Our privacy policy, in plain words.

Who we are

CXB (Creators x Brands) runs earnwithreels.com, a marketplace in India where brands pay Instagram creators to make reels. This policy explains what personal data we collect, why, who sees it, how long we keep it and how to have it deleted.

Questions and requests go to hello@earnwithreels.com. A person reads every email.

What we collect

Your account. Your name, email address and whether you’re a creator or a brand. The profile details you add: city, country, the kind of creator or business you are, languages and a short bio, a creator’s portfolio link, and a brand’s name and website. A profile picture or logo if you add one; a brand’s logo can also be fetched from its own website.

Sign-in. You sign in with your email and a password, with Google, or as a creator with Instagram. We never store passwords as plain text. Supabase Auth, our sign-in provider, checks them and sends our sign-in emails. With Google, Google tells us your name and email address. If you sign up with Instagram, your Instagram username is your name on CXB. If phone sign-in is offered and you use it, we keep your phone number. A cookie keeps you signed in.

Instagram, if you connect it. Creators connect through Instagram’s own login and allow two permissions: instagram_business_basic (your profile and posts) and instagram_business_manage_insights (their numbers). We never see your Instagram password, and we can’t post, comment or send messages for you. Once you connect, we read:

• your account’s username, ID, account type, follower count and number of posts;
• your list of reels, posts and stories, with their captions, links, dates and thumbnails, so you can pick what to send to a campaign;
• for each reel, post or story you send to a campaign: its link, caption and numbers, such as views, reach, likes, comments, saves and shares, and where Instagram gives them, watch time, skip rate, reposts, profile visits and follows;
• your account’s daily numbers, such as views, reach, accounts engaged, interactions and follower changes;
• your audience: the countries, cities, ages and gender of your followers and of the people who engage with you, as group totals. Never who they are. Connecting asks you to agree to the sharing described under “Who sees what”, and we keep the version of the words you agreed to and when.

We don’t download or keep copies of your videos. When a brand plays your reel on CXB, it streams from Instagram. If you check a handle with the bio code, we also look up that account’s public profile on Instagram.

Campaign work. The briefs brands post, the pitches creators send, the reels and posts sent in, review decisions and notes, and a log of key actions (for example accepting a creator or stopping tracking) with the time.

Tracking links. When someone clicks a creator’s tracking link, we count the click with their browser type and a random code saved in a cookie on that browser for 30 days, so repeat clicks from one browser count once. We don’t use IP addresses for this. The visitor then lands on the brand’s page, and its address carries a click code, the campaign and the creator’s Instagram account ID. A brand can report a sign-up or sale back to us with the click code, its value and the brand’s own reference; we ask brands not to send names or contact details. Some links lead to CXB itself. Then the click code is also kept in a cookie on this site for 30 days, and if a new CXB account is made on that browser in that time, we count one sign-up for the creator whose link it was. The brand and the creator see how many sign-ups, never who signed up. A creator’s own clicks while signed in aren’t counted, and a browser where someone signed in to CXB in the last 30 days never counts as a new sign-up.

Sign-up checks. A new account does not earn a referral reward by itself. We check email verification, temporary email domains and mail records, and store a normalized email to spot aliases. For referral review, we use a signed random device cookie and keyed hashes of network addresses. Observations expire after 30 days and are removed by an hourly cleanup. We do not show network or device identifiers to brands or creators. Derived review flags and payment decisions are retained for fraud prevention and payment records. We retain keyed records of the first verified email and an Instagram account's first connection to prevent reuse after disconnect or account deletion. Instagram does not tell us an account's creation date. Rewards require activation, a seven-day hold and CXB approval. Finalised sign-up rewards also wait at least seven days before payout.

