Who we are
ADFLU’s apps at app.adflu.in are run by ADFLU Media House Private Limited (“ADFLU”, “we”, “us”). For anything about your data, write to hello@adflu.in.
This policy covers the apps. The adflu.in website has its own: adflu.in/privacy (opens in a new tab).
What we keep about you and your brand
- Your account. Your name, email and workspace name, which apps your workspace has, when you agreed to the terms of use and this policy, and when you confirmed your email address. Your password is kept only as a scrambled code (a hash), so nobody at ADFLU can read it. A number kept with your login changes whenever a new password is set for it, which ends every session of that login.
- Emails we send you. When you join, ask for a new link, or forget your password, we email you a link: to confirm your email address (it works for 7 days) or to set a new password (it works for one hour, once). For each link we keep a scrambled code of it (never the link itself), the address it went to, when it was made, when it expires and when it was used, and a short scrambled code of who asked for it (never their internet address). If someone tries to join as a creator with an address that already has a login, that address gets an email saying so, with nothing the person typed in it.
- Your brands and campaigns. The brands, campaigns and creators you add: names, websites, channel links, creators’ emails and UPI IDs, fees, what each creator promised, and the payments you mark as made. A creator you add from Find influencers keeps the name and category you confirm for them, and the channel’s YouTube id and link: nothing else from YouTube.
- Your files. The logos you upload, the videos you or your creators upload (or the link to a video file), and the screenshots Spotted saves of each moment your logo is on screen.
- Your requests. For Get assistance: your name, email, phone number if you give it, the product, budget, timing, the influencers you picked and your note. When you ask for one of ADFLU’s apps: the app, your note, your name and email. To limit how many Get assistance requests can be sent, a short scrambled code made from the internet address a request came from (never the address itself) is kept with it for one day.
- Media accounts and agreements. For a media channel’s or creator’s account: the same account details as above. For each agreement: what it says, every version, the brand’s and the channel’s names, who wrote and approved it, which media account opened its link and when, any change the channel asked for, and its acceptance: the name and role typed by the person who accepted, their account, the time, and a short scrambled code made from the internet address it was accepted from (never the address itself). Also the optional choice to let Spotted read YouTube analytics for that campaign’s videos, and when it was withdrawn. Agreements hold no fees or payment details.
- Creator accounts. The creator name, email, what you make, languages, region and links you give; that you confirmed you are 18 or older; each consent you give or take back, with the time, which words you were shown, and a short scrambled code made from your internet address (never the address itself); and the YouTube channel, Facebook Page or Instagram account you connected, with the numbers Spotted reads from it (see the sections on Google, Instagram and Facebook below). If you use the channel search, what you type is sent to YouTube to find the channel and is not kept by Spotted.
- Teammates. For an invite link: who made it, a note about who it is for, when it expires and who used it. Only a scrambled code of the link itself is kept. The workspace’s owner can remove a teammate: the teammate’s login is deleted, and what they added stays with the workspace without their name. The first time an owner’s password is set from a link we email (or by ADFLU’s team at the owner’s request), teammates who joined before are paused until the owner lets them back in, and we keep the time they were paused.
- Failed logins. The email that was tried and a short scrambled code made from the internet address it came from (never the address itself), or the name of the browser it came from (see Cookies), to stop password guessing.
- Sign-up, log-out, email and search limits. To limit how many sign-ups (for creators, brands and media accounts), log outs, password resets, emails to one address and YouTube channel searches there can be, a short scrambled code made from the internet address or the email address (never the address itself), or the account’s number, is kept with the time of each try.
Why we keep it
To run the apps for you: to log you in, check your videos for your logo, make your reports, keep your shortlists, and answer the requests you send us. For creators, also to check that a channel, Page or account a creator connects is theirs, and to show brands on Spotted the numbers a creator chose to share, so a brand can decide whether to ask for a promotion. That is all. We do not sell your data. The apps show no advertising, and they use no third-party trackers or analytics.
