Privacy notice.

HOTKOK is operated by AVIDZ Business Private Limited (CIN U92490DL2022PTC408368), registered office: D-1/LG-9, LG/F, Dilshad Colony, East Delhi, Delhi 110095, India. In these pages, “HOTKOK”, “we” and “us” mean AVIDZ Business Private Limited.

We are the data fiduciary for the personal data described here. Questions or requests: privacy@hotkok.com. Grievances: see section 11.

Everyone who visits

• Anonymous visit statistics: which pages are viewed, the referring site, and country, browser and device type. No cookies are used for this and it doesn't identify you; links carrying personal codes are cleaned before anything is counted, and signed-in admin pages are never counted.

Everyone who signs in

• Mobile number (to send a one-time sign-in code by WhatsApp or SMS) and your role on HOTKOK.
• Technical data: sign-in session cookie, language and theme preferences, IP address and request logs (for security, rate limiting and fixing errors).

Labels and artists (customers)

• Business or display name, email for invoices, PAN and name on PAN, and GSTIN if you give one (PAN and GSTIN are checked with our verification provider).
• Songs and campaigns you create: title, artist, Instagram audio link, YouTube and Spotify links, budget and settings.
• Payments are made on Razorpay’s checkout. We receive the order and payment reference and status; we never see or store your card, UPI PIN or bank login.

Partners (aggregators and distributors)

• Your application: business name, your name, email, city and who you work with.
• Once approved: PAN and name on PAN (checked with our verification provider), GSTIN if you give one, and the UPI ID or bank account where we pay your commission. We keep masked copies for display and store the full PAN and account details encrypted; only our team opens them to pay you or file taxes.
• Whom you invited, your commission, TDS and payments.

People our team invites: the name, mobile number and (if given) email our team enters to send you an invite. We use them only for that invite; they stop being used when the invite ends, and we delete them if you ask.

Invites (everyone): who invited your account (their invite code) and, if you invite others, whom you invited and what you earned. To stop people inviting themselves, we compare sign-in phone numbers and coded (hashed) versions of PANs, GSTINs and payout accounts — never the numbers themselves.

Creators

• Name, date of birth (you must be 18 or older) and invite code; for each Instagram account you connect, whether it’s your own account or a page, the content categories you choose and the rate you usually charge per reel.
• Instagram data, for each Instagram professional account you connect and only after you agree on Instagram’s consent screen: your Instagram user ID, username, profile picture, account type, follower, following and post counts; your list of posts and reels with their links and dates; insights for your reels (views, reach, likes, comments, shares, saves, average and total watch time); follower demographics as aggregated shares by city, country, age and gender; and your daily follower count for the last 30 days. We cannot see your password, your messages or anything you haven’t allowed.
• For reels you submit for a campaign: the reel link, the audio it uses and its public details, which we check with a third-party Instagram data provider.
• Payout details: PAN, name on PAN, and your UPI ID or bank account and IFSC. We verify the PAN with our verification provider, which returns the registered name, date of birth and whether the PAN is linked to Aadhaar (we do not collect your Aadhaar number). We validate the UPI ID or bank account with our payments provider, which returns the account holder’s name. We keep only masked copies of these details; the full account details are held by our payments provider.
• If you're registered for GST and choose to add it: your GSTIN and the legal name on it, checked with our verification provider, so we can pay GST on top of your earnings and keep GST records. We keep it hidden (masked) for display and store the full number encrypted.
• Your earnings, tax deducted at source (TDS) and payouts.
• An email address, only if you add one for tax papers (your yearly TDS certificate and payout statements).

Songs: for song reports we also read public statistics about the promoted song (the number of reels on its Instagram audio page, views of its YouTube video, and similar public figures). These are about the song, not about you.

