Privacy Policy

Last updated: 15 October 2026

This policy covers The Creator Collab, an invite-only pilot for content creators: the waitlist on this site; the app at app.thecreatorcollab.com, where creators find brands, manage outreach, build a media kit and message brands; the media kits and Atlas pages creators publish; and the optional YouTube, Instagram, Facebook and TikTok connections. It explains what we collect, why, who else handles it, and what your rights are.

1. Who we are

The data controller is Spijker Dienstverlening (trading as The Creator Collab), a business registered in the Netherlands with the Dutch Chamber of Commerce (KVK) under number 96035250, located at Sibeliusstraat 12, Leiden, the Netherlands.

For anything privacy-related, email hello@thecreatorcollab.com. We have not appointed a data protection officer, as our processing does not require one.

2. What we collect

What we hold depends on how you use The Creator Collab:

• Creator waitlist: email address, biggest platform, follower range, and — optionally — your handle and content niche.
• Brand waitlist: company, business type, and email address.
• Your account: your email address and password (stored only as a secure hash), or, if you continue with Google, the name, email address and profile picture Google shares with us. Brand accounts also hold the company name, address, phone number, website and contact person.
• How you joined: if you join, or sign up for the waitlist, through an invite, campaign or ambassador link, we store which link you used, to measure which channels work and to credit referrals (Article 6(1)(f) GDPR — our legitimate interest).
• Days you use the app: we record on which days you use the app (the date only, nothing about what you did) to see whether people keep using it, and keep it until you delete your account (Article 6(1)(f) GDPR — our legitimate interest). We also count how often each campaign link (/join?c=…) is opened — a number per link, nothing about who opened it.
• What you add in the app: your media kit (name, handle, bio, niche, photos, rates, past collaborations), the platform figures you enter or sync (section 3), your trips, the brands and leads you save, drafts and templates, deals, and feedback you send us, including any screenshot you attach.
• Brand scans: the brief you give a scan and the brands it returns, including business contact details from public sources, such as an address on the brand's website (section 4).
• Media-kit contact form & in-app messages: every published media kit has a contact form. If you contact a creator through it or message them in the app, we process your name, company, email address and the content of your messages, so the conversation can be delivered and continued. Messages arrive in the creator's inbox in the app, and the creator gets a notice at their account's email address; creators have no separate contact address.
• Offers, shared figures and work examples in a conversation: besides text, a creator can send a brand an offer: a title, line items with prices, the total, whether VAT is included, excluded or not charged, an optional note, how long it is valid and the service-fee percentage the brand would pay on top. We keep each version of an offer and its status (sent, changes requested, accepted, declined, withdrawn, expired or replaced by a new version), with the brand's change request if there is one, and we record who accepted it and when. An accepted offer creates a deal in the creator's deal register. A creator can also share a dated snapshot of their verified platform figures, or a work example: a past collaboration from their own media kit with the verified figures of the posts linked to it (section 3). The email that tells a brand about a new offer shows its title, prices and validity.
• Payments: when you buy scan credits or pay for a pilot subscription, Stripe handles the payment. We store what you bought, your credit balance and Stripe's references to the payment and invoice. Stripe collects your card and billing details; we never see your full card number. If you connect a payout account to receive payments from brands, Stripe verifies you and pays out; we store the account reference and its status.
• Usage records: how many scans and AI requests your account used, and when, to apply the limits in our terms and to track our costs.

We also see cookieless, aggregated visit statistics for this site (for example how many people viewed a page). These cannot identify you.

Atlas — places a creator saves. A creator can build a travel log: the places they stayed, with coordinates and dates, and per place their tips (a hotel, a restaurant, an activity) with an optional note, price, photos, video and booking link. Coordinates come from a place the creator picks from a search list, or from the photos they import. This is location data about the creator, entered by the creator.

We do not collect location data about visitors, or any cross-site tracking data.

3. Connected social platforms

In the app, a creator can optionally connect a YouTube account (via Google sign-in), an Instagram professional account (via Instagram Login) a Facebook Page they manage (via Facebook Login for Business) or a TikTok account (via Login Kit for TikTok), so their profile and media kit fill themselves. Connecting is never required — every number can also be entered by hand — and each connection stands on its own. We do not connect to any other platform; figures for those are entered by the creator.

Read-only, always. All four connections are read-only by design. We cannot post, comment, message, advertise, or change or delete anything on your account. We never see or store your password on any platform: you authorise access on the platform's own screen, and you can withdraw it there or with us.

