Effective date: September 8, 2026

Who Operates Cravgen

Cravgen is operated by HASHMARK (PRIVATE) LIMITED ("we", "us", "our"). HASHMARK (PRIVATE) LIMITED provides the Cravgen software platform for influencer–brand collaboration, social publishing, paid advertising (Cravgen Ads), analytics, automation, and lead engagement.

Marketing website: https://www.cravgen.com
Application: https://admin.cravgen.com
Company: HASHMARK (PRIVATE) LIMITED

Google API Services User Data Policy

Cravgen's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Cravgen's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• We use Google user data only to provide user-facing features that you explicitly request — such as YouTube channel connection, video publishing, YouTube Analytics insights, comment management on videos you published through Cravgen, and optional Google Ads campaign management in Cravgen Ads.
• We do not sell Google user data, use it for unrelated advertising, or transfer it except as necessary to provide the service (for example, publishing to YouTube or calling the Google Ads API on your behalf).
• You can disconnect Google or YouTube at any time under Connections in https://admin.cravgen.com, or revoke access at https://myaccount.google.com/permissions. See Section 13 below for data deletion requests.
• Cravgen does not use Google APIs for AI NCII (AI-generated Non-Consensual Intimate Imagery). Cravgen does not use Google APIs, or information received from Google APIs, to create, request, generate, or distribute non-consensual intimate imagery. Google user data is used only for user-facing features the account owner requests: Google sign-in, YouTube publishing and analytics, comment management on videos published through Cravgen, and optional Google Ads campaign management.

For scope-specific details, see Section 5 (YouTube, Google & Google Ads Platform Data) below. You may revoke Google account access at any time via Google Account permissions.

This Privacy Policy describes how we collect, use, store, share, and delete information when you visit our website, create an account, connect social platforms, publish content, run campaigns, or use marketplace and automation features. By using Cravgen you agree to this policy and our Terms & Conditions.

1. Information We Collect

• Account data: name, email address, organization, role, login credentials, subscription and billing details you provide when registering or upgrading a plan.
• Connected social accounts: platform identifiers, Page or profile names, usernames, profile images, follower counts, permissions you grant, access tokens (stored securely), and metadata returned by platforms you authorize.
• Collaboration and influencer data: campaign briefs, creator profiles, marketplace listings, brand–creator communications, performance metrics, and eligibility information needed for collaborations you participate in.
• Content and campaign data: posts, captions, media, schedules, drafts, comments, insights, ad campaign configurations, ad account identifiers, performance metrics, and lead-form submissions you create or import.
• Usage and technical data: IP address, device/browser type, logs, cookies, session identifiers, and product analytics used for security, reliability, and improvement.
• Communications: messages you send to our support team or through in-product contact flows.

2. Third-Party Platforms and APIs

Cravgen may access information from third-party platforms when you authorize integrations. We use this information solely to provide the functionality you request— not for unrelated advertising or resale.

Platforms we may connect to include:

• Meta (Facebook and Instagram)
• YouTube
• TikTok
• LinkedIn
• WhatsApp Business
• Google (where sign-in or maps features are enabled)

Each platform's own terms and privacy policies apply to your use of that platform. We only receive data that you (or your organization administrator) explicitly authorizes through OAuth or similar connection flows.

3. Meta Platform Data (Facebook & Instagram)

Because Cravgen is an influencer and brand collaboration platform, connecting Facebook or Instagram is optional and used for features you choose — such as organic publishing, comment management, collaboration workflows, analytics, automation, and Cravgen Ads (Meta Marketing API campaigns on ad accounts you authorize).

When users connect their Facebook or Instagram accounts, Cravgen may access profile information, Pages, business or creator account information, ad account metadata, permissions you grant, and related data necessary to provide publishing, collaboration, analytics, automation, and advertising features. We do not use Meta Platform Data for purposes unrelated to these features.

