Privacy Policy

1. Who and what this Policy covers

This Policy applies to personal information relating to:

• website visitors and people who join our creator or brand waitlist;
• current, former, and prospective creator and brand customers, their team members, and their representatives;
• visitors to creator profiles, portfolios, media kits, booking pages, and Superlinks published through Creonnect;
• people who comment on or message an Instagram professional account that its owner has connected to Creonnect;
• people who communicate with us for support, partnerships, feedback, grievances, or other enquiries; and
• job applicants who apply through a linked form or by email.

A creator or brand that connects an Instagram professional account chooses which account to connect, which Creonnect features to use, and which comment or messaging automations to configure. For information about that account's commenters and message participants, Creonnect processes the information to provide tools to the connected account holder and also processes limited information for security, compliance, and service operation. A commenter or message participant may contact the connected account holder or us about that information.

This Policy does not govern a third-party website, app, payment page, social platform, or creator link after you leave Creonnect. That third party's own privacy notice applies.

2. Information we collect

The information we collect depends on how you interact with the Services and which features you use.

A. Account, profile, and contact information

We may collect your name, username or handle, email address, phone number, role, company, profile image, biography, location or service area, social links, account preferences, and authentication identifiers. We process passwords or other credentials only in the form needed by the relevant authentication system; we never ask for or store your Instagram password.

We also maintain communications and support records, including the content of messages you send us, our replies, and information reasonably needed to verify and resolve a request.

B. Creator, brand, and workspace information

Depending on the features used, this may include creator portfolios and media kits, audience and performance information, collaboration preferences, service or product listings, availability, campaign briefs, creator shortlists, proposals, deliverables, approval records, contracts, workspace messages, transaction status, and other content that a creator or brand submits or creates in the Services.

Information entered in a shared campaign or collaboration workspace may be visible to the creator, brand, or authorised team members participating in that workspace.

C. Payments, payouts, and verification

If paid, escrow, or payout features are available and used, Razorpay and other relevant financial or verification providers may collect payment instrument, bank, billing, tax, identity-verification, or know-your-customer information directly. Creonnect may receive transaction identifiers, status, amount, limited billing or payout details, verification results, invoices, and information needed for accounting, disputes, fraud prevention, or legal compliance. We do not need your complete card credentials to provide the normal Creonnect interface.

D. Waitlist and marketing information

When you join the waitlist, we collect your email address, whether you are a creator or brand, social handle or company name, the priorities or free-text response you submit, your choice about product updates, IP address, device type, and submission time. We use this to manage early access, prevent duplicate or abusive submissions, send a confirmation, understand demand, and send optional product news where you have chosen to receive it.

You may withdraw from optional marketing at any time by using an unsubscribe method in the communication, where available, or by emailing hello@creonnect.com. We may still send non-promotional messages that are necessary to respond to you or provide a service you requested.

E. Recruitment and other communications

If you apply for a role through a Google Form, email, or another application channel linked from our careers pages, we may receive the details you provide, such as your name, contact details, resume, portfolio, employment and education history, work eligibility, responses to application questions, interview notes, and communications. Google or another form provider separately processes information you submit through its service under its own terms.

F. Instagram and Meta Platform Data

When an authorised account holder connects an Instagram Business or Creator account through Meta's official authorisation flow, Creonnect may receive the following information, to the extent made available by Meta and needed for enabled features:

• Professional account and media data: Instagram-scoped account and media identifiers, username, name, profile picture, biography, account type, media captions and URLs, media type, permalink, publication time, and related metadata.
• Insights: account- and media-level reach, impressions, views, engagement, follower, audience, and other metrics that Meta makes available for that account.
• Comments: comment identifiers, media identifiers, commenter Instagram-scoped identifiers and usernames, comment text or attached media, timestamps, replies, and moderation or automation status.
• Messaging: Instagram-scoped participant and conversation identifiers, usernames where made available, message text, attachments, reactions or replies, timestamps, and delivery or read status needed to display conversations and operate configured responses.
• Connection and automation data: access tokens and their status, permission grants, webhook events, connected-account status, automation keywords, reply content, rules, opt-out signals, and delivery, error, or audit events.