How we store it. Data from a connected account is stored in our database (Supabase, Frankfurt, Germany). Within the app, only you can read it; our administrator can access it where needed to support you or to run the service. The sign-in tokens are stored with additional access controls that make them unreadable from the app itself; only our server-side functions use them, solely to fetch the data described below.

Images. The image addresses these platforms hand us expire, so when you import a post or video into your media kit we save a copy of its image in our own media storage. Section 3d explains who can open those copies and how they are deleted.

Publishing is manual. Nothing from a connected account appears on your public media kit until you publish it yourself (section 3d).

Figures you share in a conversation. In a conversation with a brand, a creator can share a snapshot of the figures a connected platform reported (username, followers, average views, engagement rate and, if they choose, the top audience country), or a work example with the verified figures of the posts linked to a past collaboration. Only that one brand, in that one conversation, can see it. It is a copy of the verified figures at the moment of sharing, shown with that date, not a live view, and it does not update. The figures in it are deleted no later than 30 days after sharing, and earlier when you disconnect that platform or use any of the deletion routes in section 3e; the message stays in the conversation without them.

How long we keep it. Access tokens are kept while a connection is active and deleted when you disconnect in the app. For Instagram and Facebook they are also deleted when Meta notifies us that you removed our access, for TikTok when TikTok notifies us of the same, and for every platform when we next find that a token no longer works. What else goes differs per platform. Disconnecting YouTube, revoking our access in your Google Account, or 30 days in which we cannot refresh your YouTube figures deletes the YouTube data listed in section 3a, also from your published media kit. Disconnecting Instagram, removing our app in Instagram, or a deletion request through Meta deletes the Instagram data listed in section 3b, also from your published media kit; the same three routes delete the Facebook data listed in section 3c. Disconnecting TikTok, or removing our app in TikTok, deletes the TikTok data listed in section 3h, also from your published media kit. Section 3e lists every route.

What we never do with it. We do not sell, rent or license it. We do not share it with advertisers, and we do not use it for advertising or targeting. We do not use it to train AI models. We do not use it to build profiles or databases about anyone beyond the media kit you build yourself and, if you switch it on, the marketplace listing you set up yourself (section 3f). We never contact brands with it: your figures reach a brand only through your media kit, a pitch you send yourself (by email, or on the marketplace — section 3g), a snapshot you share yourself in a conversation with one brand (see above), or a listing you switched on — and in a listing they appear as a range, without your name or username, until you accept an introduction — unless you choose to show your full media kit yourself (section 3f). YouTube, Instagram, Facebook and TikTok data are never sent to an AI provider (sections 3a, 3b, 3c and 3h).

Legal basis: Article 6(1)(b) GDPR — performing the service you asked for. You start each connection yourself and can end it at any time. Audience statistics are aggregated percentages about your followers or viewers as a group; we receive no data that identifies an individual follower or viewer.

3a. YouTube & Google user data

What we access. When you connect YouTube, you grant us read-only access. We retrieve your channel name and ID, subscriber count, view and video counts, a list of your uploads (titles, thumbnails, view counts, publish dates) and, from YouTube Analytics, 28-day totals (views, watch time, likes, comments, shares, subscribers gained) and aggregated audience statistics (age groups, gender split, top countries). We show these figures as YouTube reports them; we do not calculate our own metrics from them, such as averages or engagement rates.

How we use it. To show your channel figures and audience statistics on your Profile and, once you publish, on your media kit (section 3d), and to let you pick videos to feature on your media kit. If your pitch uses the follower, platform or audience placeholders, your figures also fill those in the pitch drafts you review and send yourself from your own email program; we never send them for you. YouTube data is not shared with AI providers or advertisers, and brand scans and brand research leave it out entirely, whether synced or entered by hand (section 4).

Keeping it current. While you stay connected, we refresh your YouTube figures automatically about once a month, also when you don't open the app. If that fails for 30 days — for example because your access expired — we stop showing them and delete them, as when you disconnect (below). Connect again to bring them back.

Disconnecting and deletion. You can disconnect at any time on your Profile in the app. We then revoke our access with Google and delete, for your account: the stored tokens; your YouTube statistics, including figures you entered by hand for YouTube, audience data and analytics; from your media kit, including the published page: the YouTube figures, the videos you imported and their thumbnails, any other YouTube tile that links to youtube.com, and a persona line made from your YouTube statistics; and the connection itself. You can also revoke access yourself at myaccount.google.com/permissions: we delete the same data as soon as the app next tries to use that access and finds it gone. Deleting your account deletes it too.

