Privacy Policy

1. Who We Are and What This Policy Covers

RaRa ("RaRa", "we", "us") is operated by RaRa Labs and runs a marketplace where content creators and brands, including agencies that act for brands, find each other, collaborate, and run campaigns. For the personal information described in this policy, RaRa decides why and how it is processed (the "data fiduciary" or "controller").

This policy applies to everyone who uses the Platform in any of these roles:

• Creators, including people who manage a creator's profile on their behalf ("Managers").
• Brands and Agencies, including their team members.
• Visitors who browse the public directory or our website without an account.
• Moderators and staff who review reports, claims and content.

If you use RaRa for a business, you are responsible for making sure you have the right to give us any other person's information (for example a client's name and email on an invoice, or a team member's phone number).

2. Information We Collect

Information you give us

• Account and sign-in: your mobile phone number (used to log in with a one-time code), and, if you choose to sign in with Google or Facebook where offered, the name, email address and profile photo that provider shares with us. We also store your account type (Creator, Brand or Agency) and your onboarding progress.
• Creator profile: display name, bio, city, profile and cover photos, creator type, content categories and style, social media handles, audience size ranges, availability for work, and the rate ranges you choose to show.
• Brand and agency profile: company or agency name, logo, website, industry, description, location, the campaigns you publish, and (for agencies) the clients you manage, your team members and their roles, and your agency code.
• Collaboration activity: applications, proposals, agreements, deliverables, reviews and ratings, posts you publish, and feedback you send us.
• Messages and notifications: messages you exchange with other users on the Platform, and the notifications we send you.
• Managers: if you add a manager, we store their phone number and link it to their account once they log in with it. If you are added as a manager, we store that you manage that creator.
• Creator business tools: if you use Invoices and GST, we store your business legal name, address, state, GSTIN and invoice prefix, plus each invoice you create, including the client's name, GSTIN, state, email address, amounts and dates. If you use the Rate Advisor or Pitch Assistant, we store the inputs you give and the results shown to you.
• Contact preferences: the phone, WhatsApp and email details you add to your profile and whether you allow verified brands to use them. Sharing is off by default and is never switched on for you.
• Photos and media: images and videos you upload, using the photo library permission you grant on your device.
• Referrals, waitlist and support: referral codes, details you enter on our website waitlist (name, email address, phone number, city and whether you are a creator or a brand), and anything you send our support team.

Information from connected accounts

• Instagram: if you connect an Instagram professional account, we receive your handle, profile details, follower and audience statistics, and post insights that Instagram makes available through its official login and API.
• YouTube and Google: if you connect YouTube, we receive your channel details and public channel statistics through Google's read-only YouTube access.
• Optional auto-replies: if you choose to turn on comment or message auto-replies when this feature is available to you, we also receive the comments and direct messages sent to your connected account, the replies we draft or send for you, and a log of what was sent. We only ask for these extra permissions when you opt in.
• We keep your connection (access) tokens on our servers. They are never readable from the app and we use them only to provide the features you turned on. You can revoke access at any time (see section 6).

Information collected automatically

• Device and log data: device model, operating system, app version, language, IP address, and time of use. We use this to keep the Platform secure and working.
• Usage and diagnostics: screens viewed, features used, crashes and performance measurements, collected through Google Firebase Analytics, Crashlytics and Performance Monitoring. We design these events to avoid personal content: they do not include message text, names, email addresses, phone numbers or free text you type.
• Push notification tokens: a token that lets us send notifications to your device, if you allow notifications.
• Website analytics: our website and portal use Cloudflare Web Analytics and Google Analytics (through Firebase) to count visits and understand how pages are used.

Information from other sources

• Other users: a brand or agency may give us your name or contact details (for example on an invitation), and users may review or rate you.
• Publicly available information: to help the marketplace grow, we may list publicly available business information about well-known brands and creators before they join, marked as unclaimed. See section 8.

We do not collect your precise location, your device contacts, or your bank or card details. RaRa does not process collaboration payments.

