This page is for anyone who wants Who's Paying to stop holding data about them — whether you asked us to scan you, someone else put your handle in, or your work email turned up in a report you never saw. You do not need a Who's Paying account, and if you have one you do not need to sign in. One email to raghav@ostryaai.com is enough.
Your rights under the DPDP Act
Abscissa AI LLP is the Data Fiduciary for Who's Paying. Under the Digital Personal Data Protection Act, 2023 you have the right to:
- A summary of processing — what personal data of yours we hold and what we did with it.
- Correction, completion and updating — if something we stored about you is wrong or out of date.
- Erasure — deletion of your personal data, unless a law requires us to keep it.
- Grievance redressal — a named human who must answer you, before you go anywhere else.
- Nomination — you may nominate someone to exercise these rights for you if you die or become incapable of doing it yourself. Send us the nominee's name and email.
The same Act asks you not to raise a false or frivolous grievance, and not to impersonate someone else.
How we check a request is genuine
We ask for the minimum needed to be sure we are removing the right person's data, and no more. For a handle, that is a DM to us from that account or a temporary line in your bio. For an email address, replying from that address. That is it.
We will never ask for your Instagram password, an OTP, a government ID number (Aadhaar, PAN or anything else), or for you to log in to Instagram through us. Who's Paying has never had an Instagram login. If anyone claiming to be us asks for those, it is not us.
If you ran a scan yourself
Email raghav@ostryaai.com with the subject My scan — summary / correction / erasure and tell us which of the three you want.
Include your Instagram handle, the email address on your account, and the scan ID if you have it (it is in the report URL). Any one of the three is enough — we will find the scans.
For a correction, say which fact in the report is wrong and what it should be. For erasure, say "erase everything" and we will clear the lot, as listed below.
If we scanned you and you never asked us to
This happens two ways: someone else typed your handle into Who's Paying — scanning is free, and although it needs a verified email, that email does not have to be yours — or you were named as a paid creator on an ad we read from the public Meta Ad Library.
You do not have to justify the request. Email raghav@ostryaai.com with the subject Remove my handle and the handle concerned. We will delete the creator record and everything attached to it, and add the handle to a block list so a future submission of it is refused instead of scanned. We apply the block by default — tell us if you want deletion only.
If your work email was returned as a brand contact
If your work address at a brand's domain was shown to a creator as a contact for that brand, email raghav@ostryaai.com from that address with the subject Remove my email — or from any address, if you name the one to remove.
We will delete the stored contact and suppress the address so a later lookup does not return it. Who's Paying never emails brand contacts itself — addresses are shown to a creator to use themselves — so we cannot recall a message a creator already sent you. Reply to that creator directly.
If a media kit uses your handle
Every published media kit carries a "Report this kit" link. Use it, or email raghav@ostryaai.com with the subject Media kit takedown and the kit's link. If the kit misrepresents you — for example, it was published for your account by someone who does not represent you — we take it down and it cannot be published again. The person who published it attested that they could; that attestation, with its date, is kept with the record of the takedown. We acknowledge within 24 hours and take a kit down within 72 hours, sooner where it plainly misrepresents you.
If you are a brand or advertiser
If you run ads in India and want to know how your public ad data is used, write to raghav@ostryaai.com with the subject Brand query and your advertiser page name. We will tell you what we hold about your ads, which creatives were read, and which reports referenced them.
Meta Ad Library data is public company data, not personal data, so there is no DPDP erasure right over it. Ask anyway and we will explain the use — and we will remove any employee contact email as described above.
How removal actually works, and how long it takes
One thing to be clear about: removal is carried out by hand by an operator today. There is no self-serve delete button in Who's Paying. Nothing on the site deletes your data — an email to the Grievance Officer does. The exception is media kits: you can unpublish a kit or delete your Insights screenshots yourself in the editor.
| Stage | Commitment |
|---|---|
| Acknowledgement | Within 24 hours of your email |
| Action completed | Within 15 days |
| Confirmation | An email to you, confirming what was deleted |
If we cannot match your request to a handle or address, we will write back with one specific question rather than sit on it.
Withdrawing consent
If you gave us your handle and change your mind, you can withdraw consent at any time by emailing raghav@ostryaai.com.
The consequence: a scan still in flight stops, and the report is not delivered. Withdrawal does not undo processing that already happened lawfully before it, but you can ask for erasure of the result in the same email — most people do both at once.
Erasure is not cancellation. If you have a paid subscription, asking us to erase your data does not by itself stop the recurring charge — that mandate sits with Razorpay and your bank. Say so in the same email and we will cancel it too, or revoke the mandate yourself in your bank or UPI app. What cancelling does, and what it does not refund, is set out in Refunds and Cancellations.
What erasure removes, and what we keep
| Removed | Kept, and why |
|---|---|
| Creator record, handle, follower and post counts | Provider spend, subscription and billing records — required for tax and accounting under Indian law |
| Stored posts: shortcode, type, play/like/comment counts, caption, tagged brands, paid-partnership flag, timestamp | A suppression record — the handle, or a hash of the email — kept precisely so we do not process you again |
| Reel transcripts and the facts derived from them | |
| Brand unlocks recorded against your account | |
| Generated reports and pitch drafts | |
Cached third-party provider responses in http_cache tied to your data | |
| Media kits, their published copies and every image stored for them | |
| Insights screenshots and the audience numbers read from them |
The suppression record exists only to enforce your own request. It is retained on a legitimate need basis, holds nothing else about you — no posts, no transcript, no report — and is used for nothing else.
Public sources are outside our control
Who's Paying reads data that is already public. Deleting it here deletes it here only. Nothing is removed from Instagram, from the Meta Ad Library, or from anywhere else on the internet, and we have no ability to reach into those services.
To take a post down from Instagram, or an ad out of the Meta Ad Library, you have to go to Meta — the Instagram app's reporting flow, or Meta's help centre. Who's Paying is not affiliated with, endorsed by, or partnered with Meta Platforms or Instagram, and cannot act for you there. See Data Sources for where each field comes from.
If you are not satisfied
If the Grievance Officer does not answer, or you are unhappy with the answer, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023. Please raise it with us first — the Act expects that, and we would rather fix it than argue about it.
Contact
Grievance Officer: Raghav Mandhana — raghav@ostryaai.com. Full entity details, phone number and postal address are on Contact and Grievance Officer.