Privacy Policy

This Privacy Policy explains how The Brand Booster ("Xchng", "we", "us"), collects, uses, discloses, and protects personal data when you use xchng.in (the "Platform"). We process personal data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and — for users located in the European Economic Area — the General Data Protection Regulation ("GDPR").

• Account & identity data — mobile number (used for OTP login), name, email, date of birth, gender, and profile photo.
• Profile data — for Brands: business name, industry, address, GST number, website, and social links; for Creators: bio, city, content niches, follower counts, social handles, pricing, and verification documents.
• Deal data — Deals posted or applied to, application status, submitted content links, ratings, and reviews.
• Payment data — transaction records (amount, plan/pack purchased, status). Card, UPI, and bank details are collected and processed directly by Razorpay; we do not store them on our servers.
• Location data — city/state you provide, and, with your permission, approximate location used to sort nearby Deals.
• Usage & device data — log data, IP address, browser type, and pages visited, collected automatically for security and analytics purposes.

• To create and authenticate your account, and operate core Platform features (posting/browsing Deals, applications, ratings).
• To process payments for brand plans, creator credits, and promotional features via Razorpay.
• To send OTPs and transactional notifications (application updates, selection, revisions, reminders) over WhatsApp via Msg91.
• To review and verify Brand and Creator profiles, and to detect fraud, spam, or Terms violations.
• To improve the Platform, provide customer support, and comply with legal obligations.

We use Msg91 to deliver OTP codes and transactional WhatsApp/SMS notifications (e.g. application status changes, deadline reminders). Your mobile number is shared with Msg91 solely for this purpose. You cannot opt out of OTP messages required for login, but non-essential reminder notifications may be limited via your account settings where available.

All payments are handled by Razorpay, a PCI-DSS compliant payment gateway. When you make a payment, your payment details are transmitted directly to Razorpay over an encrypted connection; we receive only the transaction status, amount, and a payment reference ID.

We share the minimum necessary data with the following service providers to operate the Platform:

• Supabase — our database, authentication, and file storage provider, which hosts all Platform data.
• Razorpay — payment processing for plans, credits, and promotions.
• Msg91 — OTP delivery and WhatsApp/SMS notifications.
• Google Maps — city/location autocomplete during profile and deal setup.

Each provider processes data under its own privacy policy and only for the purpose we engage them for. We do not sell your personal data to third parties.

We use essential cookies to keep you signed in and remember your session. We do not currently use third-party advertising or tracking cookies.

We retain account and Deal data for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, and dispute-resolution obligations (typically up to 7 years for financial transaction records, in line with Indian tax law). You may request earlier deletion of your account data as described in Section 9, subject to these retention obligations.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data via your profile settings.
• Request deletion of your account and associated personal data ("right to erasure"), subject to Section 8.
• Request a copy of your data in a portable format ("data portability"), where applicable.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at hello@xchng.in. We will respond within 30 days.

We apply reasonable technical and organizational security measures — including encryption in transit, access controls, and row-level authorization on our database — to protect your data from unauthorized access, alteration, or disclosure. No system is completely secure, and we cannot guarantee absolute security.

The Platform is not directed at individuals under 18, and we do not knowingly collect personal data from minors. If you believe a minor has registered on the Platform, please contact us so we can take appropriate action.

Our infrastructure providers may process and store data outside India. Where this occurs, we rely on our providers' contractual and security safeguards to ensure your data continues to receive an appropriate level of protection.

We may update this Privacy Policy periodically. Material changes will be notified via the Platform. The "Effective" date at the top of this page reflects the most recent revision.

For privacy questions or to exercise your rights, contact us at hello@xchng.in or via our Contact page. Our registered office is in Rajkot, Gujarat, India.