Privacy Policy

Last updated: June 22, 2026

1. Introduction

ValueSkins ("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Platform").

This Policy complies with the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; the Digital Personal Data Protection Act, 2023 (DPDP Act) of India; the General Data Protection Regulation (GDPR) of the European Union; and the California Consumer Privacy Act (CCPA).

Please read this Policy carefully. By using the Platform, you consent to the practices described in this Policy. If you do not agree with this Policy, please do not use the Platform.

2. Information We Collect

Account Information: When you create an account, we collect your name, email address, phone number, password (stored as a bcrypt hash, never in plaintext), and profile information such as display name, avatar, and biography.

Profile & Listing Data: Creators may provide professional information including portfolio samples, pricing, profession categories, social media links, and credentials. Brands may provide company information, industry, and campaign preferences.

Deal & Transaction Data: We collect information related to Deals you create or participate in, including deal terms, deliverables, messages, offers, counter-offers, reviews, ratings, and payment transaction records (note: full payment card details are handled by Razorpay/Stripe and are not stored by us).

Communication Data: Messages sent through the Platform, support inquiries, and communications with other Users are recorded and stored with tamper-evident protections.

Usage Data: We automatically collect information about how you interact with the Platform, including pages visited, features used, time spent, clickstream data, and referring URLs.

Device & Technical Data: IP address, browser type and version, operating system, device type, unique device identifiers, and other technical information.

Cookies & Similar Technologies: We use cookies, web beacons, and similar tracking technologies to enhance your experience, analyze usage, and provide personalized content. See Section 10 (Cookie Policy) for details.

3. How We Collect Your Information

Direct Collection: You provide information directly when you create an account, complete your profile, create Deals, send messages, submit support requests, or otherwise use the Platform.

Automatic Collection: We automatically collect usage and device data when you interact with the Platform through cookies, server logs, and analytics tools.

Third-Party Sources: We may receive information from third-party authentication providers (Google, GitHub) when you choose to sign in using those services. We may also receive information from our payment processors (Razorpay, Stripe) limited to transaction status and identifiers (not full payment details).

4. How We Use Your Information

We use your information for the following purposes:

To Provide Services: Operate, maintain, and provide the Platform's features, including account management, Deal creation and execution, messaging, payment processing, and dispute resolution.
To Improve the Platform: Analyze usage patterns, conduct research, perform analytics, and develop new features to enhance user experience.
To Communicate with You: Send administrative messages (account verification, password resets, deal updates), service announcements, technical notices, and support responses.
To Ensure Safety & Security: Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
To Comply with Legal Obligations: Fulfill legal requirements, respond to lawful requests from authorities, and enforce our rights.
With Your Consent: For any other purpose disclosed to you at the time of collection, with your consent.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data under the following legal bases:

Contractual Necessity: Processing necessary to perform our contract with you (e.g., account management, Deal execution).
Legitimate Interests: Processing for our legitimate interests (e.g., improving the Platform, fraud prevention, security) that do not override your fundamental rights.
Consent: Processing based on your explicit consent (e.g., marketing communications, non-essential cookies). You may withdraw consent at any time.
Legal Obligation: Processing necessary to comply with legal obligations.

6. Data Sharing & Disclosure

Service Providers: We share data with trusted third-party service providers who help us operate the Platform, subject to contractual obligations to protect your data:

Payment Processing: Razorpay (INR payments), Stripe (USD payments) — transaction data necessary to process payments
Hosting & Infrastructure: Vercel, Supabase (PostgreSQL), Render, AWS — data hosting and storage
Authentication: Google, GitHub — authentication data when you use OAuth
Analytics: Google Analytics, Mixpanel — aggregated, anonymized usage data (only with your consent where required by law)
Communications: Email service providers for transactional emails

Other Users: Your profile information is visible to other Users as part of the Platform's marketplace functionality. Deal-related communications are visible to the participants of the Deal.

Legal Requirements: We may disclose your information if required to do so by law, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. You will be notified of any such change.

We do not sell your personal information to third parties for marketing or advertising purposes.

7. Data Retention

Active Accounts: We retain your information for as long as your account is active and as needed to provide you with services.

Deleted Accounts: When you request account deletion, a 30-day grace period begins during which you may cancel the deletion. After 30 days, your personal data is permanently deleted by our automated deletion system. Deal messages are retained for 90 days after deletion for dispute resolution purposes, then permanently deleted.

Logs: Server logs containing IP addresses and technical data are retained for 30 days.

Anonymized Data: Aggregated, anonymized data that cannot identify you may be retained indefinitely for analytics and platform improvement.

Legal Holds: Data may be retained longer if required by applicable law, regulatory obligations, or legal proceedings.

