Privacy Policy

1. Scope

This Privacy Policy applies to information collected through:

• our public website and contact flows;
• our product and workspace experience;
• account registration, login, and authentication flows;
• support and other communications with us; and
• third-party integrations you choose to connect.

This Privacy Policy does not govern third-party websites, platforms, or services that we do not operate.

2. Information We Collect

We collect information in the following categories:

A. Account and organization information

• name and email address;
• login and authentication information;
• workspace, organization, client, brand, and agency information; and
• preferences and profile details you choose to provide.

B. Merchant and workspace data

When you use the product, we store information you or other authorized users submit into the workspace, including merchant, agency, brand, campaign, creator, contact, and workflow records.

• creator, contact, client, brand, and campaign records;
• deliverable, content, reporting, and workflow records;
• notes, statuses, approvals, links, and attachments; and
• email drafts, sent-message records, and related outreach metadata.

C. Creator data and campaign fulfillment data

Creators, brands, agencies, or authorized workspace users may provide names, email addresses, social handles, profile information, content submissions, shipping addresses, phone numbers, gifting selections, campaign statuses, and related workflow records.

Creator shipping information may be visible to the responsible brand, merchant, or agency and may be sent to fulfillment systems such as Shopify when a brand creates a draft order or coordinates product fulfillment.

D. Communications and support information

• demo requests, support requests, and feedback submissions;
• the contents of messages you send to us;
• files or screenshots you provide; and
• records of our communications with you.

E. Connected platform data and third-party API data

If you choose to connect third-party services, we receive and store only the information needed to provide the connected functionality you authorize.

• Google / Gmail data: when a workspace user connects Gmail, we receive Google account identity details such as account ID, email address, display name, granted scopes, and token metadata. We also process the recipients, subject lines, message bodies, and sending metadata for emails the user directs the product to send.
• YouTube data: when a creator connects YouTube, we may receive channel identity and profile information, channel metadata, content metadata, available performance metrics, and OAuth token and scope information needed to maintain the connection.
• Meta / Instagram / Facebook data: when a creator or authorized connected account is linked through Meta, we may receive account identifiers, usernames, display names, profile information, media metadata, captions, permalinks, timestamps, and available performance metrics where applicable to the connected workflow and granted permissions.
• TikTok data: when a creator connects TikTok, we may receive account identifiers, usernames, display names, avatar information, video metadata, video descriptions, share links, timestamps, and available performance metrics where applicable.
• Shopify data: when a brand or merchant connects Shopify, we may receive Shopify shop connection information, product catalog information, inventory information, order and fulfillment information, tracking or shipping status, and related operational data used for product gifting workflows.
• OAuth and connection data: for connected services, we may store connection status, timestamps, scopes, token expiry details, and related operational metadata.

We only receive connected-platform data when a user, creator, or organization chooses to connect an account and authorize access.

F. Technical and usage information

• IP address, browser type, device and operating system information;
• pages viewed and actions taken in the website or product;
• timestamps, logs, diagnostics, and error data; and
• basic analytics and performance information.

G. Cookies and similar technologies

We may use cookies or similar technologies to support security, login state, analytics, and site performance. You can usually control cookies through your browser settings.

3. How We Use Information

We may use information we collect to:

• provide, maintain, secure, and improve the website and product;
• create and manage accounts, organizations, and workspaces;
• authenticate users and control access;
• store, organize, display, and update workspace records;
• send user-directed outreach emails through a connected Gmail account;
• support connected-account, profile, content, and performance functionality;
• manage creator campaigns, content approvals, reporting, and product gifting;
• coordinate product selections, draft orders, fulfillment status, and shipments;
• troubleshoot issues, prevent abuse, and investigate fraud or security incidents;
• communicate with you about support, updates, and administrative matters; and
• comply with legal obligations and enforce our agreements.

4. Connected Platforms and Third-Party Services

Connected-platform data is used only to provide creator marketing workflows, send communications requested by users, manage creator campaigns, generate reports, support product gifting and fulfillment, maintain integrations, and troubleshoot issues.

We do not sell connected-platform data. We do not use connected-platform data for unrelated advertising, unrelated profiling, or unrelated retargeting.

A. Google / Gmail

Gmail access in the current product is used to support user-directed outreach sending. We do not request Gmail read access for this flow. Connected Gmail data is used to send messages the user composes or triggers through the product, store sending records, support delivery, maintain the connection, and troubleshoot delivery or auth issues.

The Creator Marketing App's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google, Gmail, or Google Workspace data for unrelated advertising, retargeting, sale, or generalized AI or machine learning model training.

Users may disconnect Google or Gmail integrations in the product where controls are available and may also revoke access through their Google account security settings.

B. YouTube

The Creator Marketing App uses YouTube API Services. By using YouTube-connected features, users are also subject to the YouTube Terms of Service and Google's Privacy Policy.

