Privacy Policy

Data you give us

• Account details: name, email, phone number and password.
• Payout details: your UPI ID or bank account, and identity information (KYC) we are required to verify before paying you.
• Anything you send us, such as support messages or a grievance.

Data created as you use the Platform

• The links you generate and the offers and campaigns you promote.
• Click and conversion data for the links you share — this is how commission is attributed to you. For a click it can include the IP address of the device that clicked, coarse location (country, region, city), device and browser type, and the referring site or app.
• Your earnings, balances, payouts and related ledger records.
• Log, cookie and device data needed to run and secure the service (see our Cookie Policy).

Under the DPDP Act we process personal data either with your consent or for the specific legitimate uses the Act permits. Our purposes and their basis are:

• To provide the service — create your account, generate links, attribute conversions, and calculate and pay earnings — using the data you voluntarily give us for that specified purpose, with your consent.
• To verify your identity (KYC), process payouts and meet tax obligations — to comply with our legal obligations.
• To prevent, detect and investigate fraud, abuse and security incidents — a legitimate use permitted under the Act.
• To communicate with you about your account, support and important service or policy changes.
• To improve the Platform, using aggregated or de-identified data wherever possible.
• To send you optional product updates or marketing — only with your consent, which you can withdraw at any time.

We do not sell your personal data. We share it only as needed:

• Affiliate network: we pass a tracking identifier (not your name) to the affiliate network that reports conversions, so your sales are credited to you.
• Payment and KYC partners: to verify you and send your payouts.
• Service providers: hosting, database, analytics and communication providers who process data on our behalf under confidentiality obligations.
• Legal and safety: where required by law, court order or regulator, or to protect the rights and safety of Kamaiyo, our users or the public.
• Business transfer: as part of a merger, acquisition or reorganisation, subject to this policy.

We aim to process and store personal data within India. Some of our service providers may process it outside India; where they do, any such transfer is made in accordance with Section 16 of the DPDP Act — that is, not to any country the Government of India restricts — and those providers are required to protect your data to a comparable standard under contract.

We keep account and earnings records for as long as your account is active and for as long afterwards as we need to meet legal, tax and accounting obligations and to resolve disputes. Raw click identifiers (IP address and user-agent) are purged after 90 days; aggregate, de-identified statistics may be kept longer.

Subject to the DPDP Act and other law, you can:

• Access the personal data we hold about you and ask for a summary of how it is processed.
• Correct or update inaccurate or incomplete data.
• Erase data that is no longer needed, subject to our legal retention duties.
• Withdraw a consent you gave (this will not affect processing done before you withdrew it).
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance with us and, if unresolved, complain to the Data Protection Board of India.

To exercise a right, email hello@kamaiyo.com from your registered email. We may need to verify your identity first, and we will respond within the timelines the law requires.

We use reasonable technical and organisational measures to protect your data — including encryption in transit, access controls and an append-only financial ledger. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a reportable breach as the law requires.

The Platform is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

We may update this policy. If a change is material we will notify you in the app or by email. The “Last updated” date above always shows the current version.

For any privacy question or to reach our Grievance Officer, email hello@kamaiyo.com or use the details below. More on raising a formal grievance is on our Contact & Grievances page.