Start bluttering

Privacy Policy

Effective From : 30-09-2026

1. INTRODUCTION

Welcome to Blutter App Privacy Policy. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and share your personal information when you visit our website or mobile application (collectively, the "Platform" or the “Blutter App”), developed by Efficacy Techlabs Private Limited, a company incorporated in India (the “Company” or “We” or “Us” or “Our).

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Platform.

2. INFORMATION WE COLLECT

2.1. Information You Provide Directly

  • At the time of Account Registration- Full name, email address, phone number, username, password, date of birth, age, profile picture, gender, IP Address, language preference
  • Identity Verification, if sought- Government-issued ID (Aadhaar, PAN, Passport, Driving License), photographs, address proof
  • Transaction Data and Financial Information- Purchase Records, biller name/id, amount, transaction ID, average order value, lifetime spends, bank account details, UPI ID, credit/debit card details (processed securely via RBI Authorised Payment Aggregator), billing address, transaction history
  • Additional at the time of Creator Registration- Social media handles, follower count, content categories, bio, portfolio links, PAN and GST details
  • Communication Data- Messages, chat logs, emails, support tickets, feedback, call activity patterns, list of users you interact with, call/chat timestamps, duration of communication, call pick-up rate, call recordings by the Platform (with consent)
  • Content Data- Photos, videos, audio files, text posts, comments uploaded on the Platform

2.2. Information Collected Automatically

a) Device Information Used for Accessing Platform: Device type and model, operating system, unique device identifiers (IMEI, MAC address), browser type and version, plug-ins, screen resolution, battery level, available storage, signal strength, foreground/background status, language of the device as set by User, Bluetooth signals, nearby Wi-Fi and cell towers.

b) Platform Usage Data: Pages visited, features used, time spent on Platform, click patterns, search queries, interaction with content and Creators.

c) Location Data: IP address, GPS location, including city, state, country (wherein the same may be determined by way of your payment currency), and with your permission, address, timezone, access to camera, microphone, speaker, image/audio/video files.

d) Network Data: Mobile carrier, ISP, IP Address, time zone, connection speed, language.

e) Log Data: Access times, error logs, referring URLs, pages viewed, links clicked.

f) Cookies and Tracking Technologies: Session cookies, persistent cookies, pixels, web beacons, local storage, crash reports, referred URLs (detailed in Section 12).

2.3. Information from Third Parties

a) Social Media Platforms: Profile information, follower data, engagement metrics (when you link accounts).

b) Payment Processors: Transaction status, payment confirmation, refund status.

c) Identity Verification Partners: KYC verification status, document authenticity.

d) Analytics Providers: Aggregated usage statistics, demographic insights.

e) Marketing Partners: Campaign performance, referral source.

3. PURPOSE OF DATA COLLECTION

We collect and process your personal data for the following purposes:

3.1. Service Delivery

  • To create and manage your account
  • To facilitate connections between Creators and Users
  • To enable performance of Services offered on the Platform
  • To process payments, payouts, refunds, and manage financial transactions
  • To provide customer support and respond to inquiries
  • To send service-related notifications and updates

3.2. Platform Improvement

  • To analyze usage patterns and improve Platform functionality
  • To develop new features and services
  • To conduct research and analytics
  • To personalize user experience and content recommendations
  • To optimize app performance
  • To improve the accuracy, relevance and responsiveness of AI-driven features

3.3. Safety and Security

  • To verify user identity and prevent fraud
  • To detect, prevent, and address technical issues
  • To enforce our Terms & Conditions and Community Guidelines
  • To protect the rights, property, and safety of our users and the public
  • To comply with legal obligations and respond to lawful requests
  • For internal operations like troubleshooting
  • For safety monitoring and moderation
  • To detect and prevent violation of Platform Policies
  • To respond to a medical emergency involving a threat to life or immediate threat to the health of User or any other individual
  • For taking measures to ensure safety of or provide assistance or services to any individual during a disaster or any breakdown of public order

3.4. Marketing and Communication

  • To communicate with you for matters as stated in the Platform Policies or as required by law
  • To send notifications, including policy updates
  • To send promotional materials (with your consent)
  • To inform you about new features, updates, and offers
  • To conduct surveys and collect feedback
  • To provide relevant advertising (with your consent)
  • To support chatbot-based interaction with users
  • To enhance the effectiveness of our marketing and user engagement efforts

