Privacy policy

Who is responsible

Cloutboard is operated by Gopal, an individual based in India, who is responsible for personal data processed through the service. Reach us at @gopalsays108 on X or gopalsays108@gmail.com.

What we never store

Card numbers, CVVs, UPI PINs and bank credentials. These are handled entirely by Dodo Payments and never reach our servers. We store only the provider’s reference for a payment, the amount, and the currency.

What we collect when you support a creator

• Your email address — to send your receipt and to tell you when the position you backed has been overtaken.
• Your phone number and display name, if you provide them. Both are optional.
• The contribution itself — amount, currency, position, time, and Dodo Payments’ reference for the payment.
• The profile you submit or back — the accounts or @handles, the category, and the public name, description and avatar we resolve for them.

Who paid is never shown publicly. Boards display the profile that holds a position and the amount behind it, never who contributed.

What we collect when you browse

A visitor identifier — a random ID in an HTTP-only cookie named cs_sid, stored for up to one year. It attaches a checkout to a browser and lets us count visitors and how many people are viewing a profile without counting anyone twice. It is not your name. Where an IP address is used for rate limiting, it is hashed rather than stored.

These counts are real measurements. Nothing on this site displays an invented visitor, viewer, or activity figure.

Separately, our host collects aggregate page-view and page-speed statistics for us. Those are cookie-less, do not identify you, and are never the source of any number shown on the site — every visitor and viewer count you see is counted by us.

Cookies

The cs_sid cookie is strictly necessary: it lets checkout and view-counting work, and we do not use it for advertising. Your browser may also store a theme preference locally so the page can stay light or dark. We do not use third-party advertising cookies.

Profiles on public boards

Rank, amounts, names, avatars, descriptions and destination links on the board are public — anyone can see them, including search engines. Do not submit a profile you do not want shown. Profile information — handle, display name, avatar, audience figures — comes from whoever submitted it; audience numbers are self-reported, are not verified, and have no bearing on position. Fetching a profile’s public metadata may disclose to that platform that Cloutboard requested the page.

Why we use this data

• To provide the service — take payment, create or raise a position, show the board, and send your receipt.
• Legitimate interests — keeping the board fair with rate limits and bot filtering, measuring visits, debugging outages, and defending legal claims.
• Legal obligation — keeping tax, accounting, and complaint records where the law requires it.

Who else sees your data

• Dodo Payments, to take payments and issue any refunds.
• Our email provider, to send receipts and notifications.
• Our hosting, database and edge providers (currently including Vercel and MongoDB), which store and serve the data on our behalf.
• Identity-lookup helpers, so we can show a name and avatar for a listed account.
• Professional advisers, authorities, or a buyer of the service, where we must share data to comply with law, enforce the Terms, or transfer the project.

We do not sell personal data, and we do not share it for advertising. Some of these providers may be outside India; where we rely on them we use the safeguards they offer, such as standard contractual clauses.

How long it is kept

Payment and contribution records are kept as long as tax and accounting rules require. The cs_sid identifier lasts up to a year, or until you clear cookies. Presence data expires within minutes. Raw analytics events are deleted automatically after a year. Public board entries remain while a profile is listed and may persist in backups for a limited time after removal.

Your rights under Indian law

If you are in India, the Digital Personal Data Protection Act, 2023 gives you the right to access the personal data we hold about you, to have it corrected or completed, to have it erased where we are not required to keep it, and to nominate someone to exercise these rights if you are unable to. Equivalent rights apply where the GDPR or a similar law covers you.

To exercise any of these, reach us at @gopalsays108 or gopalsays108@gmail.com and tell us what you want done. If we cannot act on a request — for example, a tax record we are required to retain — we will tell you why.

Children

The service is for adults. We do not knowingly collect personal data from children. If you believe a child has used the service, contact us and we will delete the data we can identify.

Grievances

If something about how we handle your data is wrong, or a profile here concerns you, you can raise it with our Grievance Officer, Gopal, who is responsible for resolving complaints under India’s IT Rules and the DPDP Act. Reach them at @gopalsays108 on X or gopalsays108@gmail.com. We acknowledge a complaint within 48 hours and aim to resolve it within 15 days, as the rules require.

Changes

We may update this policy when the service or the law changes. The date at the top of this page is the current version; if a change is material, we will post the updated policy here.