Platform terms. The YouTube connection uses YouTube API Services. By connecting, you also agree to the YouTube Terms of Service; Google's handling of your data is described in the Google Privacy Policy. Our use of data received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

3b. Instagram

What we access. When you connect an Instagram professional (Business or Creator) account, you grant us two read-only permissions through the Instagram API with Instagram Login: instagram_business_basic and instagram_business_manage_insights. With them we read from Meta:

• Profile: your Instagram user ID, username and follower count. Meta's response also includes your number of posts and the address of your profile picture; we do not store or use either.
• Posts: your most recent posts (up to 25; stories are skipped) with the image or video thumbnail, caption, link to the post, publish time, and like and comment counts, so you can choose posts for your media kit. For the posts you import we keep a copy of the image, the first 140 characters of the caption, the like count and the link.
• Post insights: views, likes, comments, saves and shares on your 12 most recent posts. We store these per post, without captions or links, and calculate your average views and engagement rate from them.
• Account insights, last 28 days: reach, views, accounts engaged and total interactions.
• Follower demographics: aggregated age ranges, gender split and countries of your followers. Meta only releases these for accounts with 100 or more followers; below that we receive nothing.

We do not receive your password, your email address or your direct messages from Meta.

How we use it. To show your figures and posts on your Profile and, once you publish, on your media kit (section 3d). If your pitch uses the follower, platform, engagement or audience placeholders, your figures also fill those in the pitch drafts you review and send yourself from your own email program; we never send them for you. Instagram data is not shared with AI providers or advertisers, and brand scans and brand research leave it out entirely (section 4).

Disconnecting and deletion. Three routes delete exactly the same data:

• Disconnect on your Profile. Instagram gives apps no way to withdraw a permission on your behalf, so to remove it at Instagram as well, go to Settings, then Website permissions, then Apps and websites (instagram.com/accounts/manage_access).
• Removing The Creator Collab in Instagram, under Apps and websites. Meta notifies us automatically.
• A deletion request through your Facebook or Instagram settings. You also get a confirmation code and a status link (section 3e).

Each route deletes, for your account:

• the connection record, with the access token and the Instagram account IDs we stored;
• your Instagram statistics: username, follower count, average views and engagement rate, post insights, 28-day account insights and follower demographics, including Instagram figures you entered by hand;
• the Instagram figures on your media kit, and in a persona you started with Start from my stats from your Instagram figures, the line saying who they are (the persona's name and description stay);
• the posts you imported from Instagram, with the copies we made of their images, and any other Instagram post in your media kit that links to instagram.com.

This includes your published media kit: the page stops showing these straight away. What stays: your other platforms and the rest of your media kit. Pitch drafts fill in your figures each time you open them, so Instagram figures drop out of them too; text you typed into a draft yourself stays, as do emails you already sent. If a step fails, we keep the connection record without its access token, so that pressing Disconnect again, or a later notice or request from Meta, can still match it to you and finish the deletion.

Platform terms. By connecting, you also agree to the Instagram Terms of Use; Meta's handling of your data is described in the Meta Privacy Policy.

3c. Facebook Pages

What we access. When you connect Facebook, you grant us two read-only permissions through Facebook Login for Business: pages_show_list and pages_read_engagement. With them we read from Meta:

• The Pages you manage: their names, Page IDs, usernames, follower counts and links, so you can choose which Page your media kit uses. Meta also hands us an access token per Page and the address of each Page's picture; the tokens are used server-side to read the Page you chose, and we store neither of them. Of the list itself we store only the Page you choose.
• That Page: its name, username, Page ID, link and follower count.
• Engagement on its recent posts: for the twelve most recent posts, how many reactions, comments and shares each one has. We store the averages across those posts and how many we counted — not the posts themselves. Meta's response also includes each post's text, image address and link; we use only the counts and store none of the rest. We never receive who reacted or commented.

We do not receive your password or your email address, and we do not read messages, comments, advertising data, or anything from your personal Facebook profile beyond the account ID Meta gives our app. We deliberately do not ask for read_insights, so your Page's reach and impressions stay out of our reach as well.

How we use it. To show which Pages you manage while you pick one, and to put that Page's name, follower count and average engagement on your Profile and, once you publish, on your media kit (section 3d). If your pitch uses the follower, platform or engagement placeholders, these figures also fill those in the pitch drafts you review and send yourself from your own email program; we never send them for you. Facebook data is not shared with AI providers or advertisers, and brand scans and brand research leave it out entirely (section 4).

Disconnecting and deletion. Three routes delete exactly the same data: Disconnect on your Profile, removing The Creator Collab in your Facebook settings under Business integrations (facebook.com/settings?tab=business_tools), and a deletion request through your Facebook settings, which also gives you a confirmation code and a status link (section 3e). Each route deletes, for your account:

• the connection record, with the access token and the Facebook account and Page IDs we stored;
• your Facebook statistics: Page name, follower count, average engagement per post and engagement rate, including Facebook figures you entered by hand;
• the Facebook figures on your media kit, including your published page, which stops showing them straight away.

