Privacy Policy

Last updated 15 September 2026

This is a draft, not a final policy

The registered company name and address are not yet published, so this document names no legal entity. Treat it as a description of how the platform behaves, not as a signed agreement. It will be replaced with a reviewed version before launch.

This policy describes what InfuMarket collects, why, and what you can ask us to do about it. It is written to describe what the software actually does. Where a practice is still manual or still changing, it says so.

The operator of this platform is the operator (to be confirmed) ("we", "us").

What we collect

Because you gave it to us. Your name, email address and password when you register. A phone number, address, and profile details if you choose to add them. Anything you type into a listing, a brief, a proposal, a deal message or the contact form.

Because you signed in with Google. If you choose Continue with Google, Google sends us your email address, whether Google has verified it, your name and your profile picture. That is the whole list — see Signing in with Google below.

Because a transaction requires it. Bank or UPI details when you request a payout. Identity documents when you complete verification. A payment reference number when you tell us you have paid.

Because the system records itself. The IP address a request came from, the time of each action, and a before-and-after record of every change made by our staff to your account or your transactions. This record cannot be switched off — it is what lets us answer "what happened to my deal" with evidence rather than recollection.

We do not collect payment card numbers. No card details pass through this platform.

Why we hold it

To run your account and let you sign in.
To operate a transaction you started — a channel sale, an enrolment, an order, a payout.
To verify identity before money leaves the platform, which we are obliged to do.
To detect fraud, abuse and duplicate payment claims.
To send you transactional email: verification, password reset, and notifications about your own activity.
To measure website visits and improve the website.

We do not sell your data, and we do not use it to build advertising profiles.

Identity documents

Verification documents are treated differently from everything else:

They are stored outside the public web directory. There is no URL that serves them.
They can only be opened through a route that checks who is asking.
Every view by our staff is logged against the person who opened it.

Encryption of the document number field at rest is planned and is not yet in place. Until it is, do not upload anything you would not accept being stored as ordinary database text.

Signing in with Google

You can create an account or sign in with Google instead of a password. Using it is optional; an email address and a password work just as well, and nothing on the platform requires a Google account.

What Google sends us, and nothing else: your email address, whether Google has verified that address, your name, and your profile picture. We request three basic permissions to get them — openid, email and profile. We do not ask for, and cannot see, your Gmail, your Drive, your contacts, your calendar, your YouTube account or anything else in your Google account.

What we do with it. The email address identifies your account and is where we send transactional mail. The name and picture fill in your profile so you do not have to type them. Because Google has already confirmed the address, an account created this way starts verified.

What we store. Alongside your account we keep the identifier Google uses for you and the tokens Google issues for the sign-in itself. We use them only to sign you in. We do not use them to read anything from your Google account, we do not sell them, and we do not share this information with anyone beyond the providers named in Who else processes it.

If you already had an account with the same email. Google sign-in attaches to it rather than creating a second one — but only once that address has been confirmed on our side, which is what stops somebody claiming an address they do not own and then inheriting your account. Until it is confirmed we refuse the link and tell you so.

Turning it off. You can revoke our access at any time from your Google Account under Security → Your connections to third-party apps and services. Doing so stops you signing in with Google; it does not delete your account here. If you want to keep the account and stop using Google, set a password first with Forgot your password? on the login page and sign in with your email instead. To delete the account entirely, write to support@infumarket.com.

What other people can see

Your public creator profile — only if you publish it. It is private by default. Audience figures on it are self-reported by you and are labelled as such.
A channel listing you publish — its title, statistics and screenshots are public once approved.
Your name — visible to the other party in a deal, a proposal or a campaign you are part of.

Your email address, phone number, bank details and identity documents are never shown to another user.

Who else processes it

Our email provider, to deliver transactional messages. It receives your email address and the contents of those messages.
Our hosting provider, which stores the database and uploaded files.
Google, if you choose to sign in with it, as described above. Google Analytics also receives information about pages visited. We do not send it account, wallet or payment details as custom events.

We do not pass your information to advertisers or data brokers.

How long we keep it

Account and transaction records are kept while your account exists and afterwards for as long as we are required to retain financial records. Contact form messages are kept until the query is resolved and for a reasonable period after. Identity documents are kept for the period required of a verification record.

Audit records of staff actions are retained as long as the underlying transaction, because a record that can be deleted is not a record.

What you can ask for

You can ask us to show you what we hold about you, correct anything wrong, or delete your account. Deletion has one limit worth stating plainly: we cannot delete records tied to a completed transaction or a verification we are required to keep. Everything not caught by that is removed.

Write to support@infumarket.com and say what you want. We answer within one business day.

Cookies

We use cookies to keep you signed in and remember site preferences. Google Analytics loads when you visit the site and may set analytics cookies to measure visits. We do not use advertising cookies.

Changes

If this policy changes materially, the date at the top changes and we notify account holders. Small corrections are made without notice.