Privacy Policy

01Who we are

Kreati is a marketplace where brands find creators, agree the terms of a collaboration, and manage the work. We run Kreati and are responsible for the personal data described here.

This policy covers the Kreati website and everything you do once signed in. It sits alongside our Terms of Service.

02What we collect

Your account

• Your name, email address and whether you are a creator or a brand.
• Your password, stored only as a one-way hash. If you sign in with Google, we receive your name, email address and profile photo from Google instead.
• Two-factor authentication settings, if you turn it on.
• Your email notification preferences.

Your profile

• Creators: handle, bio, niche, location, phone number, profile photo, media kit, portfolio, packages and prices, the platforms you work on, and your follower and engagement figures.
• Brands: brand name, logo, industry, description, website and phone number.

Connected social accounts

If you are a creator and connect Instagram, YouTube or TikTok, we receive read-only access and store your username, display name, profile link, profile picture, follower count, and an engagement rate we calculate from your recent posts or videos. We also keep the access tokens the platform gives us, encrypted, so the numbers can be refreshed. If you have not uploaded a photo, or you choose to, your profile picture from a connected account is shown as your Kreati profile photo. We never post, comment or message on your behalf.

What you do on Kreati

• Campaigns you publish, and the applications you send or receive.
• Collaboration agreements, including every earlier version of the terms, so both sides can see what was agreed and when.
• Deliverables you submit, and for 30 days after one is approved, the views and likes of the published post, so the brand can see the results.
• Messages, reviews, saved campaigns, disputes, reports and support tickets.
• Profile and campaign views and likes. We record which account viewed or liked something so each person is only counted once.

Newsletter

If you sign up for the newsletter, we keep your email address, where you signed up and when. We first email you a link to confirm it's your address, and send newsletters only once you have. Every newsletter has a link to unsubscribe. You don't need an account to sign up, and signing up doesn't create one.

Technical data

• A record of each successful sign-in: time, method, IP address, and the browser, operating system and device type read from your browser.
• When you were last active, used for online status and to avoid emailing you while you are on the site.
• Error reports when something breaks. These are sent without IP addresses, cookies or other personal details attached by default.

03How we use it

• To run your account and show your profile, campaigns and messages to the people they are meant for.
• To show verified numbers. Follower and engagement figures from connected accounts are refreshed about once a day, and stop counting as verified if they have not refreshed in 30 days.
• To send you emails you have not turned off: unread messages that have waited at least 15 minutes, deliverable deadline reminders, and updates on applications, agreements and disputes. Security emails, such as password resets, are always sent.
• To keep people safe. Messages are checked automatically for common scam patterns, such as requests to pay outside Kreati, to move the chat to another app, or shortened links. A match shows a warning to the recipient and never blocks the message. If one sender triggers many warnings, a report is created for a moderator to review.
• To settle disputes. When a dispute is raised, we save a copy of the agreement, the deliverable and the recent chat so a moderator can decide fairly.
• To spot suspicious sign-ins, investigate abuse, and enforce our Terms.
• To fix bugs and understand which parts of Kreati are used, in aggregate.

04What other people can see

Creator and brand profiles are public by default, like a professional profile on LinkedIn. Anyone can view them without an account, and search engines can list them. A public profile shows your name, handle or brand name, photo or logo, bio, niche, location, platforms, verified numbers, reviews, and view and like counts.

Creators can hide their profile from search engines and signed-out visitors at any time under Settings. Signed-in brands can still find you, because that is how campaigns get filled.

Phone numbers are never shown publicly. A creator's phone number is visible only to that creator and to Kreati moderators.

Messages are visible to the two people in the conversation, and to moderators when a chat is reported or a dispute is raised.

05Who we share it with

We do not sell your personal data, and we do not share it with advertisers. We use a small number of service providers to run Kreati. Each only gets what it needs to do its job:

• MongoDB Atlas stores our database.
• Vercel and Railway host the website and the server behind it.
• Cloudinary stores the photos, logos, media kits and files you upload.
• Resend delivers our emails.
• Sentry receives error reports.
• Google handles sign-in if you choose “Continue with Google”.
• ipapi.co turns an IP address into an approximate city and country, for Kreati staff accounts only, to flag unusual sign-ins. It is not used for creator or brand accounts.
• Instagram, YouTube and TikTok receive requests from us only when you connect an account, to read the data described above.

We may also disclose information if the law requires it, to protect someone from harm, or as part of a sale or merger of Kreati, in which case this policy would continue to apply to your data.

06Google, YouTube, Instagram and TikTok data

Kreati uses the YouTube API Services to read your channel details and video statistics when you connect YouTube. By connecting, you agree to be bound by the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy.

Kreati's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to show your verified numbers and campaign results on Kreati. We do not use it for advertising, do not sell it, and do not let people read it except where you have made it visible on your profile.

The same applies to Instagram and TikTok: we request read-only access, use the data only to show your numbers and results on Kreati, and follow the Meta Platform Terms and the TikTok Terms of Service.

Removing access

Disconnect a platform from your creator profile at any time. We delete the stored account, its numbers and its tokens straight away, and ask the platform to revoke our access. You can also remove access from the platform itself, for Google through your Google Account permissions page.

07How long we keep it

We keep your data while your account is open. When you delete your account:

• Deletion is scheduled for 14 days later. Sign back in and cancel during that time if you change your mind.
• After that, we permanently delete your login, sessions, password and two-factor settings, your profile details, photos, media kit and portfolio, your connected social accounts and their tokens, saved campaigns, support tickets, notifications, sign-in history, and any newsletter signup under the same email.
• Some records other people rely on are kept but anonymized, shown as “Deleted creator” or “Deleted brand”: messages you sent, reviews, accepted collaborations, and a brand's campaigns, which are closed. Pending applications are withdrawn.
• Reports about unsafe chats are kept as safety records.

Campaign results are only collected for 30 days after a deliverable is approved. Error reports are kept by Sentry for a limited period and then deleted. A newsletter signup is kept until you unsubscribe; after that we keep only a note that you unsubscribed, so you aren't emailed again by mistake.

08Your choices and rights

From your account you can, at any time:

• Edit or remove anything on your profile.
• Hide your creator profile from search engines and signed-out visitors.
• Turn email notifications off by category.
• Unsubscribe from the newsletter with the link in any newsletter email.
• Disconnect Instagram, YouTube or TikTok.
• Download a copy of your data as a file, from Settings.
• Delete your account, also from Settings.

Depending on where you live, you may also have the right to object to or restrict how we use your data, or to complain to your local data protection authority. Email support@kreati.app for anything you cannot do yourself and we will respond within 30 days.

09Cookies

Kreati uses only the cookies it needs to keep you signed in. The session cookie lasts up to 7 days and is renewed while you use the site. Signing out removes it.

We do not use advertising cookies, tracking pixels or third-party analytics cookies, so there is no cookie banner to click through. If you accept an invitation to become a moderator, the invitation is held in your browser's local storage until you finish signing up.

10Security

All traffic to Kreati is encrypted in transit. Passwords are hashed, social account tokens are encrypted at rest, and you can turn on two-factor authentication. Staff access to accounts is logged. No system is perfectly secure, so if we learn of a breach that affects your data, we will tell you and the relevant authorities as the law requires.

11Age

Kreati is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, email us and we will delete it.

12Where your data is processed

Our service providers may store and process data in countries other than yours, including the United States. Where the law requires it, we rely on safeguards such as standard contractual clauses for these transfers.

13Changes to this policy

When we change this policy, we update the date at the top of the page. If a change affects how we use data you have already given us, we will tell you by email or in the app before it takes effect.