Privacy Policy

This Privacy Policy explains how PublicMe ("PublicMe", "we", "us", "our") collects, uses, discloses, and safeguards information when you visit publicme.app or use any PublicMe service (the "Service"). By using the Service you agree to this Policy.

We comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules made thereunder (including the SPDI Rules, 2011). Where applicable to international users, we also align with the GDPR and similar laws.

1. Who we are

PublicMe is a single platform that provides (a) bio-link pages, (b) social media scheduling and cross-posting, and (c) WhatsApp Business messaging powered by Meta's official Cloud API. PublicMe is the Data Fiduciary (controller) for the personal data described in this Policy.

• Service: PublicMe — publicme.app
• Contact: support@publicme.app
• Grievance Officer: the PublicMe Grievance Officer, reachable at support@publicme.app.

2. Information we collect

2.1 Information you give us

• Waitlist data: your email address and submission timestamp.
• Account data (when accounts launch): name, handle/username, email, password hash, profile photo, bio, links you choose to publish.
• Communications: messages you send to support and any feedback you share.
• Billing data (if/when paid plans launch): processed by our payment processor; we receive only transaction metadata, not full card details.

2.2 Information we collect automatically

• Usage data: pages viewed, links clicked, time spent, referrer.
• Device & log data: IP address, user-agent, OS, browser, timestamps, approximate location (derived from IP).
• Cookies & similar: a session cookie (pmid) for login state and a CSRF token. We do not use third-party advertising cookies on this site today.

2.3 Information from third parties

• Social platforms (Instagram, Facebook, X, LinkedIn, YouTube, TikTok, etc.) — when you connect them via OAuth, we receive an access token and limited profile data needed to publish on your behalf.
• Meta WhatsApp Cloud API — when you connect a WhatsApp Business number, we process the message content, sender/recipient phone numbers, message status (sent, delivered, read), and template metadata strictly to deliver the Service.

3. How we use information (purposes & legal bases)

4. Sharing & disclosure

We do not sell personal data. We share data only with:

• Processors / sub-processors acting on our instructions — hosting, email delivery, error monitoring, analytics, payments.
• Meta Platforms Inc. (WhatsApp Business Platform / Cloud API) and the social networks you choose to connect.
• Authorities when legally required (court order, lawful request) and only to the minimum extent necessary.
• A successor entity in case of a merger, acquisition, or reorganisation, with notice to you.

5. International transfers

Some of our processors are located outside India (e.g. in the EU and the United States). Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses and the receiving country's recognised adequacy.

6. Retention

• Waitlist emails: until launch + 12 months, or until you unsubscribe.
• Account data: while your account is active and up to 90 days after deletion.
• WhatsApp message metadata: as required by Meta and applicable law (typically up to 30 days for delivery troubleshooting, longer if mandated by law).
• Server / security logs: up to 180 days.
• Billing records: as required by Indian tax and accounting law (typically 8 years).

7. Your rights

Subject to the DPDP Act and other applicable laws, you have the right to:

• Access the personal data we hold about you.
• Correct or update inaccurate data.
• Request erasure of your data ("right to be forgotten") where applicable.
• Withdraw consent at any time (where processing is based on consent).
• Port your data to another service in a structured, machine-readable format.
• Nominate another individual to exercise your rights in case of death or incapacity.
• Lodge a grievance with our Grievance Officer or the Data Protection Board of India.

To exercise any right, email support@publicme.app. We will respond within the statutory timelines.

8. Security

We use industry-standard measures to protect your data — TLS in transit, encrypted password storage (bcrypt/argon2), least-privilege access, CSRF protection, security headers, rate limiting, and routine audits. No system is 100% secure; we will notify you and the Data Protection Board of India of a personal data breach as required by the DPDP Act.

9. Children

The Service is not intended for children under the age of 18 as defined under the DPDP Act. We do not knowingly collect personal data from a child without verifiable parental consent. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Third-party links and platforms

PublicMe pages may link to third-party websites, and our Service interacts with third-party platforms (Meta, social networks). We are not responsible for the privacy practices of those third parties — please review their policies separately. WhatsApp messaging is also subject to Meta's WhatsApp Business Messaging Policy and the WhatsApp Business Terms of Service.

11. Changes to this Policy

We may update this Policy. Material changes will be announced on this page and, where appropriate, by email. The "Last updated" date at the top reflects the latest revision.

12. Contact

Questions, requests, or complaints? Email support@publicme.app.