We obtain this information through Meta's APIs and webhook notifications—not by asking for an Instagram password or scraping private Instagram pages. Meta independently processes Instagram information under Meta's own terms and privacy policy.

G. Public profile and Superlink information

A creator can choose to publish information such as their display name, image, username, biography, portfolio, social links, audience or performance highlights, past partnerships, testimonials, offerings, public contact email, and external links. Once published, anyone can view or copy it, and search engines or other third parties may index or cache it. A creator should publish only information they are comfortable making public.

For the safe delivery of public pages and link redirects, we receive routine request information such as IP address, date and time, requested page or link, browser or device information, and error or security signals. If a visitor accepts optional Superlink analytics, we may also record a pseudonymous session identifier and associate page visits or link and banner redirects with the referring page and campaign parameters such as utm_source, utm_medium, and utm_campaign. This optional information is used to give the publishing creator aggregated performance and attribution reporting. Declining optional analytics does not prevent access to the public page or external destination.

H. Website, device, cookie, and analytics information

Our servers and essential technologies may process IP address, browser and device type, operating system, language, requested page, referring URL, date and time, session or security identifiers, consent preferences, error logs, and interactions needed to deliver, protect, and troubleshoot the Services.

If you accept optional analytics, Google Analytics may process cookie or device identifiers and information about pages viewed, events, referrer, browser, device, and approximate location derived from network information. We configure analytics storage as optional, deny advertising storage and advertising personalisation through consent settings, and enable IP anonymisation. We do not use Google Analytics to run cross-site targeted advertising.

We also use Microsoft Clarity to understand how visitors interact with our website through behavioral metrics, heatmaps, and session replay to improve platform usability and user experience. Clarity captures site usage data using first-party cookies and tracking technologies. Sensitive input fields, payment details, and passwords are masked by default. We configure Clarity with advertising storage denied (ad_Storage: "denied") so that session data is not used for advertising, marketing profiling, or cross-site tracking. For more details on how Microsoft processes this data, visit the Microsoft Privacy Statement.

I. Optional AI feature information

If you allow and use an AI feature — such as Account Analysis, post analysis, Post Ideas, Script Studio, the Image Editor, or Showcase and Superlink AI — we process the content that feature needs: for analysis and ideas, your connected Instagram account's profile, posts, captions, and insights; otherwise, the prompt, instructions, text, and images you choose to submit. We also keep the generated output and limited technical records needed to provide and secure the feature. AI features are optional and are not required to connect an Instagram account. Section 9 explains who receives this information.

3. Where information comes from

We collect information:

• from you, when you create an account, join the waitlist, publish a profile, configure a feature, make a payment, apply for a job, or communicate with us;
• from an organisation or user you work with, such as a brand administrator who invites a team member or a campaign participant who adds information to a shared workspace;
• from Meta, when an authorised Instagram professional account is connected and sends API or webhook data;
• automatically, from browsers, devices, cookies, local or session storage, server requests, and product activity, subject to the choices described below; and
• from service providers, such as payment status from Razorpay, email delivery status from Google, or security and hosting events from our infrastructure providers.

4. Why we use information

We use personal information only for a stated or reasonably related purpose, including to:

• create, authenticate, administer, and support accounts and workspaces;
• provide creator profiles, Superlinks, media kits, analytics, collaborations, campaigns, payments, and other requested features;
• connect Instagram accounts and provide only the Meta-enabled feature the account holder selects;
• display and manage comments, deliver configured Instagram responses, handle recipient opt-out signals, and show delivery status;
• process payments and payouts, maintain financial records, and handle refunds or disputes;
• operate the waitlist, provide early access, and send optional product communications;
• provide optional AI-generated results in response to a user's instruction;
• understand and improve service performance and user experience, using optional analytics only after the relevant choice;
• detect spam, fraud, misuse, security incidents, and breaches of our Terms or Meta's rules;
• answer support, privacy, legal, recruitment, partnership, and grievance enquiries;
• enforce agreements, establish or defend legal claims, and comply with lawful obligations or requests; and
• prepare for, evaluate, or complete a corporate financing, merger, acquisition, reorganisation, or transfer, subject to appropriate confidentiality and applicable law.

