Fablecart (“Fablecart”, “we”, “us”) is a creator marketing platform where brands, agencies and creators run campaigns together, at fablecart.com.

Fablecart is operated by Fablecart (Private) Limited, a company incorporated in Pakistan with the Securities and Exchange Commission of Pakistan (registration number 0361474), whose registered office is at E-121-2-A, Alfalah Town, Bedian Road, Lahore Cantonment, Lahore 54000, Punjab, Pakistan. Fablecart (Private) Limited is responsible for the personal information described in this policy. Questions about your data go tohello@fablecart.com.

• Your account: your name, email address, password (stored only as a one-way hash) and whether you use Fablecart as a brand or a creator.
• A creator profile: your handle, display name, title, bio, city, categories, languages, keywords, a description of your audience, brands you have worked with, your photos, and the packages and prices you publish.
• A brand profile: your company name, website, category, city, description, social handles, logo and cover image.
• Orders and campaigns: briefs, every version of a deliverables agreement and who accepted it, the work handed in (links, photos, notes), reviews, messages between a brand and a creator, payment and shipment records you enter (amounts, methods, references, dates) and a shipping address when a product is sent.
• Instagram, only if you connect it: see section 3.
• The early access form: your name, email address, whether you are a brand or a creator, and the answers you give.
• Technical records: our hosting provider keeps request logs (IP address, browser, time) for security and troubleshooting. We use cookies only to keep you signed in and to secure the Instagram connection. We use no advertising or analytics trackers.

Connecting Instagram is optional. When a creator chooses to, they sign in on Instagram's own screen and decide what to share. We ask for two permissions, instagram_business_basic and instagram_business_manage_insights, and only Creator or Business accounts can connect.

What we receive:

• Your profile: username, name, account type, profile picture, bio, website, and follower, following and post counts.
• Account insights: reach, views, interactions and engagement over recent weeks, and the audience breakdown by country, city, age and gender where Instagram provides one.
• For a post you hand in on a Fablecart order: the post itself (its link, caption, type, date and thumbnail) and its results (reach, views, likes, comments, saves and shares), read for 30 days after it goes live.

How we use it: to show verified figures on your Fablecart profile, so brands can see reach and audience that come from Instagram rather than from anyone typing them, and to report the results of posts you deliver for an order to you and the brand on that order. We use it for nothing else. We do not sell it, share it with advertisers, or use it to target advertising.

How we protect it: your Instagram access token is encrypted before it is stored and is never shown to anyone, you included. We refresh it automatically while you stay connected.

How you stop it:

• Disconnect in Fablecart, under Settings, Connections. The token, the copy of your profile, every account snapshot and the audience breakdown are deleted at once.
• Remove Fablecart in Instagram, under Settings, Apps and websites. Instagram tells us, and we delete the same data automatically.
• Ask for your data to be deleted, from Instagram or by writing to us. We also delete the results of your posts that we read through the connection. See data deletion.

Our use of information received from Instagram follows the Meta Platform Terms and Developer Policies.

• To run Fablecart: your account and profile, creator search, matching campaigns to creators, orders and deliverables agreements, messages, payment records and reports.
• To email you about your account and your orders: sign-in links, a new order, an answer to one, a deliverable handed in or approved, a payment recorded. These are part of the service.
• To keep Fablecart secure and working, and to stop fraud and abuse.
• To answer you when you write to us.

• Anyone: what a creator or brand publishes on their public page (fablecart.com/c/ and fablecart.com/b/ addresses), including verified Instagram figures a creator has connected.
• The other side of an order: the brief, every agreement version, the work handed in, reviews, messages, payment records, and a shipping address when a product is sent.
• The brand on a campaign: the applications creators send to that campaign.
• Fablecart: our team, where needed to support you, keep the service safe, or resolve a problem you raise.

We use these providers to run Fablecart. Each processes data only to provide its service to us:

• Vercel: hosting and request logs.
• Supabase: the database and file storage.
• Resend: sending email.
• HubSpot: the early access form.
• Meta: the Instagram connection, when you choose it.
• Sentry: error reports, so we can find and fix faults. A report carries the page, the browser and the error, not what you typed into a form.

Some of these providers store and process data outside Pakistan. We do not sell personal information to anyone.

We keep your information while your account is open. Instagram data is kept only while you stay connected, and is deleted as described in section 3.

When you ask us to delete your account, we delete your personal information within 30 days. An order is a shared record between a brand and a creator, so where the other side still relies on an agreement or a payment record, we keep that record with your personal details removed. We keep anything the law requires us to keep, for as long as it requires.

• See and correct your information in Settings at any time.
• Ask us for a copy of your information, or to delete it.
• Disconnect Instagram whenever you like.
• Withdraw a permission you gave, such as Instagram access.

Write to hello@fablecart.com from the email address on your account. We answer within 30 days.

Everything travels over an encrypted connection. Passwords are stored only as one-way hashes, Instagram tokens are encrypted with AES-256, and access to stored data is limited to the systems and people that need it. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Fablecart is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe a child has given us information, write to us and we will delete it.

When this policy changes, we update the date at the top. If a change affects how we use information you have already given us, we will email you before it takes effect.

Fablecart (Private) Limited, E-121-2-A, Alfalah Town, Bedian Road, Lahore Cantonment, Lahore 54000, Punjab, Pakistan. hello@fablecart.com