YouTube data in Find influencers
Find influencers uses YouTube API Services. Google’s Privacy Policy applies to that data: http://www.google.com/policies/privacy (opens in a new tab). Using Find influencers also means agreeing to the YouTube Terms of Service: https://www.youtube.com/t/terms (opens in a new tab).
Find influencers uses YouTube’s public data, with an API key: it never connects to your YouTube or Google account. Channel search on the creator page also uses YouTube’s public data: what you type goes to YouTube to find the channel, and Spotted does not keep it. The places the apps connect to a Google account are Connect YouTube for media channels and Connect YouTube for creators: see Google user data: Connect YouTube below.
- What we keep. Channel and video data from YouTube’s public API: each channel’s name, handle, picture, description, and the country, language and topics it has on YouTube; its subscriber, view and video counts; and its latest videos, with their titles, pictures and view, like and comment counts. Each item is refreshed from YouTube or deleted within 30 days.
- Creators’ channels. For a creator who connected their channel, the channel’s public subscriber, view and video counts come from here. Spotted reads them again about once a day while the channel is connected, and shows them to brands on the creator’s card. Like the rest, they are refreshed or deleted within 30 days.
- Contact details. The emails, numbers and links shown for a channel come from that channel’s own public YouTube description. They are read from the description when the page shows them, and are not kept separately.
- Pictures. Channel and video pictures load straight from YouTube’s servers, so YouTube sees that your browser asked for them.
- Shortlists. A shortlist keeps the YouTube id of each channel on it, with your brand (or with your workspace, if you have not added a brand). When a channel’s data is deleted, it leaves every shortlist too.
- Videos added to a campaign. When a channel adds a YouTube link in Spotted, its public details from YouTube (title, publish date, length, view count, and whether YouTube marks it as a paid promotion) are kept with the time they were fetched, and refreshed or deleted within 30 days. Nothing is worked out from them.
- Messages to ADFLU’s team. A Get assistance request or a request to leave a channel out names the channels by their YouTube links, not by YouTube’s names for them.
Own a YouTube channel and want it left out? Anyone can ask, at app.adflu.in/remove-channel or by writing to hello@adflu.in. We first check that the request comes from the channel’s owner, and may email you to make sure. Once that is confirmed, we delete the channel’s data within 7 days, and never fetch or show it again.
When you ask there, we keep what you typed (the channel’s link or handle), your email and your note until 90 days after we decide your request, so that we can reply, and they go to ADFLU’s team on Telegram. A short scrambled code made from your internet address (never the address itself) is kept with the request, so that no more than five requests an hour can come from one place.
Deleting data from ADFLU’s apps does not change anything on YouTube. To change or delete what YouTube shows, use YouTube itself.
You can always see which apps can reach your Google account, and take access back, at https://myaccount.google.com/permissions (opens in a new tab).
Google user data: Connect YouTube
Spotted's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Media channels. A media channel that works with a brand on Spotted can choose to connect its own YouTube channel, with Google sign-in. It is optional. It is offered only to the owner of the media account, only for campaigns where they ticked “Allow Spotted to read YouTube analytics for this campaign’s videos only (views and how many people were watching at each second), until the report is done”, and Google asks them to allow it on its own screen.
- What we read. With the permission to see your YouTube account (youtube.readonly): your channel’s name and id, and the list of your own newest uploads (titles, dates and pictures), so that you can tick the videos made for a campaign. With the permission to see YouTube Analytics for your videos (yt-analytics.readonly): for the videos you tick, and only those, their views and their audience retention (how many people were still watching at each point of the video). Nothing else: not your other videos’ analytics, your subscribers, your comments, your earnings or your Google account’s other data. We never post, change or delete anything on YouTube.