Permissions we may request and why:

• public_profile: Identify your connected Facebook personal account (name and profile picture) and associate Facebook Pages and Instagram accounts with the correct Cravgen user.
• pages_show_list: List Facebook Pages you manage so you can choose which Page to connect to Cravgen.
• pages_manage_posts: Publish posts, images, and videos to Facebook Pages you authorize, including scheduled and AI-assisted publishing workflows.
• pages_manage_engagement: Manage comments and other engagement on Facebook Page posts you authorize through Cravgen.
• pages_read_engagement, pages_read_user_content: Read Page engagement metrics, comments on Facebook posts published through Cravgen, and related content needed to display performance analytics, Timeline comment threads, and publishing status in Cravgen.
• instagram_basic: Access Instagram Business/Creator profile information (username, profile picture, account identifiers) for connected accounts.
• instagram_content_publish: Publish photos, reels, stories, and other media to Instagram accounts you connect and authorize.
• instagram_manage_comments: Read and reply to comments on Instagram content published through Cravgen, including the Timeline comments panel (with optional real-time webhook updates or periodic API sync, depending on your settings).
• instagram_manage_insights: Retrieve Instagram insights and follower metrics to power analytics dashboards and campaign reporting.
• pages_manage_metadata: Subscribe to Page webhooks and manage Page metadata required for comment sync and publishing status in Cravgen.
• business_management: Identify the Meta Business you admin so Cravgen can attach and manage product catalogs used for Facebook Shop, Instagram Shopping, and WhatsApp catalog.
• catalog_management: Create, update, and delete products in Meta product catalogs you authorize, so your Cravgen shop catalog can sync to Facebook Shop and Instagram Shopping in one click.
• ads_management: Create, update, and manage Meta (Facebook and Instagram) ad campaigns, ad sets, ads, and related objects in ad accounts you authorize through Cravgen Ads.
• ads_read: Read Meta ad account metadata, campaign structure, delivery status, and performance insights for accounts linked in Cravgen Ads.
• leads_retrieval: Retrieve lead submissions from Meta Instant Forms and Lead Ads attached to campaigns you create or manage in Cravgen Ads.
• pages_manage_ads: Create and manage ads associated with Facebook Pages you authorize, including Page-connected lead ad and Instant Form workflows in Cravgen Ads.
• whatsapp_business_management: Manage WhatsApp Business accounts linked through Meta so Cravgen can configure business profiles, catalogs, and related WhatsApp settings you authorize.
• whatsapp_business_messaging: Send and receive WhatsApp Business messages on accounts you connect, including customer conversations and automated replies powered by Cravgen.

We do not sell Meta Platform Data. We do not use it to build unrelated user profiles for third-party advertising. Access is limited to personnel and subprocessors who need it to operate the service under confidentiality obligations, in compliance with Meta Platform Terms. Meta ad account spend is billed by Meta to the payment method on the linked ad account, not by Cravgen.

4. TikTok Platform Data

When you connect your TikTok account to Cravgen, we access information from TikTok only with your explicit authorization through TikTok Login Kit and Content Posting API. We use this data solely to provide features you choose — such as account connection, profile display, analytics, and publishing videos you create or schedule in Cravgen.

We do not read individual TikTok comment text, direct messages, or private account content through our integration. Comment counts shown in Cravgen come from aggregate video insights where available.

Permissions we may request for TikTok Login Kit and organic features:

• user.info.basic: Identify your connected TikTok account (open ID, avatar, and display name) and associate it with the correct Cravgen user on the Connections page.
• user.info.profile: Read your TikTok username, bio description, profile links, and verified status to display your connected account profile in Cravgen.
• user.info.stats: Read follower count, following count, likes count, and video count to show account statistics and analytics in Cravgen.
• video.list: Read your public TikTok video metadata and aggregate engagement metrics (views, likes, comment counts, shares) to power post insights and analytics in Cravgen. We do not access individual comment text or direct messages through this scope.
• video.upload: Upload video files you create or schedule in Cravgen to TikTok as part of the publishing workflow you authorize.
• video.publish: Publish videos directly to your TikTok profile when you schedule or publish content through Cravgen.

TikTok Ads (Marketing API): when you use Cravgen Ads for TikTok, we may access advertiser account information, campaign and ad group structure, creatives, Instant Form metadata, lead submissions, and performance metrics from TikTok for Business through the Marketing API, only for accounts you authorize and only to provide advertising features you select in Cravgen.

TikTok Marketing API permissions we may request and why:

• ad_account_management: List and read TikTok for Business advertiser accounts the authorized user can access, to link ad accounts under Ads → Ad accounts in Cravgen.
• ads_management: Create and manage TikTok ad campaigns, ad groups, ads, and related structures in advertiser accounts you authorize through Cravgen Ads.
• reporting: Read TikTok Ads performance metrics (such as impressions, clicks, and spend) for linked advertiser accounts and display them in Cravgen campaign insights.
• creative_management: Upload and manage video or image creatives used in TikTok In-Feed ads you create through Cravgen Ads.
• lead_management: List Instant Form pages and fields and retrieve lead submissions for TikTok lead-form campaigns managed in Cravgen Ads.
• dpa_catalog_management: Create and manage TikTok Dynamic Product Ad (DPA) catalogs and related catalog assets for shopping ads you authorize through Cravgen.
• onsite_commerce_store: Manage TikTok Onsite Commerce Store settings and storefront bindings for advertisers you authorize through Cravgen Ads.
• audience_management: Manage custom audiences on linked TikTok advertiser accounts when audience features are enabled for your plan.
• pixel_management: Read or configure TikTok Pixel and measurement settings on linked advertiser accounts when measurement features are enabled.

We do not sell TikTok Platform Data. We do not use it for unrelated advertising or to build third-party marketing profiles. Access is limited to personnel and subprocessors who need it to operate the service under confidentiality obligations, in compliance with TikTok Developer Terms, TikTok's Privacy Policy, and TikTok's applicable policies. TikTok ad spend is billed by TikTok to the payment method on the linked advertiser account, not by Cravgen.

5. YouTube, Google & Google Ads Platform Data

When you connect your YouTube channel or Google account to Cravgen, we access information from Google and YouTube only with your explicit authorization through Google OAuth. We use this data solely to provide features you choose — such as channel connection, publishing videos and Shorts, displaying performance metrics on post cards, analytics in the Insights tab, viewing or replying to comments on videos you published through Cravgen from the Timeline panel, and Cravgen Ads (Google Ads campaigns on customer accounts you authorize).

We do not read your private YouTube messages, unrelated channel content you have not published through Cravgen, or data from channels you have not connected. Metrics such as watch time and subscribers gained are retrieved from YouTube Analytics for videos you publish or monitor through Cravgen. YouTube comment text we display in Timeline is fetched from YouTube and may be stored in our database to show your comment history; YouTube does not send real-time comment webhooks, so updates are synchronized periodically while you use Timeline.

Google OAuth permissions we may request for YouTube and why:

• openid, email, profile: Sign you in with Google, identify your Google account, and associate your YouTube channel(s) with the correct Cravgen user on the Connections page.
• youtube.upload (https://www.googleapis.com/auth/youtube.upload): Upload and publish videos and YouTube Shorts you create or schedule in Cravgen to the YouTube channel(s) you authorize.
• youtube.readonly (https://www.googleapis.com/auth/youtube.readonly): Read your YouTube channel profile, video metadata, and public statistics (such as view counts, likes, and comment counts) to display connected account information, post performance, and insights in Cravgen.
• yt-analytics.readonly (https://www.googleapis.com/auth/yt-analytics.readonly): Retrieve YouTube Analytics metrics for videos you publish through Cravgen — including watch time, average view duration, and subscribers gained — to power insights dashboards and campaign reporting.
• youtube.force-ssl (https://www.googleapis.com/auth/youtube.force-ssl): View comments on your YouTube videos published through Cravgen and post replies from the Timeline comments panel on your behalf. Comment threads are synchronized from YouTube on a periodic basis while you use Timeline (YouTube does not provide real-time comment webhooks).

Google Ads: when you use Cravgen Ads for Google, we access Google Ads customer account metadata, campaign structure, keywords, assets, lead-form extensions, and performance metrics through the Google Ads API, only for accounts you authorize and only to provide advertising features you select in Cravgen. API calls may use our Manager Account (MCC) as login-customer-id when acting on client accounts you link.

