mumbai region), payment processing, and email delivery. These providers are bound by contractual data protection obligations and may only use your data to provide services to us.
6.2 Legal Requirements
We may disclose information where required by law, court order, regulatory authority, or government request — including under the Information Technology Act, 2000 and applicable rules. We will, where legally permitted, notify you of such a request before complying.
6.3 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, user information may transfer to the successor entity. We will notify you of any such change and ensure the same privacy protections continue to apply.
6.4 With Your Explicit Consent
We may share information when you have given clear, explicit, and informed consent for a specific disclosure.
Section 07
Data Retention
| Data Type | Retention Period |
|---|---|
| Account and registration data | For as long as your account is active, plus 12 months after closure |
| Analysis reports and outputs | For the duration of your account subscription |
| Usage logs and session data | 12 months from the date of collection |
| YouTube-sourced analytics data | Cached temporarily; retained in anonymized/aggregated form indefinitely for model improvement |
| Instagram profile & media data | Cached temporarily; deleted within 30 days of account closure or deletion request |
| Instagram OAuth tokens | Stored server-side until revoked by user or account deletion; auto-expire after 60 days |
| Instagram comment analysis results | For the duration of your account subscription; deleted within 30 days upon request |
| Billing records | 7 years (tax and legal compliance) |
| Communications records | 3 years from last communication |
To request deletion of your data, email info@influight.com. Deletion will be completed within 30 days, subject to any legal retention obligations.
Section 08
Data Security
We implement industry-standard technical and organizational measures to protect your data, including:
- Encrypted data transmission (HTTPS/TLS) for all Platform communications
- Hashed and salted credential storage — we cannot read your password
- Role-based access controls limiting employee access to personal data
- Infrastructure hosted on Google Cloud Platform (Mumbai region) with SOC 2 and ISO 27001 certifications
- Database hosted on Supabase (Mumbai region) with encryption at rest
- Regular security reviews and vulnerability assessments
Section 09
Your Rights
Depending on your jurisdiction and applicable law (including the IT Act 2000 and any applicable data protection regulations), you may have the following rights:
To exercise any of these rights, email info@influight.com. We will respond within 30 days. We may require identity verification before processing your request.
Section 10
Cookies and Tracking Technologies
The Platform uses the following types of cookies:
| Cookie Type | Purpose | Can You Disable? |
|---|---|---|
| Essential / Session | Keeping you logged in, maintaining session state | No — required for Platform to function |
| Preference | Remembering your display settings and preferences | Yes — some features may be affected |
| Analytics | Understanding Platform usage in aggregated, anonymized form | Yes — via browser settings |
We do not use advertising cookies, cross-site tracking cookies, or third-party targeting cookies. You may control cookie settings through your browser preferences. Disabling essential cookies will prevent login and core Platform functionality.
Section 11
Children's Privacy
The Platform is a business tool intended exclusively for commercial users. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. Contact us at info@influight.com if you believe we have collected data from a minor.
Section 12
International Data Transfers
The Platform is operated from India. Our servers are located in Mumbai, India (GCP and Supabase — Mumbai region). If you access the Platform from outside India, your data will be transferred to and processed in India.
By using the Platform, you consent to this transfer. We ensure that appropriate safeguards are in place for any cross-border data transfers, consistent with applicable law.
If you are based in the European Economic Area (EEA) and use the Platform, please contact us at info@influight.com for information about the specific safeguards applicable to your data transfers.
Section 13
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this Policy.
- Send a notification to your registered email address.
- Display a prominent notice on the Platform for at least 30 days.
Your continued use of the Platform after changes are posted constitutes your acceptance of the updated Privacy Policy.
Section 14
Contact Us
For any privacy-related questions, data requests, or to exercise your rights under this Policy:
Website: www.influight.com
Jurisdiction: Bengaluru, Karnataka, India
Response time: Within 30 days of receipt
KreatorHive LLP — Influight · Privacy Policy
Effective 28 March 2026 · v1.0