What stays: your other platforms and the rest of your media kit. Pitch drafts fill in your figures each time you open them, so Facebook figures drop out of them too; text you typed into a draft yourself stays, as do emails you already sent. Removing Facebook does not remove a connected Instagram account, or the other way round — they are separate connections, and you end each one yourself. If a step fails, we keep the connection record without its access token, so that pressing Disconnect again, or a later notice or request from Meta, can still match it to you and finish the deletion.

Platform terms. By connecting, you also agree to the Facebook Terms of Service; Meta's handling of your data is described in the Meta Privacy Policy.

3d. Your public media kit

Your media kit is a page at app.thecreatorcollab.com/k/<your-address> that you share with brands. You choose the address, and you decide when it goes public.

Publishing. A new kit is set to public, but nothing appears on it until you publish it yourself: with Save & publish on the Media kit tab, or with Turn on next to a pitch draft, which puts the kit online as you last saved it. Save & publish shows the kit as it is at that moment. Figures from a connected platform are shown as that platform last reported them, marked as verified, and update on your published page without publishing again. Figures you enter yourself are frozen when you publish and marked “Self-reported”. You can hide sections, such as Performance, before you publish.

Who can see it. Anyone with the link, without an account. We do not ask search engines to skip the page, so it can be indexed once the link appears somewhere public — for example when you post it. Others can copy or archive what they see.

Contact form. Every published kit has a contact form. Messages from it arrive in your inbox in the app, and we send a notice to your account's email address. There is no separate contact address.

What can appear from YouTube. Your channel name and a link to your channel; your subscriber count; your 28-day views, likes, comments, shares and subscribers gained, each as YouTube reports it (the Performance section); your viewers' age groups, gender split and top countries, the countries as a ranking without percentages (the Audience section, off until you switch it on or choose the Travel creator template); a persona line we suggest from those statistics, if you add it to your personas; and the videos you imported, each with its thumbnail, title, view count and a link to the video. Your subscriber count is not added to the followers of your other platforms. While you stay connected we refresh your YouTube figures automatically about once a month, also when you don't open the app; if that fails for 30 days we stop showing them and delete them, as when you disconnect. Disconnecting YouTube takes all of this off the page (section 3a).

What can appear from Instagram. Your username and a link to your profile; your follower count, average views and engagement rate; your 28-day reach, views, accounts engaged and total interactions (the Performance section); your follower demographics (the Audience section, off until you switch it on or choose the Travel creator template); a persona line we suggest from those demographics, if you add it to your personas; and the posts you imported, each with its image, caption, like count and a link to the post. Your Instagram user ID and per-post insights never appear on the page. Disconnecting Instagram takes all of this off the page (section 3b).

What can appear from Facebook. Your Page's name and a link to it, its follower count and the average engagement on its recent posts. Disconnecting Facebook takes those off the page (section 3c).

What can appear from TikTok. Your username, your follower count, and the videos you imported, each with its cover image, title, view count and a link to the video. Your TikTok user ID never appears on the page. Disconnecting TikTok takes all of this off the page (section 3h).

Posts linked to a collaboration. If you link one of your own posts to a past collaboration, we show that post's figures on your media kit, including the published page, exactly as the platform reports them. While you stay connected we refresh them when you open your media kit in the app, at most once a day; YouTube figures that have not been refreshed for 30 days are deleted. We delete them when you remove the post from the collaboration or disconnect that platform.

Images. The images in your kit — the ones you upload and the copies we make of imported posts — are stored from the moment they are added, also before you publish. Anyone with an image's address can open it, without an account; the storage can't be browsed or listed. Removing an image from your kit takes it off the page but does not delete the stored file; email us and we delete the files. Disconnecting Instagram, removing our app in Instagram, a deletion request through Meta, or deleting your account deletes the copies of your Instagram posts automatically (section 3b); disconnecting TikTok, removing our app in TikTok, or deleting your account does the same for the copies of your TikTok covers (section 3h).

Taking it offline. On the Media kit tab, open the Live button, switch off Public page and save: the page goes offline immediately. Deleting your account does the same. What others saved or archived in the meantime is outside our control.

Legal basis: Article 6(1)(b) GDPR — publishing is the service you ask for, and you do it yourself.

3e. Asking us to delete your data

Three routes, all of which reach us. You do not have to give a reason, and the last two work without logging in.

