This Privacy Policy explains how the company that operates FansBless, named in our Terms of Service ("FansBless", "we", "us") collects and uses your personal data when you use FansBless. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules, we are the Data Fiduciary for this data.
FansBless is only for people aged 18 and above. We do not knowingly collect personal data of children. If you believe a child has used FansBless, contact the Grievance Officer and we will delete their data and refund their payments after verification.
1. Data we collect and why
| What | From whom | Why (purpose) | Basis |
|---|---|---|---|
| Name, email, password (stored only as a secure hash) | Fans, creators | Create and secure your account, send you service emails | Your consent; performing our contract with you |
| Mobile number | Fans, creators | Verify your account with a one-time SMS code, secure your account, apply the daily payment limit and prevent fraud. Never shown publicly | Your consent; performing our contract with you; legitimate uses |
| Date of birth | Fans, creators | Confirm you are 18+. Never shown publicly | Your consent; legal compliance |
| Display name, avatar, short messages | Fans | Show your supports on public lists (you can switch to "Anonymous") | Your consent |
| Payment details: amount, status, Razorpay order and payment IDs, and the email/phone you used at checkout (stored only as one-way hashes) | Payers | Process payments, receipts, refunds, daily limits, fraud prevention, linking guest payments to your account | Contract; legitimate uses under the DPDP Act; legal obligations |
| Identity document (masked Aadhaar, PAN or driving licence image), full name on ID, document number | Creators only | Verify that the real creator is creating the account and is 18+ | Your explicit consent |
| Social profile links and follower counts | Creators | Show on your public profile; verify you own the accounts | Your consent |
| IP address (stored hashed), device and browser type, session records | All users | Security, rate limiting, fraud prevention, "log out other devices" | Legitimate uses; legal compliance |
| Reports and complaints | Anyone | Moderation and grievance handling as required by the IT Rules | Legal obligation |
We collect only what we need for these purposes, and show a short notice wherever we collect data.
2. Aadhaar and ID documents — special handling
- For Aadhaar we accept only a masked Aadhaar (only the last 4 digits visible) and we store only the last 4 digits of the number. We never ask for, accept or store your full 12-digit Aadhaar number.
- For PAN and driving licence we store the number encrypted (AES-256) and show it only masked (for example
XXXXXX123F). - Uploaded ID images are encrypted at rest, kept in private storage that is never publicly accessible, and can be viewed only by our authorised verification team. Every view is logged.
- We delete the uploaded ID images 30 days after you upload them, whether or not they have been reviewed by then. We keep only the document type, the last 4 characters, the review result and the review record.
- Images are processed to remove location and other hidden metadata when uploaded.
3. Who we share data with (processors)
We share data only as needed to run FansBless, with service providers who process it on our instructions under contracts:
- Razorpay Software Pvt. Ltd. — payment processing, refunds.
- Email provider (Resend, or our SMTP provider) — sending verification codes, receipts and notices.
- SMS provider (for example MSG91 or Twilio) — sending one-time verification codes to your mobile number.
- Hosting and database provider — servers in India where possible (for example, AWS Mumbai region).
- File storage provider — S3-compatible storage in India where possible, for photos and encrypted ID documents.
- Cloudflare — security, bot protection (Turnstile) and content delivery.
- Error monitoring (Sentry, if enabled) — technical error reports with personal data removed.
- Privacy-friendly analytics (self-hosted, only if you accept cookies).
We may also disclose data when required by law, a court order, or a lawful request from government authorities, and to protect the rights and safety of users and FansBless. We never sell your personal data.
Public information: creators' public profiles, and fans' display names (unless set to Anonymous), badges, supports and messages are shown publicly. We never show payer email addresses or phone numbers publicly.
4. How long we keep data
- ID document images: deleted 30 days after upload.
- Payment and invoice records: kept for 8 years, as required by tax and accounting laws (anonymised where possible after account deletion).
- Accounts that never verify their email: deleted after 7 days.
- Server logs: rotated after 90 days.
- Everything else: kept while your account is active, and deleted or anonymised when you delete your account, except where the law requires us to keep it.
5. Security
We use encryption in transit (HTTPS) and at rest for sensitive data, hashed passwords (argon2id), hashed identifiers, access controls, two-factor authentication for our admins, rate limiting, and audit logs. No system is perfectly secure; if a personal data breach happens, we will inform affected users and the Data Protection Board of India as the law requires.
6. Your rights
Under the DPDP Act you can:
- access your data — download it any time from Settings → Download my data;
- correct and update your data — from Settings, or by contacting us;
- withdraw consent and erase your data — Settings → Delete account. Withdrawing consent doesn't affect processing done before. We keep payment and tax records the law requires, anonymised where possible;
- nominate another person to exercise your rights in case of death or incapacity — email the Grievance Officer;
- complain — to our Grievance Officer (below) and, if unresolved, to the Data Protection Board of India.
7. Cookies
We use only essential cookies (to keep you logged in, remember your theme/language, and keep the site secure). Analytics cookies are used only if you choose "Accept" in the cookie banner. See our Cookie Policy.
8. Marketing
We never subscribe you to marketing emails automatically. You can opt in separately, and every marketing email has a one-click unsubscribe link. Service emails (verification codes, receipts, security notices) are not marketing.
9. Grievance Officer (contact for privacy questions)
Adv. Uday Unbule · [email protected] · Pune - 411033. Use the Grievance page to file a complaint and get a ticket ID. We acknowledge within 24 hours and aim to resolve within 15 days.
10. Changes
When we change this policy materially, we update the version and date above and ask you to accept the new version at your next login.
This policy must be reviewed by an Indian lawyer for compliance with the DPDP Act, the DPDP Rules and Aadhaar-related rules before launch.