• To create your account, sign you in and keep it secure (including limiting repeated code requests).
• For creators: to confirm your account is an eligible Creator account that you control; to work out and show your price per reel from your engagement, watch time and audience; to offer you campaigns whose audience matches yours; to check that a submitted reel is yours, uses the campaign’s song audio and was posted on time; to track the reel’s performance for 7 days and calculate your pay; and to detect bought views, likes or followers.
• For customers: to run your campaigns, take payment, issue invoices and refunds, and report results.
• To pay creators, deduct and deposit TDS, keep accounting records and meet other legal obligations — including reminding a creator on WhatsApp when earned money is waiting for their payout details.
• To send creators WhatsApp messages about offers (only if they turn this on) and about work they’ve taken on — deadlines, reel results, Instagram and payouts. Creators can turn either off in Profile.
• To handle support requests, reviews, disputes and fraud.

We process your data on the basis of your consent (for example when you connect Instagram) and for the legitimate uses the law allows, such as meeting legal obligations. You can withdraw consent at any time (section 8); this doesn’t affect processing already done, and some features, like getting paid for reels, need the data to work. We do not sell personal data, show ads, or use your data to train AI models.

• Labels running a campaign you join see your Instagram handle, the reels you made for their campaign and those reels’ performance (views, likes and similar figures), and campaign totals. They do not see your price per reel, your demographics, your PAN or your payout details.
• Shared song reports: a label can share a read-only report of a campaign. It shows aggregated song and campaign figures and no money.
• Service providers who process data for us under contract and only on our instructions: cloud hosting, website analytics and database providers, our payments partner (Razorpay), an identity verification provider, a messaging provider that delivers sign-in codes, Meta (Instagram), a data provider for public Instagram reel details, and Google (YouTube) for public video statistics. You can ask us for the current list.
• Authorities, when the law requires it (for example tax filings for TDS), and professional advisers under confidentiality.
• A buyer or successor if our business is reorganised, under the same protections.

Our main data is stored in India. Some providers, such as Meta and the Instagram data provider, may process data outside India; we transfer data only as permitted under Indian law.

We use the official Instagram API with Instagram Login. The access Instagram gives us is stored securely and used only to read the data listed in section 2 while you stay connected. We never post, comment or message on your behalf.

You can stop our access at any time:

• In Instagram: Settings → Website permissions → Apps and websites → remove HOTKOK. Instagram tells us, and we delete our access and disconnect your account.
• To also delete the Instagram data we hold, use Instagram’s “Send request to delete data” option there, or email privacy@hotkok.com. You’ll get a confirmation code and a status page. We delete our access, your profile statistics, insights, demographics and scores. We keep the records we are required to keep for payments and tax, described in section 6.

• Account and profile data: while your account is active, and deleted within 30 days after you ask us to delete your account.
• Instagram access: deleted as soon as you disconnect.
• Payment, invoice, payout and tax records, including the reels and figures a payment was based on: for 8 years, as required by Indian tax and company law.
• Security logs: up to 180 days, unless needed for an investigation.
• Records of fraud decisions and bans, so a banned person can’t rejoin: as long as needed for that purpose.

We use industry-standard safeguards, including encryption in transit and at rest for sensitive data, masking of identity and bank details, and access limited to people who need it, with their actions recorded. If a breach affects your data, we will inform you and the Data Protection Board of India as the law requires.

Under the Digital Personal Data Protection Act, 2023 you can:

• get a summary of the personal data we process about you and who we shared it with;
• correct, complete or update it, and ask us to erase it (subject to the records we must keep);
• withdraw consent, for example by disconnecting Instagram;
• nominate someone to exercise your rights if you die or become unable to; and
• raise a grievance with us, and then with the Data Protection Board of India.

Email privacy@hotkok.com from your registered details, or write to the Grievance Officer. We may need to confirm it’s you before acting.

HOTKOK is for people aged 18 and over, and we verify creators’ age. We do not knowingly process data of children; if we learn we have, we delete it.

We’ll post any change here with a new effective date, and tell you in the app or by message before a significant change applies.

Grievance Officer: Pooja Singh, AVIDZ Business Private Limited, D-1/LG-9, LG/F, Dilshad Colony, East Delhi, Delhi 110095, India. Email: grievance@hotkok.com. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. More ways to reach us: Contact.