Privacy Policy

1. Who we are

Cirql is a hyperlocal creator marketplace that connects local Businesses with Creators for marketing campaigns. This policy explains what personal data we collect, why, how we use and share it, and the choices and rights you have. When we decide how and why your personal data is processed, we act as the Data Fiduciary.

2. The information we collect

Depending on how you use Cirql, we may collect:

• Account details — name, email, phone number, password, user type (Business or Creator), and profile information.
• Verification and KYC details — identity documents, business registration/GST details, and information used to verify follower authenticity.
• Social media information — your public profile, handle, audience and engagement data you connect or share.
• Campaign and transaction data — briefs, deliverables, messages, ratings, and records of campaigns.
• Payment information — bank/UPI details for payouts and billing details. Card and payment-instrument data are handled by our payment gateway, Razorpay; we do not store full card numbers.
• Usage and device data — how you use the platform, device and log information, and cookies (see our Cookie Policy).
• Communications — messages you send us and support requests.

We do not knowingly collect data from anyone under 18; Cirql is for adults only.

3. How we use your information

We use personal data to: create and manage your account; verify users and display badges; match Businesses and Creators; enable campaigns, messaging and content exchange; process payments through escrow and pay out to Creators; provide ROI reports and analytics; prevent fraud and misuse; comply with law and tax obligations; provide support; and, where you have consented, send marketing and personalised recommendations.

We rely on your consent for processing that requires it, and on certain legitimate uses permitted by the DPDP Act (for example, where you voluntarily provide data for a specified purpose). You can withdraw consent at any time (see Section 6).

4. When we share your information

We share personal data only as needed:

• Between users — a Business and a matched Creator see the information necessary to run their campaign.
• Service providers (Data Processors) — hosting/cloud, payment gateway and escrow, verification, analytics, and communications providers, under contract and only for the purposes above.
• Legal and safety — where required by law, regulation, or valid legal process, or to protect rights and safety.
• Business transfers — in connection with a merger, acquisition or restructuring, subject to this policy.

We do not sell your personal data.

5. Where your data is stored

We store personal data on servers located in India.

6. Your rights and choices

Under the DPDP Act you have the right to access, correct, complete, update and erase your personal data, to withdraw consent, to nominate another person to exercise your rights, and to grievance redressal. Here is how to exercise them:

• Access / correct / update: Go to Account Settings → Privacy in the app or on the website. If you can't do this through your account, email support@cirql.in.
• Delete your data / close account: Go to Account Settings → Privacy → Delete Account. Some data may be retained where the law requires (see Section 8).
• Withdraw consent: Go to Account Settings → Privacy → Consent preferences to turn off optional processing such as marketing. Withdrawing consent is as easy as giving it and does not affect processing already carried out.
• Nominate someone: Contact us to nominate an individual to exercise your rights in the event of death or incapacity.
• Grievances: Contact our Grievance Officer (Section 10).

7. Consent and marketing preferences

At the point we collect your data we ask for consent separately for each optional purpose (for example, marketing emails, SMS/WhatsApp updates, personalised recommendations, and advertising cookies), with a clear description and unticked boxes. Consent to the core service is required to use Cirql; optional consents are your choice and can be changed any time.

8. How long we keep your data

We keep personal data only as long as needed for the purposes above or as required by law (for example, tax and transaction records). When no longer needed, we delete or anonymise it.

9. How we protect your data

We use reasonable technical and organisational measures to protect personal data, including access controls and encryption in transit. No system is perfectly secure; if a personal data breach occurs, we will notify affected users and the Data Protection Board as required by law.

10. Grievance Officer and Data Protection Board

If you have a privacy concern, contact our Grievance Officer:

We will acknowledge and respond within the timelines in our Grievance Redressal Framework. If you are not satisfied, you may approach the Data Protection Board of India.

11. Changes to this policy

We may update this policy and will post the revised version with a new effective date. Where changes are material, we will provide notice and, where required, seek fresh consent.