Privacy Policy

Vitaay Platform — including data handled by the Vitaay Escrow Payment System

Last Updated: August 5, 2026

Effective Date: August 5, 2026

Website: https://www.vitaay.ai

Contact: connect@vitaay.ai

Classification: Public — Published on vitaay.ai

• Introduction

Welcome to Vitaay ("Vitaay," "we," "us," or "our"). This Privacy Policy explains how Vitaay collects, uses, shares, and protects your personal information when you access or use the Vitaay platform, an AI-powered marketplace that connects brands with influencers and content creators to forge authentic marketing partnerships, including payments made through the Vitaay Escrow Payment System.

This Privacy Policy applies to all users worldwide, including users in the United States, the European Economic Area (EEA), the United Kingdom, Canada, India, Brazil, Australia, Japan, South Korea, and all other jurisdictions. By registering for, accessing, or using Vitaay in any capacity (as a Brand, Creator, or visitor), you agree to the terms of this Privacy Policy. If you do not agree, please do not use our platform.

• Who We Are & Data Controller Information

Vitaay is operated from India and serves users globally. For the purposes of applicable data protection laws:

• Data Controller (EEA/UK, GDPR/UK GDPR): Vitaay, accessible at connect@vitaay.ai, with EU/UK representative arrangements in place as required
• Data Controller (USA): Vitaay as described above, with privacy rights exercised via connect@vitaay.ai
• Data Controller (India, DPDPA): Vitaay, with user rights and grievance redressal available via connect@vitaay.ai in accordance with applicable Indian data protection laws

Vitaay serves two primary user categories:

• Brands - Companies and businesses seeking to partner with creators for marketing campaigns
• Creators - Influencers, content creators, and digital personalities seeking brand collaboration opportunities
• Information We Collect

3.1 Information Provided by Brands

• Company name, registered business details, and business registration number
• Contact name, email address, phone number, and job title
• Product information and analytics (e-commerce): This includes details about your products, such as descriptions, pricing, inventory, and performance data (e.g., engagement, conversions, and sales metrics)
• Industry category and campaign budget range
• Campaign briefs, project details, and creative requirements
• Billing and payment information (processed via Stripe, our third-party payment processor; we do not store full card details — see §3.6)

3.2 Information Provided by Creators

• Full name, email address, and date of birth (to verify age eligibility)
• Location (city or country)
• Social media handles (such as Instagram, TikTok, YouTube, Twitter/X, and other connected platforms), along with associated analytics and information, including content, reach, engagement metrics (likes, comments, shares), and audience interactions
• Content niche and category (Fashion & Beauty, Lifestyle, Technology, Food & Cooking, Health & Fitness, Travel, Comedy, Education, Gaming, etc.)
• Audience size and engagement rate data
• Profile bio, content description, and portfolio samples
• [NEW] Payout eligibility data: to receive escrow releases or tips, Creators complete identity verification and connect banking details directly through Stripe Connect’s hosted onboarding flow. Vitaay never receives, transmits, or stores your full bank account number, government ID images, or other raw KYC documents — these are collected and verified exclusively by Stripe. Vitaay receives only a verification status (e.g., "not started," "in progress," "complete") from Stripe.

3.3 Information Collected Automatically

• IP address and approximate geographic location
• Browser type, operating system, device identifiers, and screen resolution
• Pages visited, time spent, click patterns, and navigation behavior on vitaay.ai
• Referral sources and search terms used to reach our platform
• Device advertising identifiers (IDFA/GAID) where applicable and consented
• Cookies, web beacons, pixel tags, and similar tracking technologies (see Section 9)

3.4 Information from Third Parties

• Social media platform APIs (where you grant permission) for verifying follower counts and engagement metrics
• E-commerce platforms: Includes product details (descriptions, pricing), order data, and key performance metrics (such as conversions and sales) used for analytics and campaign optimization
• [NEW] Stripe and Stripe Connect: identity-verification status, payout/onboarding status (e.g., charges_enabled / payouts_enabled), and fraud/risk signals generated by Stripe Radar — see §3.6
• Identity verification providers (KYC/AML checks where legally required, performed by Stripe on our behalf)
• Analytics partners for platform performance data
• Publicly available information (e.g., public social media profiles for creator verification)

3.5 Sensitive Personal Information

We do not intentionally collect sensitive personal information such as racial or ethnic origin, religious beliefs, health data, biometric data, or political opinions. Please do not submit such information. If such data is incidentally received, it will be deleted.

