Privacy Policy

Last Updated: 12 September 2026
Effective Date: 23 February 2023

This Privacy Policy describes the policies of M/s Bravima Technologies, 651 North Broad Street, 201, Middletown, DE 19709, United States, email: privacy@idukki.io, on the collection, use and disclosure of your information that we collect when you use our website (https://idukki.io), our dashboard, or our Service, our shoppable UGC / video product for ecommerce brands, and the widget it powers on our customers’ storefronts (the “Service”). By accessing or using the Service, you are consenting to the collection, use and disclosure of your information in accordance with this Privacy Policy. If you do not consent to the same, please do not access or use the Service.

Idukki plays two different roles depending on the data in question. For account, billing and dashboard data belonging to the brands that subscribe to our Service, we act as a data controller. For the UGC, reviews and shopper interaction data collected through a customer’s widget on their own storefront, we act as a data processor on that customer’s documented instructions, they are the controller of that data. This distinction is described in more detail on our GDPR overview.

We may modify this Privacy Policy at any time without any prior notice to you and will post the revised Privacy Policy on the Service. The revised Policy will be effective 180 days from when the revised Policy is posted in the Service and your continued access or use of the Service after such time will constitute your acceptance of the revised Privacy Policy. We therefore recommend that you periodically review this page.

Information We Collect

We will collect and process the following personal information about you:

Name, email address and phone number
Company name and job title, for users of our dashboard
Account credentials (passwords are hashed, never stored in plain text)
Billing information, processed via Stripe, we do not store full card numbers
Social media OAuth tokens for platforms you connect, such as Instagram, TikTok, YouTube, Twitter (X), LinkedIn and Threads
Store and catalogue data from the ecommerce platform you connect, such as Shopify, BigCommerce, Magento or WooCommerce, or via our custom API
User-generated content itself, photos, videos, captions, reviews, creator handles and rights records
Shopper interaction data collected through a customer’s widget, such as wishlist activity, poll or vote responses, quiz answers, AI Shopper / chat and nudge interactions, and product click or view events
Support and correspondence records
Cookies, device and usage data

How We Collect Your Information

We collect/receive information about you in the following manner:

When a user fills up the registration form or otherwise submits personal information
Interacts with the website, dashboard or a customer’s widget
From public sources

How We Use Your Information

We will use the information that we collect about you for the following purposes:

Creating and managing user accounts
Providing the UGC and review collection, moderation, tagging and display service
AI-driven features a customer has enabled, such as product-tagging suggestions, AI Shopper, and quiz or nudge personalisation
Rights management, requesting, recording and tracking usage consent
Processing payments
Support
Analytics and fraud / bot filtering
Marketing, only where you have opted in
Legal compliance

We do not sell personal data, and we do not use customer content to train third-party AI models.

If we want to use your information for any other purpose, we will ask you for consent and will use your information only on receiving your consent and then, only for the purpose(s) for which consent is granted unless we are required to do otherwise by law.

How We Share Your Information

We will not transfer your personal information to any third party without seeking your consent, except in limited circumstances as described below. We share personal information with the following categories of recipients:

Cloud hosting, storage and CDN providers
Payment processing, via Stripe
Transactional email and messaging providers
Product analytics and error-monitoring tools
AI inference providers, for tagging and captioning
The social media, review and ecommerce platforms you authorise us to connect to
Professional advisors and legal entities, where required by law

For the current named list of sub-processors we use, see the GDPR overview.

We may also disclose your personal information for the following: (1) to comply with applicable law, regulation, court order or other legal process; (2) to enforce your agreements with us, including this Privacy Policy; or (3) to respond to claims that your use of the Service violates any third-party rights. If the Service or our company is merged or acquired with another company, your information will be one of the assets that is transferred to the new owner.

Retention of Your Information

Active accounts: we keep your data for as long as your account is active.
Closed accounts: we delete or anonymise data within 90 days of closure. You can also request immediate deletion.
UGC and rights records: kept for the duration of your subscription, then exported to you on request and deleted.
Logs and backups: application logs are purged after 90 days; encrypted backups roll off after 30 days.
Legal hold: where the law requires (for example, invoices or tax records), we retain only what’s necessary.

Residual anonymous information and aggregate information, neither of which identifies you (directly or indirectly), may be stored indefinitely.

Your Rights

Depending on the law that applies, you may have a right to access and rectify or erase your personal data or receive a copy of your personal data, restrict or object to the active processing of your data, ask us to share (port) your personal information to another entity, withdraw any consent you provided to us to process your data, and a right to lodge a complaint with a statutory authority, as well as such other rights as may be relevant under applicable laws. To exercise these rights, you can write to us at privacy@idukki.io. We typically respond within 72 hours, and no later than 30 days, in accordance with applicable law.

You may opt-out of direct marketing communications or the profiling we carry out for marketing purposes by writing to us at the same address.

Do note that if you do not allow us to collect or process the required personal information or withdraw the consent to process the same for the required purposes, you may not be able to access or use the services for which your information was sought.

Cookies, Etc.

To learn more about how we use these and your choices in relation to these tracking technologies, please refer to our Cookie Policy. You can also reopen your consent preferences at any time via the “Cookie preferences” link in the site footer.

Security

The security of your information is important to us and we will use reasonable security measures to prevent the loss, misuse or unauthorized alteration of your information under our control. However, given the inherent risks, we cannot guarantee absolute security and consequently, we cannot ensure or warrant the security of any information you transmit to us and you do so at your own risk. For the current state of our security posture, see our Security page.

Grievance / Data Protection Officer

If you have any queries or concerns about the processing of your information that is available with us, you may email our Data Protection Officer at M/s Bravima Technologies, 651 North Broad Street, 201, Middletown, DE 19709, United States, email: dpo@idukki.io. We will address your concerns in accordance with applicable law.

GDPR overview , how Idukki handles personal data under GDPR, including our role as processor, sub-processors, transfers, retention, security and your rights as a data subject.
Security , controls and the technical / organisational measures we have in place today, and what’s on the roadmap.
Compliance hub , an index of our data-protection documents and posture.