Privacy Policy
How Cr8rStore handles personal data — what we collect, why, how long we keep it, and how you get it changed or deleted.
Version 2026-11-14.2 · Applies to everyone using cr8rstore.in
1. Who we are, and the two roles we play
Cr8rStore is operated by LEGAL_ENTITY — to be filled in, registered at REGISTERED_ADDRESS — to be filled in ("we", "us"). We run cr8rstore.in, where creators build a store and sell to their own audience.
Which obligations we owe you depends on who you are, and this is the most important thing to understand about this policy:
- For creators, we are the data fiduciary. You give us your personal data to open an account and run a store, and we decide how it is handled. This policy is our notice to you.
- For buyers and visitors, the creator whose store you are on is the data fiduciary. They decide what to ask you for and what to do with your answers. We process that data as a data processor on their instructions, and only to make their store work. We do not use it for our own purposes.
- For a small set of platform-level data — security logs, aggregate traffic counts and the operation of the service itself — we are the fiduciary regardless of whose store it came from.
A practical consequence: if you are a buyer who wants your details removed from a creator’s customer list, ask that creator first. If they do not act, write to us at GRIEVANCE_OFFICER_EMAIL — to be filled in and we will.
2. What we collect
Itemised below, because a general description is not enough under the DPDP Act. Nothing is collected that is not in this table.
| Data | Who it is about | Why we have it |
|---|---|---|
| Name and email address | Creator | To create and secure your account, and to write to you about your store |
| Password and two-factor settings | Creator | Held by our authentication provider, Clerk. We never receive or store your password |
| Store name, link, bio, profile picture, cover image, social links | Creator | This is your public store. You chose to publish it |
| Products you create: titles, descriptions, prices, images, files, settings | Creator | To render your store and deliver what you sell |
| Google account email and an encrypted access token | Creator | Only if you connect Google Calendar, so bookings land in your calendar. Stored encrypted and never shown to a browser |
| Name, email address, phone number (if asked for), and answers to the creator’s own form questions | Buyer | Collected by the creator through their store, to deliver what you asked for and to contact you about it |
| Booking time, time zone, and membership or download records | Buyer | To honour a booking, grant access to a file, or keep a membership active |
| Email delivery outcomes, and addresses that bounced or complained | Buyer | So we stop emailing an address that does not work or asked us not to |
| A daily-rotating pseudonymous identifier, traffic source, referring website, UTM tags, device type (phone, tablet or desktop), approximate country, region and city, and the page visited | Visitor | To give the creator counts of how their store is doing. See section 4 for what this deliberately is not |
| A one-way hash of your IP address, held for under a minute | Visitor | To stop one source flooding a store with requests. The address itself is never written down |
| Google Analytics measurements: pages viewed, approximate location, device and browser, and a Google-set identifier | Visitor | Only if you accepted analytics (section 5). Collected by Google on our behalf so we can see how our pages are used |
We do not collect payment card details, bank details, PAN, Aadhaar or any other government identifier. The service does not process payments at all today; when it does, card and bank details will go to a regulated payment partner and not to us.
3. How we use it, and on what basis
- To give you the service you asked for — your account, your store, and delivering what a buyer requested. This is the specified purpose you consent to when you create an account or submit a form.
- To write to you about something you did: a booking confirmation, a download link, a membership welcome, a reminder before a call. These are part of the service, not marketing.
- To keep the service working and safe — rate limiting, abuse prevention, error diagnosis, and backups.
- To show a creator aggregate numbers about their own store.
- To meet a legal obligation, or to establish or defend a legal claim.
We do not use personal data to train machine-learning models, and we do not make automated decisions about you that have a legal or similarly significant effect.
4. What we deliberately do not do
We use Google Analytics, and only if you agree to it (section 5). Everything in this list is still true alongside it, and each item is a design decision built into how the product works rather than a statement of intent.
- Our own store analytics never store your IP address or your browser user-agent string. The visitor identifier is a one-way hash that mixes a secret, the date and the store, so it cannot be reversed to an address.
- That identifier changes every day. Nobody is traceable across days.
- The store is part of the hash too, so the same person visiting two creators is two unrelated identifiers. We cannot build a profile of someone across stores, and neither can a creator.
- We do not sell personal data, rent it, or share it for anyone else’s advertising.
- We do not run advertising on this site, and we do not use your data to target ads at you anywhere else.
- We do not profile children, and we do not direct anything at them.
- A creator sees counts and breakdowns for their own store. They never see another creator’s data, and they never see a list of who visited.
- If you decline analytics, the Google Analytics script is never downloaded at all — it is not loaded and silenced, it is simply not requested.