Depending on the context and law that applies, we process information with your permission or consent, to provide a service or perform an agreement you requested, for a permitted and proportionate operational or security purpose, or to comply with law. Where consent is the basis, you may withdraw it prospectively, although this may prevent the affected feature from working.

5. Meta permissions and their limited purposes

Creonnect requests the following permissions for the Instagram API with Instagram Login. The exact data available remains controlled by Meta, the connected account type, the permissions granted, and the feature used.

We do not request these permissions to access an Instagram password, unrelated private accounts, or information Meta does not make available through the approved API. We do not sell Meta Platform Data, use it for off-platform advertising, build profiles of message or comment participants for advertising, or use it for surveillance or eligibility decisions.

6. Instagram comments, messages, and Auto DM

The connected account holder controls its automation rules and message content and is responsible for using them lawfully and respectfully. Creonnect sends messages only through Meta's official API and subject to Meta's then-current rate, content, permission, and timing rules.

Meta applies different rules to different conversation paths:

• User-initiated conversation: when an Instagram user starts or continues a conversation with the connected professional account, ordinary automated replies must be responses permitted within Meta's standard messaging window, generally 24 hours after the user's message.
• Comment-triggered private reply: a configured automation may send one private reply to a person who comments on eligible professional-account media within seven days after the comment. For Instagram Live, the reply must be sent while the live broadcast is active. Follow-up messages may be sent only if the recipient responds, after which Meta's standard 24-hour response window applies.

Creonnect does not treat a comment as permission for an unlimited message sequence. Connected account holders must not use the Services for spam, harassment, prohibited content, or attempts to bypass Meta's rules. Where Creonnect supports opt-out keywords or receives a clear opt-out, the relevant configured promotional automation must stop for that recipient. Recipients can also use Instagram's native block, restrict, delete, and report controls.

7. Public pages, collaboration visibility, and visitor analytics

A creator decides whether to publish a Creonnect profile or Superlink and which available fields are public. The creator can unpublish or edit the page through available account controls or by contacting us. Removing a page from Creonnect does not immediately remove copies previously indexed, cached, downloaded, or shared by others; requests about third-party copies must be directed to those third parties.

Brands and creators participating in a collaboration may see the profile, campaign, communication, deliverable, approval, and transaction information needed for that collaboration. We do not make private workspace information public merely because another profile field is public.

Anyone viewing a creator's public page in the Creonnect app can report it or block that creator. A report sends us the page, the reason chosen, and the reporter's contact email so we can review it; we review reports within 24 hours and may remove content or suspend an account that breaks our Terms. Blocking is stored on the reporter's device and is not shared with the blocked creator.

A link or banner redirect still processes the requested creator and link identifiers, together with routine request information, to send the visitor to the selected destination and protect the service. Pseudonymous session-based visit and attribution analytics are collected only after the visitor accepts analytics. The publishing creator receives reporting intended to be aggregated or pseudonymous and is not given a visitor's raw IP address through ordinary analytics dashboards.

8. Cookies and your analytics choices

We use two categories of browser technology:

• Strictly necessary technology supports page delivery, sign-in, security, load balancing, fraud prevention, and storage of your privacy preference. Blocking it may prevent parts of the Services from working.
• Optional analytics technology helps us and publishing creators understand visits, feature usage, and session-based link attribution. This includes Google Analytics and optional Superlink analytics. We do not activate it until you choose to accept analytics through our consent control.

You can accept or decline optional analytics through the privacy control displayed on the site and later change that choice through Privacy choices. You may also delete or block cookies and site storage in your browser. Withdrawing consent stops future optional analytics on that browser; it does not automatically delete reports already lawfully created, so contact us if you also want to request deletion.

We do not currently use advertising cookies or sell browsing activity for cross-context behavioural advertising.