• In the app. On your Profile, remove a platform's figures with the X next to it, or disconnect a platform: for Instagram that deletes all the data listed in section 3b, for a Facebook Page section 3c, for YouTube section 3a, for TikTok section 3h. Under Settings (for brand accounts: on the company profile) you can delete your account entirely: that removes your profile and statistics, your connections and their tokens, your media kit (the public page goes offline immediately), your messages, trips, leads, deals and scan history, and the copies we made of your Instagram posts, YouTube thumbnails and TikTok covers. It does not delete the photos and videos you uploaded to our media storage (section 3d), including Atlas photos, or screenshots you attached to feedback; email us and we delete those too.
• Through your Facebook or Instagram settings. Remove The Creator Collab under Apps and websites (Instagram) or Business integrations (Facebook) and ask there for your data to be deleted. Both reach us automatically, and each deletes the same data as a Disconnect for that platform — Instagram as in section 3b, a Facebook Page as in section 3c — also from your published media kit. For the deletion request you are given a confirmation code and a link where you can check the status without logging in; if removing the app had already deleted everything, that page says the deletion is completed. If you disconnected that platform in the app before, the request finds no connection to match, because the Disconnect already deleted that data. If anything from Instagram or Facebook still shows on your profile or media kit, email us and we delete it.
• Email us. hello@thecreatorcollab.com, from any address, naming the account concerned. Use this if you cannot log in, if you never had an account with us, or if you want published figures or stored images removed as well.

The deletion log. We record every deletion request we receive and every notice from Meta that our app was removed: the confirmation code, which platform it concerned, that platform's account ID, and what we did. That record is what makes the status link work, and it is how we can show a regulator that a request was honoured. We keep it for twelve months and it is never readable from the app.

What stays. Data we are legally required to keep — invoices, for the seven years Dutch tax law prescribes — and aggregated statistics that can no longer be traced back to you. Stripe keeps its own payment records under its own obligations. Anything others copied or archived from a media kit while it was public is outside our control. If we cannot honour a request in full, we tell you which part we kept and why.

We complete deletion requests within one month, as Article 12(3) GDPR requires, and in practice much sooner. This is your right to erasure under Article 17 GDPR; the same address serves the other rights in section 8.

3f. Your marketplace listing

The marketplace is a place where brands with an account on our platform can search for creators who are open to working with them. You are not in it unless you switch it on yourself, on the Marketplace tab. It is off for every account until you turn it on.

Turning it on. You pick what you are open to (content for a brand's own channels, a gifted product or service, a paid promotion), at least one niche, and you tick a box confirming we may show your profile to brands. We record the moment you ticked it, so we can show when you agreed. The switch stays locked until you have done all three.

What a brand can see before you agree to anything. The first name you type in yourself (leave it empty and brands see no name at all), your profile photo, the one line you wrote, your niches, the country you chose, the languages you work in, a range for your followers and for your engagement rate (never the exact figures), which platforms you are on, your audience countries, ages and gender if you have that section switched on in your media kit, and whether you have a published media kit. If your media kit is published, a brand can also open a profile page with what is on that kit — your bio and tags, your audience personas, your featured work and the results of past collaborations — but without your name, your usernames, any links, your rates or the names of the brands you worked with. Those are stripped before anything leaves the database.

What a brand cannot see. Your full name, your username on any platform, any link to your accounts, your media kit address, your email address, your exact follower count, and which brands you have worked with. Those stay private. Your full name and media kit address become visible to one brand only if you accept that brand's request for an introduction.

Showing your full media kit. On the Marketplace tab you can also choose to show brands your full media kit before they ask — exactly the public page, your name, usernames and links included. This is off unless you switch it on, it only works while your media kit is published, and you can switch it off again at any time.

Where the figures come from. The ranges are worked out, each time a brand searches, from the figures already on your profile. For a connected platform they come from the figures that platform last reported; ranges from figures you entered yourself are marked self-reported. We do not keep a separate copy. Disconnecting a platform removes its figures here at the same moment it removes them from your media kit (sections 3b and 3c).

Brands cannot message you. They can only ask us for an introduction, with a message explaining what they have in mind. The request sits on your Marketplace tab until you accept or decline it. Nothing is opened, and no conversation exists, until you accept. We never send a message to a brand on your behalf, and we never give a brand a way to reach you that you did not agree to.

Switching it off. One switch on the Marketplace tab. You disappear from the marketplace immediately, and nothing else about your account changes. Requests you already accepted stay as conversations, as any conversation does.

Legal basis: Article 6(1)(a) GDPR — your consent. You give it with that one tick, it is not bundled with anything else, and you can withdraw it at any time by switching the listing off, without that affecting your account, your media kit or anything you pay for.

