Legal · Privacy notice
1.1 Signal Crew (https://crew.signalhouse.co.in) is run by Signal House, a brand of VATSALAYA RASA PRIVATE LIMITED, CIN U85306DL2024PTC425706, registered office WZ-1324, Rani Bagh, Pitampura, Delhi 110034 ("we", "us").
1.2 We are the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This page is our notice to you under section 5 of the DPDP Act and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules").
1.3 Contact for anything about your data: [email protected]. Grievances: Grievance Officer, Signal Crew, at the same email. See Grievances & Contact.
2.1 The DPDP Rules were notified by the Ministry of Electronics and Information Technology on 13 November 2025 (G.S.R. 846(E), published 14 November 2025). They come into force in phases. Most obligations of Data Fiduciaries, including notice, consent, rights, security and breach reporting (Rules 3 and 5 to 16), come into force 18 months after publication, on 13 May 2027.
2.2 Until then, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") continue to apply to us. Section 44(2) of the DPDP Act, which removes section 43A, commences on the same 18-month date.
2.3 We follow this policy now, on the DPDP standard, so you get the same rights before and after full commencement. Where the SPDI Rules treat certain data (such as financial information like bank account details) as sensitive, we collect it only with your consent and for a lawful purpose connected with payouts.
| Data | When and how | Why we use it |
|---|---|---|
| (a) Sign-in: email address and password (stored only as a hash by our authentication provider); if you use Google sign-in, your Google basic profile: name, email and profile picture | When you sign up or sign in. We email a one-time code to sign up or reset a password. We do not use phone OTP. | To create and secure your Account and identify you. |
| (b) Profile: full name; date of birth; work phone number; city and state; languages; bio; work types; categories you will and won't do; comfort preferences; optional expected rates | From you, in your application and profile. | To screen you and match you with suitable work. Date of birth is used to confirm you are 18 or older. Your phone number is used for calls and, if you opt in, WhatsApp messages about campaigns and payouts. |
| (b) Optional sensitive-category answers: whether you are willing to take part in campaigns in sensitive categories, including political content | Only if you choose to answer. We ask for your separate, explicit consent. | Only to avoid offering you work you are not comfortable with. Never shared with Clients, never used to profile your views. You can withdraw this consent and delete the answers at any time from your profile. Political campaigns are not currently offered. |
| (c) Social accounts you add: handles and links; follower counts; average views you report | From you. | Screening and matching. |
| (c) Public metrics we fetch: public profile data and metrics of the accounts you add | From Instagram through Meta's Business Discovery API (professional accounts only) and from the YouTube Data API. | To check that your accounts are real and active, for screening and for verifying campaign posts. |
| (c) Connected-account data (only if you choose to connect): profile, follower counts, media, and insights such as views and reach | Through Instagram or Facebook login, with your permission. Read-only access. | Screening and verifying campaign views. We never post, comment or send messages from your accounts. You can disconnect at any time (see Data Deletion). |
| (d) Payout and tax details (after approval only): PAN; name as on PAN; UPI ID; optionally bank account number, IFSC and account holder name | From you, after we approve you. | To pay you, to check the account is in your name, and to deduct and report tax at source as the Income-tax Act, 2025 requires. |
| (e) Campaign activity: campaigns accepted; drafts uploaded; post links; screenshots of insights and of paid-partnership labels; views; earnings; payouts | From you and from the sources in row (c). | To run campaigns, check disclosure, verify views, calculate and pay earnings, prevent fraud and report results to Clients. |
| (f) Communications: emails and messages with us; WhatsApp opt-in status | When you contact us or we contact you. | To support you and keep a record of what was agreed. |
| (g) Technical data: a sign-in session stored in your browser's local storage; server logs kept by our hosting providers (such as IP address, browser type, time of request) | Automatically when you use the Platform. | To keep you signed in, keep the Platform secure and fix problems. We use no advertising cookies and no third-party tracking or analytics scripts. |
3.1 If you choose not to give data marked as needed for a purpose (for example, date of birth or PAN), we may not be able to approve you or pay you. Optional fields are marked in the app.