9. AI processing and safeguards for Meta data

AI features are optional. In the Creonnect mobile app, nothing is sent to an AI provider until you allow AI features on the screen shown before the first AI feature runs, and you can turn them off at any time in Settings → AI features. On the web, an AI feature runs only when you start it.

When you start an AI feature, we send the content that feature needs to our AI providers, only to produce the result you asked for, operate safety controls, and troubleshoot the feature:

• Account Analysis and post analysis: your connected Instagram account's profile, posts, captions, and insights.
• Post Ideas: your recent posts, captions, and their performance, and any instructions you give.
• Script Studio, Showcase AI, and Superlink AI: the text, ideas, and instructions you write.
• Image Editor: the photo you choose to edit and your instructions.

Our current AI providers are OpenAI, Microsoft (Azure OpenAI Service), Google (Gemini API), and OpenRouter, which passes a request to the model provider it selects. AI output may be inaccurate and should be reviewed before use.

We never send Instagram access tokens or passwords to an AI provider. Creonnect does not use Meta Platform Data to train a general-purpose or shared model, and we do not use AI results derived from it for advertising. Where a provider offers the option, we configure it so that submitted data is not used to train its models or for its own advertising, and is kept only for limited safety and abuse monitoring under that provider's terms.

10. When and with whom we disclose information

We do not sell or rent personal information or Meta Platform Data. We disclose only the information reasonably necessary for the relevant purpose to:

• Supabase, for managed database and related backend services, including waitlist storage where used;
• Meta, to authenticate connected Instagram accounts and exchange API requests, webhook events, comments, messages, and status required for enabled Instagram features;
• Google, for optional Google Analytics, Gmail or Google Workspace email delivery, and recruitment forms where used;
• Microsoft, for Microsoft Clarity website analytics, heatmaps, and session replay to improve user experience;
• Razorpay and financial or verification partners, for payments, payouts, refunds, fraud checks, and identity or KYC verification where those features are used;
• OpenAI, Microsoft (Azure OpenAI Service), Google (Gemini API), and OpenRouter, only for AI features you allow and start, as described in section 9;
• hosting, network, security, monitoring, and communications providers, to operate, protect, and troubleshoot our website, application, API, and email;
• creators, brands, and authorised team members, when information is public, belongs in a shared collaboration, or you instruct us to share it;
• professional advisers, auditors, insurers, courts, regulators, law enforcement, or government authorities, where reasonably necessary to obtain advice, protect rights, investigate misuse, or comply with a valid legal process; and
• a prospective or completed corporate transaction participant, under appropriate confidentiality protections, if our business or assets are financed, reorganised, merged, acquired, or transferred.

Service providers may process information only to provide contracted services to us or as independently required by law. Their own privacy notices may also apply when you interact directly with them, such as on a Razorpay payment page, Instagram, Google Form, or external creator link.

11. Retention

We use the following retention periods or criteria. A legal preservation requirement, unresolved dispute, fraud investigation, or enforceable government request may require limited information to be held longer; when that happens, we restrict it to the relevant purpose.

For the steps and exceptions that apply to deletion, see our Data Deletion and Disconnect Instructions.

12. International processing

Creonnect is operated from India. Some providers, including Meta, Google, Microsoft, OpenAI, OpenRouter, Supabase, hosting providers, and payment or support providers, may process information in India, the United States, or other countries where they or their subprocessors operate. Those countries may have different data-protection rules.

Where applicable, we use provider reviews, written data-protection and confidentiality terms, access restrictions, data minimisation, and other measures intended to protect information during international processing. We make transfers subject to applicable Indian restrictions and any other transfer rules that apply to the relevant information.

13. Security

We use administrative, technical, and organisational measures appropriate to the nature of the information and risk, which may include access controls, authentication protections, encryption in transit, restricted production access, logging and monitoring, backups, provider due diligence, and incident-response procedures. Access tokens and other credentials are treated as sensitive and access is limited to systems and personnel that need them.