3g. Pitching a brand on the marketplace

Brands with an account can choose to hear from creators: they can post a brief (what they want to achieve, the kind of collaboration, a budget range, niche, country, reach and period) or open up to pitches. By default a brand receives nothing. If you have a listing switched on and a published media kit, you can respond to a brief or pitch an open brand yourself. We never send a pitch for you, and a brand never gets a way to reach you that you did not start.

What you see of a brand. Its company name, its website and its brief. Never its address, phone number or contact person.

What the brand sees of you. Exactly the marketplace card (section 3f): the first name you typed in, your photo, your one line, your niches, your country and your ranges — plus your pitch. Your full name and your media kit address become visible to that brand only if it accepts your pitch; then a conversation opens, with your pitch as its first message. A brand that passes sees nothing more, and you can pitch it again after 90 days.

Limits. One open pitch per brand, a daily limit on pitches, and a brief takes a fixed number of responses. We keep your pitch, its status and the dates with both you and the brand, as we do with introduction requests (section 7).

Legal basis: Article 6(1)(b) GDPR — performing the service you asked for by sending the pitch. The brand's brief is the brand's own request to be found, stored under the same basis.

3h. TikTok

What we access. When you connect TikTok, you grant us read-only access through TikTok's Login Kit and Display API. We retrieve your TikTok user ID (open_id), avatar, display name, username, bio and whether your account is verified; your follower, following, total like and video counts (TikTok counts public videos only); and a list of your public videos, with each video's title, cover image, share link, view, like, comment and share counts and its publish date. TikTok gives us no audience statistics, and we do not ask for them. When you import a video into your media kit, we save a copy of its cover image in our own media storage, because the cover address TikTok hands us expires after a few hours (section 3d).

How we use it. To show your TikTok figures on your Profile and, once you publish, on your media kit (section 3d), and to let you pick videos to feature on your media kit. If your pitch uses the follower or platform placeholders, your figures also fill those in the pitch drafts you review and send yourself from your own email program; we never send them for you. TikTok data is not shared with AI providers or advertisers, and brand scans and brand research leave it out entirely (section 4).

Disconnecting and deletion. You can disconnect at any time on your Profile in the app. We then revoke our access with TikTok and delete, for your account: the stored tokens; your TikTok statistics, including figures you entered by hand for TikTok; on your media kit, also the published page, the TikTok figures, the videos you imported and the copies of their covers, and any other TikTok tile that links to tiktok.com; and the connection itself. You can also remove The Creator Collab in your TikTok settings, where TikTok lists the apps you gave access: TikTok then notifies us, and we delete the same data. Deleting your account deletes it too.

Platform terms. The TikTok connection uses TikTok for Developers products and is governed by the TikTok Developer Terms of Service; TikTok's handling of your data is described in TikTok's Privacy Policy. The Creator Collab is not affiliated with or endorsed by TikTok.

Legal basis: Article 6(1)(b) GDPR — performing the service you asked for. You start the connection yourself and can end it at any time.

4. Why we collect it & legal basis

• Managing the waitlist and sending pilot invites. Legal basis: Article 6(1)(b) GDPR — taking steps prior to a contract at your request.
• Selecting the pilot group based on platform, follower range and niche, so the first cohort is a workable mix. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in running a small, balanced pilot. Platform and follower range are required to join; your handle and niche are optional — leaving those empty still keeps you on the waitlist.

Invite emails are the service you signed up for, not marketing. We only send a newsletter or other marketing if you separately opt in (Article 6(1)(a) GDPR — consent), and you can withdraw that consent at any time.

