Privacy

Privacy policy

Last updated 14 October 2026

This policy explains what personal data FollowCan collects, why, who sees it, how long we keep it and what you can do about it. It applies to the website and services run by FollowCan (“FollowCan”, “we”), at A-35, Brotherhood Society, Vikaspuri, New Delhi, who decide why and how your data is used (in the language of India’s Digital Personal Data Protection Act, 2023, the “Data Fiduciary”). It should be read with the Terms.

What we collect Why we use it Your ID Who sees it Cookies How long we keep it Your rights Security Age Contact and complaints

1. What we collect

  • Your account: name, email and mobile number, and for hosts and creators a password (we keep only a scrambled form of it, never the password itself). We only use an email or mobile number that has been verified with a one-time code; a number you type and do not verify is stored but never used. Your gender is taken from your verified ID. If you choose Continue with Facebook, Facebook tells us your name, your email (if you allow it) and your Facebook ID; we keep the Facebook ID so you can sign in the same way next time. We do not receive your Facebook password, friends, posts or photos, and we never post to Facebook.
  • Bookings and attendance: the events you book, your seat, whether you checked in, reviews you write, and messages in an event’s group chat.
  • Hosts also give a brand name, city, bio, pictures, Instagram handle, payout UPI ID and, optionally, a GSTIN.
  • Link in Bio pages: what you put on your page (name, picture, bio, links, theme), and, if you connect it, your Instagram account details and latest posts.
  • Tips: the amount and payment record, and, if a tipper chooses to give them, a name, email and note. Creators who receive tips give a UPI ID.
  • Reports and safety: reports you make or that are made about you, and what we decided.
  • Technical data: your IP address and device details when you sign in or when a code is sent, used to protect accounts and stop abuse.
  • Visits to Link in Bio pages: daily totals of visits and clicks only. We do not store your IP address or browser details for this: they are used for a few minutes to avoid counting a refresh twice, then dropped. Bots and the owner’s own visits are not counted.

2. Why we use it

We use your data only for the purposes you gave it for, or that the law allows:

  • to create and secure your account and sign you in (one-time codes, passwords);
  • to run bookings: check your ID, balance groups, take holds and payments, confirm seats, check guests in, settle events and pay hosts and creators;
  • to keep people safe: handle reports, remove people who break the rules, and stop a closed account from coming back;
  • to show your Link in Bio page and, if you choose, list it in Search Celebrity;
  • to send you messages about your bookings, payouts and account, only by an email address or mobile number you have verified, by email, SMS or WhatsApp (WhatsApp only if you opted in);
  • to follow the law (tax, accounts, orders from authorities), and to find and stop fraud and misuse;
  • to improve the service, using totals and not individual profiles.

Where we need your consent we ask for it (for example, a tick box for WhatsApp updates, or connecting Instagram), record when you gave it, and let you withdraw it at any time. We do not sell your data and we do not show ads.

3. Your ID

Our team checks your ID by hand. You send a photo of a driving licence or a masked Aadhaar (with the first 8 digits hidden; never send a full Aadhaar number) and a photo of your face. These photos are stored encrypted, only our verification staff can open them, we use them only for this check, we never share them (except where the law requires, see below), and we delete them a few days after we decide. A staff member types the name, date of birth and gender they see on the ID. The ID number is turned into a one-way fingerprint immediately and is not saved, so one ID cannot verify two accounts. We keep your date of birth and the gender on the ID, and the name on the ID for 30 days. Opening a photo is recorded. We ask for your agreement before you send the photos.

You must verify your ID to book events, to host events, and to be paid (hosts for event payouts, creators for tips). If you do not verify, you can still use the parts that do not need it.