3. How We Use Your Information

We use personal information to:

• Create and secure your account, verify your phone number and sign you in.
• Operate the marketplace: show profiles, match creators with brands and campaigns, process applications and run collaborations.
• Let agencies and managers act for the brands and creators who authorise them.
• Provide messaging, notifications, reviews, and the optional tools you use (invoices and GST, rate advice, pitch drafts, social insights and auto-replies).
• Send service messages: login codes, security alerts, reminders you ask us to send (such as invoice reminders to your client), and policy or product updates.
• Send marketing messages only where you have agreed, and honour your choice to stop.
• Review reports, claims and content, and detect and prevent fraud, abuse, spam and security incidents.
• Measure and improve the Platform, fix errors and plan new features.
• Comply with law, respond to lawful requests, and enforce our Terms of Service.

Where the law requires a legal basis, we rely on your consent, on performing our agreement with you, on our legitimate interests in running and securing the Platform, and on legal obligations.

4. Who Can See Your Information

We do not sell your personal data. What others can see depends on how you use RaRa:

• Public directory: approved creator and brand profiles, and published campaigns and posts, can appear in the public directory and be seen by anyone, including people without an account. Your profile is public by default once it is approved, and you can switch your public listing off in the app. Your private contact details, messages and applications are never shown in the public directory.
• Other users: logged-in users can see profile information you publish. Brands see applicants' profiles and what applicants submit. Creators see brand and campaign details. Messages are visible to the people in the conversation.
• Contact details: your phone, WhatsApp or email is revealed only to verified brands, only for channels you have allowed, and not to brands you have blocked.
• Agencies and their teams: when a brand links to an agency (for example by entering the agency's code), the agency's team can see and manage that brand's campaigns, applications, messages and profile on the brand's behalf, until the link is removed. Agency owners and admins can see their agency's clients, team and agency code.
• Managers: a manager you add can edit your profile, posts, applications and messages. They cannot see your invoices or change your contact permissions, payments or connected social accounts.
• Moderators and staff: a limited number of RaRa staff can access reports, claims and flagged content to keep the Platform safe.

5. Service Providers We Share Data With

We share information with trusted companies that process it on our behalf, only as needed to run the Platform:

• Supabase: database, file storage, authentication and server functions.
• Google (Firebase): phone-number verification and SMS delivery, push notifications, analytics, crash reporting and performance monitoring.
• Cloudflare: content delivery, security and website analytics.
• Meta (Instagram) and Google (YouTube): only when you choose to connect those accounts.
• AI service providers (such as OpenAI): when you use AI features, the text you submit and the context needed to answer it is sent to the provider to generate a response and to check content for safety.
• Email delivery (such as Resend): to send emails such as welcome messages and invoice reminders.

We may also disclose information when required by law, court order or a government authority; to protect rights, safety and security; and in a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different policy.

6. Connected Social Accounts and Google API Data

RaRa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to show your channel on your profile and to provide features you ask for. By connecting YouTube you also agree to the YouTube Terms of Service and the Google Privacy Policy. You can revoke RaRa's access at any time at security.google.com/settings/security/permissions.

We use Instagram data only to show your professional profile and statistics and to provide features you ask for. You can remove RaRa at any time in Instagram under Settings, then Apps and Websites (or Business Integrations).

We do not sell this data, use it for advertising, or give it to data brokers. A human at RaRa will read your connected-account data only when needed to support you, to investigate abuse or security issues, or to comply with law.

7. AI Features and Automated Decisions

RaRa offers AI-assisted features such as pitch drafts, reply suggestions and optional auto-replies. AI output can be wrong or incomplete, so review it before you use it. When you turn on auto-replies, you control which accounts and rules are active, you can pause them at any time, and replies the AI is unsure about are held for your review. Content is checked for safety before and after it is generated, and sensitive topics are not auto-answered.

We do not make decisions about you that have legal or similarly significant effects based only on automated processing. Automated checks may flag spam, abuse or policy violations, and a person can review the outcome on request.

8. Unclaimed Profiles, Reviews and Moderation

RaRa may show public business information about brands and creators who have not yet joined (for example a name, public handles and a link to the public source), clearly marked as unclaimed. If that is you, you can claim the profile when you sign up (we may ask you to prove ownership, for example by connecting your account or by verifying your business email domain), or ask us to correct or remove it by emailing privacy@joinrara.app.