8. Your Rights & Choices

Under the DPDP Act (India):

Right to Access: Request a summary of your personal data held by us
Right to Correction: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data (subject to legal exceptions)
Right to Grievance Redressal: Lodge complaints regarding data processing
Right to Nominate: Nominate a person to exercise your rights after your death

Under the GDPR (EEA Users):

Right to Access: Obtain confirmation of whether we process your data and request a copy
Right to Rectification: Correct inaccurate data
Right to Erasure (Right to be Forgotten): Request deletion of your data
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a structured, commonly used format
Right to Object: Object to processing based on legitimate interests or direct marketing
Right to Withdraw Consent: Withdraw consent at any time without affecting lawfulness of prior processing

Under the CCPA (California Users):

Right to Know: Request disclosure of data categories collected, sources, purposes, and third parties
Right to Delete: Request deletion of your personal information
Right to Opt-Out: Opt out of the sale of your personal information (we do not sell data)
Right to Non-Discrimination: We will not discriminate against you for exercising these rights

To Exercise Your Rights: Contact us at valueskinsfounder@gmail.com. We will respond to your request within the timeframes required by applicable law (generally 30 days). We may need to verify your identity before processing your request.

9. Data Security

We implement robust security measures to protect your data:

Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3+
Encryption at Rest: Sensitive data (passwords, PII, payment tokens) is encrypted using AES-256-GCM
Password Hashing: Passwords are hashed using bcrypt with a minimum of 12 salt rounds
Access Controls: Strict role-based access controls (RBAC) and row-level security (RLS) on all databases
Rate Limiting: Per-user and per-IP rate limiting to prevent abuse
Audit Logging: All access to sensitive data is logged with immutable audit trails
Regular Audits: Periodic security assessments, vulnerability scanning, and penetration testing
Incident Response: Documented incident response plan with breach notification procedures

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Cookie Policy

We use cookies and similar technologies to enhance your experience:

Essential Cookies: Required for the Platform to function (session management, CSRF protection, authentication). No consent required. These cannot be disabled.
Analytics Cookies: Help us understand how you use the Platform (pages visited, features used). We use Google Analytics and Mixpanel. These are only set with your consent where required by law.
Preference Cookies: Remember your settings and preferences.

Managing Cookies: You can control cookies through your browser settings. Disabling essential cookies may affect Platform functionality. You can also use our cookie consent banner to manage your preferences.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your own. Our hosting and service providers operate globally, including in India, the United States, and the European Union.

GDPR Adequacy: For EEA users, we ensure appropriate safeguards for data transfers through Standard Contractual Clauses (SCCs) or adequacy decisions as required under applicable law.

DPDP Act: For Indian users, data is primarily stored within India. Where data is transferred outside India, we ensure equivalent levels of protection as required under the DPDP Act.

12. Children's Privacy

The Platform is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information.

13. Documented Communications

All deal-related communications (including but not limited to messages, offers, counter-offers, contract terms, and file submissions sent through the ValueSkins deal room) are permanently recorded with the following properties:

Tamper-evident storage: Each message is cryptographically hash-chained to the previous message. Any modification to a past message breaks the chain and is detectable.
Server-authoritative timestamps: All timestamps are assigned by our servers at the moment of receipt. Client-side timestamps are not accepted.
Signed proof export: You may export a verifiable proof of any deal, which includes an RSA signature over the hash chain. This signature can be independently verified without contacting ValueSkins.
Recording consent: Before sending your first message in any deal room, you will be shown a notice explaining that the conversation is permanently recorded. Sending a message constitutes your consent to recording. Your consent choice is logged in our system.
Retention: Deal messages are retained for the duration of your account plus 90 days after account deletion, or as required by applicable law (whichever is longer).

14. Data Deletion

When you request account deletion, the following happens:

A 30-day grace period begins during which you may cancel the deletion
After 30 days, your personal data is permanently deleted by our automated deletion system
Deal messages are deleted as part of this process (retained for 90 days for dispute resolution)
Anonymized audit log entries may be retained for legal compliance
Backup copies are purged within 90 days

15. Grievance Officer (India)

In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023, please direct any concerns regarding data processing and privacy to valueskinsfounder@gmail.com. We will acknowledge your complaint within 24 hours and resolve it within 30 days as required by law.

16. Data Protection (GDPR)

For users in the European Economic Area, you may contact us at valueskinsfounder@gmail.com regarding data protection matters. You also have the right to lodge a complaint with your local data protection supervisory authority.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Platform. The "Last updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Platform after the changes take effect constitutes your acceptance of the updated Policy.

18. Contact Us

valueskinsfounder@gmail.com