Privacy Policy

Blitzo is operated by Piston Software LLC, a Wyoming limited liability company, 312 W 2nd St Unit #A2299, Casper, WY 82601, United States. Phone: +1 914-387-7853. “We”, “us” and “our” in this policy mean Piston Software LLC.

• Account details: name, email, phone, password (hashed), profile photo, role.
• Creator profile: username, city, niches, Instagram and YouTube handles, portfolio, shipping addresses for samples.
• Payout and tax details: PAN, UPI ID or bank account (we store only the last 4 digits and IFSC), KYC status.
• Content: videos, images, captions, transcripts and review comments.
• Commerce data from brands: order IDs, values, delivery status and a one-way hash of the shopper's email. We don't receive shoppers' names, phone numbers or addresses.
• Tracking: a first-party visitor ID and the tracking code from the ad link, used only to attribute orders.
• Ad data: spend, impressions, clicks and purchases from connected Meta ad accounts.

• To run the marketplace: programs, submissions, chat, samples and ads.
• To attribute orders to the right creator and calculate earnings.
• To charge brands, pay creators and meet tax obligations (TDS, GST).
• To keep the platform safe: fraud and self-referral checks, blocking off-platform contact.
• To send notifications you can switch off, except essential ones about money and security.

Brands see a creator's public profile, content they submitted to that brand, and their performance with that brand. Brands never see a creator's PAN, bank details or other brands' earnings.

We use service providers to run the platform: payment processing (Razorpay / RazorpayX), cloud hosting and storage, email delivery and Meta's APIs for ads. They process data only on our instructions.

We disclose data when the law requires it, for example to tax authorities.

Brands who connect Meta through Facebook Login for Business let us: list the ad accounts, Facebook Pages and linked Instagram accounts they choose to share; read campaigns and ad sets; copy campaigns and ad sets (always paused); upload approved creator videos to their ad account; create ads, including partnership ads with creators who have approved them on Instagram; send and check partnership ad permission requests; and read daily ad results (spend, impressions, clicks, purchases, video views). We use this only to build and report on the brand's own ads and to calculate creator earnings.

Creators who connect Instagram let us read their Instagram account ID, username, account type and follower count. We don't read their messages, and we don't post or comment on their behalf. Partnership ad permission is granted by the creator inside the Instagram app and can be removed there at any time.

Access tokens from Meta are encrypted at rest (AES-256-GCM) and used only by our servers. We never sell Meta data, use it for advertising profiles, or share it with anyone other than the brand or creator it belongs to. Our use of Meta data follows the Meta Platform Terms and Developer Policies.

Removing access: disconnect from Integrations (brands) or Settings > Social accounts (creators), or remove Blitzo in Facebook Settings > Business Integrations or Instagram Settings > Apps and websites. When you remove the app, Meta tells us and we delete the tokens straight away. You can also ask us to delete all data we received from Meta; you'll get a confirmation code and can track it at /meta/data-deletion. Records of past ad results and payouts are kept for 8 years as tax law requires.

We keep account data while your account is open. Financial and tax records are kept for 8 years as Indian law requires. Content you delete is removed from our storage within 30 days, except where a brand holds a paid license to it.

You can access, correct or delete your personal data, withdraw consent, and nominate someone to act for you. Most of this is in your settings. For anything else, write to our Grievance Officer at privacy@blitzo.ai and we'll respond within 30 days.

Data is encrypted in transit, passwords are hashed, and payout details are tokenised by our payment provider. Staff access is limited, role-based and logged, including any time our support team views an account to help you.

We use a session cookie to keep you logged in and a first-party visitor cookie on brand stores to attribute orders. We don't use third-party advertising cookies on this site.