1. Who We Are
Analytic Miles ("we", "us", "our") operates the influencer marketing platform at analyticmiles.com. This policy explains how we handle personal data under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and, for people in the European Economic Area or the United Kingdom, the GDPR.
We decide how and why the personal data described here is processed (a "Data Fiduciary" under the DPDP Act, a "controller" under the GDPR). For any privacy question, request or grievance, contact us at support@analyticmiles.com.
2. Data We Collect
| Data Type | Examples | Source |
|---|---|---|
| Account data | Name, email address, profile photo | You, or Google sign-in through Clerk |
| Campaign data | Brand name, campaign brief, budget range, target audience, outreach messages you edit or send, deal terms | You, when you use the Service |
| Billing data | Plan, billing period, subscription status, invoice links | Razorpay. We do not see or store your full card, UPI or bank details. |
| Usage and device data | Pages used, campaign history, timestamps, browser type, IP address | Collected automatically |
| Communications | Emails to support; messages sent to and received from creators through the Service | You, and the creators who reply |
| Creator data (people who may not be our users) | Instagram handle, name, bio, follower and post counts, engagement on recent public posts, profile link, contact details published in the bio; for creators who claim a profile, the rate card, location, language and portfolio link they add | Public Instagram profiles, collected through Apify; creators who claim a profile |
3. How We Use Your Data
- Provide the Service — search and score creators for your briefs, and draft strategy, outreach and reply suggestions with AI language models
- Manage your account and plan — sign you in, apply your plan's limits, and keep your campaign history
- Take payments — create and renew subscriptions and keep invoices
- Send email — account and campaign notifications, and outreach messages you choose to send
- Keep the Service safe — detect and prevent abuse, fraud and breaches of our Terms
- Improve the Service — find and fix errors and measure how well shortlists work
We do not sell personal data. We do not use your campaign briefs or data to train AI models without your explicit consent.
4. Legal Basis for Processing
Under the DPDP Act: we process your account, campaign and billing data with the consent you give when you create an account and use the Service, and for the legitimate uses the Act allows, such as meeting legal obligations. You can withdraw consent at any time (section 10); we will then stop processing and delete the data unless the law requires us to keep it. Creator data comes from profiles the creators have made public, or from creators who claim a profile; creators can ask us to remove it at any time (section 6).
Under the GDPR: contract performance (to provide the Service), legitimate interests (to keep it secure and improve it, and to help brands find creators who publish their profiles), consent (marketing, which you can withdraw at any time), and legal obligation.
5. Service Providers & Data Sharing
We share personal data only with the providers below, only to run the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Clerk | Sign-in and account management | Name, email, profile photo, session data |
| Supabase | Database | Account, campaign, billing status and creator data |
| Vercel | Hosting | Request logs, IP addresses |
| n8n | Running the campaign workflow | Campaign briefs and creator data while a campaign runs |
| OpenAI | AI language models | Campaign brief and the shortlisted creators' public profile details |
| Apify | Collecting public Instagram profile data for paid-plan searches | Hashtags and creator handles to look up; no user account data |
| Razorpay | Payments and invoices | Name, email, plan and payment details you enter at checkout |
| Resend | Recipient email addresses and message content | |
| WATI | WhatsApp messages, only once WhatsApp sending is switched on | Recipient phone number and message content |
We may also disclose data if required by law or court order, or to protect the rights and safety of our users or the public.
6. Creators: Notice & Removal
If you are a creator, Analytic Miles may hold the public Instagram profile details listed in section 2 so that brands can find you, see why you fit a campaign and contact you. We collect them from your public profile when a brand's campaign needs more creators, or you add them by claiming a profile. We keep them until they are refreshed, you ask us to remove them, or we no longer need them.
To have your profile removed: email support@analyticmiles.com with your Instagram handle. We delete your profile from our creator index and add your handle to a suppression list, so it is not collected again. We act on removal requests within 30 days. The same address corrects or deletes a claimed profile.
7. Cookies & Local Storage
- Session cookie (
im_session, HTTP-only) — keeps you signed in. Required for the Service. Expires after 7 days. - Clerk cookies — sign-in state.
- Razorpay — sets its own cookies during checkout.
- Local storage in your browser — your light or dark theme, whether you closed the welcome guide, and when your Free plan limit resets. Nothing in it is sent to us.
We do not use advertising cookies or third-party tracking pixels.
8. Data Retention
- Account and campaign data — kept while your account is open. When you ask us to delete your account, we delete it within 30 days.
- Billing records — kept for as long as Indian tax law requires.
- Usage logs — kept for up to 90 days for debugging and security.
- Email records — kept for up to 12 months.
- Creator index records — see section 6.
9. Data Security
- All data between your browser and our servers is encrypted with HTTPS/TLS
- Session tokens are stored in HTTP-only cookies that page scripts cannot read
- Sign-in tokens are verified on our servers
- Database access is restricted by row-level security policies
- Service keys are kept in server environment settings, never in the page
No method of transmission over the internet is completely secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
10. Your Rights
Under the DPDP Act you can:
- Access — ask what personal data we process about you and who we shared it with
- Correct and complete — ask us to fix inaccurate or incomplete data
- Erase — ask us to delete your data, unless the law requires us to keep it
- Withdraw consent — at any time, as easily as you gave it
- Nominate — name someone to exercise these rights if you die or cannot
- Grievance redressal — raise a complaint with us first, and then with the Data Protection Board of India
If the GDPR applies to you, you also have the rights to data portability and to object to processing based on legitimate interests. To exercise any right, email support@analyticmiles.com. We respond within 30 days.
11. Children's Privacy
Analytic Miles is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, contact us and we will delete it promptly.
12. International Data Transfers
Analytic Miles is operated from India. Some of our service providers process data in other countries, including the United States and the European Union. We transfer data only as permitted by the DPDP Act and, where it applies, with GDPR safeguards.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date above and, where appropriate, by email.
14. Contact & Complaints
For any privacy question, request or grievance:
- Email: support@analyticmiles.com
- Website: analyticmiles.com
If you are not satisfied with our response, you can complain to the Data Protection Board of India or, if the GDPR applies, to your local data protection authority.