Privacy policy

8Bit Creatives is a gaming creator agency based in India. We manage esports talent, produce campaigns for brands that want to reach India's gaming audience, and partner with platforms entering the country. This privacy policy applies to 8BitCreatives.com and to any personal data you share with us through the website, our forms, our email, or our offline work together. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), 8Bit Creatives is the Data Fiduciary — the entity that decides why and how your personal data is processed. We're responsible for handling it carefully, and this page explains how.

Directly from you, when you fill out a form or send us a message:

• —Your name
• —Your email address
• —Your phone number (if you choose to share it)
• —Your company or role (if you mention it)
• —The content of your message or enquiry
• —Any documents you attach

When you apply to be a managed creator:

• —Real name, date of birth, and address
• —Government-issued ID (PAN, Aadhaar, or passport)
• —Bank account details (for payments and contracts)
• —Social media handles and links to your content
• —Portfolio or reel links
• —Professional references (if you provide them)

Automatically when you visit our website:

• —Your IP address
• —Browser type and version
• —Device type (mobile, tablet, desktop)
• —The pages you visit and how long you stay
• —The website that referred you to us
• —Approximate location (city-level, derived from IP)

From third parties, in limited cases:

• —Public social media profiles of creators we manage or are evaluating
• —Professional references you've authorized us to contact
• —Public records needed for due diligence (e.g., company registration)

We don't buy data from data brokers. We don't scrape data from social platforms. We don't profile you across other websites.

We use your data for one of these reasons at a time:

• —To respond to your enquiry when you contact us through the website or by email.
• —To evaluate creator applications and decide whether to offer representation.
• —To run and improve our website — what pages work, what forms are confusing, what devices people use.
• —To send you updates and newsletters — but only if you've explicitly opted in. You can unsubscribe at any time.
• —To fulfil contracts with creators, clients, and partners — including payments, deliverables, and tax records.
• —To meet legal, tax, and regulatory obligations under Indian law.
• —To protect against fraud, abuse, and security incidents.

We do not use your personal data for advertising you across other websites. We do not sell your data, ever.

Under the DPDP Act, we process your personal data for one of these reasons:

• —With your consent — when you fill out a form, apply for representation, or subscribe to the newsletter. You can withdraw consent at any time.
• —For a contract — when we're working with you as a creator, client, or partner, and processing is necessary to fulfil that contract.
• —For a legal obligation — when Indian tax, labour, or company law requires us to keep certain records.
• —For a legitimate purpose — limited cases like protecting our website from fraud or responding to a security incident.

We don't process your data for anything not listed here. If we ever need to, we'll ask for your consent first and update this policy.

Our website uses cookies and similar technologies in three categories:

• —Essential cookies — the site doesn't work without them. They keep your session alive and remember your settings.
• —Analytics cookies — they help us understand which pages people read, where they drop off, and what devices they use. We use [Google Analytics / Plausible / Fathom — pick one before publishing] for this.
• —Optional cookies — they remember your newsletter preferences and form inputs.

You can control cookies through your browser settings. Most browsers let you block all cookies, block third-party cookies only, or clear cookies when you close the browser. If you block essential cookies, some parts of the site won't work.

We share your personal data only in these cases:

• —Service providers who help us run the business — our website host, email provider, analytics tool, accounting software, and contract management platform. They process your data under contract and can't use it for anything else.
• —Brand and platform partners when running a campaign that involves you as a managed creator — only with your written consent.
• —Legal authorities when Indian law requires us to respond to a valid request, court order, or regulatory inquiry.
• —Successors in a business transaction — if 8Bit is acquired or restructured, your data transfers to the new entity under the same protections.

We never sell your data. We never share it for cross-context advertising. We never share it with social media platforms for ad targeting.

8Bit is based in India and most of your data stays in India. Some of our service providers (web hosting, email, analytics) may process data in countries outside India — usually the United States or the European Union. When that happens, we work with providers that offer contractual safeguards equivalent to Indian requirements, and we limit what data they can access.

You can ask us which providers process your data outside India by writing to the grievance officer (see Section 13).

We keep your data only for as long as we need it:

• —Contact form enquiries: 12 months from your last message.
• —Creator applications (not accepted): 24 months, or until you ask us to delete them.
• —Creator applications (accepted): the duration of our representation contract, plus 7 years for tax and legal records.
• —Newsletter subscribers: until you unsubscribe, plus 30 days for record-keeping.
• —Client and partner contracts: the duration of the contract, plus 7 years for tax records.
• —Analytics data: 26 months, then aggregated and de-identified.
• —Government IDs and bank details: only for active contracted creators; deleted within 30 days of contract end.

When retention ends, we delete the data or de-identify it so it can't be linked back to you.

Under the DPDP Act, you have the right to:

• —Access — ask what data we hold about you and get a copy.
• —Correction — ask us to fix inaccurate or incomplete data.
• —Erasure — ask us to delete your data, where we're legally allowed to.
• —Nomination — nominate someone to exercise your rights if you can't.
• —Grievance redressal — file a complaint with us, and if we don't resolve it, with the Data Protection Board of India.
• —Withdraw consent — at any time, for any processing based on your consent. Withdrawing consent doesn't affect anything we did before you withdrew.

To use any of these rights, write to the grievance officer in Section 13. We'll respond within 30 days.

We take reasonable steps to protect your data:

• —HTTPS encryption across the whole website.
• —Access restricted to staff who need it for their role.
• —Passwords and credentials stored in a password manager, never in plain text.
• —Government IDs and bank details stored separately from other records, with restricted access.
• —Annual review of who has access to what.
• —Staff trained on data handling when they join and refreshed yearly.
• —A breach response plan, with notification to affected users and the Data Protection Board of India within 72 hours of a notifiable breach.

No system is perfectly secure. If something goes wrong, we'll tell you.

Our website is not directed at anyone under 18. We don't knowingly collect personal data from anyone under 18. If you believe we've collected data from a minor — yours, or someone you're responsible for — write to the grievance officer and we'll delete it within 30 days.

We update this policy when our practices change, when the DPDP Act is updated, or when we add or remove a service that processes your data. When we update, we'll change the "Last updated" date at the top of this page. For material changes — a new use of your data, a new sharing partner, or a longer retention period — we'll also post a notice on the home page for 30 days.

If you've subscribed to the newsletter, we'll email you about material changes.

If you have any question about this policy, want to use one of your rights, or want to file a complaint, write to us.

We'll respond within 30 days. If you're not satisfied with our response, you may also raise a complaint with the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.