Privacy Policy

SwayHouse is a creator management and brand partnerships business operating from Sector 18, Noida, Uttar Pradesh, India (Delhi NCR), registered in India under Udyam Registration Number UDYAM-UP-28-0229065.

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below, and you are the Data Principal. You can reach us at legal@swayhouse.in or +91 98218 19622.

We collect only what a given interaction actually needs. Browsing the public site does not require you to give us any personal data.

Information you give us

• Contact form: your name, email address, Instagram handle, whether you are a creator or a brand, and your message.
• Programme application and payment: your name, email address, phone or WhatsApp number, social handle or channel link, follower range, content niche, the plan you selected and any goal note you write. Card, UPI and bank details are entered directly into Razorpay’s checkout and are never seen or stored by us.
• Creator portal, SwaySpace and CRM accounts: your login credentials (stored as a hash, never in readable form), profile details, portfolio and document uploads, campaign records and payment records that you or your manager enter.
• Testimonials: feedback you send us. Nothing appears on our public reviews page unless you have separately approved it and chosen whether your name and handle are shown or withheld.

Information collected automatically

• Security and delivery logs: our host, Vercel, processes your IP address and request headers to serve pages and block abuse.
• Analytics, only if you consent: a random visitor identifier stored in your browser, the pages you view, the site you arrived from, your device type, operating system and the approximate country and city derived from your IP address by our host. We do not store your full browser user-agent string and we do not store your IP address in our analytics database.

If you decline analytics, or make no choice at all, no analytics identifier is created and no page views are recorded. See our Cookie Policy for the full list of what is stored in your browser.

• To answer your enquiry and to contact you about a partnership or application.
• To provide the service you paid for, issue receipts and keep account records.
• To operate the creator portal, SwaySpace and our internal CRM.
• To present creators to brands, and to run and report on campaigns.
• To keep the site secure, prevent spam and diagnose faults.
• To understand which pages are useful, where consent has been given.
• To meet our tax, accounting and other legal obligations.

We do not sell your personal data. We do not share it with advertising networks for behavioural advertising, and we do not use your submissions to train our own AI models.

Under the Digital Personal Data Protection Act, 2023 we process personal data on the basis of your consent, or where the Act permits processing for a legitimate use.

• Consent covers everything you submit through a form and all analytics. Every form that sends us personal data asks you to tick a box first, and the notice next to it tells you what you are agreeing to. You can withdraw consent at any time — see Your rights.
• Performance of a service you asked for covers running your account and delivering a plan you have bought.
• Compliance with law covers tax records, statutory registers and responding to a lawful request from an authority.

Withdrawing consent does not affect anything we lawfully did before you withdrew it, and does not remove records we are separately required by law to keep.

We share personal data only with the service providers we need to run the business. Each of them is bound to use it solely for the purpose we engaged them for.

We may also disclose personal data to our professional advisers, or to a court, regulator or law-enforcement agency where we are legally required to do so.

Brands. When we present you to a brand for a campaign, we share the professional details relevant to that pitch — your handle, content, reach and rates. We do not pass on your phone number, email address or documents without asking you first.

Several of the providers listed above store or process data outside India, principally in the United States. Where that happens, the transfer is made in reliance on Section 16 of the Digital Personal Data Protection Act, 2023, which permits transfer to any country not restricted by the Central Government, and is subject to the provider’s own contractual data-protection commitments.

If you are in the United Kingdom or the European Economic Area, you may also have rights under the UK GDPR or EU GDPR. We will honour those rights on request, using the same contact details given below.

• Enquiries that go nowhere: up to 24 months from your last message, then deleted.
• Client and creator records: for the duration of the relationship and then for as long as we may need them to defend a legal claim.
• Payment and tax records: eight years, as required by Indian tax and accounting law.
• Analytics records: up to 26 months, in a form that does not identify you by name.
• Assistant conversations: until you delete the conversation, or until your account is closed.

We apply reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000. In practice that means: the whole site is served over HTTPS; passwords are stored only as salted hashes; portal and CRM data is protected by row-level access rules so one account cannot read another’s records; administrative keys are held server-side and never sent to the browser; and payment details are handled entirely inside Razorpay’s PCI-DSS compliant checkout.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected person as required by the Digital Personal Data Protection Act, 2023.

As a Data Principal you have the right to:

• ask for a summary of the personal data we hold about you and who we have shared it with;
• ask us to correct anything inaccurate, or complete anything missing;
• ask us to erase personal data we no longer need for the purpose we collected it for;
• withdraw your consent, as easily as you gave it;
• nominate another person to exercise these rights if you die or become incapacitated; and
• have a grievance heard and answered before you escalate it.

To exercise any of these, email legal@swayhouse.in. We will respond within 30 days. We may need to verify who you are before we act, which protects you as much as us.

To withdraw analytics consent, open the Cookie Policy and use the button there; it takes effect immediately and clears the identifier from your browser.

Our services are for people aged 18 and over. We do not knowingly collect personal data from children under 18, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has given us personal data, write to legal@swayhouse.in and we will delete it.

Rocky and SwayAI are automated assistants, not people. What you type into them is sent to the AI providers listed in section 5 to generate a reply, and — if you are signed in — the conversation is stored against your account so you can return to it. Delete a conversation and we delete our copy.

Do not enter passwords, financial account numbers, government identifiers or anyone else’s personal data into an assistant. Their answers are generated automatically, can be wrong, and are not legal, tax or financial advice. No decision that produces a legal effect for you is made by an assistant alone.

In accordance with the Information Technology Act, 2000 and the rules made under it, and the Consumer Protection (E-Commerce) Rules, 2020, the details of our Grievance Officer are:

We acknowledge every complaint within 24 hours and aim to resolve it within 15 days of receipt. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

We update this policy when what we do with personal data changes. The date at the top of this page always reflects the current version. If a change materially affects your rights, we will say so on the site and, where we hold your email address and the change requires it, ask for your consent again.