Privacy Policy

The Platform connects two types of users: brands, events, organizations, or public figures who create marketing campaigns (“Campaign Owners”), and individuals or agencies who create and publish content in those campaigns (“Creators”). This policy applies to both, as well as to visitors of our Services. Please read it together with our Terms and Conditions.

We are committed to handling your personal data in accordance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (the “PDPA”), and other applicable Sri Lankan law.

The data controller responsible for your personal data is Hygge Industries (Pvt) Ltd, a private limited company incorporated in Sri Lanka under company number PV00281258, with its registered address at 57/2, Lower Dickson Road, Galle 80000, Sri Lanka. For any privacy question, request, or complaint, contact us at:

• Email: support@polysocial.cc
• Postal address: 57/2, Lower Dickson Road, Galle 80000, Sri Lanka

When you register, we collect your email address (used for log-in), full name, district, phone number, and gender (male or female).

You provide links to your social media profiles, which may include YouTube, Instagram, Facebook, TikTok, and LinkedIn.

When you join a campaign as a Creator, we collect the links to the social media posts you publish for that campaign, and the content you upload to the Platform for review and approval.

Our pricing includes a performance-based component tied to the number of views your content receives. To measure this, we connect to your social media accounts through the official APIs of each platform (for example YouTube, Instagram, Facebook, and TikTok) using OAuth authorization.

At the point of connection, we obtain your consent in accordance with the privacy guidelines and developer terms of each social media platform. We only access the metrics that each specific platform permits to be shared under its own guidelines and within the scope you authorize (such as view counts and engagement data for the relevant posts). You may review and revoke these permissions at any time through the settings of the relevant social media platform.

For each post you submit to a campaign, the metrics we read may include its views, likes, comments, shares, and saves (where the platform reports them), how its views change over time, and its cover image or thumbnail. We read these only for the posts you submit to campaigns, not for the rest of your content.

If you connect a YouTube account, we use YouTube API Services. By connecting it you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy. You can revoke our access to your YouTube data at any time through your Google security settings.

Where a social media platform’s API permits it and you have authorized it, we may retrieve audience information relating to your profile and your campaign posts (such as aggregate audience characteristics like age range, gender, and country) to help match Creators with suitable campaigns and to report to Campaign Owners on who their campaign reached (see Section 6.1). We only retrieve this data where the relevant platform allows it and you have consented. This data describes your audience as a group, in percentages; it never identifies individual viewers or followers. Where a Campaign Owner sets eligibility restrictions for a campaign (for example, a campaign open only to a particular audience or Creator type), campaigns with such restrictions may not be visible to Creators who do not meet them. This filtering applies only where the Campaign Owner has expressly set restrictions.

If you are a Creator, we collect your bank account details for the sole purpose of depositing your earnings. If you are a Campaign Owner, payments are made to us through an Internet Payment Gateway (IPG) or by bank transfer.

We collect the messages you exchange with other users through the in-Platform chat, and any communications you send to our support team.

Like most online services, we automatically collect certain technical information when you use the Services, such as your IP address, device and browser type, and information about how you interact with the Platform, collected through cookies and similar technologies (see Section 9).

We use your personal data to:

• create and manage your account and verify your eligibility;
• operate campaigns, including matching Creators with campaigns and enabling Campaign Owners to review and approve content;
• measure the performance of published content and calculate performance-based payments;
• provide Campaign Owners with performance and audience reports on the campaign content they paid for;
• process payments and deposit Creator earnings;
• enable communication between users through the in-Platform chat;
• provide support, maintain security, prevent fraud and abuse, and enforce our Terms;
• comply with legal obligations; and
• market and promote the Platform, including the use of campaign content as described in Section 5.

Under the PDPA, we process your personal data on the following bases: your consent (for example, connecting your social media accounts and processing your data for those purposes); the performance of a contract with you (operating your account and campaigns and paying you); compliance with legal obligations; and our legitimate interests in operating, securing, and improving the Platform, provided these do not override your rights.

When you upload content to the Platform and payment for that content is completed, the content is fully transferred to the Platform, and we acquire the copyright in that content as set out in our Terms and Conditions. This means we may use the content on our own social media profiles and in other marketing campaigns to promote the Platform. This use continues even after a campaign ends or your account is closed, because ownership of the content has been transferred to us.

When you take part in a campaign as a Creator, we share the following with the Owner of that campaign only:

• Your profile: your name, your social media profile links, and the links to the posts you submitted to that campaign.
• Post performance: for each post you submitted to that campaign, its views, likes, comments, shares, and saves (where the platform reports them), how its views changed over time, and its cover image or thumbnail.
• Audience breakdown: who the campaign reached by age range, gender, and country. This is shown in percentages and combined across all of the campaign’s posts. For some platforms (for example Instagram) this reflects the audience of your account as a whole rather than of a single post, because that is the only audience data the platform provides. Where a campaign has few posts, this breakdown may mostly reflect your own audience. It never identifies individual viewers or followers.