3.5. Legal Compliance

  • To comply with applicable laws, regulations, and legal processes
  • To respond to requests from Central Government, State Government, Local Authorities or any of their instrumentalities
  • To fulfill tax and financial reporting obligations
  • To maintain records as required by law

4. LEGAL BASIS FOR PROCESSING

We process your personal data based on the following legal grounds:

4.1. Consent

Where you have given explicit consent for processing your personal data for purposes specified in this policy by agreeing to the terms of Platform policies or other specific purposes. You may withdraw consent at any time. The consequence of such withdrawal shall be borne by the Data Principal and such withdrawal shall not affect the legality of processing of the personal data based on consent before the withdrawal.

4.2. Contract Performance

Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

4.3. State Accorded Benefit to Data Principal

For the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed.

4.4. State Function

For the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State.

4.5. Legal Obligation

For fulfilling any obligation under any law for the time being in force in India on Data Fiduciary to disclose any information to the State or any of its instrumentalities.

4.6. Judgement or Decree or Order

For compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India.

4.7. Medical Emergency

For responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual.

4.8. Public Health

For taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health.

4.9. Public Order

For taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order.

5. DATA SHARING AND DISCLOSURE-

We do not share your information publicly. However, we may share your personal data with the following categories of recipients.

5.1. Service Providers

We engage third-party service providers to help operate and maintain the Platform. These may include:

  • Payment Processors (eg. Razorpay
  • Cloud Service Providers (AWS, Google Cloud)
  • Communication Services
  • Analytics and diagonostic partners
  • Identity Verification Services
  • Customer Support Tools
  • Security and fraud detection services
  • User Engagement and notification platforms
  •   AI service providers

The information is shared with Service Providers under contracts with strict confidentiality obligations.

5.2. Creators and Users

  • Creators receive limited User information necessary for service delivery
  • Users receive Creator profile information as displayed on the Platform
  • Chat messages and call logs are accessible to both parties involved

5.3. Legal and Regulatory Authorities

We may disclose personal data to:

  • Law enforcement agencies pursuant to legal proceedings or to comply with legal requests
  • Government authorities as required by applicable law
  • For enforcement of Terms of Use or investigation of policy violations
  • Courts, tribunals, and regulatory bodies
  • Tax authorities

5.4. Business Transfers

In the event of a merger, acquisition, reorganization, restructuring, or sale of assets of Platform or Company, your personal data may be transferred to the relevant acquiring entity.

5.5. With Your Consent

We may share your data with third parties when you have explicitly consented to such sharing.

5.6. Aggregated or De-identified Information

We may share aggregated or de-identified data (which cannot be used to personally identify You) with partners or third parties for analytical, research or service improvement purposes.

6. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and to meet legal obligations and defend disputes:

  • Account Information: Duration of account + 5 years thereafter
  • Transaction Records: 10 years after the Transaction
  • KYC Documents: 10 years after account closure
  • Communication Data (Chats, Calls): 3 years from creation or as required by law
  • Usage Logs: 2 years
  • Marketing Preferences: Until consent is withdrawn
  • Support Tickets: 5 years after resolution
  • Cookies and Analytics Data: As specified in Cookie Policy

After the retention period, data will be securely deleted or anonymized in accordance with our data disposal procedures.

If you request deletion of your account or content, we will remove your data from our active systems. However, copies of certain information may continue to exist in backup storage or archived versions of the platform.

Also, because of the way the internet works, content that has been shared or saved by other users may continue to exist outside our control, even after deletion. This includes screenshots or downloads shared through other platforms.

7. DATA SECURITY

We implement robust technical and organizational measures to help keep your personal data protected, including:

7.1. Technical Safeguards

a) Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256).

b) Secure Payment Processing: PCI-DSS compliant payment gateway (Razorpay); we do not store card details.

c) Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA) for internal systems.

d) Firewalls and Intrusion Detection: Enterprise-grade firewalls, IDS/IPS systems, DDoS protection.

e) Regular Security Audits: Periodic vulnerability assessments and penetration testing.

f) Data Backup: Regular encrypted backups with secure off-site storage.

g) Secure Development: Secure coding practices, code reviews, security testing.

7.2. Organizational Safeguards

a) Employee Training: Regular data protection and security awareness training.

b) Confidentiality Agreements: All employees and contractors bound by confidentiality obligations.

c) Access Limitation: Data access limited to personnel who require it for job functions.

d) Incident Response Plan: Documented procedures for data breach detection, containment, and notification.

e) Vendor Assessment: Due diligence and security assessments for third-party service providers.

7.3. RBI Compliance

In compliance with Reserve Bank of India guidelines:

  • All payment data, including back-up data and archives, are stored on servers located in India
  • Card-on-file tokenization as per RBI directives
  • Transaction data purged as per RBI timelines
  • Regular compliance audits and reporting

However, your account security also depends upon You. Please keep your login details confidential and do not share with anyone.

While we have taken reasonable steps to protect your information, no system is completely secure. Information shared over the internet always carries some risks. We cannot guarantee that our safeguards will stop unauthorized attempts to access or misuse your data.

8. YOUR RIGHTS

Under the DPDP Act, you have the following rights:

a) Right to Access: You have the right to obtain confirmation and access to your personal data being processed.

b) Right to Correction: You have the right to correct inaccurate or incomplete personal data.

c) Right to Erasure: You have the right to request erasure of your personal data, subject to legal retention requirements.

d) Right to Grievance Redressal: You have the right to register complaints with our Grievance Officer and escalate to the Data Protection Board of India.

e) Right to Nominate: You have the right to nominate an individual to exercise your rights in case of death or incapacity.

To exercise any of your rights, please contact us at contact details of the Grievance Officer notified at the beginning of this Privacy Policy.

In case you have any questions with respect to processing of your personal data, you may reach out to the Grievance Officer as per details provided in the beginning of this Privacy Policy.

We may request verification of your identity before processing your request.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1. Types of Cookies We Use

Cookie Type

  • Essential Cookies
    • Purpose: Required for Platform functionality, authentication, security
    • Duration:Session / Persistent
  • Performance Cookies
    • Purpose: Analyze usage patterns, improve performance
    • Duration: Up to 2 years
  • Functional Cookies
    • Purpose: Remember preferences, settings, language
    • Duration: Up to 1 year
  • Analytics Cookies
    • Purpose: Track user behavior, measure engagement
    • Duration: Up to 2 years
  • Advertising Cookies
    • Purpose: Deliver targeted advertisements, measure campaign effectiveness
    • Duration: Up to 1 year

9.2. Third-Party Cookies

We may use cookies from third-party services including:

  • Google Analytics (usage analytics)
  • Facebook Pixel (advertising)
  • Razorpay or other applicable payment aggregator (payment processing)
  • Hotjar (user experience analysis)

9.3. Managing Cookies

You can manage cookie preferences through:

  • Browser Settings: Most browsers allow you to refuse or delete cookies
  • Cookie Consent Banner: Use our cookie consent tool on the Platform
  • Opt-Out Links: Use third-party opt-out mechanisms (e.g., Google Ads Settings, Facebook Ad Preferences)

Note: Disabling certain cookies may affect Platform functionality.

10. CHILDREN'S PRIVACY

10.1. Age Restrictions

Our Platform is not intended for individuals under the age of 18 years.

10.2. DPDP Act Compliance (India)

In accordance with the Digital Personal Data Protection Act, 2023:

  • We do not process personal data of children (under 18 years) without verifiable consent from a parent or lawful guardian
  • We do not undertake tracking, behavioral monitoring, or targeted advertising directed at children
  • We do not process personal data that is likely to cause harm to a child

10.3. Parental Rights

Parents or legal guardians may:

  • Request access to their child's personal data
  • Request correction or deletion of their child's personal data
  • Withdraw consent for processing their child's personal data

To exercise these rights, please contact the Grievance Officer with proof of parental/guardian relationship.

11. INTERNATIONAL DATA TRANSFERS

11.1. Data Transfer Mechanisms

If your personal data is transferred outside India by Us, we ensure appropriate safeguards are in place:

a) Standard Contractual Clauses (SCCs): EU-approved contractual terms ensuring adequate data protection.

b) Adequacy Decisions: Transfers to countries recognized as providing adequate protection.

c) Binding Corporate Rules: Internal rules governing intra-group international transfers.

d) Contractual Necessity: Transfers necessary for the performance of a contract with you.

