Privacy Policy

This Privacy Policy explains how Fairrate Technologies Private Limited (CIN U62099MH2026PTC473507), with its registered office at 1202 Eden Woods, Shastrinagar, Lokhandwala, Andheri (West), Mumbai – 400053, Maharashtra, India (“OVERDUE”, “we”, “us”), collects, uses, shares and protects personal data. It covers the OVERDUE website at www.overdue.in, our apps and related services (the “Platform”).

We’re the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025. This is also our privacy policy for the purposes of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”).

This policy applies to Creators, Brands and the people who use the Platform on a Brand’s behalf. It also applies to visitors, including anyone who uses our free rate calculator without an account. Capitalised terms not defined here have the meanings given in our Terms & Conditions.

The Platform is only for people aged 18 and over. We don’t knowingly collect personal data from anyone under 18. If we find that we have, we’ll delete it.

We collect only what we need for the purposes set out in section 4:

Your followers’ data. When you connect Instagram or YouTube, we receive aggregated audience statistics, for example “38% of your audience is aged 18–24”. We don’t receive, and don’t collect, the names, profiles or any other personal data of your individual followers.

Sensitive financial information. Your bank account details and payment information are sensitive personal data under the SPDI Rules. We collect them only for payouts, refunds, invoicing and legal compliance, and only with the consent you give when you submit them.

Data about other people. If you give us personal data about someone else, such as a colleague you add to a Brand account or a person who appears in your portfolio, please make sure you’re allowed to share it.

Consent. We process most personal data with your consent. You give it through the notice we show you when you sign up, connect an account or use a feature. Consent to marketing messages is separate and optional.

Legitimate uses. Section 7 of the DPDP Act allows us to process personal data without separate consent in limited cases, including:

1. (a)where you voluntarily give it to us for a specific purpose and haven’t said you don’t consent, for example entering figures into the rate calculator to get a result; and
2. (b)where we must process it to comply with the law, a court order or a government request.

Withdrawing consent. You can withdraw consent at any time, and it’s as easy as giving it: use your account’s privacy settings or email info@overdue.in. Withdrawal doesn’t affect processing already carried out. Some services depend on consent, so if you withdraw it we may not be able to provide them. For example, we can’t pay you without bank details. We may also have to keep some data where the law requires it (section 8).

When a Consent Manager registered under the DPDP Rules is available, you may also give, manage and withdraw consent through it.

The Pricing Engine applies fixed rules to your data, combining:

1. (a)follower tiers and per-thousand pricing;
2. (b)platform and format multipliers;
3. (c)the paying brand’s industry; and
4. (d)how closely your audience matches that industry’s typical customer.

It doesn’t use artificial intelligence or machine learning. The same inputs always produce the same result.

Every result comes with a breakdown of how it was calculated, so you can see, and challenge, the figures behind your recommended rate.

Engine Outputs are recommendations. They don’t decide whether you get a Deal or what price you agree; you and the other party decide that. However, when a Brand searches, Creators are ranked using Engine Outputs calculated for that Brand’s audience. Your data therefore affects where you appear in that Brand’s results.

We don’t use your personal data to train artificial intelligence models, and we don’t allow our service providers to do so.

The public. Your Storefront’s public fields (Terms clause 7.2) are visible to anyone, and search engines may index them. Reviews you write appear on the profile of the user you reviewed.

Brands on the Platform. Logged-in Brands can see the Storefront information you’ve made visible to them, along with Engine Outputs calculated for them. This may include your rates, engagement figures and audience demographics summary.

The other party to a Deal. When you’re in a Deal, the other party sees your messages, the Deliverables, the Collaboration Agreement and your invoice details. Invoice details include your legal name, address and tax registration, where the law requires them on an invoice. Once a Deal is Funded, contact details you choose to share in chat are no longer masked.

Service providers (Data Processors). These process data only on our instructions, under contracts that require confidentiality and security:

1. (a)cloud hosting and database providers;
2. (b)our Payment Partner, for payment processing, Escrow and payouts;
3. (c)email delivery services;
4. (d)WhatsApp and SMS messaging providers;
5. (e)identity and bank-account verification providers;
6. (f)electronic signature providers; and
7. (g)customer support tools.

