Privacy Policy

Effective 5 October 2026

1. Introduction

Statsbay ("Statsbay", "we", "us") is an influencer campaign management and analytics platform for brands and agencies, available at statsbay.com. Statsbay is operated by Mrinbit, Nayabad, Kolkata 700094, India.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to:

• Customers: brands, agencies and their team members who create a Statsbay account.
• Creators: influencers who connect their YouTube channel to Statsbay, or whose public profile and posts are added to Statsbay by a customer.
• Visitors: people who visit our website or click a Statsbay tracking link.

We process personal data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the rules made under it.

2. Information we collect

We collect the following information:

• Account information: your name, work email, company name, account type (brand or agency), and either your password (stored securely by our authentication provider) or your Google sign-in details. We also store your selected plan and trial dates. You provide this when you sign up or update Settings.
• Campaign data: campaign names, budgets, dates, deliverables, payment terms, spend, notes, and the conversions and revenue you enter or upload. You and your team provide this.
• Creator information: creator name, username, profile link, follower or subscriber count, category, city, contact email and phone number, and rate card. Customers enter this, or it is fetched from public profiles.
• Public post data: post links, views, likes, comment counts, titles, thumbnails, publish dates and video duration of public Instagram, Facebook and YouTube content. We get this from public sources through our data providers and the YouTube Data API.
• YouTube data from connected channels: when a creator connects their YouTube channel, we collect the channel ID and channel name, and for that creator's videos in the requesting brand's campaigns, video view counts and audience retention data (the share of viewers watching each part of the video). We collect this only after the creator signs in with Google and approves read-only access. See section 3.
• Google sign-in tokens: when a creator connects YouTube, we store an access token and refresh token on our servers only, so we can read the data above. These tokens are never shown in the app or sent to the browser.
• Tracking link data: the time of each click, a one-way hash of the IP address (we do not store the IP address itself), browser and device type, and the referring website. This comes from people who click a Statsbay tracking link.
• Payment information: your plan, billing period, invoices and payment status. Card and bank details are handled by our payment processor and are not stored by Statsbay.
• Support and usage data: support tickets and messages, login times, actions in the app, credit usage and error logs.

Cookies. We use essential cookies and similar storage to keep you logged in, remember your settings and keep the service secure. We do not use advertising cookies.

3. Google and YouTube data

Statsbay uses YouTube API Services. By using Statsbay's YouTube features, you agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

Public YouTube data. We use the YouTube Data API to read public information about videos and channels that customers add to Statsbay, such as view, like and comment counts, titles, thumbnails, duration and subscriber counts.

Connected YouTube channels. A creator can choose to connect their YouTube channel by signing in with Google. We request read-only access (the youtube.readonly and yt-analytics.readonly permissions) and use it only to:

• confirm which channel was connected, and
• read view and audience retention data for the creator's videos in campaigns with the brand that requested access, so we can show that brand how many viewers watched the sponsored segment.

We cannot upload, edit or delete anything on the creator's channel. A connection is shared only with the brand account that requested it.

Limited Use. Statsbay's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI or machine learning models.

Revoking access. A creator can disconnect at any time by removing Statsbay from their Google Account permissions, and a brand can disconnect a creator from Statsbay. When access is revoked, we stop fetching data and delete the stored access tokens. Analytics data already shown in a campaign is deleted within 30 days of revocation, unless the creator asks us to delete it sooner.

4. How we use information

We use personal data only for these purposes:

• Provide the service: create and secure your account, store your campaigns, fetch post data, calculate metrics such as CPV, CPC and ROAS, and run tracking links.
• Billing: manage trials, subscriptions, credits and invoices.
• Support: answer your questions. Our support team views your account only when you grant access in Settings, for the time you choose.
• Security and abuse prevention: detect fraud, misuse and bot clicks, and enforce our Terms of Service.
• Improve Statsbay: understand which features are used and fix errors, using aggregated or de-identified data where possible.
• Communicate with you: send login codes, account notices and billing emails. We send marketing emails only if you opt in, and every marketing email has an unsubscribe link.
• Legal obligations: keep records required by tax and accounting laws and respond to lawful requests.

We do not sell personal data, and we do not use it to show advertising.

5. Sharing and service providers

We share personal data only with the service providers who help us run Statsbay, under contracts that limit their use of it, and only as needed for the purposes above:

• Base44 (Wix.com Ltd.): hosting, database and user authentication.
• Google (YouTube API Services): public YouTube data and, for connected channels, YouTube Analytics data.
• Apify: fetching public Instagram and Facebook post data.
• Payment processor: processing payments.
• Email provider: sending login codes and account emails.

We may also share data:

• Within your account: with team members you invite.
• For legal reasons: when required by law, court order or a government authority, or to protect the rights and safety of our users and the public.
• In a business transfer: if Statsbay is merged, acquired or sold, data may transfer to the new owner, who must continue to protect it under this policy. We will notify you before that happens.

We never share Google or YouTube user data with anyone other than the brand that requested access, and we never sell it.

Statsbay staff access. Our administrators may access account data when needed for security, fraud prevention or legal reasons. Every such access is logged.

6. Storage, transfers and retention

Our service providers may store and process data on servers outside India. When data is transferred abroad, we do so only as permitted under Indian law and take reasonable steps to keep it protected.

We keep data for these periods:

• Account and campaign data: while your account is active. Deleted within 30 days after you delete your account. Backups are overwritten within 90 days.
• YouTube Analytics data and tokens: until the creator or brand disconnects. Tokens are deleted immediately, and analytics data within 30 days, as described in section 3.
• Tracking link click records: 12 months, after which we keep only aggregated totals.
• Invoices and billing records: as long as Indian tax and accounting laws require.
• Logs of staff access: 2 years, for security and audit.

7. Security

We use reasonable security measures to protect personal data, including encrypted connections (HTTPS), secure password handling by our authentication provider, keeping API keys and access tokens on the server only, access controls by role, and logging of staff access to customer accounts.

No system is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we hold about you and how we use it;
• correct, complete or update inaccurate or incomplete data;
• have your data erased, unless we must keep it by law;
• withdraw consent at any time, which stops future processing based on that consent;
• nominate another person to exercise these rights if you die or become unable to; and
• raise a grievance with us, and if you are not satisfied with our response, complain to the Data Protection Board of India.

Customers can edit most data directly in Settings and delete their account there. For anything else, email privacy@statsbay.com. We will respond within 30 days.

Creators. If a brand added your public profile or contact details to Statsbay, that brand decides how your data is used in its campaigns, and we process it on the brand's behalf. You can contact the brand directly, or email us and we will help pass on or act on your request.

9. Children, changes and contact

Children. Statsbay is a business service and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy. We may update this policy as Statsbay changes. We will post the new version here with a new effective date, and notify customers by email or in the app before significant changes take effect.

Grievance Officer and contact

• Grievance Officer: Mrinmoy
• Email: privacy@statsbay.com
• Address: Mrinbit, Nayabad, Kolkata 700094, India

We will acknowledge grievances within 72 working hours and aim to resolve them within 30 working days.