Legal
Privacy Policy
Draft for legal review — the reviewed version will replace this text before public launch.
This Privacy Policy explains how YourBackers Private Limited ("we", "us", "our") processes your personal data when you use YourBackers AI (the "Service"). It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
By using the Service you acknowledge this Policy. Where we rely on your consent, we ask for it clearly and you can withdraw it at any time. Capitalised terms not defined here have the meaning given in our Terms of Service.
1. Who we are
YourBackers Private Limited is the Data Fiduciary for personal data processed through the Service. Our office is at 140, 1st Floor, Cuddalore Main Road, Ariyankuppam, Puducherry 605007, India. You can reach us at reachus@yourbackers.org or +91 95144 10101.
When a Workspace owner invites team members or shares Outputs, the Workspace owner decides how their project content is used; we process that content on their instructions to provide the Service.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a salted hash), profile picture, Workspace name and role, consent and terms version accepted | You |
| Sign-in provider data | When you use Google, Microsoft or Apple sign-in: provider account identifier, name, email address and whether it is verified, profile picture; Apple may provide a private relay email | The provider, with your permission |
| Payment and billing data | Order and transaction IDs, amount, credits purchased, payment status, invoice details, mobile number required by the payment aggregator, last digits or type of payment method where returned by the aggregator. We never receive or store full card numbers, CVV, UPI PIN or net-banking passwords | You and our payment aggregators |
| Content data | Ideas, prompts, scripts, uploaded story documents and their extracted text, images, audio, video, Outputs, comments, chat with the AI crew, Pitch Room settings | You and Workspace members |
| Cast and likeness data | Designed character images, portrait references registered for identity consistency, real-actor invitation details, consent records (name, usage scope, validity, acceptance and revocation times) | You and invited actors |
| Verification data | Real-actor liveness (selfie) verification is performed directly by our identity verification partner. We receive only the verification result and a reference identifier; we do not receive or store biometric templates | Verification partner |
| Usage and device data | Pages and features used, runs, credits consumed, error logs, IP address, browser and device type, approximate location derived from IP, timestamps | Automatically |
| Communications | Support requests, grievance submissions, emails and notifications we send you and delivery status | You and us |
| Cookies and local storage | Session and security cookies, and browser storage for drafts and preferences — see the Cookie Policy | Automatically |
Uploaded footage, face swap analyses and cast portraits may contain images of people. Our Acceptable Use & AI Content Policy requires that you have the right and consent to use them. Face swap analysis stores only text labels and approximate positions of people, never biometric templates.
3. Why we use personal data (purposes and legal basis)
| Purpose | Legal basis under the DPDP Act |
|---|---|
| Creating and securing your Account, authenticating you (including social sign-in), preventing account takeover | Consent and legitimate uses for the service you requested |
| Providing the Service: running productions and tools, generating and storing Outputs, reading uploaded documents, casting and portrait registration, Pitch Rooms | Consent; processing necessary for the service you requested |
| Estimating, holding and charging credits; processing payments, refunds and invoices; preventing payment fraud | Consent; compliance with law (tax and accounting) |
| Recording real-actor consent and enforcing revocation | Consent of the actor; compliance with law |
| Sending service emails and notifications (verification, run ready, security alerts, receipts) | Legitimate uses for the service requested |
| Safety, abuse prevention, content moderation, grievance handling, responding to lawful requests | Compliance with law (IT Act, IT Rules 2021); legitimate uses |
| Improving reliability and quality using aggregated or de-identified metrics | Consent; legitimate uses |
| Optional product updates and marketing emails | Consent only — you can opt out at any time |
We do not use the content of your private projects to train our own foundation models, and we do not sell personal data.
4. Children
The Service is intended for adults aged 18 and above. We do not knowingly collect personal data of children. If we learn that a child has created an Account, we will delete it. If you believe a child has provided us personal data, contact our Grievance Officer.
6. Cross-border transfers
Some of our providers process data outside India (for example in Singapore, the United States or the European Union). We transfer personal data outside India only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and we require providers to protect it with safeguards equivalent to this Policy.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and Workspace data | While your Account is active; deleted or de-identified within 30 days of Account deletion, except as below |
| Projects, uploads and Outputs | Until you delete them or your Account; deleted project media is purged from storage |
| Temporary provider output copies | Deleted automatically within 2 days after being copied into your gallery |
| Face swap analyses | 24 hours |
| Real-actor consent records | For the consent validity period plus the limitation period for claims (up to 3 years after expiry or revocation) |
| Payment, invoice and tax records | 8 years, as required by tax and accounting laws |
| Security and access logs | Up to 180 days, or longer where required by law or an investigation |
| Grievance and legal correspondence | Up to 3 years after closure |
8. How we protect data
We implement reasonable security practices consistent with the SPDI Rules and industry standards, including encryption in transit (TLS), hashed passwords, short-lived signed sessions, role-based access control, scoped service-to-service credentials, least-privilege access for staff, private storage with time-limited links, audit logging and regular reviews. No system is completely secure; if a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.
9. Your rights
Subject to the DPDP Act and applicable rules, you have the right to:
- access information about the personal data we process about you and the processors we share it with;
- correct, complete or update inaccurate or incomplete personal data;
- erase personal data that is no longer necessary, unless we must retain it by law;
- withdraw consent at any time (withdrawal does not affect processing already done, and may mean we cannot provide parts of the Service);
- have grievances redressed by our Grievance Officer;
- nominate another person to exercise your rights in the event of your death or incapacity.
How to exercise your rights
Use Settings in the Service (profile, connected accounts, password, data export and deletion where available) or email reachus@yourbackers.org from your registered email address with the subject "Data request". We may verify your identity before acting. We acknowledge requests within 48 hours and respond within 30 days, or sooner where the law requires.
If you are not satisfied with our response, you may complain to the Data Protection Board of India after exhausting our grievance process.
11. Communications
We send service emails that are necessary for your Account (for example verification, security notices, receipts and run notifications). With your consent we may send product updates; every such email has an unsubscribe link.
12. Changes to this Policy
We may update this Policy. We will publish the new version with its effective date and notify you by email or in the Service of material changes before they apply.
13. Grievance Officer
| Contact | Details |
|---|---|
| Designation | Grievance Officer |
| reachus@yourbackers.org | |
| Phone | +91 95144 10101 |
| Address | 140, 1st Floor, Cuddalore Main Road, Ariyankuppam, Puducherry 605007, India |
We acknowledge grievances within 24 hours and resolve them within 15 days of receipt, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Who we are
YourBackers Private Limited140, 1st Floor, Cuddalore Main Road
Ariyankuppam
Puducherry 605007
India
Email: reachus@yourbackers.org
Phone: +91 95144 10101