Privacy Policy

1. Information we collect

• Account information: name, email address, phone number, username, OTP/authentication information and account identifiers.
• Profile and storefront information: bio, avatar, theme preferences, storefront settings and custom-domain information.
• Creator content: product links, titles, descriptions, prices, images, videos, banners, logos, categories and other content you upload or publish.
• Usage and technical information: IP address, browser/device type, operating system, timestamps, referring URLs, pages viewed, clicks, interactions, logs, diagnostics and security-related information.
• Analytics information: storefront visits, clicks, engagement, referral information, conversion/affiliate events and related performance metrics.
• Payment and subscription information: subscription, billing and transaction records. Card, UPI and other payment-instrument credentials are processed by Razorpay and are not ordinarily stored by us.
• Instagram/Meta information: if you connect an eligible Instagram Business or Creator account, we may receive your Instagram account ID, username, profile information, profile picture, comments, messages and other information permitted by the permissions you authorize.
• Instagram conversation data: where automated or AI-assisted replies are enabled, we may process messages, conversation history and generated responses to maintain conversational context, automate replies, and route conversations to you.
• Order/customer information: when a Creator operates a productlink.in shop, we collect customer name, email address, phone number, billing/shipping address, order details and other information submitted at checkout.
• Shipping information: information necessary to create, track and manage shipments through Shiprocket.
• Third-party integration credentials: credentials, access tokens or API keys required to connect supported services such as Razorpay or Shiprocket, protected with appropriate security controls and used only for the authorized integration.
• Notifications information: mobile push notification tokens, if you enable notifications in the app.
• Communications: information in support requests, emails, feedback and other communications with us.

We do not intentionally collect precise geolocation.

2. How we use personal data

We use personal data only as reasonably necessary to:

• create and administer accounts, and authenticate/secure them;
• provide storefront, link-in-bio, shop, analytics and other Service functionality;
• publish and display Creator Content;
• process subscriptions and billing;
• facilitate orders, payments, shipping and fulfilment;
• connect and operate authorized Meta/Instagram, Razorpay, Shiprocket and other integrations you enable;
• provide automated and AI-assisted replies where enabled;
• send transactional notifications, OTPs, service messages and order updates;
• provide customer support;
• detect fraud, abuse, security incidents and unauthorized activity;
• maintain, troubleshoot and improve the Service;
• comply with applicable legal, tax and regulatory requirements;
• enforce our Terms and protect our rights, users and Service; and
• generate aggregated or de-identified analytics that do not reasonably identify an individual.

We do not sell personal data to third parties, and we will not use personal data for a materially different purpose than disclosed at collection unless permitted or required by applicable law.

3. Creator data and customer data

productlink.in serves both Creators and their customers. For a Creator's own account, Oneplexo determines the purposes for which relevant personal data is processed. Where a Creator uses productlink.in to collect customer information for its own products, the Creator determines the purposes and means of processing that customer information — the Creator is responsible for providing appropriate notices, obtaining consents where required, and complying with applicable privacy, consumer-protection and e-commerce laws. We process such customer information to provide the requested technology and services, including order management, payment integration, customer support and shipping. Creators must not collect, upload or process personal data through productlink.in unless they have the necessary rights, permissions and lawful basis to do so.

4. Meta and Instagram integration

If you connect an Instagram Business or Creator account, you authorize us to access information made available through the Meta/Instagram integration and the permissions you grant — depending on enabled functionality, this may include Instagram account identifiers and profile information, comments and messages, and other information made available through the applicable Meta APIs. We use this information only to provide the connected functionality, including comment/DM automation and AI-assisted responses where enabled.

You may disconnect the integration at any time. Disconnection stops future access where technically possible, but does not automatically delete information already lawfully processed or that must be retained for legal, security or operational purposes. Meta may change its APIs, permissions or availability, which may affect particular Instagram features. productlink.in is not affiliated with, endorsed by or sponsored by Meta or Instagram.

5. AI features

Where you enable an AI feature, relevant information may be sent to third-party AI providers — Google Gemini, Anthropic Claude, or OpenAI, depending on which is configured — to generate responses. Depending on the feature, this may include messages and conversation text, Creator Content, product names/descriptions/ prices, links and storefront information, and other contextual information necessary to generate the requested response. We limit what we send to what's reasonably necessary for the feature — we do not intentionally send sender names, email addresses or Instagram IDs to AI providers for generating Instagram replies.

AI-generated content may be inaccurate, incomplete or inappropriate; Creators remain responsible for reviewing and using AI-generated communications. AI providers process information under their own contractual terms and privacy policies, which may vary by provider and configuration.

6. Third-party service providers

We use a small number of providers to operate the Service:

• Meta/Instagram — social-account integration, comments, messages and authorized automated responses.
• Razorpay — subscription payments, and, where connected by a Creator, that Creator's own customer payment processing.
• Shiprocket — shipping, fulfilment, shipment creation and tracking.
• Cloudflare R2 — hosting and delivery of uploaded images and media.
• Google Firebase Cloud Messaging — mobile push notifications; receives your device's push token, not your account content.
• Google Gemini, Anthropic Claude and OpenAI — optional AI functionality (see Section 5).
• Brevo and MailerCloud — transactional and service-related email delivery.
• Our database and infrastructure hosting providers — storage, backups and application infrastructure.
• Other vendors, analytics, security or domain providers reasonably required to operate the Service.

