Privacy Policy

At getvik, we respect your privacy and are committed to protecting your personal information. This policy explains what data we collect, how we use it, and the rights available to you.

1. Scope & Applicability

This Privacy Policy applies to all users of the getvik marketplace, including buyers, creators, and visitors accessing our website or related services.

2. Key Definitions

• Personal Information: Name, email, phone (for buyers during payment processing), payment identifiers, and payout-related information.
• Usage Data: IP address, device details, browser type, and activity logs.
• Sensitive Financial & Payout Information: Information such as PAN, bank account information, payout identifiers, or similar information required for platform operations.

3. Information We Collect

We collect information necessary to operate and secure the platform:

• Account: Name, email, and password credential (stored as a hash).
• Tax & Payout Information: We may collect PAN and related payout information where required for compliance, verification, or payouts.
• Account Setup & Security: We collect only the minimum information required to operate the platform securely. This may include contact details and payout-related information provided by users. Additional information may be requested as required for payouts or compliance at later stages.
• Transactions: We collect payment reference IDs, order details, and settlement statuses. We do not store sensitive credit card or bank login details. Transaction fees, payment-provider charges, currency conversion where applicable, settlement timing, and payout eligibility may vary by payment method and are reflected in the relevant transaction records.
• Usage Data: Logs, analytics, IP addresses, device/browser info.
• Support: Messages, emails, reports, feedback.
• Instagram and Meta integration: When a creator connects an Instagram professional account, we process the Instagram account ID, username, encrypted access token, token expiry, media or post identifiers, webhook events, eligible comments and messages, recipient identifiers, automation settings, reply text, delivery status, and related usage records. We also keep a contact record for each person who replies to the creator's automation: their Instagram username, name, the email address they choose to send, which automation reached them and when, and whether they tapped the link. The creator sees this list. It is deleted when the creator disconnects Instagram or deletes their Getvik account.
• Consultation communications: We process the policy accepted at booking, session outcome declarations, reminder delivery records, and optional feedback-email choices and timestamps to deliver bookings, handle refund review, and send requested feedback emails. Feedback-email preferences can be withdrawn from the private booking page without affecting the appointment or necessary booking updates.
• Google Calendar integration: When a creator connects Google Calendar, we process encrypted OAuth tokens, the connected calendar identifier, availability data returned by Google, and consultation event details such as times, attendee names and email addresses, event identifiers, and Google Meet links to check availability and schedule or manage bookings.

4. How We Use Your Information

• To operate and improve the getvik platform.
• To process purchases and deliver digital products.
• To send payouts to creators securely.
• To prevent fraud, abuse, and security threats.
• To send transactional emails such as receipts, alerts, and account updates. Optional marketing emails are sent only when you opt in and can be withdrawn at any time.
• To provide customer support.
• To connect a creator's Instagram professional account, receive eligible webhook events, and send creator-configured private messages and public comment replies through Meta's official APIs.

We process personal data for specified purposes including protecting Getvik, preventing fraud and abuse, maintaining platform security, enforcing our Terms, and complying with applicable legal obligations, in accordance with applicable data protection law.

5. Data Sharing

We never sell personal data. We share only what is needed for the relevant purpose with:

• Payment processors (Cashfree Payments) for payments and payouts.
• Hosting and cloud infrastructure: Google Cloud runs the Getvik API and background jobs, MongoDB holds the database, Cloudflare serves the site and stores files (R2).
• Email providers: ZeptoMail for account and order emails, Amazon SES for newsletters and marketing emails you confirmed. Support requests go to our support desk (Zoho).
• Google Analytics, only after you accept cookies, to measure how the site is used. Ad features are off.
• Google's image-safety service (Cloud Vision), which checks images and video frames that creators upload for prohibited content. It sees the file, not who uploaded it.
• Slack, for error alerts to the Getvik team. An alert holds the request path (secrets removed), the status, the error message and the IP address, so faults can be fixed. No account details are sent.
• Creators and affiliates when needed to fulfil a purchase, calculate attribution, provide customer support, or operate creator tools. Buyers should expect their purchase name and email to be visible to the relevant creator.
• Creator-configured webhook endpoints when a creator enables webhooks for order and fulfilment events.
• Meta and Instagram when a creator connects an Instagram professional account and directs getvik to process comments, messages, media identifiers, and reply actions. Instagram data is used only to provide the connected automation and analytics features, not for unrelated advertising or sale.
• Meta, through a creator's Meta Pixel when a creator adds their Meta Pixel ID and you accept cookies. On that creator's store, product, membership and checkout pages and the payment confirmation, your browser sends Meta your page views, cart adds, checkouts and purchases there (product IDs, amounts and currency), with Meta's own cookie and browser details. We never send your name, email or phone. Meta and the creator use this to measure and improve the creator's ads, under Meta's own terms and privacy policy.
• Google when a creator connects Google Calendar. We send availability checks and consultation event details to Google Calendar to create or update booking events and Google Meet links. Google processes that information under its own privacy terms.
• Authorities when required by applicable law.

Please note that we are not responsible for the privacy practices of third-party services linked to or integrated with our platform.

6. Cookies

We use first-party cookies that are necessary to operate Getvik, including login sessions and preferences. With your consent, when you visit a signup link containing a creator referral code or a product link containing an affiliate code, we set a signed first-party attribution cookie. It stores only the referral or affiliate code needed to credit the relevant user; it does not store your password, payment information, or other sensitive account credentials. It is a first-touch attribution cookie, expires after 30 days, and is configured as HttpOnly, Secure in production, and SameSite=Lax.

A referral or affiliate code can also reach Getvik without a cookie. If the signup link or product link you open contains a code, we read it from that link and use it for that signup or checkout. If you add the product to your cart, the cart keeps the code in page memory only, until checkout; nothing is stored on your device. The code is shown in the affiliate code field at checkout, where you can clear it. This happens whether or not you accept cookies.

Attribution cookies are used solely to attribute signup referrals and product affiliate purchases. They are not used for advertising or cross-site tracking. We use analytics cookies only after consent where applicable. If you reject cookies, we do not create attribution or analytics cookies, and any existing attribution cookies are removed on the next request. You can also delete or block cookies through your browser settings, but doing so may prevent attribution, login, or other website functionality.

If a creator adds a Meta Pixel to their store and you accept cookies, Meta sets its own cookies (_fbp, and _fbc when you arrive from a Meta ad) on that creator's pages so the creator can measure their Instagram and Facebook ads. Nothing is sent to Meta before you accept. Declining stops the pixel and removes these cookies.

When you sign in, we also set a security cookie, getvik_device. It holds a random identifier for your browser and nothing else, and we use it only to notice a sign-in from a browser we haven't seen before and email you about it. It is HttpOnly, Secure in production and SameSite=Lax, and expires a year after your last sign-in. Because it protects your account, it is set whether or not you accept optional cookies. For these alerts we keep a hashed form of the identifier, the browser and operating system, the IP address and the time of your recent sign-ins for up to a year, and delete them when your account is deleted.

When you watch a course, we set a second cookie, getvik_player_device, with a random ID for this browser. It is sent only on course video requests and lets us count the devices a course is open on. We keep only a hashed form of it, per course, for 24 hours. It is needed to deliver the course, so it is set without asking.

To prove your cookie choice, we keep a random ID in your browser's storage and record the choice with that ID, your IP address, browser and the time. We do this for Accept and for Decline. The ID is not used for analytics and is not linked to your account.

7. Data Retention

We retain information only as long as necessary for the stated purpose:

• Account data: kept until you delete your account.
• Transaction, invoice, payout, and ledger records: retained as required for accounting, tax, fraud prevention, dispute handling, and legal obligations.
• Support, trust, and messaging records: retained while needed to resolve the request, protect users, and maintain an auditable support history.
• Webhook delivery payloads: automatically expired after 30 days unless required for an active delivery or dispute.
• Instagram access tokens: stored encrypted while the account is connected and removed when the account is disconnected or deleted.
• Instagram webhook payloads, queued replies, delivery activity, analytics cache, contact records, and tracked-link attribution records: retained only while needed to operate the connected feature and provide activity history. Completed reply history is removed after 15 days. Webhook inbox records expire within 30 days. Tracked-link, reply-dedupe and alert records are kept for up to 400 days so link statistics stay accurate. Contact records are kept while the account is connected. Meta deauthorization, a verified Meta deletion request, or account erasure removes the related Instagram account, token, automation, webhook, queue, analytics-cache, daily statistics, alert, contact, and tracked-link records, subject to lawful retention obligations.
• Google Calendar OAuth tokens: stored encrypted while connected and revoked with Google and removed from getvik when disconnected. Disconnecting moves active consultation products to draft; booking records, event identifiers, and Meet links may remain with the related consultation record for service delivery, support, and legal obligations.
• Analytics view records and logs: retained only for security, reliability, attribution, and aggregated product measurement, then deleted or anonymized according to operational schedules.

8. Security

We use encryption, secure storage practices, access controls, and monitoring to protect your data. No system is perfect, report any concerns to our support team.

9. Children's Privacy

getvik is not intended for individuals under the age of 18. We do not knowingly collect data from minors.

10. Your Rights

You may request to:

• Access your personal data.
• Correct inaccurate information.
• Request deletion of your personal account data.
• Export your account information.
• Withdraw optional analytics and marketing consent.
• Nominate another individual to exercise your rights in the event of death or incapacity.

Note on Account Deletion & Record Retention: Your account will be deactivated immediately. You can reactivate it by logging in within the next 7 days. After 7 days, your account will be permanently deleted and cannot be restored. Upon permanent deletion, your personal data will be deleted or anonymized, except for information we are required to retain to comply with applicable legal, tax, financial, or regulatory obligations, such as orders, invoices, payout records, and ledger entries. If you are a creator, your products will be removed from sale and archived solely to enable existing buyers to access purchases made before your account deletion.

Authenticated users can use the Privacy & data center to download an export, submit correction/erasure/grievance requests, manage nominee details, and manage optional consent preferences. The export covers your account, purchases, payouts, messages, reviews, consents and privacy requests. Instagram, consultation, course-learning and sign-in records are not in the file yet; email [email protected] to receive them. Export and erasure actions require recent email verification. Instagram users can also follow the public Meta and Instagram data deletion instructions. Creators can disconnect Google Calendar from the Consultations dashboard; this revokes access and removes stored Google credentials.

11. Additional Disclosures for Indian Data Principals (DPDP Act, 2023)

If you reside in India, you are a "Data Principal" and Getvik acts as a "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

• Consent and Notice: We provide purpose-specific collection notices and record the applicable policy and notice versions, collection method, timestamp, and request context when consent is collected.
• Consent Withdrawal: You can withdraw optional analytics and marketing consent in the Privacy & data center or by contacting [email protected]. We will cease optional processing unless required or authorized under applicable Indian laws.
• Rights of Data Principals: You have the right to: (i) obtain a summary of personal data processed; (ii) seek correction, completion, or erasure of your personal data; (iii) register a grievance with our Grievance Officer; and (iv) nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance Redressal and Appeal: We aim to acknowledge grievances within 3 business days and provide a response or status update within 30 calendar days. Contact our Grievance Officer at [email protected]. If you are unsatisfied with the resolution, you may escalate and register a complaint with the Data Protection Board of India (DPBI) where applicable.

12. Contact

13. Changes to This Policy

We may update this policy from time to time. Significant changes will be posted with an updated effective date.