- Why. To show the brand how many people were really watching while its logo was on screen, from your own numbers instead of Spotted’s estimate. That is the only use of the media channel’s data. We do not sell this data, use it for advertising, use it to train AI models, or use it to compare or rank channels.
- Who sees it. The brand of that campaign and the people in your media account, on that campaign’s pages and its report, marked “measured with YouTube Analytics”. Not other brands, not other channels, and not other campaigns. People at ADFLU look at it only in four cases: when the person it is about asks them to (for example, for help with their account), to keep the apps secure (for example, to look into abuse), when the law requires it, or as anonymous totals for running the apps.
- What we keep, and how. Your channel’s name and id, the permission Google gives (a refresh token, kept encrypted), which videos you ticked, and each ticked video’s views and audience retention with the time they were read. The list of your uploads is read when you open it and not kept. Your Google password is never seen by Spotted: you sign in on Google’s own page.
- How long. A video’s numbers are read again when they are more than a day old and someone opens the campaign, and are never kept more than 30 days after they were read. When you withdraw the consent for a campaign, the numbers read for that campaign’s videos are deleted at once, and Google’s permission too if no other campaign still has the consent on. Everything, the permission included, is deleted when you disconnect YouTube. A campaign’s numbers are deleted 30 days after its end date, and the permission with them once no campaign needs it.
- How to stop it. On Spotted, Brands and campaigns: Disconnect YouTube (Spotted asks Google to take back its access, and deletes what it read), or Withdraw consent for one campaign. Or at any time on your Google account: https://myaccount.google.com/permissions (opens in a new tab). To have anything deleted sooner, write to hello@adflu.in.
Creators. A creator can connect their own YouTube channel on Spotted’s “Connect where you post” page. It is optional, and the account works without it. Spotted asks Google for one read-only permission, to see the creator’s YouTube account (youtube.readonly), for one purpose: to confirm which channel the creator owns and to show brands using Spotted the channel’s public numbers, so a brand can decide whether to ask for a promotion. Google asks the creator to allow it on its own screen. Only if and when ADFLU switches on showing a channel’s last 28 days of YouTube Analytics to brands (it is off), Spotted also asks for the permission to see YouTube Analytics (yt-analytics.readonly), and says so on its consent screen before asking; creators who agreed earlier are asked again.
- What we read. With youtube.readonly: the channel’s id, name, @handle, picture, subscribers, total views and number of videos. Only once 28-day analytics are switched on for brands and the creator agrees to that, also with yt-analytics.readonly: the channel’s views and watch time for the last 28 days and the top five countries of its viewers. Nothing else: not your earnings, the text of your comments, your viewers’ age or gender, your subscribers’ names, your private videos or your Google account’s other data. We never post, change or delete anything on YouTube.
- Why. To confirm that the channel is yours, to show brands using Spotted your channel’s numbers, so they can decide whether to ask you for a promotion, and to show you the same numbers. Once ADFLU switches it on for a platform, brands on Spotted find creators who have connected that platform, so Spotted can check that the channel, Page or account is really theirs and show brands its numbers. A connection counts while Spotted could read it in the last 10 days. Creators who joined before the first platform was switched on can still be found for a notice period, and creators whose platform does not count yet can still be found until it does. Others keep their account, but brands do not find them until they connect. While Spotted can send account emails, creators found through a connection also need to confirm their email address, with the link Spotted emails them. We do not sell this data, use it for advertising, use it to train AI models, or use it to compare or rank creators.
- Who sees it. You see your channel’s numbers on your “Connect where you post” page. Brands using Spotted see, on your card in Creators on Spotted, a link to your channel and its subscribers, total views and videos, which Spotted reads from YouTube’s public data, marked “From YouTube” with the date they were read; with 28-day analytics switched on, and only if you agreed to it, also your views and watch time for the last 28 days and the top countries of your viewers. Brands see your email only after you accept their request. People at ADFLU look at it only in four cases: when the person it is about asks them to (for example, for help with their account), to keep the apps secure (for example, to look into abuse), when the law requires it, or as anonymous totals for running the apps.
