Privacy Policy

Creatrbase ("we", "us", or "our") operates the Creatrbase platform, a creator analytics and brand partnership tool accessible at creatrbase.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. By using Creatrbase you agree to the practices described here.

1. Who we are

Creatrbase is a sole-trader business operating in the United Kingdom. Our data protection contact is privacy@creatrbase.com. We act as data controller for all personal data processed via this platform.

2. Legal basis for processing

We rely on the following legal bases under UK GDPR / GDPR:

• Contract performance (Art. 6(1)(b)): Providing your account, calculating brand-readiness scores, syncing platform metrics, and sending transactional emails. This processing is necessary to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, platform analytics, and improving the service. Our legitimate interests do not override your rights.
• Consent (Art. 6(1)(a)): Sending marketing emails and newsletters. You may withdraw consent at any time via the unsubscribe link in any email or by contacting us.
• Legal obligation (Art. 6(1)(c)): Complying with applicable law, including responding to lawful requests from authorities.

3. Information we collect

Account information: When you register, we collect your name, email address, and a hashed password (or your Google account identifier if you sign in with Google).

Platform data: When you connect a social media platform (YouTube, TikTok, Instagram, Twitch, or others we add over time), we request OAuth access to retrieve your channel or profile metrics such as subscriber or follower counts, view counts, video metadata, and engagement statistics. We only request the minimum permissions needed to provide the service.

Usage data: We automatically collect information about how you interact with the platform, including pages visited, features used, and timestamps. This is used to improve the service and is not sold.

Communications: If you contact us by email, we retain that correspondence to respond to your inquiry.

Newsletter subscription: If you subscribe to our newsletter, we record your email address, the date of subscription, and the segments you opted in to. We record explicit consent at the point of sign-up.

4. How we use your information

We use collected information to:

• Provide, operate, and maintain the Creatrbase platform
• Calculate brand-readiness scores and analytics based on your platform metrics
• Sync your platform data on a scheduled basis to keep insights current
• Send transactional emails (account confirmations, weekly digests, task reminders)
• Send marketing emails where you have given consent
• Diagnose technical issues and improve platform performance
• Comply with legal obligations

We do not use your data to train AI models for third parties, sell your data to advertisers, or share it with brands without your explicit action.

5. Platform integrations and third-party APIs

Creatrbase integrates with third-party platforms including Google (YouTube), TikTok, Meta (Instagram), and Twitch. By connecting a platform you authorise us to retrieve data via that platform's official API under their respective terms of service. The data we retrieve is stored securely and used solely to power your analytics dashboard.

Access tokens obtained during OAuth authorisation are encrypted at rest. We store refresh tokens where permitted by the platform in order to maintain continuous sync without requiring you to re-authorise frequently. You may revoke our access at any time by disconnecting the platform within Creatrbase or by revoking app permissions directly on the third-party platform.

6. Data sharing and disclosure

We do not sell, trade, or rent your personal information. We may share data only in the following circumstances:

• Service providers: We use infrastructure providers (hosting, database, email delivery via Resend, payments via Stripe) who process data on our behalf under data processing agreements.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority.
• Business transfer: If Creatrbase is acquired or merges with another entity, your data may transfer as part of that transaction. We will notify you in advance.

7. