Legal

Privacy Policy

Last updated 11 September 2026.

1. Who we are and what this covers

Musubi (musubiclip.com) is a creator performance platform operating in India. Brands fund campaigns with a public rate per 1,000 views, creators post their own clips, and creators are paid on views the platform verifies. Sellers can also run a storefront at musubiclip.com/yourname for courses, communities and digital downloads.

This policy explains what we collect, why, who we share it with, and how you get it removed. It covers the website, the signed in product and the mobile API.

2. Signing in with Google

Google is the only way to create an account. When you sign in we ask Google for the basic profile scopes (openid, email, profile) and receive exactly four things:

  • Your Google account identifier, used to recognise you on return visits
  • Your email address, used as your account identity and for transactional email
  • Your name, shown on your profile and to brands whose campaigns you join
  • Your Google profile picture URL, shown as your avatar
We request no other Google scopes. We do not read your Gmail, Drive, Calendar or Contacts, and we cannot post anything to your Google account.

Musubi’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the features above. It is never sold, never used for advertising, and never transferred to others except as described in section 6.

You can revoke our access at any time from your Google account permissions page. Doing so signs you out; to remove the data we already hold, use section 8.

3. What you give us directly

Everyone:

  • Name, email and profile picture, from Google as described above
  • Optional phone number, and city, region and country if you supply them
  • Which of creator, brand, seller or browsing describes you, so we can shape the product around it

Creators additionally:

  • Your UPI id, used solely to send payouts
  • Your Instagram username or YouTube handle, used to attribute clips to you
  • Public URLs of the clips you submit as evidence for a campaign
  • A Razorpay contact and fund account identifier, created so a payout can reach you

Brands and sellers additionally:

  • Business name, category, logo and GST number where you choose to provide them
  • Campaign briefs, budgets and the artwork you upload
  • Product listings, files and cover images for a storefront
We never see or store your card, UPI PIN or bank credentials. Payment details are entered inside Razorpay, which is PCI DSS Level 1 certified, and we receive only the result of the payment.

4. What we collect from public platforms

Payment is settled on views the platform reports rather than on screenshots, so for every clip you submit we read its public performance:

  • View counts and basic public post metadata from the YouTube Data API v3 for YouTube submissions
  • View counts and basic public post metadata for Instagram submissions, collected on our behalf by Bright Data
  • A daily snapshot of those counts, taken on IST day boundaries, which is what your earnings are computed from

We read only what is publicly visible on the post you chose to submit. We never ask for your social account password and we have no access to your private account data, messages or followers.

5. What we collect automatically

  • Device, browser and IP address, used for security and to detect fraud such as bot traffic, view inflation and duplicate accounts
  • When you submit a clip, the IP address, browser and approximate location (city, region and country) the submission came from, used to detect coordinated or duplicate submissions
  • Product analytics through PostHog: pages viewed, features used and timestamps, so we can see which parts of the product work
  • Session replays through PostHog on a sample of sessions, with all form inputs masked, so passwords, one time codes, UPI ids and GST numbers are never captured
  • Aggregate traffic measurement through Google Analytics
  • Error and performance traces, so a failure can be diagnosed

Admin areas of the product are excluded from analytics entirely.

6. Who we share it with

We do not sell personal data, and we do not share it for advertising. We use a small number of processors, each for one job:

  • Google: sign in and authentication
  • Razorpay and RazorpayX: collecting wallet top ups and sending UPI payouts
  • Amazon Web Services: hosting, database and file storage, in the Asia Pacific (Mumbai) region
  • PostHog: product analytics and session replay
  • Google Analytics: aggregate traffic measurement
  • Bright Data: reading public Instagram post metrics
  • Resend and Gmail: sending transactional email
  • Law enforcement or a regulator: only where Indian law requires it

Brands see the clips you submit, your creator name and the public performance of those clips. They never see your email, phone number or UPI id.

7. How long we keep it

  • Account data, for as long as your account exists
  • Daily view snapshots, for 400 days, so a campaign can be audited and a 90 day chart drawn
  • The IP address a clip was submitted from, for 90 days, after which it is erased and only the approximate location is kept
  • Financial and ledger records, for the period Indian tax law requires
  • Session replays and product analytics, for the retention window configured with PostHog
  • After deletion, everything except records we are legally required to keep is removed within 30 days

8. Your choices and your rights

Under the Digital Personal Data Protection Act 2023 you can ask us to do any of the following, and we will respond within 30 days:

  • Give you a copy of the data we hold about you
  • Correct anything that is wrong
  • Delete your account and the data attached to it
  • Withdraw consent for analytics and session replay
  • Nominate someone to exercise these rights if you cannot
Write to contact@musubiclip.com to exercise any of these. Account deletion also revokes the Google connection and removes the profile data received from Google.

9. Security

  • Everything travels over HTTPS with TLS
  • There is no password to steal: authentication is delegated to Google
  • Sessions are held in signed, HTTP only cookies
  • Money moves through a double entry ledger in integer paise, and payouts require a verified UPI id
  • Uploaded files are stored in private buckets and served through signed access
  • Access to production data is restricted and logged

10. Cookies

We use cookies that keep you signed in and protect the site against request forgery. These are essential and cannot be turned off while you are using an account.

We also set analytics cookies for PostHog and Google Analytics, described in section 5. We do not use advertising cookies and we do not run ad networks on the site. You can block analytics cookies in your browser, or write to us to opt out, and the product will continue to work.

11. Children

Musubi is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.

12. Where your data lives

Data is stored in the Asia Pacific (Mumbai) region. Some processors listed in section 6 operate outside India, so limited data may be processed abroad under their own contractual protections.

13. Changes to this policy

If we change this policy materially we will email account holders and update the date at the top. Continuing to use Musubi after that constitutes acceptance.

14. Contact and grievances

For any privacy question, request or complaint, write to contact@musubiclip.com. We are the data fiduciary for the information described here and will acknowledge a grievance within 30 days.

Musubi, India. contact@musubiclip.com