- What we keep, and how long. The channel’s id, name and @handle, the permission Google gives (a refresh token, kept encrypted), and the numbers above with the time they were read. Spotted tries to read them again about once a day. A reading is never kept more than 30 days, and if Spotted cannot read the channel for 30 days, it disconnects it and deletes what it read. A record that you agreed (the time, which words you saw, and a short scrambled code made from your internet address; no numbers) is kept for one year after you stop.
- How to stop it. On Spotted, on your “Connect where you post” page: Disconnect YouTube. Spotted deletes what it read and the permission it kept at once, and asks Google to take the permission back (unless the same channel is also connected for a media account on ADFLU, which still uses it). Or remove Spotted at any time at https://security.google.com/settings/security/permissions (opens in a new tab) or https://myaccount.google.com/permissions (opens in a new tab): Spotted finds out the next time it tries to read, normally within a day and at the latest within 30 days, and deletes what it read. Taking access back at Google also ends a Connect YouTube for media made with the same Google account. To have your whole creator account deleted, write to hello@adflu.in.
Creators, and Instagram data: Connect Instagram
Creator accounts. Creators can join Spotted to be found by brands, if they are 18 or older. A creator’s profile holds what they write: their name, a line about them, their categories, languages and region, their YouTube channel link and their Instagram @handle. Brands on Spotted see the profile while the creator lets brands find them (they can turn that off at any time). Once ADFLU switches it on for a platform, brands on Spotted find creators who have connected that platform, so Spotted can check that the channel, Page or account is really theirs and show brands its numbers. A connection counts while Spotted could read it in the last 10 days. Creators who joined before the first platform was switched on can still be found for a notice period, and creators whose platform does not count yet can still be found until it does. Others keep their account, but brands do not find them until they connect. While Spotted can send account emails, creators found through a connection also need to confirm their email address, with the link Spotted emails them. A brand sees the creator’s email only after the creator accepts that brand’s request, and the creator then sees the email of the person who asked.
Connect Instagram is optional. The creator logs in with Facebook on Facebook’s own page, allows what Spotted asks for, and then picks, on Spotted, one Instagram Creator or Business account linked to a Facebook Page they manage. Spotted asks Facebook for four permissions: pages_show_list, pages_read_engagement, instagram_basic and instagram_manage_insights. Facebook also gives every app its basic public_profile permission. Facebook’s names for these sound wider than what Spotted does: for example, pages_read_engagement also lets an app read a Page’s posts. Spotted reads only what is listed below, and never sees the Facebook or Instagram password.
- What we read. The account’s id, username and name; its followers; and its insights for the last 28 days (reach, views and accounts engaged). While the creator picks, the Pages they allowed on Facebook, with their names, links and followers. Nothing else: not posts’ content, comments, messages, where followers are or their gender and age, or other people’s data. We never post, comment or send messages.
- Why. To check that the account is the creator’s own, to show the creator their numbers, and to show brands on Spotted the numbers the creator agreed to share, so a brand can decide whether to ask them for a promotion. We do not sell this data, use it for advertising, use it to train AI models, or rank creators with it.
- Who sees it. The creator sees the account’s followers, reach, views and accounts engaged on their “Connect where you post” page. Brands using Spotted see the @handle on the creator’s card in Creators on Spotted. Once ADFLU switches Instagram on for brands, they also see the followers and the reach for the last 28 days, marked “From Instagram” with the date they were read; until then they see none of the numbers. Brands never see the rest. People at ADFLU look at it only in four cases: when the person it is about asks them to (for example, for help with their account), to keep the apps secure (for example, to look into abuse), when the law requires it, or as anonymous totals for running the apps.