Where the app offers it, users can report profiles, messages and content. Reports, blocks, claim requests and moderation decisions are stored so that we can enforce our rules and protect users.

9. Where Your Data Is Processed

RaRa is built for users in India and elsewhere. Our service providers may process data on servers in India and in other countries. Where information leaves your country we use providers that maintain appropriate safeguards and we limit what is shared to what is needed.

10. How Long We Keep Your Information

We keep personal information for as long as your account is active or as needed to provide the Platform. When you delete your account we remove or anonymise your profile, messages and connected-account data, except where we must keep records to meet legal, tax, accounting, fraud-prevention or dispute-resolution needs (for example invoice records and moderation records), and for a limited period in backups. Other users may keep copies of content you sent them, such as messages and agreements.

11. Your Rights and Choices

Under India's Digital Personal Data Protection Act, 2023 and other laws that apply to you, you may have the right to:

• Know what personal data we hold about you and how it is used, and receive a summary.
• Correct, complete or update inaccurate data.
• Request erasure of your personal data.
• Withdraw consent at any time, which does not affect processing already done.
• Obtain grievance redressal, and nominate another person to exercise your rights if you die or become unable to.
• Object to or restrict some processing, and request your data in a portable format, where the law gives you that right.

You can also manage your information in the app:

• Edit your profile, rates and posts, and turn your public listing on or off.
• Use Sleep Mode to pause new unsolicited outreach. Your contact details are not shared with brands unless you have allowed it.
• Revoke RaRa's access to Instagram or YouTube in those services' settings (section 6) or ask us to disconnect them, and pause or switch off auto-replies.
• Remove managers, agency links and team members you added.
• Turn off push notifications in your device settings, and unsubscribe from marketing emails using the link in them.

To exercise your rights, including account and data deletion, email privacy@joinrara.app from the phone number or email linked to your account. We may need to verify who you are, and we aim to respond within 30 days.

12. Data Deletion Instructions

To delete your RaRa account and data, email privacy@joinrara.app with the subject "Delete my account" from the phone number or email address on your account. If you connected Instagram or Facebook, you can also remove RaRa in your Instagram or Facebook settings under Apps and Websites, then ask us to delete the data we received from that connection. If you connected YouTube, revoke access at Google as described in section 6, then email us to delete the data. We will confirm when your request is complete.

13. Cookies and Similar Technologies

Our website, dashboard and public directory use cookies, local storage and similar technologies to keep you signed in, remember preferences, secure the Platform and measure traffic. The mobile apps use device identifiers and storage for the same purposes. You can block cookies in your browser settings, but parts of the web experience may not work. You can reset or limit your device's advertising identifier in your phone settings; RaRa does not use it to show you ads.

14. Security

We protect your information with encryption in transit (TLS), access controls, per-user data access rules in our database, restricted storage of connection tokens on our servers, and monitoring. Staff access is limited to what each role needs. No system is completely secure. Keep your phone and any accounts you connect secure, and tell us promptly at privacy@joinrara.app if you suspect unauthorised access. If a personal data breach affects you, we will notify you and the authorities as the law requires.

15. Children's Privacy

RaRa is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

16. Third-Party Links and Services

The Platform may link to or connect with services we do not control, such as social networks, WhatsApp, a brand's website or a payment arrangement you make with another user. Their privacy practices are their own, so please read their policies.

17. Changes to This Policy

We may update this policy as the Platform or the law changes. For material changes we will notify you in the app or by email before they take effect where practical. The "Last updated" date at the top shows the latest version. Continuing to use RaRa after a change means you accept the updated policy.

18. Contact and Grievance Officer

For privacy questions, requests or complaints, contact RaRa's Grievance Officer at privacy@joinrara.app. For account help, write to support@joinrara.app. We acknowledge complaints promptly and aim to resolve them within the time the law allows. If you are not satisfied, you may escalate to the Data Protection Board of India or other competent authority.