Payments. Brands pay through Razorpay’s checkout. Card, UPI and bank login details go straight to Razorpay and never reach CXB. We keep each payment’s record: amounts, fees, Razorpay’s reference numbers, status and refunds. For payouts, creators add a bank account: the account holder’s name, account number and IFSC. We store them encrypted, show only the last 4 digits, and pass them with your name and email address to Razorpay, which sends the money. We keep a record of every payout, including any tax held back. For manual UPI payouts, creators can instead save their UPI ID and the recipient name shown in their UPI app. We store these encrypted and show them only to that creator and authorised CXB admins. Admins use the details in their bank or UPI app to transfer the money, then record the transaction reference in CXB. Saving a UPI ID does not verify ownership. Updated details apply to new payment reservations; existing reservations keep their saved recipient. These declarations and payment records are retained with our financial records. We never ask for your UPI PIN or OTP. For that tax (TDS), creators can add their PAN and their name as it is on the PAN. We store them encrypted, show only the last 4 characters, and use them to work out the tax held back and to report it to the Income Tax Department. Without a PAN, the law makes us hold back more. We make a GST invoice for each of our fees. Brands can add their GSTIN, business name, billing address and state for it; creators’ invoices carry their account name. We store these encrypted, and report the invoices to the GST authorities as the law requires.

Technical data. Our app logs errors with a request number and the type of error, not who you are, and doesn’t keep IP addresses. Our hosting and database providers keep their own standard logs. Your browser also remembers a few site settings, such as the side you picked (creator or brand).

How we use it

• To run campaigns: show briefs, send pitches, let brands accept creators and review what they send.
• To measure reels and posts for the brand that ran the campaign, and to show creators their own numbers.
• To work out fees from each campaign’s terms, take brand payments, give refunds and pay creators.
• To check for unusual numbers, such as sudden jumps in views, and whether a caption carries the words a brief asks for, like #ad. A flag can hold a payment while we review it; it doesn’t cut pay by itself.
• To keep accounts and payments safe and stop misuse.
• To send sign-in emails, such as email checks and password resets, and to answer your emails.
• We don’t sell personal data, and we don’t use it for advertising.

Who sees what

• Brands. When you apply, the brand sees your name, profile, pitch, and your Instagram handles and follower counts. For what you send to its campaign, it sees the reel or post, its link, caption and numbers, the check results, the link clicks and how many sign-ups came through the link (never who). A brand never sees what you sent to other brands, or your account’s daily numbers.
• Your audience mix, for the campaigns you send a reel to. When you connect Instagram you agree that the brand of each campaign you send a reel to sees your audience totals (age, gender, cities and countries of your followers and of people who like or comment, never who they are) and the numbers of the reels you send. Audience sharing starts the moment you send the reel and ends 7 days after the campaign ends, or sooner if the brand declines you, or you stop sharing or disconnect. A brand never sees your audience for a campaign you haven’t sent a reel to. If you connected before this agreement existed, nothing changes until you agree: until then, a brand sees your audience only for a campaign where you said yes. Once you agree, an earlier yes for a campaign you haven’t sent a reel to no longer shows anything, and a campaign you stopped stays stopped until you turn it back on.
• Everyone. Open briefs are public: the brand’s name and logo, what the brief asks for and what it pays. Creator profiles aren’t public. Pictures you upload, such as a profile picture or a campaign cover, are served from a hard-to-guess link that anyone who has it can open.
• CXB staff. A few people at CXB with admin access can see accounts (including email addresses), campaigns, what was sent in, checks and payments, to run the service, review payouts and help with problems.
• Service providers that run parts of CXB for us, only for that: Supabase (database, file storage and sign-in), Resend (delivers our sign-in emails), Render (hosting), Razorpay (payments and payouts), Meta (the source of Instagram data), Google (sign-in, if you use it), and a text-message provider if phone sign-in is offered and you use it. Our database is in India (Mumbai) and our hosting runs in Singapore, so some data is processed outside India.
• The law. We share data with authorities only when the law requires it, such as the tax held back from a creator’s payments, reported with their PAN, and the GST invoices for our fees.
• We don’t sell personal data.