• Running the pilot app and delivering messages. When you contact a creator or exchange messages, we deliver and — because people use the app occasionally rather than all day — email you a notification that a new message or inquiry is waiting (never the text of a message; an offer notification shows the offer's title, prices and validity, so you can decide whether to open it). Legal basis: Article 6(1)(b) GDPR (performing the service) and 6(1)(f) GDPR — our legitimate interest in reliably delivering conversations.
• Fetching statistics from a connected social account (section 3). This only happens after you connect the account yourself, and only to fill your own profile and media kit, and the follower, platform, engagement and audience placeholders in pitch drafts that you review and send yourself. Legal basis: Article 6(1)(b) GDPR — performing the service you asked for.
• Brand scans and brand research. When you run a scan or research a brand, we send our AI provider, Anthropic, what it needs to find, rank and research brands for you: the name, handle, tagline and niche from your media kit, your follower counts and the audience statistics of your largest platform, and public information about the brands, such as their website text, photos and recent news; for a scan also the scan brief (destination, type of business, your instructions) and the brands in your deal register. YouTube, Instagram, Facebook and TikTok data are never included: scans and research leave out every YouTube, Instagram, Facebook and TikTok figure, whether synced or entered by hand. To find candidate brands and news about them we also send search terms to Serper, a search service: terms built from your brief and media kit (destination, type of business, your niche and part of your instructions) and brand names. Business contact details come from the brand's own website or, when it lists none, from Hunter, a business-email lookup service. Everything a scan or research returns is a suggestion for you to check. Legal basis: Article 6(1)(b) GDPR — performing the service you asked for; for brands' business contact details, Article 6(1)(f) — our legitimate interest in helping creators reach businesses through publicly available business contact details.
• Payments and invoices. Processing your purchase and keeping the invoice. Legal basis: Article 6(1)(b) GDPR, and 6(1)(c) — our legal obligation to keep invoices.
• Usage limits. Counting scans and AI requests per account, to apply the limits in our terms. Legal basis: Article 6(1)(b) GDPR.

5. Who we share it with

We do not sell your data and we do not share it with advertisers. What you send in a conversation — messages, offers and your answers to them, shared figures and work examples — is seen by the other party in that conversation, and only by them. We use these service providers (processors):

• Supabase — database, login, file storage and server-side functions, hosted in Frankfurt, Germany. Of the providers in this list, only Supabase receives Instagram or Facebook data.
• Vercel — website and app hosting, and cookieless analytics.
• Resend (EU region) — delivers our transactional email: invites, password resets, and new-message, new-inquiry and offer notifications.
• Hostinger — hosts our hello@thecreatorcollab.com mailbox, which receives the emails you send us (including removal and rights requests).
• Stripe — payments for scan credits and pilot subscriptions, their invoices, and payouts to creators who connect a payout account.
• Anthropic (United States) — the AI model behind brand scans and brand research. It receives the data described in section 4, never YouTube, Instagram, Facebook or TikTok data, and does not use it to train its models.
• Serper — search results for brand scans and brand research. It receives search terms only, never account details.
• Hunter — business-email lookup when we look for a brand's contact details. It receives brands' web addresses only.

5b. Public Atlas pages

A creator can publish a trip. It then gets a public page at /a/<handle>, or an unlisted page at a link containing a random token. The page shows their name, handle and avatar, a world map of the places, and per place their tips: title, note, price, photos or video, a booking link where there is one, and the required disclosure whenever a partnership or a commission sits behind it. Nothing appears that the creator did not enter, and any tip can be kept off the page individually.

Who can see it. Anyone, without an account. Search engines can index a public page, and others can copy or archive it. A trip with future dates also shows where the creator will be, and when. A creator who does not want that keeps the trip as a draft, or publishes it after the trip.

Undoing it. Setting a trip back to draft, or deleting it, takes the page offline immediately. What others saved or archived in the meantime is outside our control.

Photos. A photo is stored as the camera wrote it, including the data inside the file — capture time, often the exact GPS location, and the camera model. Anyone who downloads the file can read that. Uploaded files are stored from the moment they are uploaded, including while the trip is still a draft: anyone with a file's address can open it, without an account; the storage can't be browsed or listed. If people are recognisable in a photo, it is for the creator to judge whether they may publish it; if you are in one and want it removed, email us.

Legal basis: Article 6(1)(b) GDPR — publishing is the service the creator asks for and switches on themselves.

5c. Parties your browser contacts directly

Some parties receive nothing from us, but are contacted by your browser because we placed their content on the page. They see your IP address, and handle it under their own terms. We have no data processing agreement with them.

• OpenFreeMap (Hyperknot Software Kft., Hungary, delivered over Cloudflare) — the map imagery on Atlas pages. They see your IP address, which part of the map you are looking at, and the page you came from. No cookie is set and there is no tracking. Their policy states they do not log IP addresses by default. If the map fails, the page falls back to a simple map with no third party involved; the list of places stays either way. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in showing a working map.
• Counting on Atlas pages — public Atlas pages keep day-level counters: how often a page or trip was viewed and how often a booking link was clicked. Counters only — no IP address, no device details, no visitor identifier, no cookie. A creator can share the counters of one collaboration with the brand that paid for it through the platform; the brand then sees those aggregate numbers for that campaign, never anything about individual visitors.
• Komoot GmbH (Germany), through its Photon place search — used in three moments. When a creator types a place name, and when they import photos: photos are read on the creator's own device and are not uploaded for this; to find a place name we send one coordinate per group of photos, rounded to roughly 100 metres. And when a visitor searches the public Atlas for a place we have no entry for, we send that search text so the map can travel there anyway. In all three cases we send the text or coordinate and nothing else — no photo, no filename, no account detail, no visitor identifier, and no cookie.