Google Ads permissions we may request and why:

• https://www.googleapis.com/auth/adwords: Discover Google Ads customer accounts accessible to the authorized user, link client ad accounts under our Manager Account (MCC), and create or manage Search and other campaign types you configure in Cravgen Ads.

We do not sell YouTube, Google, or Google Ads Platform Data. We do not use it for unrelated advertising or to build third-party marketing profiles. Access is limited to personnel and subprocessors who need it to operate the service under confidentiality obligations, in compliance with Google API Services User Data Policy, Google's Privacy Policy, and YouTube's Terms of Service. Google Ads media spend is billed by Google to the payment method on the linked Google Ads account, not by Cravgen.

6. LinkedIn Platform Data

When you connect LinkedIn to Cravgen, we access information from LinkedIn only with your explicit authorization through LinkedIn OAuth. We use this data solely to provide features you choose — such as personal profile connection, publishing to your LinkedIn profile, Company Page management (via our separate LinkedIn Pages connection where enabled), Cravgen Ads (LinkedIn Campaign Manager campaigns on ad accounts you administer), and — when Lead Sync API access is approved and you authorize it — LinkedIn Lead Gen Form response sync into your Cravgen leads workspace.

LinkedIn personal connection permissions we may request and why:

• openid, profile, email: Sign you in with LinkedIn, identify your LinkedIn member account, and associate it with the correct Cravgen user on the Connections page.
• w_member_social: Publish posts to your LinkedIn personal profile when you create or schedule content in Cravgen.
• r_member_social: Read insights for posts published to your LinkedIn personal profile through Cravgen, when this scope is approved for our application.

LinkedIn Ads (Marketing API): when you use Cravgen Ads for LinkedIn, we access ad account metadata, campaign group and campaign structure, and ads reporting metrics through the LinkedIn Marketing API, only for ad accounts the authenticated member is authorized to manage and only to provide advertising features you select in Cravgen.

LinkedIn Marketing API permissions we may request and why:

• rw_ads: Discover LinkedIn ad accounts the authenticated member administers, and create or manage paused campaign groups, campaigns, and related ad objects in Campaign Manager through Cravgen Ads.
• r_ads: Read LinkedIn ad account metadata, campaign structure, and ad account access status for accounts linked in Cravgen Ads.
• r_ads_reporting: Retrieve LinkedIn Ads reporting metrics (such as impressions, clicks, and spend) for linked ad accounts and display them in Cravgen campaign insights.
• r_marketing_leadgen_automation (Lead Sync API): Download LinkedIn Lead Gen Form / Instant Form responses (leadFormResponses) for lead campaigns the customer creates or manages in Cravgen Ads, so leads can be stored in the customer workspace, reviewed by authorized team members, used for in-product notifications, and optionally synced or exported to CRM or marketing automation tools the customer configures.

LinkedIn Lead Sync / Lead Gen Form responses: When LinkedIn Lead Sync API access is approved for our developer application and you authorize Cravgen with the Lead Sync permission (r_marketing_leadgen_automation), we may retrieve Lead Gen Form responses submitted by LinkedIn members on Instant Form / Lead Gen Form ads for LinkedIn ad accounts you administer and connect to Cravgen Ads.

• Data collected: Depending on the fields configured on each Lead Gen Form, responses may include personal information such as name, email address, phone number, company, job title, and other questions the advertiser defines on the form, along with LinkedIn form and campaign identifiers needed to associate the lead with the correct ad account and campaign in Cravgen.
• How we use it: We use Lead Gen Form responses solely to provide Cravgen features you enable: storing leads in your workspace, displaying them to authorized users on your Cravgen account, notifying your team of new submissions, associating leads with campaign performance views, and forwarding or exporting leads to destinations you configure (such as a CRM or marketing automation system). We do not sell LinkedIn lead data, do not use it to build third-party advertising profiles, and do not use it to target ads to LinkedIn members on behalf of unrelated advertisers.
• Access controls: Lead responses are accessible only to the Cravgen customer workspace that owns the LinkedIn connection and linked ad account, and to personnel or subprocessors who need access to operate the service under confidentiality obligations. Access requires LinkedIn OAuth consent from a member authorized on the ad account, and Lead Sync is requested only when that product capability is enabled for the application and the customer’s plan features require it.
• Retention & deletion: We retain Lead Gen Form responses while your Cravgen account remains active and the related Ads / leads features are in use, and for a limited period afterward as needed for support, dispute resolution, security, and legal obligations. You may delete leads in-product where available, unlink the LinkedIn ad account, disconnect LinkedIn under Connections, revoke Cravgen in LinkedIn Settings → Permitted services, or request account deletion; we then delete or anonymize stored lead responses and revoke tokens as described in Your Choices & Data Deletion.

