Privacy Policy

Last updated 11 September 2026

We collect what a barter collaboration needs and little else: who you are, how to reach you, what your Instagram account looks like publicly, and — for creators — where a parcel should go. We do not sell it, and we do not use it to advertise to you. You can have all of it deleted at any time by emailing us.

Zorrid is a barter-only marketplace: brands send creators products, creators post about them, and no money changes hands. This policy explains what we do with information about the people on both sides of that. It applies to zorrid.com and to the dashboards behind it.

In this policy "we" and "Zorrid" mean M/s Vardhman One, the legal entity that operates zorrid.com and decides what is done with the information described here — the data controller, or data fiduciary under India’s Digital Personal Data Protection Act. If you want to reach a person about anything here, write to hello@zorrid.com.

What we collect

Everyone with an account

Your name and email address.
A password, which we never see — accounts are handled by Supabase Auth, and what is stored is a cryptographic hash rather than the password itself.
Whether you are a creator, a brand or an administrator.

Creators

Your Instagram handle.
Your follower count, the categories you post in, a short bio, and the city and country you are in.
A postal address and phone number. We ask for these so a product can physically reach you, and for no other reason.
Optionally, a screenshot of your Instagram insights, which you upload as evidence of your reach. It is kept in private storage and is visible only to Zorrid staff reviewing your profile.

Brands

Company name, website, logo, a short description, and the country you operate from.

From Instagram, about creators

When a creator signs up, we ask Meta's Instagram API for the public profile information attached to the handle they gave us. This is the same information anyone can see by visiting the profile. We receive and store:

Follower count, following count and total number of posts.
Display name, biography, profile picture and website link.
For recent posts only: how many were reels, and the average likes and comments on them, from which we calculate an engagement rate.

We do not receive views, reach, impressions or audience demographics through this, and we cannot see anything private, anything from a private account, or anything at all about accounts that are not public professional accounts.

We use it for one thing: deciding whether to approve a creator, and helping brands judge a fit. It is not combined with data from anywhere else, not used for advertising, and not sold.

Collaborations

Which campaigns you are part of and what state each is in.
Tracking numbers and courier status for parcels, so both sides can see where a product has got to.
Links to the content a creator posts under a collaboration.

Technical

A session cookie, set when you log in, so that you stay logged in. It is necessary for the site to work and cannot be turned off while you are signed in.
Ordinary server logs kept by our hosting provider, which include IP addresses. We use them to keep the service running and to stop abuse.

We do not run advertising trackers, analytics pixels or third-party cookies. There is no cookie banner on this site because there is nothing on it to consent to beyond the login cookie.

How we use it

To create and run your account, and to sign you in.
To review profiles before approving them, which is the point of the follower and engagement figures.
To match creators with brand campaigns and to run the collaborations that follow.
To send you email about your own account and your own collaborations.
To detect fraud and misuse, and to comply with the law where we have to.

We do not sell your information, rent it, or share it with anyone for their own marketing.

Who sees it

Brands see, about creators

A brand looking at creators in the app sees your name, profile picture, Instagram handle, follower count, tier, categories, bio, and the city and country you are in.

Your email address and your postal address are not shown to brands in the app. Your address is used to get a product to you: when you accept a collaboration it is used to address that parcel, which means the brand or its courier necessarily learns where to send it.

Creators see, about brands

The brand's company name, logo, website and campaign details.

Companies that process data for us

We use a small number of providers to run the service. They act on our instructions and may not use your information for their own purposes.

Supabase — the database, sign-in and file storage.
Vercel — hosting, and the server logs that come with it.
Brevo — sending account and collaboration email.
Cloudflare — serving images and video on the public pages.
Meta Platforms — we ask Instagram about public profiles, as described above. We send Meta a handle; we do not send Meta anything about you that it did not already have.
Courier companies (Delhivery, Blue Dart, DTDC) — we query shipment status using the tracking number only. We do not send couriers your name or address; the party posting the parcel does that when they book it.

We may also disclose information where the law requires it, or to establish or defend legal claims.

Where your information is held

Our database and file storage run in Supabase's Mumbai region. Our hosting, email and media providers operate internationally, so some information is processed outside the country you are in. Where that happens we rely on those providers' standard data protection terms.

How long we keep it

Account and profile information: for as long as you have an account, and then deleted on request as below.
Instagram figures: replaced each time we look your handle up, and deleted with your account.
Collaboration records: kept while the collaboration is live and for a period afterwards, because both sides may need to refer to what was agreed and delivered.
Server logs: kept for a short period by our hosting provider and then discarded.

Deleting your data

You can have your account and the information attached to it deleted. Email hello@zorrid.com from the address you signed up with, with the subject Delete my data. We will confirm and complete the deletion within 30 days.

What is removed: your profile, your Instagram figures, any screenshot you uploaded, and your contact and address details.

What may remain: records of completed collaborations, in a reduced form that no longer identifies you, where we need them for accounting or to resolve a dispute; and anything the law requires us to keep. Content you have already published on Instagram is on Instagram, not here, and deleting your Zorrid account does not remove it — that is done in Instagram.

Removing Zorrid's access to Instagram data about you is the same request: we stop looking your handle up and delete what we have already stored.

Your rights

Depending on where you live you may have the right to ask for a copy of what we hold about you, to have mistakes corrected, to have it deleted, or to object to how we use it. To exercise any of these, email hello@zorrid.com. We will not charge you for asking, and we will not treat you differently for having asked.

Security

Access to the database is restricted by row-level security, so that an account can reach its own records and not other people's. Follower screenshots are held in private storage and served only through short-lived links. Passwords are hashed by Supabase Auth and are never visible to us. No system is perfect, and we do not claim otherwise — but if something goes wrong that affects you, we will tell you.

Age

Zorrid is for people aged 18 and over. We do not knowingly collect information about children. If you believe a child has an account here, write to us and we will remove it.

Changes

If we change this policy we will update the date at the top. If a change materially affects what we do with your information, we will email you about it rather than rely on you noticing.

Who else handles your information

We do not run our own servers, so a few companies hold this information on our behalf. They may only act on our instructions, and none of them may use it for anything of their own.

Supabase, Inc. (United States) — the database and file storage behind Zorrid. Your account, your profile, the figures read from Instagram, the token that authorises us to read them, and your profile picture all live here. Why we need it: it is where your account exists at all. Without it there is nothing to sign in to, no profile for a brand to find, and nowhere to keep a shipping address between the day you enter it and the day a parcel is sent.
Vercel Inc. (United States) — hosts the site itself, so everything you see and everything you submit passes through it. Why we need it: it is what serves zorrid.com. Every page you open is built on their servers, so anything on that page passes through them on the way to you.
Brevo (France) — sends the email we send you: confirmation links, and news about your profile and your collaborations. Why we need it: we cannot confirm that an address belongs to you without sending something to it, and you would not hear that a brand had chosen you. It gets your address and your name, and nothing else.
Cloudflare, Inc. (United States) — serves the images and video on the public pages. Why we need it: the marketing pages carry large files, and serving them from somewhere close to the reader is the difference between a page that loads and one that does not. It holds nothing about you: those files are the same for everybody.

These companies are outside India, so information about you is stored and processed abroad.

Contact

M/s Vardhman One, operating as Zorrid, is responsible for the information described in this policy.
GSTIN: 23CZPPG8385L1ZM

Write to hello@zorrid.com about anything here — including to ask what we hold about you, to correct it, or to have it deleted. Our terms & conditions sit alongside this policy.