Privacy Policy.

FameX ("FameX", "we", "us") runs the FameX app and Tara, its AI coach. Under India's Digital Personal Data Protection Act, 2023 ("DPDP") we are the Data Fiduciary, and under the EU and UK General Data Protection Regulation ("GDPR") the controller, for the personal data described here. Our Grievance Officer is in section 15.

Under the DPDP Act a child is anyone under 18. Creators under 18 may use FameX's coach. When the date of birth you give says you are under 18, FameX asks you for a parent or lawful guardian (their name, email address and how they are related to you) and emails them a link. The page it opens explains what FameX holds and what you can and cannot do, and lets them confirm or refuse. Later, they can ask for a new link with the same email address to withdraw their consent.

For that decision we keep:

• the guardian's name, email address and relationship to you;
• their answer, when they gave it, which version of the notice they were shown, and a one-way hash of the network address it came from (not the address itself);
• when we emailed them, and a one-way hash of the network address each request to email them came from, so we can limit how many of these emails go out in a day;
• if the person at that address told us they are not your parent or guardian, when they did (nothing else is recorded about you in that case, and we ask you for the right address);
• the first date of birth you gave that said you are under 18. Changing your date of birth later does not lift the rules for under-18 accounts; you are treated as an adult when you turn 18 by that first date.

How we check, said plainly: we send the link only to the address you give, and a guardian who confirms, refuses or withdraws tells us they are 18 or older and your parent or lawful guardian. Someone the email reached by mistake can say they are not your parent or guardian without being shown your name. We do not check identity documents. India's Digital Personal Data Protection Rules, 2025 ask for checks that the parent is an identifiable adult; those rules come into force on 13 May 2027, and FameX will add such a check before then. From that date, FameX does nothing with an under-18 account beyond creating it until a guardian has confirmed.

If a guardian refuses or withdraws, Tara and every feature that would start new work on that account's data stop at once. A background job already running when they answer (such as reading a public profile) may finish; what it produced is deleted with the account. We tell the child, and the account is deleted 7 days later through the same deletion as section 11. The guardian's record and the account's sign-in record are deleted with it.

While a creator is under 18, nothing about them is public (section 4), brands cannot find them, and we never use their data for advertising or to target anything at them.

We collect what we need to give you your Digital Mirror, Tara's coaching and the tools you use:

• Account: an anonymous device identifier until you sign in; then your email address, a hashed password (or your Google sign-in, if you use it), and a display name if you give one. Your consent to FameX reading what you share, with the time you gave it.
• What you tell us at the start: your stage, city, date of birth, the categories you work in, your goal, and whether you already spend on ads. Each is optional except where a feature says it needs one.
• Connected social account (optional): if you connect one, we read only your own account data the platform's official API returns. Instagram, through Meta's official API, can provide your profile and recent-post signals. Reddit can provide the same where that connector is switched on. LinkedIn verifies identity only and does not give us your posts. TikTok is built but hidden for the India-first launch. FameX has no X/Twitter connector, and you cannot connect an X account. Where a platform reports metrics (followers, karma, reach, views, likes), we use only those reported numbers. Access tokens are stored encrypted. We never receive your social password.
• Public profile snapshot (optional): if you give us a handle and confirm the profile is yours or that you have permission to analyse it, we read what a logged-out visitor can see. For Instagram, our public-data provider, Apify, may return the profile details, public counts and recent public posts or reels. To describe who engages with you, it may also read a small, capped sample of the public accounts that commented on your recent posts (their comment, public bio, follower count and account type); we call that an engaged-audience sample, never your followers, and we never guess anyone's age or gender. For YouTube, we call Google's official YouTube Data API with your channel handle and read the channel's public statistics and its most recent public videos with the counts YouTube publishes; a hidden subscriber count stays blank rather than showing as zero. For Reddit, Threads and X, where switched on, Apify may return the public identity, counts and recent public text. None of these is an account connection, and none can see private insights such as reach, saves, shares, profile visits, watch time, impressions or audience demographics. Content behind a private profile stays unavailable. If a lookup fails you can type the visible numbers or upload screenshots; we label those values by where they came from.
• What you tell Tara: your chats, the text transcript of voice calls, your answers, the identity you are working toward and the commitments you make. We distil short "memories" from these so Tara remembers you.
• Your Mirror and your work: your Digital Mirror and gap analysis, weekly plans and calendar, the posts you mark as posted, a baseline of your own past performance (used only to show change against yourself), and your milestones.
• What you choose to make public: a Fame Profile, wins-stream cards, feed posts and comments, reviews and responses, and shareable cards (section 4).
• Brands and collabs: for a brand account, the business details and verification evidence the brand gives us and its team members. For a collab, the brief, messages, ratings, reviews and files either side uploads. Uploaded pictures are re-made from their pixels alone, so location, camera and other hidden data in the original file are not kept.
• Notifications: your choices, the email address we write to, and, if you turn on browser notifications, the push address your browser gives us.
• Product analytics: first-party usage events (such as which screens you opened and key actions). We strip raw performance numbers and long free text before storing them, and we use no third-party analytics, advertising pixels or tracking SDKs. We never use these events for advertising or to target anyone.
• Credits: your free monthly allowance and what used it. FameX takes no payments today, so we hold no card or bank details.

