Privacy policy

Overview and who is responsible

This Privacy Policy explains how Zerohorizon Labs Private Limited, operating the Pickie service, handles personal data when you visit our website, create a creator account, build a storefront, use affiliate links, participate in campaigns, receive payments or contact us. It also explains what choices and requests are available to you. In this policy, Pickie, we, us and our refer to Zerohorizon Labs Private Limited; Service refers to the Pickie website, creator workspace and related features.

We determine how personal data is used for the core Pickie Service, such as account operation, link attribution, campaign administration and support. A merchant, brand, payment provider or social platform may separately determine its own handling of data when you interact with it. Their privacy notices apply to their own services. Some features may also be subject to a separate notice shown at the point of collection; read that notice together with this policy.

Our contact email for privacy questions and requests is hello@woohl.com. Our correspondence address appears at the end of this policy. Please use those channels rather than posting identity or account information publicly. We may need to verify that a request concerns your own data before we act on it.

Who and what this policy covers

This policy covers visitors, prospective users, creators, brand and merchant representatives, storefront visitors and people who communicate with us. The data we handle depends on how you use the Service. A visitor reading a public page provides less information than a creator who completes onboarding and requests a payout. We explain the principal categories below rather than suggesting that every category is collected from every person.

This policy does not replace the privacy notice of a merchant where a customer completes a purchase, a payment provider handling a transfer, or a social service where a creator posts content. A link from Pickie to another service does not make that service part of our own privacy practices. We encourage you to review the relevant third-party notice before giving it information.

Information you provide

When you register and use an account, you may provide your name, email address, login information, username, profile photograph, biography, location or contact details. During onboarding, you may provide information about your content categories, social accounts, audience and creator activity. You may also provide storefront titles, descriptions, collections, product choices, links and other material you choose to publish.

If you apply to a campaign, we may receive your application, responses to a brief, submitted content, delivery links, revisions and communications about the work. If you request a withdrawal, we may receive bank or UPI details, tax and verification information and the information needed to review and process payment. We may collect support messages, feedback, survey responses, complaint details and documents you choose or are required to send to us.

Only provide information that is accurate and necessary for the relevant purpose. Do not put passwords, payment card numbers, private customer information or identity documents in a public profile or an ordinary support message. If a verification step requires sensitive documentation, use only the designated process we provide. If you provide information about another person, you are responsible for having a lawful basis to do so and for informing them where required.

Information collected when you use Pickie

Our systems may record device and browser type, operating system, IP address, approximate location derived from technical signals, language preferences, timestamps, pages viewed, clicks, referral pages, session events and error reports. We use these records to deliver the Service, understand what works, secure accounts, diagnose failures and improve the experience. We may use cookies, local storage or similar technologies for sign-in, preferences, performance measurement and link attribution, as described later in this policy.

When someone opens an affiliate or storefront link, our systems and partners may record the link identifier, referring creator, campaign or product, click time, device or browser information and events needed to determine whether a resulting transaction is eligible. A merchant or partner may later report an order identifier, amount, status, return or cancellation and commission information. The creator workspace may show aggregated or transaction-level performance information, subject to the controls and data made available by partners.

We may generate analytics from activity on the Service, such as counts of visits, product interest, campaign progress and payout status. Aggregated or de-identified information that can no longer reasonably identify a person may be used to understand trends and improve the Service, subject to applicable law. We do not treat a label such as 'anonymous' as a substitute for actually reducing the ability to identify someone.

Information from other sources

Brands, merchants, affiliate networks and payment providers may give us product details, campaign data, conversion reports, return or cancellation information, settlement confirmations and payment status. Where you connect or share a social profile, we may receive public profile information or data you authorise through that service. We may also receive a report from another user about content, impersonation, rights or account misuse.

We may obtain information from identity or fraud-prevention services where needed to verify eligibility, protect the Service or comply with law. We use information from another source only for a purpose related to the Service and in a manner permitted by applicable law and the source's terms. If a source report is incomplete or contested, we may ask for more information before acting on it.

Why we use personal data

We use personal data to create and secure accounts, authenticate sign-ins, show and edit storefronts, generate links, deliver catalog and campaign features, attribute eligible activity, calculate and reconcile commissions, enable withdrawals and provide records such as invoices or payout history. We also use it to answer requests, investigate problems, keep services available, prevent fraud, enforce our terms and comply with legal obligations.

We may use relevant account and usage information to personalise product discovery, recommend campaigns or improve navigation and performance. We may measure how features are used and test changes to make the Service clearer and more useful. Where permitted, we may send product updates, educational content or marketing about Pickie. Operational messages about security, account status, campaign work and payouts may be sent even if you opt out of optional marketing.

We may use information to establish, exercise or defend legal claims, respond to lawful requests and preserve evidence of a dispute. We do not sell your personal data as a standalone product. If we propose a new use materially different from those described here, we will provide an appropriate notice and seek consent where law requires it.

