Privacy notice

Last updated 1 October 2026.

Who we are

Elamp Stars is operated by [Legal entity name], [Registered office address] (“we”, “us”). For the personal data described here we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). Questions about this notice: [privacy contact email].

Whose data, and what we collect

Everyone who visits or signs in

• Name and email address from your Google account when you sign in, and records of your sign-ins.
• Passkeys you register: we store only the public key; your device keeps the private key and your fingerprint or face never leaves it.
• Messages you send through our forms (name, email, organisation, what you tell us). We keep only a one-way fingerprint of your IP address, to stop spam.
• Technical data needed to run the service securely: device type, error reports with personal details removed, and notification subscriptions you turn on.

Stars and their managers

• Profile: professional name, photo, bio, the categories, regions and languages you accept, and your rate card.
• Your signed licence, the consents you gave, and the evidence of signing (time, and the passkey signature over the exact document).
• Biometric data: the live face check you complete with our AI video provider, the reference photos of your face, and — only if you choose to add it — recordings of your voice. See the next section.
• Payout details: name on the account, bank account (we keep only the last four digits), IFSC, PAN (stored encrypted, because tax law requires it on TDS returns) and GSTIN if you have one. Full bank numbers go only to our payment partner.
• Your decisions in the app: offers answered, ads approved or sent back with comments, and payouts.
• Protection findings: public links, screenshots and media where your face may appear without permission, and the takedown notices sent for you.

Brands

• Contact details of the people on your team, your website and social links, your brand guidelines, budget, billing details (legal name, GSTIN, address) and campaign briefs and product images.
• Payment records. Card and bank details you enter at checkout go directly to our payment partner; we never see or store them.

People in reported content

When a Star or a member of the public reports a fake, we store the link and a copy of the public content as evidence, only to get it taken down.

Face and voice data

A Star's face and voice data is collected only with their explicit, separate consent, given when signing the licence and again when starting verification. It is used for exactly two purposes: to create the Star's licensed digital likeness (and, if they add it, voice) with our AI video provider, and to recognise unauthorised uses of their face online. It is never used to train AI models, sold, or used for anything else.

The verification and the resulting likeness are held in the Star's own verified profile with our AI provider. When the licence ends or the Star withdraws consent, we retire the likeness with the provider immediately, remove the face from our protection index, and delete verification data within 30 days.

Why we use personal data

• To run accounts, sign-in and security (including “confirm it's you” before signing, approving or paying).
• To match brands with Stars, send offers, produce ads, and record every approval so that nothing is published without the Star's consent.
• To find and take down fakes of Stars.
• To take payments, issue GST invoices, pay Stars, and deduct and report tax as the law requires.
• To answer enquiries, send the notifications and emails you've asked for, and keep the service working and secure.
• To meet legal obligations and to establish or defend legal claims.

We process personal data on the basis of your consent, and where the DPDP Act allows without consent — for example to comply with law (tax and accounting records) or for the uses you have voluntarily given the data for. We do not use your data for advertising, and we do not sell it.

Who helps us (processors)

These providers process data on our instructions, under contract, only to provide their service to us:

• BytePlus (ModelArk) — likeness verification, AI video generation and AI text drafting. Servers outside India (Singapore region).
• Amazon Web Services (Rekognition) — matching faces for protection (Mumbai region).
• Google — sign-in, and YouTube search for protection.
• Our cloud hosting and storage providers — running the service and storing files.
• Our payment partner (Razorpay) — brand payments, Star payouts and bank verification.
• Our email provider — sending notifications and sign-in codes.
• Error monitoring, with personal details removed before reports are sent.

Some providers process data outside India. We transfer data only to countries the Government of India has not restricted, and only what each provider needs. Brands see a Star's public profile and the ads the Star has approved for them — never the Star's rates, bank or verification data.

How long we keep it

• Face and voice verification data: until the licence ends or consent is withdrawn, then deleted within 30 days.
• Account and profile data: while your account is open; deleted when you ask us to, except what we must keep below.
• Signed licences, consents, approvals and the audit record of who did what: for the licence term and 8 years after, to prove that every ad was authorised.
• Payments, invoices, payouts and tax records: 8 years, as tax and company law require.
• Protection evidence: while the takedown is open, and up to 1 year after it is resolved.
• Website enquiries: up to 2 years.

Keeping it safe

Data is encrypted in transit; sensitive fields such as PAN are also encrypted at rest. Access is limited to people who need it, important actions need a fresh identity check, and every significant action is written to an audit record that can't be edited. If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

Your rights

• Get a summary of the personal data we hold about you and who we've shared it with.
• Correct, complete or update it.
• Have it erased once it is no longer needed for the purpose you gave it for, or withdraw consent — as easily as you gave it. Withdrawing consent for face or voice data ends the use of your likeness or voice.
• Nominate someone to exercise your rights if you die or become unable to.
• Complain to our Grievance Officer, and then to the Data Protection Board of India.

Stars can download their data or request deletion from Settings in the app. Anyone else can write to [privacy contact email].

Cookies and storage on your device

We use only what the service needs: a secure sign-in cookie, and on your device a cache of recently opened app pages so they open offline. No advertising or analytics cookies, and no third-party trackers.

Children

The service is for adults. We do not knowingly onboard anyone under 18; a Star under 18 needs a separate arrangement with their parent or guardian.

Grievance Officer

[Grievance Officer name], [Legal entity name], [Registered office address]. Email: [grievance email]. We acknowledge complaints within 24 hours and resolve them within 15 days.

Changes

If we change this notice in a way that matters, we'll tell you in the app or by email before the change takes effect.