What we do not collect: your social passwords, card numbers, precise location or GPS, mobile advertising identifiers, or health data. We do not build biometric identifiers such as voiceprints or facial geometry: a voice call streams audio to our voice provider to transcribe and reply (section 6), and no recording or voiceprint is kept.

Nothing about you is public unless you are an adult and you choose it:

• A Fame Profile, only once you publish it, and only the parts you put on it.
• Wins-stream cards, only if you join the stream (off by default). Without a published profile a card says "a creator in your lane" and carries no name.
• Feed posts and comments you write, and reviews and responses after a collab.
• Being discoverable to brands, only if you switch it on; brands then see what you chose to show.
• A shareable card, only to people who have its unguessable link, until you delete it.

Never public: your chats and calls with Tara, your memories, your Mirror unless you publish it, your date of birth, your email address, your connected accounts, your analytics, and anything about an under-18 creator. A brand's rating of a creator is shown only to that creator.

• To build your Digital Mirror and the gap to the identity you want.
• To let Tara coach you and remember your journey between sessions.
• To save your progress so a dropped call or a closed tab does not lose your place.
• To show performance against your own past, never as an invented benchmark or a promise.
• To show what you chose to make public, and to let brands find you if you opted in.
• To send the emails and notifications you asked for, and the ones the service needs.
• To check public text before it is shown, and to handle reports and grievances.
• To operate, secure, debug and improve FameX, and to meet legal obligations.

Under the GDPR our legal bases are your consent (for the analysis and connected-account access), our contract with you (to run the service), and our legitimate interests (to keep it secure and working). Under DPDP we rely on the consent you give before any analysis begins and, for a child, the consent of their parent or guardian (section 2).

FameX's AI features use models from OpenAI, which processes data for us under contract. We send it the text a feature needs, such as your handle, bio, captions, and your answers to or conversations with Tara. OpenAI also turns some of that text into numeric embeddings so FameX can find similar journeys, and checks public text (posts, comments, reviews) before it is shown. FameX's code can be configured to use Anthropic or Google models instead; if we switch, we will update this page first.

If you choose screenshot reading, the images are sent to OpenAI to read the visible profile and content details that screen asks for. FameX does not deliberately store the uploaded images. Check what was read before you save it.

In a live voice call with Tara, your device streams your microphone audio directly to OpenAI, which replies in Tara's voice, using a short-lived token we issue. We keep the text transcript so Tara remembers the conversation; we do not store the audio. Voice calls are free.

When a brand renders a reel from its own approved script, the script and FameX's prompt for an original, fictional presenter are sent to our video provider, Runway, where that feature is switched on. No creator's face, voice or likeness is ever sent or generated. Every reel carries a visible "AI-generated" label.

FameX does not use your data to train AI models. OpenAI states that data sent to its API is not used to train its models unless the customer opts in to sharing it, and FameX's code makes no such request.

Runway is different. Its Terms of Use (last updated 15 September 2026, section 4.4) say that Runway may use what it receives and what it makes to train and improve its AI models. For a reel, that means the brand's script, FameX's prompt for the fictional presenter, and the reel itself. The studio says this beside the render control, before anything is sent.