4. Who sees it

Only what each party needs to do its job:

  • Hosts see the name, contact details and attendance history (check-ins only) of guests who book their events. The exact address of an event is shared only with confirmed guests. Guests in a group chat see each other’s first name and the first letter of the last name.
  • Razorpay (payments and payouts): your name, email, phone and the amounts. We store references and amounts, not your UPI PIN or bank details.
  • MSG91 (SMS): your phone number and the one-time code or message.
  • WhatsApp (Meta): your phone number and the message, only if you opted in.
  • Facebook (Meta): only if you choose to continue with Facebook. Facebook sees that you signed in to FollowCan and shares your name, email and Facebook ID with us.
  • Instagram (Meta): only if you connect it, to read your posts and follower count. You can remove FollowCan in your Instagram settings too.
  • Google Safe Browsing: the web addresses on Link in Bio pages are checked for malware and phishing. Only the address is sent, never who added it.
  • OpenStreetMap (maps): when a page shows a map, your browser loads it from OpenStreetMap, which sees your IP address and the area shown. A host’s place searches go to OpenStreetMap too.
  • Our email, hosting and infrastructure providers, to send email and run the service.
  • The public. What you put on a Link in Bio page is public. A celebrity page is created by FollowCan from public information. A person’s page is listed in Search Celebrity only if its owner chooses.
  • Authorities and courts, where the law or a valid order requires it. We check that a request has a legal basis, give only what it asks for, and keep a record of every request, who on our staff looked at the data and what we handed over. We do not keep ID numbers, and ID photos are deleted a few days after a check, so apart from those few days anyone who needs the document must ask the issuing authority.

Some of these providers keep data on servers outside India. We use them only for the purposes above.

5. Cookies

We use only the cookies the site needs to work: one to keep you signed in and one to protect forms from forgery. We do not use advertising or tracking cookies.

6. How long we keep it

  • Your account details and ID result: until you delete your account.
  • One-time codes (with the phone, email and IP they were sent to): 7 days.
  • Who a message went to and what it said: 90 days.
  • Group chat messages: 7 days after the chat closes.
  • Records of payments, invoices and payouts: 8 years, because the law requires it. After you delete your account they no longer carry your name or contact details.
  • Invites: if you ask for an invite we keep your email (and name, if you gave it) for 180 days, or until you sign up, and then delete it.
  • Instagram connection: we keep the access token (encrypted) and copy your latest posts so they can show on your page. Disconnecting deletes the token, the copied posts and the picture copies.
  • Tips: the amount and payment record are kept for 8 years; the name, email and note a tipper may add are removed after 90 days.
  • Claims and removal requests for celebrity pages: the claim, the proof and our decision. The proof email is removed when the claim is decided or after 30 days.
  • Requests from authorities: the request, its legal basis, the log of what we did and the outcome are kept for as long as the law requires, even after an account is deleted. An account cannot be deleted while a legal request about it is open.
  • Safety reports and closed accounts: we keep the report and our decision so we can act on repeat behaviour. If we close an account for safety reasons we keep a one-way fingerprint of that person’s ID (never the number) so the same ID cannot open another account. We keep these even after an account is deleted, and an account cannot be deleted while a safety report about it is being reviewed.

7. Your rights

You can, at any time:

  • see and correct your details, and download a copy of your data;
  • withdraw consent, for example turn WhatsApp updates off in Privacy & data (emails about your bookings continue either way), or remove FollowCan from your Facebook settings (Settings, Apps and Websites), after which we remove the link to your Facebook account;
  • delete your account. Deleting waits 7 days (signing in again cancels it) and cannot go ahead while a booking, refund, event or payout is still open;
  • nominate another person to exercise these rights for you if you die or cannot act;
  • complain to us (section 10) and, if you are not satisfied, to the Data Protection Board of India.

When you are signed in, you can do most of this yourself in Privacy & data. For anything else, write to info@followcan.com. We may need to confirm it is you, and we may keep what the law requires us to keep.

8. Security

We protect your data with encryption of sensitive items such as access tokens, limited staff access, and secure connections. No system is perfectly secure. If a breach affects your personal data we will tell you and the authorities as the law requires.

9. Age

FollowCan is for adults. You must be at least 18 to book or host, and your ID is checked. We do not knowingly collect children’s data; if you think a child has an account, tell us and we will remove it.

10. Contact and complaints

Questions about your data, or a complaint: write to Nidhi Manchanda, Grievance Officer, at info@followcan.com. We acknowledge a complaint within 48 hours and aim to resolve it within 15 days.

We may update this policy. The version on this page, with the date above, is the one that applies; for a significant change we will tell you by email or on the site.