LinkedIn Pages: when you connect LinkedIn Pages separately, we may request:

• rw_organization_admin: List LinkedIn Company Pages you administer so you can choose which Page to connect in Cravgen.
• w_organization_social: Publish posts to LinkedIn Company Pages you authorize from Cravgen.
• r_organization_social: Read engagement and insights for posts published to LinkedIn Pages through Cravgen.
• w_organization_social_feed, r_organization_social_feed: Manage and read LinkedIn Page feed social actions (comments and reactions) for Community Management workflows in Cravgen.
• r_organization_followers: Read LinkedIn Page follower counts and related demographics for Pages you administer in Cravgen.

We do not sell LinkedIn Platform Data. We do not use it for unrelated advertising or to build third-party marketing profiles. Access is limited to personnel and subprocessors who need it to operate the service under confidentiality obligations, in compliance with LinkedIn's API Terms and LinkedIn's Privacy Policy. LinkedIn ad spend is billed by LinkedIn to the payment method on the linked ad account, not by Cravgen.

7. Cravgen Ads — Billing & Ad Account Ownership

Cravgen Ads helps authorized users plan, configure, launch, pause, and report on paid campaigns across connected advertising platforms. Cravgen does not hold client advertising media budgets. Each subscriber links ad accounts they own or are authorized to manage; ad spend is billed directly by the platform (Meta, Google, TikTok, LinkedIn, or others) to the payment method on that ad account. Cravgen charges a separate SaaS subscription for platform access, automation, and AI features.

When you use Cravgen Ads, we store campaign names, objectives, budgets, audiences, creatives, platform object identifiers returned by each ads API, launch status, and reporting metrics needed to operate the Ads builder, launch checklist, and insights views at https://admin.cravgen.com/ads. We do not use ads platform data to target unrelated third-party advertising or to resell API access.

8. How We Use Information

• Authenticate users and maintain secure sessions.
• Connect and manage social accounts you authorize.
• Publish, schedule, and monitor organic posts and paid ad campaigns on your behalf.
• Facilitate brand–creator collaborations and marketplace workflows.
• Display analytics, insights, comments, and workflow status.
• Power AI-assisted content, automation, and lead features.
• Sync and display LinkedIn Lead Gen Form / Instant Form responses authorized through Lead Sync for your linked ad accounts, notify your team of new leads, and forward leads only to destinations you configure.
• Provide customer support, billing, fraud prevention, and legal compliance.
• Improve performance, reliability, and product experience.

9. Legal Basis for Processing

Where applicable law requires a legal basis (for example, in the European Economic Area or United Kingdom), we process personal information on one or more of the following grounds:

• Consent: when you connect a social account, accept cookies, or opt in to optional features.
• Contractual necessity: to provide the service you signed up for, including publishing, analytics, and collaboration tools.
• Legitimate interests: to secure our platform, prevent abuse, improve products, and support customers, balanced against your rights.
• Legal obligations: to comply with law, respond to lawful requests, and meet tax or regulatory requirements.

10. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure product usage, and protect against abuse. You can control cookies through your browser settings; some features may not work if cookies are disabled.

11. How We Share Information

We do not sell personal information. We may share limited data with:

• Service providers (hosting, email, analytics, payment processors) under contractual safeguards.
• Platforms you connect (such as Meta, Google, LinkedIn, YouTube, or TikTok) when you direct us to publish, sync content, or manage ad campaigns.
• Collaboration participants (brands, creators, team members) when you use shared campaign or marketplace features.
• Authorities when required by law or to protect rights, safety, and security.