- What we keep, and how long. The account’s id, username and name, the id and name of the Page it is linked to, the numbers above with the time they were read, and the permission Facebook gives for the chosen account (kept encrypted). Also the number Facebook gives Spotted for the creator’s Facebook login (an id that means something only to Spotted’s app): it is kept as it is, not encrypted, so that a deletion request from Meta, which names that number, can find what to delete. While the creator picks, for at most 30 minutes, the list of Pages and accounts they allowed and the permission Facebook gave their login (kept encrypted); both go once they pick. Spotted tries to read the numbers again about once a day while the account is connected. A reading is never kept more than 30 days, and if Spotted cannot read the account for 30 days, it disconnects it and deletes what it read. Facebook can end an app’s access after about 90 days; when Facebook gives an end date, a reminder to connect again shows on the creator’s “Connect where you post” page in the 14 days before it (and goes by email when ADFLU has set up email), and if access ends, Spotted deletes the permission and everything read. A record that the creator agreed (the time, which words they saw, and a short scrambled code made from their internet address; no numbers) is kept for one year after they stop.
- How to stop it, and delete it. On Spotted, on the “Connect where you post” page: Disconnect Instagram, and everything Spotted read from it is deleted at once. Spotted also asks Facebook to take its permission back when that was the creator’s last Facebook or Instagram connection on Spotted. Or remove ADFLU Spotted in your Facebook settings: Meta tells Spotted, and the same data is deleted. See Deleting what Spotted read from Facebook or Instagram below. To have your whole creator account deleted, write to hello@adflu.in.
Facebook Page data: Connect Facebook Page
Connect Facebook Page is optional. The creator logs in with Facebook on Facebook’s own page, allows what Spotted asks for, and then picks, on Spotted, one Facebook Page they manage (a personal profile does not count). Spotted asks Facebook for three permissions: pages_show_list, pages_read_engagement and read_insights, and Facebook also gives every app its basic public_profile permission. It asks for no Instagram permission when a Page is connected, and never sees the Facebook password.
- What we read. The Page’s id, name, link and followers, and its insights for the last 28 days: views and the people who viewed it. While the creator picks, the Pages they allowed, with their names, links and followers. Nothing else: not the Page’s posts, comments or messages, or its followers’ names or where they are.
- Why, and what we keep. As for Instagram above: to check that the Page is the creator’s own, to show the creator their numbers and brands the numbers the creator agreed to share; kept, renewed and deleted in the same way.
- Who sees it. The creator sees the Page’s followers, views and the people who viewed it on their “Connect where you post” page. Once ADFLU switches Facebook on for brands, brands using Spotted see the Page’s name, followers and views for the last 28 days on the creator’s card, marked “From Facebook” with the date they were read; until then they see nothing of the Page. Brands never see the rest. People at ADFLU look at it only in four cases: when the person it is about asks them to (for example, for help with their account), to keep the apps secure (for example, to look into abuse), when the law requires it, or as anonymous totals for running the apps.
Deleting what Spotted read from Facebook or Instagram. On Spotted, on your “Connect where you post” page, press Disconnect on the Facebook Page or Instagram card, and everything Spotted read from it is deleted at once. Or remove ADFLU Spotted in your Facebook settings, and Meta tells Spotted to delete it: Meta’s request goes tohttps://app.adflu.in/auth/facebook/deletion, and you can check what became of it at app.adflu.in/auth/facebook/deletion/status with the confirmation code Meta gives you. To delete your whole creator account, write to hello@adflu.in.
How long we keep it
- Get assistance requests: 12 months after they are done or closed, then deleted. The scrambled address code kept with one: one day.
- Requests to leave a YouTube channel out: 90 days after we decide it, then deleted. The channel stays left out once we have confirmed the request.
- Messages to ADFLU’s team (on their way to Telegram), including the notes about creators and their connections: 90 days after they are sent, then deleted; one that could not be sent, 90 days after it was written. In the team’s chat on Telegram: deleted by ADFLU’s team by hand at least once a month.
