Privacy Policy

This policy covers personal data processed by SuperCreators when you visit supercreators.in, create an account, publish a course, or make a purchase. It is written to align with the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices) Rules, 2011.

Where a creator collects data from their own buyers through custom checkout questions, that creator is the data fiduciary for that data and we process it on their behalf.

You give us directly:

• Account details — name, email address, phone number, password hash, profile photo.
• Creator details — bank account or UPI ID for payouts, PAN and GSTIN where required, KYC documents requested by our payment partner.
• Course content — text, images, video, files and any other material you upload.
• Purchase details — courses bought, coupon codes used, and answers to any custom checkout questions the creator has configured.
• Support correspondence — messages you send us, including any attachments.

Collected automatically:

• Device and browser type, operating system, and approximate location derived from IP address.
• Usage data — pages viewed, lessons completed, time spent, drop-off points, and referral source.
• Cookies and similar technologies, described in our cookie notice.

• To create and secure your account, and to authenticate you when you sign in.
• To deliver courses you have bought and to give creators the sales, completion and drop-off analytics shown in their dashboard.
• To process payments, issue payouts, generate invoices and meet tax obligations.
• To issue and verify completion certificates.
• To send transactional messages — receipts, access links, payout confirmations, security alerts. These are not marketing and cannot be opted out of while your account is active.
• To send product updates and offers, where you have consented. You can withdraw this at any time.
• To detect and prevent fraud, chargeback abuse, account takeover and content piracy.
• To comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal data. We share it only with the following categories of recipient, and only to the extent needed:

• Payment processing — Razorpay, for transactions, settlements, refunds and KYC.
• Creators — when you buy a course, the creator receives your name, email and your answers to their checkout questions, so they can deliver and support the course.
• Infrastructure and analytics providers — cloud hosting, email delivery, error monitoring and product analytics, each bound by contract to process data only on our instructions.
• Professional advisers — auditors, accountants and lawyers, under confidentiality.
• Authorities — where disclosure is required by law, court order, or to protect the rights and safety of users.

We keep account data for as long as your account is active. After you delete your account we remove or anonymise personal data within ninety days, except:

• Transaction and tax records, retained for eight years as required under Indian tax law.
• Course content still accessible to learners who purchased it before deletion.
• Records needed for an ongoing dispute, investigation or legal claim, kept until it is resolved.

We use TLS encryption in transit, encryption at rest for sensitive fields, hashed passwords, role-based internal access controls, and logging of administrative actions. No system is perfectly secure — if a breach affects your data, we will notify you and the Data Protection Board without undue delay, as required by law.

You may, at any time:

• Access the personal data we hold about you and request a copy.
• Correct or complete inaccurate data through your account settings or by writing to us.
• Erase your account and associated data, subject to the retention exceptions above.
• Withdraw consent for marketing communications, without affecting the lawfulness of prior processing.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unsatisfied.

We respond to verified requests within thirty days. We may ask for identity verification before acting on a request.

SuperCreators is not directed at children under 18. We do not knowingly process a child’s personal data without verifiable parental consent. If you believe a child has created an account, write to us and we will remove it.

Some of our infrastructure providers operate servers outside India. Where personal data is transferred abroad, we ensure comparable protection through contractual safeguards, and we do not transfer to territories restricted by the Government of India.

We may update this policy. The revision date at the top always reflects the current version, and we will notify you of material changes by email or an in-app notice.

Under Indian law, you may contact our Grievance Officer for any data-related complaint: