Privacy Policy

1. Legal Grounds & Scope of Data Collection

MyScoop collects and processes digital personal data strictly under lawful grounds specified in Section 4 and Section 6 of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023):

• Identity & Contact Data: Full Legal Name, WhatsApp Phone Number, Email Address, and Storefront Handle provided upon registration, waitlist participation, or account sign-up. You can create an account by verifying ownership of an email address (Google sign-in, magic link, or one-time code) or a WhatsApp number (one-time code); the verified contact becomes your account identifier.
• Creator Verification & Tax Data: Permanent Account Number (PAN), verified Indian bank account details (account number, IFSC code, beneficiary name) required for statutory settlement routing and TDS compliance. GSTIN is optional and collected only from creators who furnish it (e.g. for B2B invoicing). We do not collect Aadhaar numbers. PAN is stored encrypted, displayed masked, and retained only for as long as statutory tax-record retention requires.
• Transaction Telemetry & Bank Settlement Identifiers: Order IDs, checkout timestamps, UPI Virtual Payment Addresses (VPA), delivery receipts, masked bank account numbers (e.g. •••• 4821), bank IFSC codes, and settlement Unique Transaction Reference (UTR) numbers generated under statement narration MYSCOOP - ADITYA. MyScoop never collects, stores, or sees your bank passwords, UPI PINs, or raw credit/debit card numbers. All financial payments are processed by RBI-licensed payment aggregators.
• Community Automation Telemetry: For creators offering private community groups, our official bot (@My_Scoop_Bot) securely maps the subscriber's Telegram numeric User ID and join timestamp to their Razorpay Subscription ID strictly for automated single-use invitation issuance and churn enforcement.
• Technical & Session Data: IP address, browser user-agent, session cookies, one-time login codes (stored only as one-way hashes, expiring within minutes), and UTM attribution parameters to protect against credential stuffing, automated bots, and unauthorized link sharing.

2. Notice & Purpose Limitation (Section 5 DPDP Act 2023)

In compliance with Section 5 of the DPDP Act 2023, data is gathered strictly for the specified, lawful purposes disclosed prior to processing:

• To provision and authenticate your personal creator storefront and administrative portal.
• To generate HMAC-SHA256 15-minute expiring cryptographic signed download links for purchased digital goods.
• To dispatch transactional order receipts, invoices, and single-use Telegram community invite links via WhatsApp and Email using authorized WhatsApp Business Cloud API and secure transactional email infrastructure.
• To automate split bank settlements direct to creator accounts through RBI-regulated payment rails (Cashfree/Razorpay).
• To prevent payment fraud, chargebacks, and intellectual property violations.

3. Data Principal Rights (Sections 11–14 DPDP Act 2023)

As a citizen or user in India (“Data Principal”), you hold absolute statutory rights over your personal information:

4. Protection of Children's Data (Section 9 DPDP Act 2023)

MyScoop is designed for creators and digital businesses aged 18 and above. We do not knowingly process personal data of individuals below 18 years without verifiable consent from their parent or lawful guardian. We strictly prohibit tracking, behavioral monitoring, or targeted advertising directed at children.

5. Third-Party Data Sub-Processors

Personal data is shared only with vetted regulatory and operational infrastructure sub-processors:

• Payment Aggregators: Razorpay Software Pvt. Ltd. / Cashfree Payments India Pvt. Ltd. (Licensed by Reserve Bank of India).
• Identity Verification (Sign in with Google): Google LLC — receives only your name, email address, and profile picture for account sign-in when you choose Google login. We verify the returned identity cryptographically against Google's keys; we never receive your Google password.
• Omnichannel Dispatch: WhatsApp Business Cloud API and secure transactional email infrastructure.
• Database & Cloud Infrastructure: Managed PostgreSQL with Row-Level Security (RLS) on isolated private cloud infrastructure.
• Marketing Conversion Pixels: Meta Platforms Ireland / India (Meta Pixel ID: 3563516833817130). See our Cookie Policy to control or disable non-essential pixels.