Privacy Policy

Pick & Partner (“we”, “us”, “our”) operates the platform at pickandpartner.com. The Platform is operated from India, and we are the data fiduciary (data controller) for the personal data described in this policy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.

For any privacy question, or to exercise any right in Section 7, contact picknpartner@gmail.com. The same address reaches our Grievance Officer, appointed under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.

Once your onboarding is complete, your profile is discoverable by other signed-in creators, and a public page at pickandpartner.com/c/<id> displays your brand name, creator name, brief text, niche, and subscriber count without requiring a login. Ratings and reviews left about you after a completed partnership are readable by others on the Platform.

Your email address is not shown on your public profile or to other creators. Partnership details, tracking links, and click counts are visible only to the two creators involved in that partnership.

Where the Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of the consent you give at registration and for the legitimate uses that Act permits, including security, fraud prevention, and compliance with law. Where the GDPR or UK GDPR applies to you, we rely on the following bases:

• Contract performance — processing necessary to provide the Platform service you signed up for (matching, tracking links, transactional emails).
• Legitimate interests — fraud prevention, abuse detection, platform security, and improving the matching algorithm, where our interests do not override your rights.
• Legal obligation — where we are required to retain or disclose data by applicable law or a valid legal process.
• Consent — where we ask for consent. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

• Platform operation — showing your profile to other creators, carrying partnership requests between you and them, generating and serving tracking links, storing your brief and images, and sending transactional emails.
• Niche classification — your newsletter description is matched against a fixed keyword list on our own server to assign it a niche category. It is not sent to any third party and is not used to train any model.
• Transactional communications — service emails such as account verification, partnership notifications, send-day reminders, and review requests, sent via Resend from noreply@pickandpartner.com. We do not send marketing email to you without your consent.
• Security & integrity — detecting and preventing fraud, abuse, and violations of our Terms of Service.
• Legal compliance — responding to lawful requests from authorities where required.

We do not sell your personal data, rent or trade it, use it for advertising, or share it with data brokers. The providers listed in Section 6 are the only third parties that receive it, and they receive it only to run the Platform. We have no advertising business and no data-licensing business, so there is nothing on our side that would be served by doing otherwise.

We share data with the following sub-processors solely to operate the Platform. Each is bound by their own data processing terms.

These providers operate globally distributed infrastructure and may process your data in countries outside your own, including outside India. Such transfers are carried out under the safeguards described in each provider’s data processing documentation.

Why this is how it works — These four providers are our database, our hosting, our image storage, and our email sender. They are infrastructure we rent rather than partners we share data with, and each one only receives what it needs to do its job. There is no fifth party, and no analytics or advertising service, on this list.

Subject to applicable law, you have the right to:

• Access — request a copy of personal data we hold about you.
• Correction — correct inaccurate or incomplete data, via Profile & Settings in-app.
• Erasure — delete your account and associated personal data at any time from Profile & Settings.
• Portability — request a copy of your data as a file you can reuse elsewhere. We provide an export of the database records relating to your account, in a common format such as CSV or JSON.
• Restriction — request that we limit how we process your data.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is consent-based, you may withdraw at any time.
• Grievance redressal — raise a complaint with our Grievance Officer.
• Nomination — where the Digital Personal Data Protection Act, 2023 applies, nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any right, email picknpartner@gmail.com. We will respond within 30 days. If you believe we have not handled your data lawfully, you may complain to the Data Protection Board of India, or to the data protection authority in your own jurisdiction.

• Raw click events — deleted after 30 days by a scheduled job.
• Aggregated click counts — retained as part of the partnership record for as long as your account is active.
• Account and profile data — retained for the duration your account is active.
• On account deletion — deleting your account removes your profile, your partnerships and their tracking links, the click events recorded against them, your reviews and notifications, your uploaded brief images, and your login credentials.
• Backups — encrypted backups expire on our ordinary backup cycle.
• Legal holds — we may retain data longer where required by law or in connection with an active legal dispute.

Why this is how it works — Raw click events are the only records that touch your readers at all, so they are deleted on a fixed 30-day schedule rather than kept indefinitely. The legal-hold exception is narrow and exists because deleting records during a live legal dispute is itself unlawful in most jurisdictions.

We use only strictly necessary cookies required for authentication (Supabase session tokens). We do not use advertising cookies, analytics cookies, or any third-party tracking scripts. You cannot opt out of strictly necessary cookies without losing access to the Platform.

We implement technical and organisational measures to protect your data, including HTTPS encryption for all data in transit, password hashing via Supabase Auth (passwords are never stored in plain text), non-reversible click de-duplication hashing, and row-level security policies in our database that restrict each record to the users entitled to see it. Administrative access to the underlying data is limited to a fixed list of administrator accounts.

Brief images you upload are stored in Cloudflare R2 and served from a public URL containing a randomly generated filename. They are not listed or indexed anywhere, but anyone holding the URL can view the image, so please do not upload anything you would not want shared with a partner.

Beta notice. Pick & Partner is an early-stage product. While we apply security best practices, no system is completely immune to breach, and we cannot guarantee absolute security. If a security incident occurs that is likely to result in a risk to your rights, we will notify affected users and the relevant authorities. Our liability terms are set out in our Terms of Service.

Why this is how it works — We would rather tell you exactly how your data is stored, including the parts that are imperfect, than publish reassurance we cannot stand behind. That is why this section describes how brief images are actually served instead of describing them as more protected than they are.

The Platform is not directed at, and may not be used by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has registered, we will delete the account and associated data promptly. If you believe a minor has created an account, please contact us.

We may update this Privacy Policy at any time. We will post the revised policy at this URL and update the “Last updated” date. Where changes are material, we will notify registered users by email. Continued use of the Platform after notification constitutes acceptance of the updated policy. If you do not agree to the updated policy, you may delete your account from Profile & Settings.

The notes headed “Why this is how it works” are provided for transparency. They are explanatory only and do not form part of the binding policy.

Pick & Partner — India

For any privacy question, to exercise a right under Section 7, or to reach our Grievance Officer, write to picknpartner@gmail.com.