You can ask us for the current list at info@overdue.in.

Social media platforms. When you connect or sign in with Google, YouTube or Instagram, those platforms know you’ve connected OVERDUE. Their own privacy policies govern what they do with your data.

Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.

Authorities. We share data with courts, law enforcement agencies, tax authorities and regulators when the law or a valid order requires it, including requests under the Information Technology Act, 2000 and the Intermediary Rules.

Business transfers. If OVERDUE is involved in a merger, acquisition, financing or sale of assets, your data may be transferred as part of it. It will remain protected by this policy, or by one that protects it at least as well, and we’ll let you know.

YouTube. OVERDUE uses YouTube API Services. When you connect YouTube, we read your channel information, statistics and aggregated audience analytics. By using this feature you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google’s Privacy Policy (https://policies.google.com/privacy) covers how Google handles your data. You can revoke OVERDUE’s access at any time through your Google account’s security settings (https://myaccount.google.com/permissions), or by disconnecting YouTube in OVERDUE.

Instagram. When you connect Instagram, we use Meta’s official APIs to read your professional account’s profile information, follower and media counts, content performance and aggregated audience insights. You can remove OVERDUE’s access under “Apps and websites” in your Instagram settings, or by disconnecting Instagram in OVERDUE.

Refresh and deletion. We refresh data from connected accounts regularly, and in any case within 30 days; data we can’t refresh is deleted. If you disconnect an account or revoke access, we delete the data and access tokens we got from that platform within 7 days. Engine Outputs and Deal records already created from that data are kept as set out in section 8.

We keep personal data only as long as we need it:

Inactive accounts. If you haven’t logged in or used your account for 3 years, and you have no open Deals or money due to you, we may delete the account. We’ll warn you at least 48 hours before we do.

When a retention period ends, we delete the personal data or anonymise it so that it can no longer identify you.

Under the DPDP Act, you have the right to:

1. (a)Access: a summary of the personal data we process about you, what we do with it, and who we’ve shared it with.
2. (b)Correction, completion and updating: fix data that’s inaccurate or incomplete. You can edit most of it yourself in your account.
3. (c)Erasure: have your personal data erased when it’s no longer needed for the purpose you gave it for, or when you withdraw consent, unless the law requires us to keep it.
4. (d)Withdraw consent at any time (section 3.3).
5. (e)Grievance redressal: complain to us and get a response (section 13).
6. (f)Nominate another person to exercise your rights if you die or become unable to.

How to use your rights. Use your account’s privacy settings, or email info@overdue.in from the email address on your account. We may need to verify your identity before acting. We’ll respond within 30 days; the law allows up to 90 days for grievances.

Deleting your account and data. Use the delete-account option in your account settings, or email info@overdue.in with the subject “Delete my data”. This also deletes data we obtained from Instagram, YouTube and other connected platforms. We’ll confirm once deletion is complete. Records the law requires us to keep (section 8) are held only for as long as required and aren’t used for anything else.

Your duties. The DPDP Act also asks you to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.

We use reasonable security practices and procedures suited to the data we hold. These include:

1. (a)encryption in transit (HTTPS/TLS);
2. (b)hashed passwords;
3. (c)encrypted storage of access tokens and financial details;
4. (d)secure, httpOnly session cookies;
5. (e)role-based access controls, so only staff who need access have it;
6. (f)activity logging and monitoring;
7. (g)rate limits on data-heavy features such as creator discovery; and
8. (h)security obligations in our contracts with service providers.

No system is completely secure. If a personal data breach occurs, we’ll tell affected users without delay and notify the Data Protection Board of India and CERT-In as the law requires.

We use only essential cookies and similar technologies, to keep you signed in, secure your session, protect against fraud and remember basic preferences. The Platform can’t work properly without them, so you can’t switch them off.

We don’t use advertising or cross-site tracking cookies. If we introduce analytics or other non-essential cookies, we’ll update this section and ask for your consent where the law requires.

For any question, request or complaint about your personal data, contact:

We acknowledge every complaint within 24 hours. We aim to resolve complaints within 48 hours, and in every case resolve them within 15 days.

If you’re not satisfied with our response, you can complain to the Data Protection Board of India through the process it provides. The DPDP Act asks you to use our grievance process first.