3.6 Escrow & Payment Transaction Data [NEW]

In connection with the Vitaay Escrow Payment System, Vitaay collects and stores the following payment-related metadata directly (i.e., on Vitaay’s own systems, separate from Stripe):

• Escrow status history (Pending, Held, Released, Refunded, Disputed, or Failed) and the timestamp of each status change
• Payment amount, currency, and any Stripe processing charges applied (Vitaay charges no platform commission — see §10.2 of our Terms and Conditions)
• The campaign, invite, brand, and creator associated with each escrow or tip
• Stripe reference identifiers (e.g., PaymentIntent ID, Transfer ID, Charge ID) used to reconcile records with Stripe — these identifiers do not themselves contain card or bank data
• For admin-initiated actions: the acting admin’s identity, the reason provided, and the before/after state, recorded in an immutable audit log

We do not collect or store: full card numbers, CVC/security codes, complete bank account numbers, or raw government identity documents. These are collected, verified, and stored exclusively by Stripe. Vitaay’s systems are designed so that this category of data never reaches Vitaay’s servers (consistent with PCI-DSS SAQ A scope — see §6.2).

• How We Use Your Information

For All Users (Brands and Creators):

• To create, verify, and manage your account on the Vitaay platform
• To facilitate introductions, AI-powered matches, and partnership agreements between brands and creators
• To communicate with you about campaigns, opportunities, platform updates, and support
• To process applications, agreements, and payments, including funding, releasing, and refunding escrow (see §10 of our Terms and Conditions)
• To verify identity and eligibility, including age verification and, for Creators, payout eligibility (KYC) via Stripe
• To provide customer support and respond to enquiries
• To improve platform features, user experience, and AI matching algorithms
• To detect, investigate, and prevent fraud, abuse, spam, or violations of our Terms, including through payment velocity and fraud-risk screening — see §15
• To comply with applicable legal obligations across all jurisdictions in which we operate, including AML, KYC, and sanctions-screening obligations
• To defend legal claims and protect the rights of Vitaay and its users

For Brands Specifically:

• To match your campaign requirements with suitable creators using our AI systems
• To provide campaign performance analytics and reporting dashboards
• To manage billing, invoicing, escrow funding, and campaign budget allocation

For Creators Specifically:

• To build and display your creator profile to relevant brands
• To surface relevant brand partnership opportunities based on your niche and audience
• To track campaign deliverables, milestones, and performance metrics
• To process escrow releases and tip payouts, and to calculate and display any Stripe processing charges applicable to a campaign

Marketing Communications:

We may send you marketing emails or in-platform notifications about Vitaay features, promotions, and relevant industry news where you have opted in or where permitted by applicable law. You may opt out at any time using the unsubscribe link in any email or by contacting us at connect@vitaay.ai. Note: transactional notifications relating to your payments (e.g., "escrow funded," "payment released," "payout landed") are not marketing communications and cannot be opted out of while you hold an active balance or pending transaction.

• Legal Basis for Processing

5.1 GDPR (EEA & UK Users)

Where applicable under the General Data Protection Regulation (EU) 2016/679 and the UK GDPR, we process your personal data on the following legal bases:

• Contract Performance (Art. 6(1)(b)) — Processing necessary to fulfill our agreements with you and provide platform services, including operating escrow
• Legitimate Interests (Art. 6(1)(f)) — To improve our platform, prevent fraud, maintain security, and conduct analytics
• Consent (Art. 6(1)(a)) — Where you have explicitly provided consent (e.g., marketing communications, optional social API access, non-essential cookies)
• Legal Obligation (Art. 6(1)(c)) — Where required by applicable European, UK, or other law, including AML/KYC obligations

5.2 India (DPDPA 2023)

For users in India, we process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA). Our legal bases include consent, contractual necessity, legitimate uses as defined under the Act, and compliance with legal obligations.

