Privacy Policy

1. Introduction and controller

This Privacy Policy describes how we ("we," "us," or the "platform operator") collect, use, store, and share personal information when you use our platform and related services (collectively, the Service), including the website, authenticated dashboard, and APIs. By using the Service, you acknowledge the practices in this policy. If you do not agree, do not use the Service.

The data controller is the organization operating the site you registered on. If we provide a separate legal entity or contact in settings or onboarding, that information controls who is responsible for your data in your region.

2. Information we collect

Depending on your role and how you use the Service, we may collect:

• Account and profile - e-mail address, password (hashed), role (for example brand or creator), display or company name, and profile fields you choose to provide (for example avatars, logos, phone number, or bio text) where the product offers them.
• Social account verification - the platform (for example TikTok, Instagram, or YouTube) you connect, identifiers we store to match your profile, and proof-of-control flows such as verification codes you place in a public bio, description, or similar location until verification completes.
• Campaign and application data - campaign configuration you create, creative instructions, applications, approval or rejection status, and internal notes required to operate the workflow.
• Submissions and public content links - URLs to public posts you submit, titles or metadata we or suppliers derive from them for display, validation, or fraud review, and review status and timestamps.
• View and performance metrics - counts and related data about public posts (for example view counts) obtained from the platforms or third-party data or API providers we use to query, import, or estimate metrics from links you or others supply. Such metrics may be delayed, restated, or estimated.
• Payout and financial contact data - information you provide to receive payouts, such as payment method details or tax identifiers, and records of requests, eligibility, and batching as processed in the product.
• Administration and security - audit and activity logs, moderation actions, support or abuse correspondence, and settings changed by you or by staff. We also collect technical and usage data (for example IP address, device and browser type, session identifiers, approximate location from IP, and timestamps) for security, debugging, and product improvement.

We do not require you to give us more than we need for a given feature; if you decline certain optional fields, some features (for example payouts or certain campaigns) may be unavailable.

3. How we use information

We use the information above to:

• create and manage accounts and sessions;
• operate the marketplace, campaigns, applications, and submissions end to end;
• fetch, display, and validate public post metrics in line with campaign rules and product logic;
• calculate balances, run fraud checks, process payout requests, and support finance and tax compliance;
• communicate with you about the Service, security, or legal matters;
• improve, secure, and debug the Service, including analytics in aggregated or de-identified form where possible; and
• comply with law and enforce our terms, including disputes and investigations.

4. Legal bases (EEA, UK, and similar)

If local law (for example the GDPR or UK GDPR) requires a "legal basis," we rely on one or more of the following as appropriate: performance of a contract with you, legitimate interests (for example security, product improvement, and fraud prevention-balanced against your rights), legal obligation, and, where we send optional marketing or use non-essential cookies that require it, consent. You may withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.

5. Sharing and disclosure

We may share information:

• With the other side of a campaign - for example, brands may see information about approved creators, submissions, and performance data needed to run a campaign; creators may see public campaign information and, where applicable, brand-facing labels or feedback visible in the product.
• With service providers under contracts - hosting, authentication, e-mail, logging, metrics and API vendors, payment or payout processors, and other subprocessors that help us deliver the Service. They may only use data to provide services to us, subject to agreements and applicable law.
• With professional advisers when needed (for example lawyers or auditors) under confidentiality obligations.
• When required by law or to protect rights, safety, and the Service - for example responding to lawful requests, enforcing our terms, or detecting and preventing harm or fraud.
• As part of a business transaction - in connection with a merger, sale, or financing, subject to appropriate confidentiality and, where required, user notice.

We do not sell your personal information in the common sense of selling lists for ad targeting. If we use advertising or cross-context tracking in the future, we will update this policy and, where the law (for example the CCPA/CPRA) requires, provide opt-out and category disclosures.

6. International transfers

We and our providers may process data in countries other than your own. Where we transfer personal data from the EEA, UK, or similar regions to countries without an adequacy decision, we will use appropriate safeguards (such as standard contractual clauses) where required by law.

7. Retention

We retain information as long as your account is active and for a period afterward as needed to resolve disputes, meet legal, tax, and accounting obligations, enforce our agreements, and for legitimate business operations (for example back-ups and security). Metrics, submissions, and audit data may be kept for the time needed to calculate or defend payouts, validate performance, and satisfy record-keeping rules, then deleted or de-identified according to our retention schedule. Exact periods may depend on configuration and local law.

8. Security

We implement appropriate technical and organizational measures designed to protect personal data. No transmission over the internet is completely secure, and you share information at your own risk except where the law imposes a non-waivable duty.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to certain processing, to port data, or to withdraw consent where we rely on consent. You may also lodge a complaint with a supervisory authority. To exercise these rights, contact us through the methods we provide. If you are in the United States, certain states may grant you additional rights; we will respond as required by applicable state law. We will verify your request in line with the law, which may require us to keep a minimal record of the request itself.

Browser signals. We describe choices for cookies and similar technology in any cookie notice we may publish; global privacy control signals are honored if and where the law says we must.

10. Children

The Service is not intended for children below the age at which they may lawfully use the product in their country (often under 16 or 13, depending on jurisdiction). We do not knowingly collect personal data from children in a way that violates the law. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

11. Third-party sites and social platforms

The Service links to or reflects content on social platforms. Your use of those services is also governed by their own terms and privacy policies. We do not control the platforms; they may process your public profile and post data independently. Limit what you post to what you are comfortable sharing publicly.

12. Changes and contact

We may update this Privacy Policy. We will post the new version on this page and change the "Last updated" date. Where the law requires, we will notify you in a more prominent way.

For privacy questions or to exercise your rights, contact us through the support or contact options on the site, or the operator address we publish in the product, if any.