12. Data Retention

We retain information while your account is active and as needed to provide the service, resolve disputes, enforce agreements, and meet legal obligations. Connected-account tokens are removed when you disconnect an account or request deletion. LinkedIn Lead Gen Form responses synced via Lead Sync are retained as described under LinkedIn Lead Sync / Lead Gen Form responses. Aggregated or de-identified data may be kept longer for analytics and security.

13. Your Choices & Data Deletion

You may request deletion of your account and associated personal data at any time. Upon verification of your identity, we will process the request within 30 days unless a longer retention period is required by law (for example, billing records or fraud prevention).

You can delete or limit your data as follows:

• Account settings: sign in at https://admin.cravgen.com/users/user-account-settings to update profile information, disconnect integrations, or delete your account where that option is available.
• Disconnect social accounts: in Cravgen go to Connections and disconnect Facebook, Instagram, LinkedIn, YouTube, TikTok, or other platforms. This revokes our access to publish, read data, and manage ad campaigns from those accounts going forward.
• Unlink ad accounts: in Cravgen go to Ads → Ad accounts to unlink Meta, Google, TikTok, or LinkedIn ad accounts you previously connected.
• Remove YouTube / Google app authorization: in Cravgen go to Connections and disconnect your YouTube channel. You may also revoke Cravgen's access in your Google Account permissions (Third-party apps with account access). We delete stored YouTube access tokens when you disconnect or when Google notifies us that authorization was removed. The same Google connection may authorize both YouTube organic features and Google Ads when the adwords scope is granted for your account.
• Remove LinkedIn app authorization: disconnect LinkedIn and LinkedIn Pages from Cravgen Connections, or remove Cravgen under LinkedIn Settings → Permitted services. We delete stored LinkedIn access tokens when you disconnect.
• Remove TikTok app authorization: in the TikTok app go to Settings → Security → Manage app permissions (or TikTok's equivalent app management screen) and remove Cravgen. You may also disconnect TikTok from Cravgen Connections at any time. We delete stored TikTok access tokens when you disconnect or when TikTok notifies us that authorization was removed.
• Remove Meta app authorization: in Facebook Settings → Apps and Websites, remove Cravgen. Meta may notify us through their data-deletion callback.
• Email a deletion request: send a message to privacy@cravgen.com from the email address associated with your account with the subject line "Data deletion request". Include your full name and, if applicable, connected Facebook, Instagram, LinkedIn, YouTube, TikTok, or Google account names.
• Meta data-deletion callback: Meta-initiated deletion requests are processed at https://api.cravgen.com/api/oauth/facebook/data-deletion. User instructions for data deletion are published at https://www.cravgen.com/privacy-policy/#data-deletion. After processing, users receive a confirmation code and status URL on this page.

14. Security

We use administrative, technical, and organizational measures—including access controls, encryption in transit, and monitoring—to protect data against unauthorized access, loss, or misuse. No online service is completely risk-free; please use strong passwords and protect your account credentials.

15. Your Rights

Depending on your location, you may have rights to access, correct, export, restrict, or delete personal information, or to object to certain processing. Contact privacy@cravgen.com to exercise these rights. We may need to verify your identity before fulfilling a request.

16. Children's Privacy

Cravgen is not intended for individuals under the age of 13 (or the applicable minimum age in their jurisdiction, such as 16 in some regions). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@cravgen.com and we will take steps to delete it.

17. International Transfers

Your information may be processed and stored in countries other than where you live, including countries where our servers, cloud hosting providers, and subprocessors operate. Those locations may have different data-protection laws than your country. Where required, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

18. Policy Updates

We may update this policy to reflect legal, product, or operational changes. We will post the revised version on this page and update the effective date. Continued use after changes constitutes acceptance where permitted by law.

19. Contact

Questions about this Privacy Policy or your data: privacy@cravgen.com, support@cravgen.com, or Contact Us.