Campaign Owners can see this data in their campaign reports on the Platform, including after the campaign has ended. We do not share data from your posts that were not submitted to their campaign, your social media log-in credentials or access tokens, or your other personal details (such as your email, phone number, district, gender, or bank details) with Campaign Owners or any other stakeholder without your consent. We do not sell your data, and Campaign Owners may use these reports only to evaluate their campaigns on the Platform.

From the Campaign Owner side, we only share the brand’s social media profiles with Creators.

Creators and Campaign Owners can communicate through the in-Platform chat. Personal contact details are not shared between users through this channel, and sharing private contact details through the chat is not permitted (see Section 11).

We share personal data with trusted service providers who help us operate the Platform, including our cloud hosting and data storage provider, Amazon Web Services (AWS), whose infrastructure and data buckets we use subject to AWS’s own privacy and security terms. Payments are processed through an IPG registered with the Central Bank of Sri Lanka.

Your bank account details are used only to deposit your earnings. They are never shared with Campaign Owners or any other stakeholder. We do not have access to your bank account itself; we use your account details only to make deposits to you.

We may disclose personal data where required to comply with the law, a court order, or a lawful request from a regulator or authority, or to protect our rights, users, or the public.

Campaign Owners pay us through an IPG registered with the Central Bank of Sri Lanka or by bank transfer. Creator earnings are made available through a mobile wallet on the Platform, from which a Creator may cash out once per day. We use your bank account details solely to process these deposits.

You may delete your account at any time. When you do, your private personal information and your bank account details are permanently deleted from our systems.

Content that you uploaded and that was paid for and transferred to the Platform will remain with the Platform after your account is deleted, because the copyright in that content has been transferred to us under our Terms and Conditions, as described in Section 5.

We stop reading metadata and performance metrics from your social media posts once the relevant campaign has ended. The metrics and audience breakdown already collected for that campaign are kept as its final report, which the Campaign Owner can continue to view.

We otherwise retain personal data only for as long as necessary to provide the Services, to comply with our legal, tax, and accounting obligations, and to resolve disputes.

We use cookies and similar technologies to keep you logged in, remember your preferences, keep the Platform secure, and understand how the Services are used. You can control cookies through your browser settings, although disabling some cookies may affect how the Platform works.

By connecting a social media account and submitting a post to a campaign, you consent to the post’s performance metrics and the audience breakdown described in Section 6.1 being shared with that campaign’s Owner. Where we rely on your consent, you may withdraw it. If you disconnect a social media account, we stop reading new data from it, but metrics already collected for a campaign remain part of that campaign’s report. You can withdraw your consent to a campaign by making a special request to the Platform up until the campaign ends. Once a campaign has ended, consent to that campaign can no longer be withdrawn, and any social media connections you have authorized can be revoked directly through the settings of the relevant social media platform at any time.

Messages exchanged through the in-Platform chat are monitored for the sharing of private contact details, which is not permitted, and for other violations of our guidelines. Chat messages are stored only until the end of the relevant campaign, after which they are not retained.

Creator content may feature other individuals (for example, people appearing at an event or in the background of a video). Because such content is published from the Creator’s own social media profiles, it is the Creator’s responsibility to obtain any consent required from those individuals and to comply with applicable law when creating and publishing that content.

The Platform is not open to minors. You must be at least 16 years old to use the Services. Under Sri Lankan labour law, individuals aged 16 and above may undertake gig work that does not interfere with their schooling. We do not knowingly collect personal data from anyone under 16. If we learn that we have collected data from a person under 16, we will delete it.

We host our systems and store data on Amazon Web Services (AWS) infrastructure and apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. Payment and bank data handling is supported by our IPG, which is registered with the Central Bank of Sri Lanka. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to affect your rights, we will notify the Data Protection Authority of Sri Lanka and affected users where required, and take steps to address it.

Our data is stored on AWS infrastructure. If any of this infrastructure or any of our service providers process your personal data outside Sri Lanka, we take steps to ensure the transfer meets the requirements of the PDPA and that appropriate safeguards are in place.

Subject to the PDPA and applicable law, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data, subject to Section 8 (content transferred to us is not deleted);
• withdraw consent where processing is based on consent, as described in Section 10;
• object to or request that we restrict certain processing; and
• lodge a complaint with the Data Protection Authority of Sri Lanka.

To exercise any of these rights, contact us at support@polysocial.cc. We will respond within the timeframe required by the PDPA.

We may send you communications relating to your account and campaigns, which are necessary to provide the Services. We may also send you promotional communications about the Platform. You can opt out of promotional communications at any time using the unsubscribe link in the message or by updating your notification preferences, without affecting service-related messages.

This Privacy Policy and any dispute arising from it are governed by the laws of Sri Lanka, including the Personal Data Protection Act, No. 9 of 2022 as amended, and are subject to the jurisdiction of the courts of Sri Lanka.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Platform or by email. Your continued use of the Services after an update means you accept the revised policy.

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact us at support@polysocial.cc or at the address in Section 1. You also have the right to contact the Data Protection Authority of Sri Lanka.