- Failed logins: one day.
- Links in our emails (confirming your address, setting a new password): deleted a day after the link stops working, and with your login.
- Agreements: kept as the record, every version and its acceptance (with the scrambled address code), for as long as the brand’s workspace exists. Either side can ask us about it.
- Invite links: for as long as the workspace exists; a link stops working after 7 days or once used.
- YouTube data: refreshed or deleted within 30 days.
- Connect YouTube (a channel’s own YouTube Analytics and Google’s permission): a campaign’s numbers until the channel withdraws the consent for it, and at most 30 days after the campaign ends; the permission until the channel disconnects, or no campaign needs it any more. Each video’s numbers: at most 30 days after they were read.
- Creator numbers (read from YouTube, Facebook or Instagram) and the platform’s permission: deleted at once when you disconnect, or when Meta tells us you removed Spotted; otherwise the next time Spotted tries to read and is told it may no longer, normally within a day, and within 30 days at the latest. A reading is never kept more than 30 days.
- Consent records (the time, which words you saw, the platform and the scrambled address code; no numbers): one year after you stop. A record of a consent that is still in force is kept while it is in force. When a workspace is deleted, its records no longer name the person, the channel or the address code, and they are deleted once they are one year old.
- Unfinished connections: a sign-in started on Google or Facebook stops working after 10 minutes; the channel picked in the search, and the Pages and accounts allowed on Facebook while a creator picks, after 30 minutes. Each is deleted at the next hourly clean-up.
- Sign-up, log-out, email and search limits (the scrambled codes or the account’s number): two days.
- Everything else: for as long as your workspace exists. Ask us to delete it, and we will.
A copy, a correction or a deletion
To get a copy of your data, correct it, or have your workspace deleted, write to hello@adflu.in from the email you log in with. We answer within 30 days. Before we delete anything, we check that the request comes from your login’s address: we write back to it and wait for your yes.
Deleting a workspace disconnects every platform it connected, and asks Google and Facebook to take back the permission they gave Spotted (unless another connection on Spotted still uses it). Then it deletes the workspace, its logins, its files, and our notes about it for ADFLU’s team. We tell you when it is done. What we keep:
- The record of each consent, for at most one year after it stopped, no longer naming you, the channel or the address code (see Consent records above).
- An agreement you accepted with a brand, which stays in that brand’s records, without your account.
- A request you sent to leave a YouTube channel out, until 90 days after we decide it.
- Our notes already in the team’s chat on Telegram, where ADFLU’s team deletes them by hand at least once a month.
- Copies in our web host’s backups, until the backups are replaced, within [OWNER: how many] days.
A teammate can ask the workspace’s owner to remove them, or write to us.
Creators can also delete what Spotted read from a platform themselves, at any time: on the “Connect where you post” page, press Disconnect on the YouTube, Facebook Page or Instagram card, and it is deleted at once. For Facebook and Instagram, removing ADFLU Spotted in your Facebook settings does the same: see Deleting what Spotted read from Facebook or Instagram.
Keeping it safe
We protect your data with reasonable security measures. The apps can only be reached over an encrypted connection (HTTPS), passwords are hashed, the permissions Google gives for Connect YouTube and Facebook gives for Connect Facebook Page and Connect Instagram are kept encrypted, and only the people at ADFLU who need your data to run the apps can see it.
Children
The apps are for businesses and adults. Creators confirm that they are 18 or older when they join, and we keep the time and which words they confirmed. We do not knowingly keep data about anyone under 18, and we do not track or target children. If you think a child has given us data, write to hello@adflu.in and we will delete it.
Changes to this policy
If we change this policy, we will update this page and its date, and we record which version of it applied when you gave each consent. If we start to use your data in a new way, or to show brands more than you agreed to, we will ask you to agree again before that applies to you.
Contact us
Questions or complaints about your privacy? Write to hello@adflu.in.