• Account and storefront operation, including identity, preferences and public profile display
• Affiliate link tracking, order validation, campaign administration and creator reporting
• Payment processing, tax documentation, accounting and transaction reconciliation
• Support, safety, fraud prevention, security and enforcement of platform rules
• Service improvement, measurement and optional communications where permitted

Consent and other grounds for processing

We process personal data where it is necessary to provide a service you request, where you give valid consent, where applicable law permits a legitimate use, or where processing is needed to comply with a legal obligation. The specific ground depends on the information and purpose. For example, an email address is needed to operate an account, while an optional marketing message may depend on your communication choice and applicable rules.

Where we rely on consent, you may withdraw it through an available setting or by writing to hello@woohl.com. Withdrawal does not affect processing that was lawful before the withdrawal. It may also mean that a feature requiring that data can no longer be provided. We will explain practical consequences where relevant, such as an inability to make a payout without required payment details.

We seek to give clear notices at the point where information is requested. If a feature requires information beyond what this policy reasonably describes, we will explain its purpose and any choices in that feature. We do not infer consent to unrelated uses merely because you created an account.

Public profiles and creator content

The name or handle you choose for your storefront, profile image, bio, social links, selected products, collections and content you publish may be visible to anyone with access to the storefront and may appear in search results or be shared by others. A public post may remain in a search cache or a third-party copy after you remove it from Pickie. Consider this when choosing what to publish.

Campaign deliverables may be shared with the relevant brand and, if you post them on a social platform, with that platform's audience. The rights and visibility of campaign content also depend on the campaign brief and any separate agreement. We may display creator names, public handles and approved content to explain or promote the relevant storefront, product or campaign, subject to the permission you have granted and applicable law.

Private account records, bank or UPI details, verification information and support correspondence are not intended for public storefront display. If you believe private information has accidentally become visible, contact us promptly so we can investigate and limit exposure where possible.

Affiliate tracking and transaction data

Affiliate attribution connects a shared link to later activity that meets a partner's conditions. To do this, we and participating partners may use link identifiers, cookies or similar signals, event timestamps, product and order references and conversion reports. A partner may report whether an order was completed, returned, cancelled or otherwise ineligible. We use this information to present performance, resolve disputes and calculate commission.

The information displayed to a creator is generally about link performance and eligible transactions, not a complete profile of a purchaser. Some merchant or campaign arrangements may provide additional transaction details needed for support or reconciliation; we limit access to people and systems with a relevant need. We do not authorise creators to use any purchaser information for unrelated marketing or contact.

Tracking is affected by browser and device settings, consent choices, network interruptions and partner rules. You may decline optional cookies where a choice is offered, but essential features and attribution can be affected by technical restrictions. A missing tracked event cannot always be reconstructed from a later statement by a user or creator.

Verification, payouts and financial records

For eligible creator withdrawals, we may collect account holder name, bank account or UPI details, tax identifiers or documents, and information needed to verify identity and comply with payment rules. Authorised payment providers and banking partners may receive the details needed to process a transfer. We use transaction records to reconcile balances, investigate failed transfers, issue documents and meet tax or accounting requirements.

We do not ask you to place payment credentials in a public profile. Access to sensitive payment and verification data is restricted according to function. A payment provider may apply its own security controls, record retention and privacy notice. If a payment fails or is disputed, we may need to keep relevant records until the matter is resolved and required reporting periods end.

Purchases made through a merchant checkout are generally handled by that merchant and its payment provider. Their collection of a customer's card or payment credentials is governed by their own notices. Pickie may receive limited order and conversion information for attribution without receiving full card details.

Cookies and similar technologies

Cookies, browser storage and similar technologies can remember a login, maintain security, retain settings, measure performance and connect a referral to an eligible order. Some are essential for the requested Service; others may support analytics or marketing depending on the feature, partner and consent choices available in your browser or on the site. Third-party destinations may set their own cookies under their own policies.

You can usually manage or delete cookies in your browser settings and may also use device privacy controls. Blocking essential storage can sign you out or prevent parts of the Service from working. Blocking attribution technologies may cause a purchase not to be credited to a creator. We aim to keep any optional choices clear and honour them as required by applicable law.

Our use of analytics is intended to understand how pages and features perform, rather than to reveal a visitor's identity to a creator. We review the categories of technologies used as integrations change and may update this policy or present a more specific notice where appropriate.

Who receives personal data

We share personal data only where it is relevant to a stated purpose, a lawful request or a service you choose to use. Recipients can include hosting and infrastructure providers, analytics and security vendors, communications tools, identity and fraud-prevention providers, payment processors, banks, tax or accounting advisers, merchants, affiliate networks and brands involved in a relevant campaign. These recipients receive data appropriate to their role, not unrestricted access to the full account.