7. Where it is held
Some of the providers above process data on servers outside India. Under the SPDI Rules we transfer personal data abroad only where the recipient maintains a level of protection comparable to that required in India, and only where the transfer is necessary to perform our contract with you. Under the DPDP Act, transfers are permitted except to territories the Central Government restricts by notification; we will stop transferring to any territory so restricted.
8. How long we keep it
| What | How long |
|---|---|
| Your account and store | Until you delete the account, then removed or anonymised within 90 days except where we must keep it |
| Products you delete | Hidden immediately; the record is retained so the orders and customers attached to it stay intelligible |
| Buyer records (bookings, memberships, download grants, form submissions) | Until the creator deletes them or closes their store. Kept after a product is deleted, so a buyer’s booking or purchase history is not silently erased |
| Raw analytics events | 90 days, then dropped automatically |
| Analytics totals (daily counts per store and per product) | Indefinitely. These are counts only — no identifiers, and nothing that can be traced to a person |
| Rate-limiting hashes | Under a minute |
| Google Analytics data | Held by Google under our account settings, currently 14 months, then deleted by Google |
| Addresses that bounced or complained | Indefinitely, because the whole purpose is to never email that address again |
| Records we must keep by law (tax, accounting) | For the period the law requires |
9. How we protect it
- All traffic is encrypted in transit (HTTPS).
- We never store your password. Authentication is handled by Clerk, and you can turn on two-factor authentication in your account settings.
- Access links sent to buyers — a download link, a membership page, a request page — are stored only as a one-way SHA-256 hash. A leaked database backup cannot be used to reach anyone’s files.
- Google Calendar access tokens are encrypted before storage and are never sent to a browser.
- Files sold to buyers are kept in private storage and reached only through a signed link that expires in minutes.
- Every query for a creator’s data is scoped to that creator, so one account cannot read another’s.
- Public endpoints are rate limited.
- We follow reasonable security practices and procedures as required by the SPDI Rules. No system is perfectly secure, and we do not claim otherwise.
10. If there is a breach
If personal data we hold is breached, we will:
- tell every affected person, and the Data Protection Board of India, without delay;
- give the Board the full account — cause, sequence of events, remedial measures and the notices we sent — within 72 hours of becoming aware, or any longer period the Board allows; and
- report to CERT-In within 6 hours where the incident falls within its directions.
There is no severity threshold on the first two. Every personal data breach triggers them.
11. Your rights
You can exercise any of the following by writing to our Grievance Officer (section 12). Tell us the email address you used, so we can find your records — we will not ask for an identity document we do not already hold.
- Access — a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction — have anything inaccurate corrected, anything misleading set right, and anything incomplete completed. Creators can edit most of this directly in their dashboard.
- Erasure — have your personal data deleted, unless we still need it for the purpose you gave it for or the law requires us to keep it.
- Withdraw consent — at any time, and as easily as you gave it. Processing stops, though what we did beforehand remains lawful and withdrawal may mean we can no longer provide the service.
- Nominate — name someone to exercise these rights for you if you die or become incapable of exercising them yourself.
- Grievance redressal — complain to us, and escalate (section 12).
Rights that commence with the DPDP Act’s substantive provisions on 13 May 2027 are available from us now in any case; we would rather honour them early than tell you to wait.
12. Grievance Officer
As required by the SPDI Rules, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, the person responsible for your complaints is:
- Name: GRIEVANCE_OFFICER_NAME — to be filled in
- Email: GRIEVANCE_OFFICER_EMAIL — to be filled in
- Phone: GRIEVANCE_OFFICER_PHONE — to be filled in
- Address: REGISTERED_ADDRESS — to be filled in
We will acknowledge your complaint within 48 hours and resolve it within 30 days of receiving it. If you are not satisfied with our answer, or we do not reply, you may complain to the Data Protection Board of India once it is operational, or to the appropriate consumer forum.
13. Children
Cr8rStore is for adults. You must be at least 18 to open an account or to buy from a store. We do not knowingly collect the personal data of anyone under 18, we do not track or profile children, and we do not direct advertising at them. If we learn that we hold a child’s personal data, we delete it and close any associated account. If you believe a child’s data has reached us, tell the Grievance Officer and we will act on it.
14. Changes to this policy
This policy is version 2026-11-14.2. When we change it in substance we publish a new version here and email creators at the address on their account. If the change needs your fresh consent, we will ask for it before relying on it. Continuing to use the service after a change means you accept the updated policy.
15. Contact
Write to SUPPORT_EMAIL — to be filled in for anything, or to GRIEVANCE_OFFICER_EMAIL — to be filled in for a privacy request or a complaint. Our registered office is REGISTERED_ADDRESS — to be filled in.