No storage or transmission method is completely secure. You are responsible for keeping your Creonnect credentials confidential, using secure devices, limiting team access, and promptly notifying hello@creonnect.com if you suspect unauthorised account activity. If a personal-information incident occurs, we will investigate, contain, remediate, and notify affected people or authorities when applicable law requires it.

14. Your choices and privacy requests

Subject to applicable law, verification, and relevant exceptions, you may ask us to:

• confirm whether we hold information about you and provide a summary or copy where available;
• correct or update inaccurate or incomplete account information;
• delete your account or other personal information;
• withdraw a consent or permission prospectively;
• disconnect Instagram and stop future Meta data access;
• export information in a technically feasible form;
• opt out of optional product marketing or analytics; or
• review a privacy decision or grievance.

Some account information can be edited through available settings. To make another request, email hello@creonnect.com from the address associated with your information and describe what you want us to do. We may ask for proportionate information to verify identity, account authority, or the Instagram interaction involved. We will not request an Instagram password.

If you are an Instagram commenter or message participant, include the connected professional account's username, the approximate interaction date, and enough non-sensitive context to locate the record. We may coordinate with the connected account holder where necessary and lawful.

Withdrawal does not affect processing already lawfully completed. If the information is necessary to provide a requested feature, withdrawing it may require us to disable that feature. We may deny or limit a request where we cannot verify it or where retention or processing is required for another person's rights, security, fraud prevention, legal claims, financial records, or another lawful obligation; if so, we will explain where appropriate.

15. Account deletion and Instagram disconnection

You can disable an Instagram connection through the Creonnect Connections area where available and can also remove Creonnect through Instagram's Settings and privacy → Apps and websites controls. Disconnection stops new access and configured Auto DM processing immediately. You can request full account or data deletion separately.

Disconnecting Instagram does not by itself delete your Creonnect account, and deleting a Creonnect account does not remove content already copied or cached by third parties. Detailed steps, timelines, and retention exceptions are in our Data Deletion and Disconnect Instructions.

16. Children and incidental Instagram interactions

Creonnect accounts, the waitlist, recruitment, and commercial Services are intended for people who are at least 18 years old. We do not knowingly permit a person under 18 to create a Creonnect account or knowingly collect their information directly for the waitlist, payments, marketing, or recruitment. If we learn that this has happened, we will take reasonable steps to delete the information.

Because Instagram account holders can receive comments and messages from a broad audience, the Meta data delivered for a connected professional account may incidentally include an interaction from a person under 18. We process only what is needed to deliver or secure the connected feature, do not use that interaction to advertise to or profile the minor, and will delete it upon a verified request unless retention is legally required. If you believe a minor has provided information to Creonnect, contact hello@creonnect.com.

17. Applicable Indian law and future legal changes

Our current practices are designed with applicable Indian law in mind, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are scheduled to commence in phases. We will apply provisions from their legally effective dates and update our practices where required.

The request options in this Policy are available as Creonnect privacy commitments even where a particular statutory right has not yet commenced or does not apply to a specific person. They do not limit any right you have under a law that already applies to you.

18. Changes to this Policy

We may update this Policy when our Services, providers, permissions, or legal obligations change. We will post the revised version with a new Last Updated date. If a change materially affects how we use information already collected, we will provide additional notice or seek renewed consent where required before the change takes effect.

19. Contact and grievance redressal

For privacy questions, account requests, or general support, contact hello@creonnect.com.

For a complaint or unresolved privacy concern, contact our designated Grievance Officer:

Harsh Kumar Suman

Grievance Officer, Quantumrealm AI Labs Private Limited

Email: hello@creonnect.com

Address: Unit 101, Oxford Towers 1, 139/88 HAL Old Airport Rd, H.A.L II Stage, Bangalore North, Bengaluru 560008, Karnataka

Please include your contact details, the service or account involved, and a clear description of the issue. Do not send passwords, complete payment credentials, or unnecessary identity documents by email. The Grievance Officer will acknowledge and investigate the matter and will seek to redress it expeditiously and within one month of receipt, as required under applicable law.