5.3 United States

For US residents, our data practices comply with applicable US federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (ColoPA), the Connecticut Data Privacy Act (CTDPA), and other applicable state laws. We do not sell personal information. We do not use sensitive personal information for purposes beyond those permitted under applicable law.

5.4 Canada (PIPEDA / Law 25)

For Canadian users, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws including Quebec’s Law 25 (Act 25). We collect, use, and disclose personal information only with meaningful consent and for the purposes disclosed herein.

5.5 Brazil (LGPD)

For Brazilian users, we comply with the Lei Geral de Proteção de Dados (LGPD). We process personal data on applicable legal bases including consent, contract performance, legitimate interest, and legal obligation, as defined under the LGPD.

5.6 Australia (Privacy Act)

For Australian users, we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We handle personal information in accordance with these principles, including providing access and correction rights.

• Data Sharing & Disclosure

We share your data only in the following circumstances, and never sell, rent, or trade your personal information to third parties for advertising or commercial purposes:

6.1 Between Brands and Creators

Core profile information — such as creator name, content niche, audience size, and social handles; or brand company name and industry — is shared to facilitate partnerships. Full contact details are only shared upon mutual agreement to collaborate.

6.2 Service Providers (Data Processors)

We engage trusted third-party vendors for hosting, cloud infrastructure, payment processing, email communications, analytics, identity verification, and security monitoring under strict data processing agreements (DPAs) that bind them to confidentiality and appropriate security obligations. Our key categories of service providers include:

• Cloud hosting and infrastructure providers (e.g., AWS, Google Cloud, or equivalent)
• [NEW] Stripe (payment processing; escrow fund holding on Vitaay’s Stripe platform account; Stripe Connect Express sub-accounts for Creator identity verification/KYC and bank payouts; fraud and velocity screening via Stripe Radar; sanctions/OFAC screening as part of Connect onboarding). Sharing your data with Stripe is necessary to fund, hold, release, refund, or pay out any transaction — this cannot be disabled while you use payment features of the platform.
• Additional payment processors where applicable (e.g., Razorpay, or equivalent, for certain regional rails)
• Email and communication platforms
• Analytics and performance tracking tools
• Identity verification and fraud prevention services

6.3 Legal Compliance

We may disclose data when required by applicable law, valid court order, government authority, regulatory inquiry, or to protect the legal rights, safety, or property of Vitaay, our users, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, corporate reorganization, or sale of all or substantially all of our assets, user data may be transferred to the successor entity. We will provide advance notice to affected users and the successor entity will be bound by this Privacy Policy or provide equivalent protections.

6.5 Aggregated / Anonymized Data

We may share aggregated, anonymized, or de-identified data — which cannot reasonably be used to identify you — with partners, researchers, or the public for industry insights and platform improvement.

• Data Security

We implement industry-standard and best-practice security measures to protect your personal information:

• Encrypted data transmission using TLS 1.3 for all data in transit
• AES-256 encryption for data stored at rest
• Secure cloud infrastructure with restricted, role-based access controls
• Regular security audits, vulnerability assessments, and penetration testing
• Multi-factor authentication (MFA) options for user accounts
• Employee data handling training and confidentiality agreements
• Incident response procedures for breach detection and notification
• [NEW] Payment card data is tokenized client-side by Stripe.js before it ever reaches Vitaay; no raw card data is transmitted through, or logged by, Vitaay’s systems (PCI-DSS SAQ A scope)

While we take all reasonable and technically feasible precautions, no internet-based service can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately of any suspected unauthorized access.