A brand may receive creator application details, public profile information, campaign submissions, performance reports and information needed to administer its campaign. A merchant or affiliate partner may receive link and attribution data needed to identify eligible orders. A payment provider receives data required to process a requested transfer. We may share information with professional advisers or authorities where required by law, needed to protect rights or necessary to investigate serious misuse.

If our business is reorganised, invested in, sold or transferred, information relevant to the Service may be reviewed or transferred under appropriate confidentiality and legal safeguards. We will continue to protect personal data during that process and give a notice if a transfer materially changes who controls it or how it is used, as required by law.

Storage and transfers across borders

Pickie is operated from India, but the technology providers, brands, merchants or users involved in a service may be located in other countries. This means personal data may be stored or accessed outside your location. We use contractual, organisational and technical measures appropriate to the data and the recipient, and we assess applicable restrictions before making a transfer.

Cross-border data rules can change and may differ by category of data. Where a transfer is restricted, we will use a permitted route or adjust the feature. A third-party site you choose to visit may independently transfer information under its own policy; this statement does not cover its decisions.

How long we keep information

We keep personal data for as long as needed to provide the relevant feature and for a reasonable period afterward to complete settlement, handle questions, enforce our terms, prevent fraud, maintain security and comply with tax, accounting or other legal duties. Different records have different lifetimes. For example, a storefront draft may be removed sooner than a completed payout ledger or a record of a disputed transaction.

When an account is closed, we may remove or de-identify profile and content data that is no longer needed while retaining transaction and compliance records for the applicable period. Backups may take additional time to cycle out and are protected while retained. Public content copied or cached by another party may remain outside our control even after we remove it from our own systems.

We review retention needs and seek to delete or de-identify information when the purpose ends and no legal or legitimate retention reason remains. If you ask for deletion, we will explain any data that must be kept and why, to the extent we can do so without disclosing sensitive security information.

How we protect data

We use administrative, technical and organisational safeguards intended to protect personal data against unauthorised access, loss, misuse and alteration. Measures may include access controls, authentication, encrypted transport, monitoring, backups, staff or contractor access limits and incident response processes. We review controls as the Service and risks change. No online service can guarantee absolute security.

You can help protect your account by using a strong, unique password, keeping devices updated, avoiding shared credentials and checking the destination before entering information. If you believe an account has been compromised or you see a vulnerability or accidental disclosure, email hello@woohl.com promptly with enough detail for us to investigate. Do not publicly disclose another person's data while reporting an issue.

If a personal data incident occurs, we will investigate, contain it where possible and provide notifications required by applicable law. The timing and content of a notice depend on the facts available and the legal requirements that apply at the time.

Your choices and privacy requests

You may edit many account and storefront fields in the creator workspace. You can remove products and collections, change public profile information, manage available notifications and request help with information that cannot be changed directly. You may ask us for access to or a summary of personal data we hold, correction of inaccurate or incomplete information, erasure where applicable, or information about how we have handled a request, subject to the rights and exceptions under applicable law.

You may withdraw consent where processing depends on consent. You may also request account closure and nominate someone to exercise rights where a law gives you that option. To make a request, write to hello@woohl.com from the email associated with your account if possible, describe the data or action concerned and include enough information for verification. Please do not attach an identity document unless we ask for it through an appropriate channel.

We may ask for additional information to confirm identity, prevent unauthorised disclosure or understand the request. We will respond within the period required by applicable law, or otherwise within a reasonable period, and will explain if an exception applies. You may raise a grievance with us through the same address and use any further remedy available under applicable law.

Children and age limits

Creator accounts are intended for adults aged 18 or over. We do not knowingly invite children to create creator accounts or provide payment and verification details. If you believe a child has created an account or submitted personal data through the Service, contact hello@woohl.com so we can review the situation and take appropriate steps.

A storefront may be accessible on the open web, so a younger person might encounter public content or a link. If we introduce a feature intended for children or a use that requires parental consent, we will provide a specific notice and controls before using data for that feature. We do not knowingly use children's personal data for targeted advertising in connection with the creator account Service.

Messages and marketing preferences

We send emails or in-product messages about sign-in, security, account changes, campaign activity, commission status, payouts and support because those messages are connected to the Service you use. We may also send optional news, tips, product information or opportunities where permitted. An optional message should provide a way to stop receiving that category, or you can ask us at hello@woohl.com.

Changing a marketing preference does not stop transaction or security messages needed for the account. A brand may contact you directly under its own relationship with you if you have separately given it your information or accepted a campaign. Its messages are governed by that relationship and its privacy notice.

Changes to this policy

We may update this policy when our features, providers or legal obligations change. The effective date at the top of the page identifies the current version. If a change materially affects how existing personal data is handled, we will provide an appropriate notice through the Service or by email where practical and seek consent where required.

We encourage you to revisit the policy when using new features. An updated policy does not by itself authorise a use of data for which law requires a fresh notice or consent. Earlier versions may be available from us on reasonable request where needed to understand a past use.