YouTube data may include connected channel identity, channel metadata, content metadata, and available performance metrics. We use YouTube data only for creator campaign, content, and reporting workflows. Users may revoke YouTube access through Google account security settings or disconnect controls where available in the product.

C. Meta / Instagram / Facebook

Meta, Instagram, and Facebook data may include account identifiers, usernames, profile information, media metadata, captions, permalinks, timestamps, and available performance metrics. We use this data only for connection, content, campaign, and reporting workflows.

D. TikTok

TikTok data may include account identifiers, usernames, profile information, video metadata, timestamps, share links, and available performance metrics. We use this data only for connection, content, campaign, and reporting workflows.

E. Shopify

Shopify is used for product gifting workflows, product selection, draft order creation, shipment coordination, fulfillment status, and support or troubleshooting. Shopify remains the source of truth for products, inventory, orders, and fulfillment where practical. The Creator Marketing App stores durable Shopify IDs and limited snapshots needed for campaign records and workflow visibility. We also keep access/action logs for relevant Shopify gifting and order workflows so workspace administrators can support compliance and audit needs.

F. Tokens, disconnects, and human access

We store OAuth tokens and related connection data in our systems using reasonable administrative and technical safeguards. Certain creator connected-account tokens are encrypted at rest. Tokens may be refreshed or replaced as needed to keep an authorized connection working, and they can be removed from active use when the connection is disconnected.

Access to connected-platform data is limited to authorized product functionality and limited human review for support, security, abuse prevention, or legal compliance needs.

5. Creator Data and Campaign Fulfillment

Creator information and campaign fulfillment data may be used for creator campaign management, user-directed communications, content approvals, performance reporting, product gifting, shipment coordination, support, and service records.

Creator shipping information may be visible to the responsible brand, merchant, or agency and may be sent to Shopify when a brand creates a draft order or coordinates product fulfillment.

6. How We Disclose Information

We may disclose information in the following circumstances:

A. Service providers and integration providers

We may share information with vendors and service providers that help us operate the website and product, including Supabase for database, authentication, and storage infrastructure; Netlify for hosting and server functions; Shopify for product gifting, draft orders, orders, fulfillment, and tracking; Google for Gmail, Google OAuth, and YouTube integrations; Meta for Facebook and Instagram integrations; and TikTok for TikTok integrations.

B. Within a workspace or organization

Information submitted to a workspace may be visible to authorized users in that workspace based on the product's access model and configuration.

C. Connected third-party services

When you choose to connect a third-party service, information may be exchanged with that service as necessary for the integration to function.

D. Legal and safety reasons

• to comply with applicable law, regulation, legal process, or governmental request;
• to protect the rights, property, or safety of The Creator Marketing App, our users, or others;
• to investigate fraud, abuse, or security issues; or
• to enforce our terms and other agreements.

E. Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be disclosed or transferred as part of that process, subject to applicable law.

7. Data Retention

We retain information for as long as reasonably necessary to:

• provide the product and related services;
• maintain campaign history, reporting records, and account administration records;
• maintain operational, business, and legal records;
• resolve disputes and enforce agreements;
• investigate security incidents or misuse; and
• meet legal, tax, accounting, compliance, support, or backup-retention needs.

Retention periods vary by data type and use case. We do not currently promise automatic deletion on a fixed schedule. Some information may remain in logs, archives, or backups for a limited period after deletion from active systems.

8. Data Security

We use reasonable administrative, technical, and organizational measures designed to help protect information against unauthorized access, loss, misuse, or alteration. No system is perfectly secure, and we cannot guarantee absolute security.

9. Your Choices

Depending on your relationship with us and applicable law, you may be able to:

• access, update, or correct certain account information;
• disconnect third-party integrations;
• request deletion of an account, workspace data, or connected-platform data;
• manage cookies through your browser settings; and
• opt out of non-essential communications using the unsubscribe mechanism where available.

Users may disconnect integrations in The Creator Marketing App where disconnect controls are available. Users may also revoke connected-platform access through the platform's own account or security settings, such as Google or YouTube account settings, Meta settings, TikTok settings, or Shopify app settings. Revocation or disconnect stops future authorized use for active workflows, but it does not automatically delete historical campaign records unless deletion is requested and deletion is not limited by legitimate retention needs.

For deletion and disconnect details, see our Data Deletion page.

10. California Notice

California residents may have privacy rights under California law depending on the nature of their relationship with us and our legal obligations. California users may contact us using the information below regarding privacy questions or requests.

11. Children's Privacy

The Creator Marketing App is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

12. Third-Party Services

Third-party platforms and APIs operate under their own terms, policies, and technical rules. Their practices are governed by their own policies, not this Privacy Policy.

13. International Use

The Creator Marketing App is based in the United States. If you use the service from another jurisdiction, you understand that your information may be processed in the United States and other locations where our service providers operate.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will revise the "Last updated" date and may provide additional notice where appropriate.

15. Contact Us

If you have questions about this Privacy Policy or want to submit a privacy or deletion request, contact:

The Creator Marketing App
support@creatormarketing.app