Privacy policy
This policy explains what 26Ritual collects, why, and the choices you have. It is written for creators who use the platform, for shoppers who buy through creator links, and for people who comment on or message a creator's Instagram account.
Last updated:
Who we are
26Ritual is a creator commerce platform for beauty creators in India. Creators share products from partner stores with their audience, the platform delivers tracked links in their Instagram DMs, attributes the orders that follow, calculates commission by rule and pays creators every month.
The legal entity that operates 26Ritual and acts as the data fiduciary under the Digital Personal Data Protection Act 2023 is being confirmed. Its name, registered address and grievance officer details will be published on this page before public launch. Until then, every reference to "we", "us" and "26Ritual" in this policy means that operating entity.
This policy covers 26ritual.com, the go.26ritual.com link service, the creator app and every service we run under the 26Ritual name. It does not cover partner stores, which have their own privacy policies, or Instagram, which is run by Meta.
What we collect from creators
When you apply, we collect what you type into the application: your name, phone number, email address, Instagram handle, the categories you create in, your city, your self-declared follower count, how you heard about 26Ritual and, once referrals launch, the referral code you used.
When you connect your Instagram account, Meta shares the data you authorise. Depending on the permissions you grant, that includes your profile (username, account id, account type, profile picture and follower count), the list of your media (posts, Reels and Stories with their ids, captions and thumbnails), the comments on that media, and the direct messages needed to reply to people who asked for a link. We store the access token that lets us act on your behalf, encrypted.
To pay you and meet Indian tax law we collect your PAN, the name on your PAN, your GSTIN if you are registered, and either a bank account number with IFSC or a UPI id. PAN is stored encrypted and shown back to you only as its last four characters.
While you use the platform we generate records about your activity: the links and coupon codes you create, the products you map to posts, the automation rules you set, your campaign assignments, the clicks and orders attributed to you, your commission ledger, payout history and statements, the notifications we send you, and support conversations on WhatsApp or email.
We also record the version of the creator terms you accepted and when, your TDS declaration and any marketing consent, each with a timestamp and the screen it came from.
What we collect about shoppers
If you buy through a creator's link or code on a partner store, the store sends 26Ritual the order details needed to attribute the sale and calculate commission: an order number, the items, quantities and prices, any coupon code used, the order status and its later changes such as cancellation or return, and a hashed customer reference.
That reference is a one-way hash generated by the store. It lets us tell whether a creator's own account placed the order and count repeat purchases, but it cannot be turned back into your name. 26Ritual never receives your name, address, phone number, email or payment details from a partner store, and creators never see anything about you except aggregate counts.
When you click a go.26ritual.com link we log the click: the link id, the time, your IP address, your browser's user agent and the referring page. The partner store keeps a first-party attribution reference for the length of the attribution window (currently 30 days) so an order can be matched to the click. Click logs are used for attribution and to filter bots, and are aggregated after the attribution window closes.
What we collect from people who comment or message
When you comment a trigger word such as "link" on a creator's post, Instagram sends us the comment: your Instagram-scoped user id, your username, the text of the comment, the post it was left on and the time. We use it to send you one direct message from the creator's account with the products for that post, and to avoid sending you the same message twice.
Instagram-scoped ids are specific to 26Ritual and cannot be used to look you up on other apps. We do not build a profile of you across creators, we do not see your follower list or your private posts, and we do not contact you again unless you ask for something else.
If a creator offers a restock alert or a WhatsApp update and you choose to share your phone number or email address, we store that contact detail with a record of what you agreed to, when and where. You can withdraw that consent at any time by replying STOP or by writing to us. Contact details are never shared with brands and are never used for anything other than what you agreed to.
Why we use it
We process personal data for a small number of specific purposes:
- Running the programme: reviewing applications, onboarding creators, connecting Instagram accounts, delivering links in DMs and running campaigns.
- Attribution: matching clicks, coupon codes and orders to the creator who drove them, detecting bots and self-purchases, and reversing commission on cancelled or returned orders.
- Payouts: calculating commission, generating monthly payout batches, sending money to a creator's bank or UPI account and issuing statements.
- Tax compliance: deducting tax at source, filing quarterly returns and keeping the records Indian law requires.
- Support and communication: answering questions on WhatsApp and email, sending transactional notifications about applications, payouts and campaigns, and sending marketing messages only where you have opted in.
- Safety and security: preventing fraud, enforcing the creator terms, keeping the platform available and investigating incidents.
We do not use personal data for any purpose that is incompatible with these, and we do not make decisions about you by automated means that have a legal effect on you without a person reviewing them.
Legal basis and consent under the DPDP Act 2023
We process personal data under the Digital Personal Data Protection Act 2023. For creators, the legal basis is your consent, given when you apply, when you connect Instagram and when you submit payout details, together with the creator terms you accept. Each consent request states its purpose, and you can withdraw consent as easily as you gave it, from the app or by writing to us. Withdrawing consent stops future processing but does not undo what was done lawfully before, and some records must be kept for tax purposes even after you leave.
For shoppers we process only the minimum a partner store must share to pay the creator who drove the sale, and we receive it in a form that does not identify you. For audience members we process comment data because you asked for a reply; anything more, such as a phone number for alerts, needs your separate and explicit consent.
Where the Act requires it we give notice in English and in the languages listed in the Eighth Schedule to the Constitution, and we honour the rights described below through the grievance officer named on this page.
Instagram and Meta platform data
26Ritual uses the Instagram API with Instagram Login and the Messenger Platform for Instagram, and complies with Meta's Platform Terms and Developer Policies. Our use of Instagram data is limited to the purposes declared in Meta's app review: reading comments and mentions on a connected creator's media, sending a private reply to a comment on that creator's behalf, sending direct messages inside Meta's messaging window to people who triggered a rule, and showing the creator their own media so they can map products to posts.
We reply only to people who asked. We never send unsolicited messages, never message someone who has not commented or written first, and never send a message outside the window Meta allows. Every attempt to send is logged with its outcome so a creator, and Meta, can see what happened.
Instagram data is never sold, never used to build advertising profiles, and never shared with brands except as aggregates, such as the number of link requests a campaign generated. Access tokens are stored encrypted, refreshed as Meta requires and revoked the moment a creator disconnects or deletes their account. If Meta tells us that a user has removed the 26Ritual app or asked for their data to be deleted, we honour that request as described on our data deletion page.
How long we keep it
Financial records, including the commission ledger, payout records, statements, PAN and TDS filings, are kept for the period Indian tax and company law requires (currently eight years from the end of the relevant financial year). When you delete your account we replace the personal identifiers on those records with a tombstone so the ledger still balances without naming you.
Everything else is deleted when you ask, and in any case within 30 days of your account being closed: your profile, Instagram data and tokens, application answers, automation rules, notifications and support history. Comment data from audience members is deleted once it is no longer needed to reply and to suppress duplicates, and in any case within 90 days. Click logs are aggregated after the attribution window closes. Backups roll off on a fixed schedule so deleted data leaves them within a further 35 days.
How we protect it
All traffic to 26Ritual is encrypted in transit. Instagram access tokens, PAN numbers and bank details are encrypted at rest with keys held separately from the database. Access to production systems needs an individual account, two-factor authentication and a reason, and every admin action that touches personal data is written to an audit log.
Incoming webhooks from Instagram and partner stores are signature-verified before we act on them. Payout instructions carry an idempotency key so a transfer cannot be sent twice. We keep the amount of personal data we hold to the minimum, which is the best protection of all. If a breach affects you we will tell you and the Data Protection Board of India as the Act requires.
Your rights
You have the right to know what personal data we hold about you, to correct it, to have it erased, to withdraw consent, and to nominate someone to exercise these rights if you are unable to. Creators can do most of this in the app: edit your profile and payout details, disconnect Instagram, download your statements and delete your account. Anyone can write to us at the address below and we will respond within 30 days.
Grievance officer: name and contact details to be published once the operating entity is confirmed. Until then, write to hello@26ritual.com with "Grievance" in the subject line. If you are not satisfied with our response you may complain to the Data Protection Board of India.
Children
26Ritual is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18, and creators must be adults to apply. If you believe a child has given us data, tell us and we will delete it. Comments from audience members are processed only to send the reply they asked for; we do not attempt to determine the age of commenters.
Changes to this policy
We will update this policy when the operating entity is confirmed, when we add a feature that changes what we collect, and when the law changes. The date at the top shows the current version. For material changes we notify creators in the app and by email before they take effect, and where the law requires it we ask for consent again.
Contact
Questions about this policy, requests to exercise your rights and complaints all go to hello@26ritual.com. Approved creators can also reach the team on WhatsApp from inside the app. Our registered address will be published here once the operating entity is confirmed.