Privacy Policy

UmbrellaX (“UmbrellaX”, “we”, “us”, “our”) provides influencer-marketing measurement for brands and creators. This Privacy Policy explains what personal data we handle, why, and the choices and rights you have. It is designed to align with data-protection laws in the markets we serve, including India’s Digital Personal Data Protection Act, 2023 (DPDP), Indonesia’s Personal Data Protection Law (UU No. 27/2022), and the developing frameworks in Bangladesh and Pakistan.

1. Who this applies to, and our role

This Policy covers:

• Brand users — people at brands and agencies who use our dashboards.
• Creators — influencers who connect their social accounts to UmbrellaX.
• Members of the public — people whose public interactions (e.g. comments, and aggregated audience metrics) we process on behalf of a brand.

We act as a data controller for account and platform-operation data, and as a data processor on behalf of our brand clients for the campaign measurement they configure. Each brand is the controller of the creator roster it chooses to track.

2. Data we collect

• Account data — name, work email, organisation, role, and login credentials.
• Creator connection data — with the creator’s authorisation (OAuth), platform account identifiers, access tokens, and the metrics those unlock: reach, impressions, views, watch-time and retention, audience geography and demographics, and post/video performance.
• Public platform data — publicly available counts, posts, and comments from connected accounts and monitored profiles.
• Comment content and sentiment — the text of public comments and mentions, which our systems (including AI) analyse to score sentiment.
• Usage data — device, browser, IP address and pages viewed, collected through cookies and similar technologies.
• Communications — messages you send us, such as emails.

3. How we use data

• Provide the service: sync and refresh metrics, and build dashboards and reports.
• Read comments and mentions and score sentiment using automated tools, including AI.
• Produce campaign and competitor analysis for the relevant brand.
• Manage accounts, provide support, secure the service, and handle billing.
• Comply with legal obligations and enforce our terms.

4. Our legal grounds

• Consent — a creator’s OAuth authorisation, and other consents where the law requires them.
• Contract — providing the service to a brand client.
• Legitimate interests — security, product improvement, and analysis of public data, balanced against your rights.
• Legal obligation — where processing is required by law.

5. Creator consent and control

Creators connect their accounts through the platform’s own authorisation flow and choose what to connect. A creator can revoke access at any time — from within UmbrellaX or from the relevant platform’s security settings. Revoking stops future first-party collection; we then delete the associated access tokens.

6. AI and automated processing

We use automated tools, including machine learning, to analyse public comments and content (for example, to score sentiment) and to surface patterns. These support human decision-making. We do not use them to make decisions that produce legal or similarly significant effects on an individual without human involvement. Where applicable law gives you rights in relation to automated processing, you can contact us to exercise them.

7. When we share data

• Brand clients see only the data for the creators on their own roster and campaigns.
• Service providers (sub-processors) — hosting, cloud infrastructure, analytics and email — under contract and only as needed.
• Social platforms — we access data through the YouTube, TikTok and Meta (Instagram/Facebook) APIs, subject to their terms.
• Legal and safety — where required by law, regulation or valid legal process.
• Business transfers — in connection with a merger, acquisition or sale of assets.

We do not sell personal data.

8. Third-party platforms

Our use of information received from Google APIs, including YouTube, adheres to the Google API Services User Data Policy, including its Limited Use requirements. Your use of YouTube data is also subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke UmbrellaX’s access via your Google security settings. Equivalent terms apply to data accessed through TikTok and Meta platforms.

9. International data transfers

We may store and process personal data in Bangladesh and in cloud regions elsewhere. Where we transfer personal data across borders — including out of India or Indonesia — we apply appropriate safeguards and follow the transfer requirements of the applicable law.

10. How long we keep data

We keep personal data only as long as needed for the purposes above, or as required by law. Connection tokens are deleted when a creator revokes access or a contract ends. We may keep aggregated or de-identified data that no longer identifies an individual.

11. Security

We use technical and organisational measures — including encryption in transit, access controls and least-privilege practices — to protect personal data. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you and regulators of incidents where the law requires.

12. Your rights

Subject to your local law, you may ask us to:

• access the personal data we hold about you;
• correct or update it;
• delete it;
• withdraw a consent you gave (without affecting prior processing);
• receive a copy in a portable format, or restrict or object to certain processing;
• complain to your data-protection regulator.

To exercise any of these, email privacy@umbrellax.ai. We respond within the timeframe your law requires.

13. Regional provisions

14. Children

UmbrellaX is not intended for anyone under 16 (or the age of digital consent in your country). We do not knowingly collect the personal data of children. If you believe a child has provided us data, contact us and we will delete it.

15. Changes to this Policy

We may update this Policy from time to time. We will post the new “last updated” date above and, for material changes, take reasonable steps to notify you.

16. Contact and grievance officer

Questions, requests or complaints: privacy@umbrellax.ai. This address also reaches our Grievance Officer / Data Protection contact for the purposes of the laws described above.