• Data Retention

We retain your personal data for as long as your account is active or as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention schedule includes:

Data Category: Retention Period

Account profile data: Deleted within 30 days of account closure

Transaction & contract records: Up to 7 years (financial/tax compliance)

Escrow status history & payment metadata (§3.6): Up to 7 years (financial/tax compliance), aligned with transaction records

Admin override audit logs (§6.2 / Stripe-related): 7 years; entries are immutable and cannot be edited or deleted

Support & communications records: 3 years from last contact

Platform log data: Up to 12 months, then anonymized

Aggregated / anonymized analytics: Retained indefinitely (cannot identify individuals)

Note: identity-verification documents and full banking details are retained by Stripe under Stripe’s own retention policy, not by Vitaay — see §3.6.

• Cookies & Tracking Technologies

Vitaay uses cookies and similar technologies to enhance your experience, analyze usage, and improve our platform. We use the following categories of cookies:

• Strictly Necessary Cookies — Required for platform operation, authentication, and security. Cannot be disabled.
• Functional Cookies — Remember your preferences such as language and display settings.
• Analytics Cookies — Understand how users interact with our platform (e.g., pages visited, session duration). Used with your consent.
• Performance Cookies — Monitor platform speed and stability. Used with your consent.

We do not use cookies for third-party advertising or cross-site behavioral tracking.

You can manage cookie preferences through our in-platform cookie consent tool or your browser settings. For EEA/UK users, we obtain your consent before placing non-essential cookies, consistent with the ePrivacy Directive. For California users, our cookie practices comply with applicable CCPA/CPRA opt-out requirements.

• Your Privacy Rights

10.1 Rights Available to All Users

• Access — Request a copy of the personal data we hold about you
• Correction / Rectification — Request correction of inaccurate or incomplete data
• Deletion / Erasure — Request deletion of your personal data (subject to legal retention requirements, including §8 financial retention periods for escrow/transaction records)
• Data Portability — Request your data in a structured, machine-readable format (JSON or CSV)
• Objection — Object to certain types of data processing based on legitimate interests
• Restriction of Processing — Request restriction of processing in certain circumstances
• Withdrawal of Consent — Withdraw consent where processing is based on consent, without affecting prior processing

10.2 Additional Rights for California Residents (CCPA/CPRA)

• Right to Know — Know what personal information we collect, use, disclose, and share about you
• Right to Delete — Request deletion of personal information, subject to exceptions
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing — We do not sell or share personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information beyond permitted purposes
• Right to Non-Discrimination — We will not discriminate against you for exercising your privacy rights

10.3 Additional Rights for EEA/UK Users (GDPR / UK GDPR)

EEA and UK residents may lodge a complaint with their national supervisory authority (e.g., the UK Information Commissioner’s Office) if they believe their rights have been violated.

10.4 Additional Rights for Indian Users (DPDPA)

Indian users have rights under the DPDPA 2023, including the right to access information about personal data processed, the right to correction and erasure, and the right to grievance redressal. You may nominate a representative to exercise these rights on your behalf.

10.5 How to Exercise Your Rights

To exercise any of these rights, contact us at connect@vitaay.ai with the subject line: "Data Rights Request — Vitaay". Please include your full name, email address associated with your account, and a description of your request. We will verify your identity and respond within:

• 30 days for GDPR / UK GDPR requests (extendable by 60 days for complex requests with notice)
• 45 days for CCPA/CPRA requests (extendable by an additional 45 days with notice)
• 30 days for DPDPA requests

Note: requests to delete escrow, transaction, or KYC-status data may be subject to the retention periods described in §8 and to Stripe’s own retention obligations as a regulated payment institution.

• Children’s Privacy

Vitaay is strictly intended for users aged 13 years and above. We do not knowingly collect personal information from minors under 13 years of age (or the applicable age of majority in the user’s jurisdiction, if higher).

In accordance with the Children’s Online Privacy Protection Act (COPPA) in the United States and equivalent laws globally, if we become aware that a minor has registered on our platform, we will immediately delete their account and all associated personal data. If you believe a minor has submitted personal information to us, please contact us at connect@vitaay.ai.

