Privacy policy | Kreodify

1. About this policy

This policy explains how Kreodify ("Kreodify") handles personal data of buyers, creators and visitors, in line with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. Creator stores are run by creators; each creator's own pages describe how that creator uses what you give them directly.

2. What we collect

Everyone who signs in

Your Google account name, email address and profile photo (we never see your Google password).
Your orders, payments status, downloads and support requests.
Basic technical data such as IP address, browser type and error logs, used for security and to fix problems.

Creators, additionally

Name, phone number and store details you provide.
Payout details (UPI ID or bank account name, number and IFSC) so we can pay you.
If you choose to verify: your legal name, ID type, the last 4 characters of your ID number and the ID document you upload. The document is stored privately and only reviewing staff can open it.

What we do not collect

We do not see or store your card, UPI PIN or net-banking credentials. Payments are handled by our payment gateway partner.

3. Why we use it

To create your account, process orders, verify payments and deliver your purchases.
To pay creators and keep accurate financial records.
To prevent fraud, abuse and security incidents, and to enforce our rules.
To answer your support requests and send service messages by email and in your account, such as order confirmations and refund updates.
To meet legal, tax and accounting obligations.

We use your data on the basis of your consent, to perform our contract with you, and where the law permits or requires. We do not use your data for third-party advertising and we do not sell it.

4. Who we share it with

Creators: when you buy, the creator whose product you bought can see the order details they need to fulfil it (product, amount, date). Your contact details are not shown to them by the marketplace.
Stores you message: if you send a question to a store, the store sees your first name and your message. It does not see your email address.
Payment gateway: our payment partner (currently Cashfree Payments) processes your payment under its own privacy policy.
Email delivery: our email service delivers order confirmations, refund and payout updates and support replies on our behalf.
Infrastructure providers: Google Firebase / Google Cloud (authentication, database, file storage and functions) and our hosting provider, who process data for us under contract. Our site also loads fonts from Google Fonts, which means Google receives your IP address.
Authorities and advisers: where required by law or a lawful order, or to protect rights and safety.

We do not sell personal data.

5. Cookies and local storage

We use only what the service needs: a sign-in session, and small items in your browser (for example, to remember a setting or cache a short-lived value). We do not use advertising or cross-site tracking cookies. You can clear this data in your browser settings; you may then need to sign in again.

6. How long we keep it

We keep account data while your account is active. Order, payment and payout records are kept for as long as the law requires for tax and accounting. Support requests and logs are kept for a limited period. Verification documents are kept only as long as needed for the review and any dispute, then deleted.

7. Security

Data travels over encrypted connections. Access to personal data is limited by role, private files are not publicly accessible, downloads use short-lived personal links, and administrative actions are logged. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

8. Your rights and choices

You can ask us to: tell you what personal data we hold about you, correct it, delete it (subject to records we must keep by law), or withdraw consent for optional uses. You can also nominate someone to exercise your rights if you cannot.

To make a request or complaint, write to us at supportkreodify@gmail.com. We acknowledge requests within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is operational.

9. Children

Kreodify is not meant for people under 18 using their own account. If you believe a child has given us personal data without a parent or guardian's consent, contact us and we will delete it.

10. Changes to this policy

If we change how we handle personal data we will update this page and the date at the top, and tell you where the law requires.