Each provider receives only the information reasonably necessary for its function, subject to its own contractual terms and applicable law.

7. Payments

We use Razorpay for productlink.in subscription payments, and for payments customers make to a Creator through that Creator's own connected Razorpay account. We do not ordinarily store complete card, UPI or other payment-instrument credentials. Payment processing, KYC, fraud controls and settlement are governed by Razorpay and applicable payment-system rules.

8. Orders and shipping

When a customer purchases through a Creator's storefront, their name, contact information, address, order details and shipping information may be shared with the Creator and with Shiprocket to process and fulfil the order. The Creator is responsible for its products, pricing, taxes, invoices, shipping, returns, refunds and other seller obligations described in our Terms. We do not become the seller merely because our technology facilitates the transaction.

9. Cookies, analytics and tracking

We may use cookies, SDKs, logs and similar technologies for authentication, session management, preferences, performance, analytics, attribution and fraud prevention. We do not use tracking cookies for third-party advertising unless specifically disclosed. Creators may independently connect analytics services such as Google Analytics to their own storefronts — see our Cookie Policy for details.

10. Disclosure of personal data

We may disclose personal data:

• to the service providers described in this Privacy Policy;
• to the Creator responsible for a transaction or storefront;
• to payment, shipping or other providers selected by the Creator;
• where required by law, regulation, court order or governmental authority;
• to investigate fraud, abuse, security incidents or violations of our Terms;
• to protect the rights, safety, property or security of productlink.in, users or others; or
• in connection with a merger, acquisition, financing or similar corporate transaction, subject to applicable law.

We do not sell personal data.

11. International processing and transfers

Some service providers or infrastructure we use may process or store information outside India. Where personal data is transferred outside India, we do so subject to applicable law, contractual safeguards and any restrictions imposed by applicable government authorities.

12. Security

We use reasonable technical, organizational and administrative safeguards appropriate to the information processed, including access controls, encryption, authentication controls, logging, monitoring and secure infrastructure. However, no internet-based service can guarantee absolute security. If we become aware of a security incident affecting personal data, we will assess and respond to it and provide notices where required by applicable law. Creators must promptly notify us of unauthorized access, compromised integrations or other security incidents involving productlink.in.

13. Retention and deletion

We retain personal data only as long as reasonably necessary for the purposes in this Privacy Policy — including maintaining active accounts, completing transactions and resolving disputes, preventing fraud, complying with tax/accounting obligations, and maintaining necessary security records. When you delete your account, we delete or anonymize your personal data and Creator Content within a reasonable period, except information we must or may lawfully retain. Backups may retain information for a limited additional period before being overwritten or securely deleted. Deletion does not remove information already lawfully disclosed to independent third parties such as payment processors or logistics providers; their own retention policies apply.

14. Your privacy rights

Subject to applicable law, you may have rights to access, correct or update, or request deletion of your personal data; withdraw consent where processing is based on consent; request information about how your data is processed and shared; and raise a grievance. Withdrawing consent does not affect processing already lawfully undertaken, and may affect our ability to provide features that require the relevant information.

You can access or update most of your data directly from the dashboard. To delete your account, see how to delete your account. To request a copy of your data or exercise any other right, contact [email protected] — we may verify your identity before acting on a request.

15. Children's privacy

The Service is intended for users with the legal capacity to use it under applicable law. Unless expressly permitted by us with required safeguards, the Service is not intended for persons under 18 years of age, and we do not knowingly process children's personal data except where permitted and appropriately authorized under applicable law. If you believe a child has provided personal data to us improperly, contact [email protected].

16. Grievances

Privacy complaints or requests may be submitted to [email protected] or [email protected]. We will handle grievances in accordance with applicable law and the timelines applicable to the relevant request.

17. Third-party websites and services

productlink.in may contain links to third-party websites, marketplaces and services, including Amazon, Flipkart, Myntra, Meta/Instagram, payment providers and other external platforms. Once you access or provide information directly to a third-party service, its own terms and privacy policy apply — we do not control the privacy practices, security or content of independent third parties.

18. Changes to this policy

We may update this Privacy Policy as the Service, technology, third-party integrations or applicable legal requirements change. Material changes will be communicated through the Service, email, or another reasonable method where required. The revised version will state its updated date.

19. Governing framework

This Privacy Policy is intended to operate together with our Terms and Conditions and other applicable policies. Personal-data processing is governed by applicable Indian data-protection and information-technology laws, including the Digital Personal Data Protection framework and rules to the extent applicable and in force, together with other applicable laws. Nothing in this Privacy Policy limits any statutory right or remedy that cannot lawfully be excluded.

20. Contact

For privacy questions, data requests or concerns: email [email protected] (privacy) or [email protected] (general/legal), or visit productlink.in.