The niche trends FameX shows come from content other people made public, read about a topic, never about you: YouTube's official Data API, a web search through OpenAI whose every citation our own code checks against the page it names, a search engine FameX runs itself, and FameX's own editorial library. Those searches use terms from a fixed list of niches, never your handle, your name or anything that identifies you, and the results are shared by everyone in a niche.

FameX does not run scrapers on Instagram, Threads, X, Reddit or the Meta Ad Library for trends. Those platforms forbid automated collection without their express written permission, which we do not have, so those sources are switched off in our code.

From creators' milestones we keep an anonymised corpus so we can show "others on a similar journey". A result holds only the shape of a journey (its theme, stage and arena), never another person's identity.

The creator–brand marketplace is opt-in and open only to adults. If you join, your lane and an identity-fit signal become discoverable, so brands find creators by fit rather than follower counts. Brands do not get your contact details or private data. You can leave at any time, and your listing goes when you delete your account. We will never sell your personal data or share it with advertisers.

We share data only with providers who process it for us under contract, and only as described:

• OpenAI: the AI processing and voice calls in section 6, and the trend web search in section 7.
• Apify: our public-data provider, only for your own or an authorised public profile (section 3), including the engaged-audience sample. We send the platform and the handle, and keep only a fixed list of fields from the answer. No password, login cookie or private-account access is ever supplied.
• Google — the YouTube Data API v3, called with the channel handle you give us (section 3), and for niche trends (section 7). Google also provides sign-in if you choose to sign in with Google.
• Meta (Instagram Graph API), Reddit, LinkedIn and TikTok, through their official APIs, for your own connected account. LinkedIn is verification-only; TikTok is hidden for the India-first launch. There is no X/Twitter connector.
• Our email provider (Resend, or our own mailbox's mail server), to send the emails you get from FameX, including the emails to a parent or guardian.
• Runway: brand reel rendering, where switched on. Its terms let it train its models on the script, the presenter prompt and the reel (section 6).
• Your browser's push service, if you turn on browser notifications, to deliver them.
• The hosting and infrastructure providers that run FameX's servers.
• Brands, only if you opt into the marketplace, and then only what you chose to show (section 8).

We may also disclose data where the law requires it or to protect people's rights and safety. We do not sell your data and we do not share it for advertising.

You can, at any time:

• see the personal data we hold about you and download a copy, under Account;
• correct what is wrong;
• delete your account and its data (section 11);
• withdraw consent: disconnect an account, leave the stream or the marketplace, or write to us;
• complain to us (section 15), to the Data Protection Board of India under DPDP, or to your local supervisory authority under the GDPR.

A parent or guardian who confirmed an under-18 account can withdraw that consent from the guardian page by asking for a new link with their email address.

• Disconnecting a social account removes our stored token, so we can no longer read or post to it. What we already built from it (such as your Mirror) stays until you delete it.
• Deleting your account erases the personal data we hold about you across our systems, including your profile, conversations, memories, plans, public posts and cards, uploads, connected-account tokens, guardian record and analytics events.

We keep your data until you delete your account, or until a withdrawal of consent means we must stop. Afterwards we keep only a minimal marker, with no personal data in it, where we need to show that a required deletion happened. We do not keep your consent record after your account is deleted.

• Public-profile lookups and their cache are removed after 24 hours by default.
• An uploaded file not attached to a message within 24 hours is deleted.
• An under-18 account whose guardian refused or withdrew is deleted 7 days after we tell the child, with its sign-in record (email address and password hash). If removing the sign-in record fails, a person at FameX is told and removes it by hand.
• Screenshots you upload for reading are processed for that request and not deliberately stored.

Data travels encrypted (HTTPS), connected-account tokens are encrypted at rest, and we keep audit trails of sensitive actions such as consents, guardian decisions and deletions. No system is perfectly secure, so we cannot promise absolute security, but we work to protect your data and to meet our obligations if anything goes wrong.

Some providers (such as OpenAI) may process data outside India or the EEA. Where they do, we rely on safeguards such as contractual protections. We may change this policy as FameX changes; we will update the effective date above and, for a significant change, take reasonable steps to tell you before it applies.

Our Grievance Officer is Samik Pandit, at grievance@famex.ai. Write there for any privacy question, to use a right in section 10, or to complain, or use our grievance page, which shows the current officer and how a complaint is handled. We acknowledge a complaint within 24 hours and aim to resolve it within 7 days.