11.2. Data Localization (India)

In compliance with Indian regulations:

  • A copy of all personal data of Indian users is maintained on servers in India
  • Cross-border transfers are conducted in compliance with DPDP Act provisions

12. THIRD-PARTY LINKS AND SERVICES

12.1. External Links

Our Platform may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12.2. Social Media Integration

When you connect your social media accounts (Instagram, YouTube, Twitter/X, Facebook, etc.) to our Platform:

  • We receive profile information and engagement metrics as authorized by you.
  • Your interactions on social media are governed by the respective platform's privacy policy.
  • You can disconnect social media accounts at any time through your account settings.

12.3. Payment Gateway (Razorpay)

Payment transactions are processed through Razorpay Payment Solutions Pvt. Ltd. When you make a payment:

  • Your payment information is transmitted directly to Razorpay via encrypted channels
  • Razorpay's privacy policy governs the processing of your payment data
  • We receive only transaction confirmation, amount, and status—not your full card details
  • Razorpay is PCI-DSS compliant and regulated by RBI

For Razorpay's privacy practices, visit: https://razorpay.com/privacy/

13. AUTOMATED DECISION-MAKING AND PROFILING

13.1. Automated Decision-Making and Profiling

We may use automated decision-making and profiling for:

a) Fraud Detection

b) Content Moderation

c) Personalization

d) Risk Assessment

13.2. Your Rights

You have the right to:

  • Request human intervention in automated decisions
  • Express your point of view and contest decisions
  • Obtain an explanation of automated decisions that significantly affect you

To exercise these rights, contact the nodal officer.

14. DATA BREACH NOTIFICATION

We maintain comprehensive incident response procedures to detect, investigate, and respond to personal data breaches, in compliance with applicable law. Where required by law, we will notify you and the relevant authorities as soon as possible.

15. GRIEVANCE REDRESSAL

15.1. Grievance Officer / Nodal Officer

Name: Mr. Sachin Ruhela

Designation: Grievance Officer

Email: connect@blutter.app

Office Address: Office No. 412, JOP Plaza P-2, Sector 18, Noida, Gautam Budh Nagar 201 301, Uttar Pradesh, India

Working Hours: Monday to Friday - 10:00 AM to 6:00 PM IST (excluding Public Holidays)

15.2. Grievance Resolution Process

Step 1: Submit grievance via email or letter with all applicable details.

Step 2: Platform to acknowledge the receipt within 24 hours.

Step 3: Platform to investigate and review.

Step 4: Platform to identify resolution and response.

15.3. Escalation

If you are not satisfied with our resolution, you may escalate your grievance by e-mail to the Designated E-mail ID with "Escalation: [Action Type] - [Username]" in the subject line.

If you are still unsatisfied, you may further escalate to the Data Protection Board of India.

16. CHANGES TO THIS PRIVACY POLICY

  • We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.
  • For material changes that affect your rights or how we use your data, we will reach out to you directly, such as through an in-app notification, e-mail or SMS.
  • We encourage you to review this Privacy Policy periodically to stay informed about how your information is protected.
  • Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated terms, please discontinue use of the Platform and contact us for account deletion.

17. MISCELLANEOUS

This Policy is drafted in English. In case of any discrepancy between the English version and any translation, the English version shall prevail.

This Policy shall be read and construed along with other Platform Policies. The general provisions of Terms of Use, including definitions, Modifications, Dispute Resolution, confidentiality, assignment, waiver, relationship, Force-Majeure, survival, indemnification, limitation of liability, platform availability etc. shall apply mutatis-mutandis to this Policy also, unless specifically provided in this Policy to the contrary.

18. DEFINITIONS

For the purposes of this Privacy Policy:

  • "Data Principal" means the individual to whom the personal data relates.
  • "Data Fiduciary" means the Company, which determines the purpose and means of processing personal data.
  • "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
  • "Platform" refers to the Blutter website, mobile application, and all related services.
  • "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and erasure.
  • "Sensitive Personal Data" includes passwords, financial information (bank account, credit/debit card details), health data, biometric data, sexual orientation, and any other data as specified under applicable law.
  • "Third Party" means any entity other than the Data Principal and Data Fiduciary.

19. ACKNOWLEDGMENT

By using the Blutter App, you acknowledge that:

  1. You have read and understood this Privacy Policy;
  2. You consent to the collection, use, and processing of your personal data as described herein;
  3. You understand your rights and how to exercise them; and
  4. You agree to the terms set forth in this Privacy Policy.