Privacy Policy

1. Who we are and what this covers

Musubi (musubiclip.com) is a creator performance platform operated by Musubi Private Limited(CIN U62099RJ2026PTC115917), a company incorporated in India. Brands fund campaigns with a public rate per 1,000 views, creators post their own clips, and creators are paid on views the platform verifies. Sellers can also run a storefront at musubiclip.com/shop/yourname to sell digital downloads.

This policy explains what we collect, why, who we share it with, and how you get it removed. It covers the website, the signed in product and the mobile API.

2. Signing in with Google

Google is the only way to create an account. When you sign in we ask Google for the basic profile scopes (openid, email, profile) and receive exactly four things:

• Your Google account identifier, used to recognise you on return visits
• Your email address, used as your account identity and for transactional email
• Your name, shown on your profile and to brands whose campaigns you join
• Your Google profile picture URL, shown as your avatar

Musubi’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the features above. It is never sold, never used for advertising, and never transferred to others except as described in section 6.

You can revoke our access at any time from your Google account permissions page. Doing so signs you out; to remove the data we already hold, use section 8.

3. What you give us directly

Everyone:

• Name, email and profile picture, from Google as described above
• Optional phone number, and the city, region and country on your profile, which you can set or clear in settings at any time
• Which of creator, brand, seller or browsing describes you, so we can shape the product around it

Creators additionally:

• Your UPI id, used solely to send payouts
• Your Instagram username or YouTube handle, used to attribute clips to you
• Public URLs of the clips you submit as evidence for a campaign

Brands and sellers additionally:

• Business name, category, logo and GST number where you choose to provide them
• Campaign briefs, budgets and the artwork you upload
• Product listings, files and cover images for a storefront

4. What we collect from public platforms

Payment is settled on views the platform reports rather than on screenshots, so for every clip you submit we read its public performance:

• View counts and basic public post metadata from the YouTube Data API v3 for YouTube submissions
• View counts and basic public post metadata for Instagram submissions, collected on our behalf by a data provider
• A daily snapshot of those counts, taken on IST day boundaries, which is what your earnings are computed from
• If you connect your Instagram account through Instagram's own sign in, your username and account id, and for each reel you submit the insights Instagram gives its owner: views, accounts reached, average watch time, how many viewers skipped it, shares and saves. We use these to confirm the views on a clip are real

Unless you connect your Instagram account, we read only what is publicly visible on the post you chose to submit. We never ask for your social account password and we never read your messages or your list of followers. You can disconnect Instagram in Settings or in Instagram's own settings at any time.

5. What we collect automatically

• Device, browser and IP address, used for security and to detect fraud such as bot traffic, view inflation and duplicate accounts
• When you sign in, the approximate location (city, region and country) your connection came from, used to fill in your profile so you do not have to. It is only ever written to a profile that has none, so once you set any of it in settings we leave all three alone. If you clear all three, the next sign in fills them in again
• When you submit a clip, the IP address, browser and approximate location (city, region and country) the submission came from, used to detect coordinated or duplicate submissions
• Product analytics: pages viewed, features used and timestamps, so we can see which parts of the product work
• Session replays on a sample of sessions, with all form inputs masked, so passwords, one time codes, UPI ids and GST numbers are never captured
• Aggregate traffic measurement through Google Analytics
• Advertising measurement through the Meta Pixel: pages viewed and actions taken on the site, so we can tell which of our own ads bring people to Musubi
• Error and performance traces, so a failure can be diagnosed

Admin areas of the product are excluded from analytics entirely.

6. Who we share it with

We do not sell personal data. We use a small number of processors, each for one job:

• Google: sign in and authentication
• Razorpay: collecting wallet top ups and product payments
• A cloud provider for hosting, database and file storage, in the Asia Pacific (Mumbai) region
• Google Analytics: aggregate traffic measurement
• Meta: measuring our own ads. When you sign up, finish onboarding, top up a wallet, buy a product or ask to book a brand call, we send Meta that event with the amount paid, your browser and IP address, and your email and phone number hashed with SHA 256 so the originals are never sent, and Meta matches it to an ad you may have seen
• A data provider that reads public Instagram post metrics
• YouTube Data API: reading public Shorts view counts and confirming channel ownership
• Instagram API, from Meta: confirming the account you connect is yours and reading the insights on the reels you submit, only if you choose to connect
• An AI provider that checks community feed posts and comments before they appear. We send the text you wrote and nothing that names you
• A content delivery network that serves the site and supplies the approximate location of each request
• A monitoring provider for error and performance traces
• Email providers that send transactional email
• Law enforcement or a regulator: only where Indian law requires it

Brands see the clips you submit, your creator name and the public performance of those clips. They never see your email, phone number or UPI id.

7. How long we keep it

• Account data, for as long as your account exists
• Daily view snapshots, for 400 days, so a campaign can be audited and a 90 day chart drawn
• The IP address a clip was submitted from, for 90 days, after which it is erased and only the approximate location is kept
• Financial and ledger records, for the period Indian tax law requires
• Session replays and product analytics, for the retention window configured with our analytics provider
• After deletion, everything except records we are legally required to keep is removed within 30 days

8. Your choices and your rights

Under the Digital Personal Data Protection Act 2023 you can ask us to do any of the following, and we will respond within 30 days:

• Give you a copy of the data we hold about you
• Correct anything that is wrong
• Delete your account and the data attached to it
• Withdraw consent for analytics and session replay
• Nominate someone to exercise these rights if you cannot

9. Security

• Everything travels over HTTPS with TLS
• There is no password to steal: authentication is delegated to Google
• Sessions use short lived signed tokens kept in your browser's local storage, and signing out removes them
• Money moves through a double entry ledger in integer paise, and payouts go only to the UPI id saved on your account
• Uploaded files are stored in private buckets and served through signed access
• Access to production data is restricted and logged

10. Cookies

We do not use cookies to keep you signed in. Your session is a signed token kept in your browser's local storage, which is essential and cannot be turned off while you are using an account.

We also set analytics cookies, including Google Analytics, and a Meta Pixel cookie that measures our own ads, described in sections 5 and 6. We do not run ad networks or show ads on the site. You can block these cookies in your browser, or write to us to opt out, and the product will continue to work.

11. Children

Musubi is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.

12. Where your data lives

Data is stored in the Asia Pacific (Mumbai) region. Some processors listed in section 6 operate outside India, so limited data may be processed abroad under their own contractual protections.

13. Changes to this policy

If we change this policy materially we will email account holders and update the date at the top. Continuing to use Musubi after that constitutes acceptance.

14. Contact and grievances

For any privacy question, request or complaint, write to contact@musubiclip.com. We are the data fiduciary for the information described here and will acknowledge a grievance within 30 days.

Musubi, India. contact@musubiclip.com