How long we keep it

• Your account and profile: while your account is open, or until you ask us to delete them.
• Your Instagram access token: until you disconnect. Disconnecting deletes it straight away.
• Your account’s daily numbers and audience readings: 90 days, then they’re deleted automatically. Disconnecting deletes them straight away.
• A reel’s numbers: we read them while tracking runs, until the campaign’s end date (for a story, 24 hours after posting), or sooner if you stop tracking, the campaign closes or the reel is rejected. The readings we took stay with the campaign, because the brand’s report and the creator’s pay depend on them.
• Caption check results: 90 days.
• Audience sharing with a brand: until 7 days after the campaign ends at the latest.
• The tracking-link cookies: 30 days in the visitor’s browser. The click and sign-up counts stay with the campaign.
• The cookie that notes someone signed in on a browser: 30 days.
• The sign-in cookie: 7 days.
• Payment, refund and payout records, including the encrypted bank details a payout uses, the PAN its tax was worked out with, and our GST invoices with the details on them: as financial records, for as long as the law requires, even after an account is deleted.
• Other campaign records, such as briefs, pitches, what was sent in, reviews, checks and the action log: until you ask us to delete them.

Your choices and rights

• Stop tracking a reel. On the reel, press Stop tracking. We stop reading its numbers and caption; the readings so far stay. The note under the button says how it affects your pay.
• Stop sharing your audience. In Connections, press “Stop sharing my audience” to stop it for every campaign at once, or press “Stop sharing for this campaign” on one campaign’s page. Your own stats and reel tracking carry on; you can turn sharing back on in Connections.
• Disconnect Instagram. In Connections, press Disconnect. We delete the saved token and your account stats, stop all tracking and end audience sharing for that account. Reel numbers already recorded for campaigns stay.
• Remove CXB inside Instagram. In Instagram, go to Settings, then Website permissions, then Apps and websites, and remove CXB. That cuts off our access. Disconnect in CXB too, so we also delete the saved token and your account stats.
• Change your profile at any time in Profile.
• See, correct or delete your data. Email hello@earnwithreels.com and we’ll send you a copy, fix it or delete it.

India’s Digital Personal Data Protection Act, 2023 gives you rights over your personal data: to get a summary of what we hold and how we use it, to have it corrected, completed or erased, to withdraw your consent, and to have a complaint dealt with. Email us to use any of them. Withdrawing consent stops what comes next; it doesn’t undo what was done before. If our answer doesn’t settle a complaint, the Act lets you take it to the Data Protection Board of India.

Deleting your data

You can ask us to delete your CXB account and your data, including everything we got from Instagram. A person does it, not a button, in three steps:

1. Disconnect Instagram. In CXB, open Connections, press Disconnect, then Yes, disconnect. This deletes your saved Instagram token and account stats straight away and stops all collection. You can also remove CXB in Instagram under Settings, Website permissions, Apps and websites.
2. Email us. Write to hello@earnwithreels.com from the email address on your CXB account, with the subject “Delete my data”. Say whether you want the whole account deleted or only your Instagram data. If you can’t use that address, tell us your name on CXB and your Instagram handle, and we’ll find another way to check it’s you.
3. We delete it and tell you. We check the request is yours, delete your data and email you when it’s done. We reply within 30 days. If you have a campaign running or a payment due, we tell you how deleting affects it before we go ahead.

What we delete: your account and profile, your sign-in details, your connected Instagram accounts and what we read from them (account stats, audience totals, reel and post numbers, captions and check results), your pitches and your profile picture.

What we keep: what the law makes us keep, mainly payment, refund and payout records (with the encrypted bank details used for payouts) and the campaign details and numbers a payment was based on, for as long as the law requires. Copies can stay in our backups until those backups are deleted.

Children

You must be 18 or older to use CXB. If you think someone under 18 has signed up or given us personal data, email hello@earnwithreels.com and we’ll delete it.

Changes to this policy

When we change how we handle personal data, we update this page and the date on it. Last updated 15 October 2026.