5d. Media-kit signals

When a creator messages a brand through the app, the link to their media kit carries a marker unique to that recipient. If the link is opened, or a reply comes in through the contact form on that kit, we record that it happened and when — nothing more. No IP address, no browser details, no fingerprint, no cookie. Several opens within the same hour count as one. This lets the creator see whether their proposal was read. Legal basis: Article 6(1)(f) GDPR — following up on a proposal they sent themselves. If you are a recipient and would rather this were not recorded, email us.

6. International transfers

Our database and file storage are in the EU, in Frankfurt, Germany (eu-central-1); that is where data from connected YouTube, Instagram, Facebook and TikTok accounts is stored. Vercel and Anthropic are based in the United States, and Stripe belongs to a US group. Where data leaves the EU, it does so under the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

Map imagery and place-name lookups stay within the EU (Hungary and Germany respectively). Our typeface is served from our own servers, so no request goes to Google for it.

7. How long we keep it

We keep your waitlist entry until you accept an invite or ask to be removed — whichever comes first. If neither happens, we delete all waitlist data no later than 12 months after the waitlist closes.

Account data stays for as long as you have an account; deleting your account removes it, except the photos and videos you uploaded to our media storage (section 3d) and screenshots attached to feedback. Feedback is kept for twelve months. Access tokens for a connected platform are deleted when you disconnect in the app. YouTube data stays until you disconnect YouTube, revoke our access in your Google Account, or delete your account, or until we have been unable to refresh it for 30 days (section 3a). Instagram data stays until you disconnect Instagram, remove our app in Instagram, send a deletion request through Meta, or delete your account (sections 3b and 3e); Facebook Page data stays until you take one of the same three steps for Facebook, or delete your account (section 3c). TikTok data stays until you disconnect TikTok, remove our app in TikTok, or delete your account (section 3h). The deletion log is kept for twelve months, invoices for seven years.

A marketplace listing (section 3f) stays until you switch it off or delete your account; switching it off takes you out of the marketplace immediately, and we keep the record that you had consented, and when, for as long as you have an account. An introduction request stays with both the brand and the creator, so each side can see what was asked and when, and it is deleted when either of those accounts is deleted.

Offers, shared snapshots and work examples belong to the conversation they were sent in. They stay as long as that conversation does, and are deleted with it when either the creator's or the brand's account is deleted. The figures in a shared snapshot go earlier, after at most 30 days (section 3). A deal created by accepting an offer stays in the creator's own deal register until the creator deletes it or their account.

8. Your rights (GDPR)

You can ask us at any time to:

• access the data we hold about you;
• correct it (rectification);
• delete it (erasure);
• restrict how we use it;
• receive it in a portable format;
• object to processing based on legitimate interest (such as pilot-group selection);
• withdraw any consent you gave, such as a newsletter opt-in.

Email us at hello@thecreatorcollab.com — we respond within one month.

You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to your local EU supervisory authority.

9. Your rights — California & other regions

We do not sell or share your personal information with anyone, for any purpose, and we do not use it for targeted advertising.

Wherever you live, you have the same rights to know, access, delete and correct your data. Use the same address: hello@thecreatorcollab.com.

10. Cookies & analytics

This site does not use cookies or similar storage on your device. We measure visits with Vercel Web Analytics, a cookieless service: it counts page views using an anonymised, aggregated method, never stores anything in your browser, and cannot identify you. Because there is nothing to consent to, you won't see a cookie banner here. If we ever introduce cookies, we will ask for your consent first and update this policy.

11. Security

All traffic to and from this site and the app is encrypted (TLS/HTTPS). Your data is stored with Supabase behind row level security, so each account can read only its own records, apart from what you publish and — if you switched on a marketplace listing — the limited set of fields in section 3f. Images in your media kit and atlas are the exception: anyone with an image's address can open it without an account, though that storage can't be browsed or listed (sections 3d and 5b). Access tokens for connected platforms cannot be read from the app at all, only by our server-side functions. Waitlist entries can be submitted from this site but not read back through it. Access across accounts is limited to our administrator, the business owner, for support and to run the service.

12. Children

The Creator Collab is aimed at professional content creators and is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has joined the waitlist or created an account, email us and we will delete it.

13. Changes to this policy

The date at the top shows when this policy was last changed. If we make a material change, we email everyone on the waitlist and every account holder before it takes effect.

14. Contact

hello@thecreatorcollab.com
Sibeliusstraat 12, Leiden, the Netherlands