• Third-Party Links & Integrations

The Vitaay platform may link to or integrate with third-party social media platforms (Instagram, TikTok, YouTube, Twitter/X, LinkedIn, e-commerce) and other external services, including Stripe’s hosted onboarding and Express Dashboard. These platforms have their own privacy policies, and we are not responsible for their data practices, privacy standards, or terms of service. We encourage you to review the privacy policies of any third-party services you connect with Vitaay, including Stripe’s privacy policy at stripe.com/privacy.

When you authorize Vitaay to access your social media accounts via API, you are also subject to those platforms’ terms and data policies. You may revoke Vitaay’s access to these accounts at any time through the relevant platform’s settings.

• International Data Transfers

Vitaay is operated from India and may transfer your personal data to countries outside your home jurisdiction, including India, the United States, and other countries where our service providers (including Stripe) operate. We ensure appropriate safeguards are in place for all cross-border data transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for EEA data transfers
• UK International Data Transfer Agreements (IDTAs) for UK data transfers
• Compliance with India’s DPDPA cross-border transfer provisions and any notified adequacy frameworks
• Data processing agreements with all service providers receiving your data, including Stripe

By using Vitaay, you acknowledge that your data may be transferred to and processed in countries that may have different data protection standards than your home country. We take steps to ensure that your data receives an equivalent level of protection regardless of where it is processed.

• Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, Vitaay will:

• Notify affected users within 72 hours of becoming aware of the breach (consistent with GDPR requirements)
• Notify relevant supervisory authorities as required by applicable law
• Notify the Indian Data Protection Board as required under the DPDPA
• Notify affected US users as required by applicable US state breach notification laws
• Take immediate remedial action to contain, investigate, and prevent recurrence of the breach
• Provide details of the nature of the breach, data categories affected, likely consequences, and steps taken

Because card data and full KYC documents are held by Stripe rather than Vitaay (§3.6), a breach of Vitaay’s own systems would not, on its own, expose that category of data; Stripe maintains its own independent breach-notification obligations as a regulated processor.

• AI & Automated Decision-Making

Vitaay uses AI and machine learning algorithms to match brands with creators, analyze platform performance, and detect fraudulent activity. Where this automated processing produces decisions that have a significant or legal effect on you:

• EEA/UK users have the right not to be subject to solely automated decisions under GDPR Art. 22, and may request human review
• We will explain the logic of significant automated decisions upon request
• Our AI matching algorithms use data such as content niche, audience demographics, engagement rates, and campaign parameters — they do not use sensitive personal characteristics such as race, religion, or health data
• [NEW] In addition to matching, we use automated fraud and velocity screening on payment activity (e.g., unusually rapid tip cycling, or large first-time campaign fundings), primarily via Stripe Radar’s risk scoring supplemented by Vitaay-specific thresholds. Flagged activity is routed to human Admin review rather than being auto-blocked, and does not itself result in account suspension without human review.
• Do Not Track & Global Privacy Control

Some browsers transmit "Do Not Track" (DNT) signals. Our platform currently does not alter its behavior in response to DNT signals due to the lack of a uniform industry standard. We do, however, honor Global Privacy Control (GPC) signals for California residents as required under CCPA/CPRA, which will be treated as an opt-out of the sale or sharing of personal information.

• Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, applicable law, or regulatory requirements. We will notify you of material changes by:

• Sending an email notification to your registered email address at least 14 days before material changes take effect
• Displaying a prominent notice on the Vitaay platform
• Updating the "Last Updated" date at the top of this Policy

Your continued use of Vitaay after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to material changes, please cease using the platform and contact us to close your account.

• Contact — Privacy Enquiries

For any privacy-related questions, requests, or concerns, please contact:

Privacy Team: Vitaay

Email: connect@vitaay.ai

Subject Line: Privacy Enquiry — Vitaay

Website: https://www.vitaay.ai

Response Time: Within 30 days of receipt

© Vitaay 2026. All rights reserved.