3.2 We do not collect Aadhaar numbers, biometrics, or your social media passwords.
4.1 Consent (section 6 of the DPDP Act). We process most data with your consent, which you give by ticking the consent boxes when you sign up, complete your profile, connect an account or add payout details. Each consent is tied to the purposes listed in section 3. Explicit sensitive-category answers have their own separate consent.
4.2 Legitimate uses (section 7 of the DPDP Act). We may process some data without fresh consent where the law allows, including: to meet a legal obligation to disclose information to the State, such as filing TDS returns (section 7(d)); to comply with a court order or judgment (section 7(e)); and to act on data you have voluntarily given for a specified purpose where you have not said you object (section 7(a)).
4.3 We keep data after you withdraw consent or ask for erasure only where retention is necessary to comply with law, as section 8(7) of the DPDP Act permits (for example, tax records).
6.1 Our main database is in India. Some providers (such as email, website security, automation and the Meta and Google APIs) may process data outside India.
6.2 We transfer data outside India only as permitted under section 16 of the DPDP Act, and not to any country the Central Government has restricted by notification.
| Data | Kept for |
|---|---|
| Account and profile | While your Account is active. Deleted within 30 days of a deletion request or account closure, except as below. |
| Applications not approved, or on the waiting list | While your Account is active, so you can be reconsidered. Deleted on request. |
| Connected-account access tokens | Deleted when you disconnect the account. |
| Data fetched from connected accounts | While your Account is active, then deleted, except figures used for payouts (kept as payout records). |
| Payout, TDS and tax records (PAN, name as on PAN, amounts, dates, payout references) | 8 years from the end of the relevant tax year, to meet tax and accounting law. (section 128(5) of the Companies Act, 2013 requires books of account to be kept for 8 years; this also covers the reassessment periods under the Income-tax Act, 2025). |
| UPI and bank details, PAN copies or other KYC documents | Deleted or securely archived once no longer needed for payouts, and in any case at the end of the period above. |
| Logs of processing and server logs | At least one year, as the DPDP Rules require for logs, then deleted. |
7.1 Where the DPDP Rules require it, we will tell you at least 48 hours before deleting data for inactivity, so you can sign in and keep your Account.
8.1 Under the DPDP Act you have the right to:
8.2 Withdrawing consent. Withdrawal does not affect processing done before it. If you withdraw consent needed to screen you, offer you work or pay you, we will not be able to continue those services, and we may close your Account. We will still keep records the law requires (section 7).
8.3 How to exercise your rights. Email [email protected] from your registered email, or use the options in your Profile (edit profile, disconnect accounts, Delete my account). We may need to verify your identity.
8.4 Timelines. We acknowledge requests within 24 hours where possible and aim to respond within 15 days. In every case we will respond within the time the DPDP Rules allow (not more than 90 days).
8.5 Complaints. If you are not satisfied with our response, you may complain to the Data Protection Board of India under section 13(3) of the DPDP Act, after first using our grievance process.
8.6 Your duties under section 15 of the DPDP Act include giving true information and not filing false or frivolous complaints.
9.1 Signal Crew is for people aged 18 and over only. We do not knowingly process children's personal data (anyone under 18 under the DPDP Act).
9.2 Sign-ups with a date of birth under 18 are blocked. If we learn that a user is under 18, we close the Account and delete their data, except any record the law requires us to keep.
10.1 No system is perfectly secure. If you think your Account is at risk, email us at once.
11.1 If a personal data breach affects you, we will tell you without delay, in plain language, what happened, the likely impact, what we are doing about it, what you can do, and who to contact.
11.2 We will inform the Data Protection Board of India without delay and send it a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows), as Rule 7 of the DPDP Rules requires. Until Rule 7 commences, we will also meet any reporting duty under the Information Technology Act, 2000 and CERT-In directions.
12.1 We will post any update on this page with a new effective date. For material changes, we will tell you by email or in-app notice before they take effect and, where the change needs new consent, ask for it.
Email [email protected], or write to the Grievance Officer, Signal Crew, VATSALAYA RASA PRIVATE LIMITED, WZ-1324, Rani Bagh, Pitampura, Delhi 110034.