Version 1.1 · Last Updated: August 2026

SpillBill ("SpillBill", "we", "our", or "us") operates a market research and survey platform that connects organisations ("Clients") with individuals ("Participants") to gather opinions, insights, and data. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you access or use our website, applications, surveys, and related services (collectively, the "Services").

By registering for or using SpillBill, you acknowledge that you have read and understood this Policy. If you do not agree, do not use the Services.

1. Information We Collect

1.1 Account and Profile Information

When you create an account we collect:

• Full name or username
• Phone number
• Email address
• Date of birth
• Gender
• Occupation
• Household income bracket

Demographic information is collected to match you with relevant surveys. You may update this information at any time via your account settings.

1.2 Survey and Research Data

When you participate in a survey we record your answers and responses to survey questions, along with associated participation metadata such as timing.

1.3 Anonymous Survey Participants

If you participate via a public survey link without logging in, we do not collect your name, phone number, or email. We do store a session identifier to prevent duplicate submissions. This identifier cannot be used to identify you personally and is not linked to any account.

1.4 Identity Verification Data

To unlock rewards, some users undergo identity verification. This process is handled by a regulated third-party verification provider. We store only the outcome of the verification and do not retain any underlying identification documents or biometric data.

1.5 Payment and Incentive Data

To disburse earned rewards, we collect the payment details you provide. Full payment processing is handled by a regulated payment service provider. We retain records of reward amounts and transaction references for accounting and dispute resolution.

1.6 Automatically Collected Information

When you use our Services we may automatically collect:

• IP address and approximate location
• Device and browser information
• Session and usage information
• Diagnostic information

1.7 Communications

If you contact us for support, we retain the content of that communication and your contact details to respond and improve our Services.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Match you with surveys you are eligible for
• Deliver the survey experience
• Process and disburse incentive payments
• Generate anonymised research insights and analytics for Clients
• Detect and prevent fraud, abuse, and duplicate submissions
• Monitor and improve platform performance
• Comply with applicable legal and regulatory requirements
• Send transactional communications
• Improve and develop our platform and services

We do not use your personal information for behavioural advertising or sell it to advertising networks.

2.1 What We Collect and Why

The table below states the specific purpose for each category of personal data we collect. We collect only what is necessary for these purposes.

3. Automated Processing

SpillBill uses automated systems as part of delivering its Services. These systems are used to:

• Facilitate survey conversations and interpret your responses
• Assess the completeness and quality of submitted answers
• Personalise and adapt questions during a survey session
• Translate survey content into supported languages on request
• Evaluate completed surveys for research quality purposes
• Support internal quality-control and platform improvement activities

Automated processing is used to facilitate the research process and improve service quality. It is not used to make decisions that have legal or similarly significant effects on you. Your eligibility for any survey is determined by the research criteria set by our Clients, not by automated scoring alone.

Where automated processing involves third-party service providers, we maintain agreements with those providers that restrict how your data may be used.

4. Legal Basis for Processing

Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we process your personal data only on a lawful basis. For SpillBill that basis is one of:

• Your consent (Section 6): the primary basis for our processing — creating and running your account, matching and delivering surveys, generating research insights, sending transactional communications, and detecting fraud and duplicate participation. You may withdraw your consent at any time (see Section 9).
• Certain legitimate uses (Section 7): where the DPDP Act permits processing without separate consent — in particular, personal data you voluntarily provide for a specified purpose and to which you have not indicated you do not consent, and processing necessary to comply with a legal obligation or a lawful order under Indian law.

We do not rely on a “legitimate interests” balancing test, as the DPDP Act does not provide for one. The table below maps each processing purpose to its basis.

5. How We Share Your Information

5.1 Research Clients

Survey responses are shared with the Client that commissioned the survey. Clients receive response data in aggregated or de-identified form unless your participation was conducted under a named-respondent research engagement with explicit prior disclosure. Clients are contractually prohibited from re-identifying you or using your data for purposes outside the research engagement.

5.2 Service Providers

We engage third-party providers under data processing agreements to support the delivery of our Services, including infrastructure, payments, identity verification, communications, and platform operations. These providers may only process your data as instructed by us and may not use it for their own purposes.

5.3 Legal Requirements

We may disclose information if required by applicable law, court order, government authority, or where necessary to protect the rights, property, or safety of SpillBill, our users, or the public.

5.4 Business Transfers

If SpillBill is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different Privacy Policy.

5.5 We Do Not Sell Your Data

SpillBill does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes.

6. Data Retention

We retain your information for as long as necessary to deliver the Services and meet our legal obligations. In general:

• Account information is retained while your account is active and for a reasonable period after closure, unless you request earlier deletion
• Survey responses are retained for research and compliance purposes and are deleted or anonymised once no longer required
• Payment records are retained as required by applicable financial regulations
• Verification status is retained for the duration of your account
• Session and participation identifiers are retained only as long as needed for the purpose they were collected

When retention periods expire, data is permanently deleted or irreversibly anonymised.

7. Cookies and Similar Technologies

We use cookies and similar technologies to maintain your session and enable core platform functionality. We do not use advertising or cross-site tracking cookies.

Session cookies are deleted when you close your browser. Persistent cookies used to keep you signed in expire after a set period of time.

You can manage or delete cookies through your browser settings. Disabling certain cookies may affect your ability to use the platform.

We may use analytics tools to understand how the platform is used in aggregate. This data does not identify you personally.

8. Security

We implement reasonable administrative, technical, and organisational safeguards to protect your information, including:

• Encryption of data in transit
• Encryption of sensitive stored data
• Access controls limiting who within our organisation can access personal data
• Secure hosted infrastructure with monitoring controls
• Access management and session controls
• Regular security reviews

No system can guarantee absolute security. If you believe your account has been compromised, contact us immediately at the address below.

9. Your Rights and Choices

Subject to applicable law, you have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request erasure of your personal information, subject to legal retention requirements.
• Portability: receive your data in a structured, commonly used format.
• Nomination: nominate another individual to exercise your rights on your behalf in the event of your death or incapacity (Section 14 of the DPDP Act).
• Withdrawal of consent: where processing is based on consent, withdraw it at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, or to raise a grievance, contact our Grievance Officer at the address in Section 14. We will respond within the period prescribed under applicable law and, in any case, within 30 days. We may need to verify your identity before processing your request.

Complaint to the Data Protection Board of India. If you are a user in India and are not satisfied with how we have handled your grievance, you have the right to lodge a complaint with the Data Protection Board of India established under the Digital Personal Data Protection Act, 2023. You must first raise your grievance with our Grievance Officer before approaching the Board. Details of the Board and its complaint process are published by the Government of India.

10. Children's Privacy

SpillBill is strictly for users aged 18 and above. Under the Digital Personal Data Protection Act, 2023, a "child" is any individual under 18 years of age. We do not knowingly collect or process the personal data of children, and we do not offer a parental-consent path — registration requires a date of birth confirming you are 18 or older, and accounts that do not meet this age requirement are refused.

Consistent with Section 9 of the DPDP Act, we do not undertake behavioural tracking or monitoring of children, and we do not direct advertising at children.

If you believe a person under 18 has provided us with personal information, contact us and we will delete that information promptly.

11. International Data Transfers

To operate SpillBill we rely on service providers located outside India, so your personal data may be stored and processed abroad. Under Section 16 of the Digital Personal Data Protection Act, 2023, such transfers are permitted except to any country or territory that the Central Government restricts by notification. We monitor such notifications and will re-region data if and as required.

Our principal processors and where they operate:

• Supabase — database and file storage
• Anthropic (Claude) — AI processing of survey answers (United States)
• Google (Gemini) — voice-survey processing (United States / global)
• Railway — backend hosting (United States)
• Vercel — frontend hosting (global edge / United States)

Each processor is engaged under a data-processing agreement requiring appropriate security and confidentiality. Where a sectoral law imposes stricter transfer rules, we follow that stricter law.

12. Third-Party Services and Links

Our platform may contain links to or integrations with third-party services. SpillBill is not responsible for the privacy practices, content, or policies of third-party providers. We encourage you to review the privacy policies of any third-party service you access.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our Services, legal requirements, or business practices. Material changes will be communicated to registered users before they take effect. The updated policy will always be accessible on our platform with a revised "Last Updated" date.

Your continued use of the Services after the effective date of any update constitutes acceptance of the revised Policy.

14. Contact Us & Grievance Officer

For privacy inquiries, to exercise your data rights, or to raise a grievance, contact our Grievance Officer:

This notice is available in English. On request to the Grievance Officer, we will provide it in any language specified in the Eighth Schedule to the Constitution of India.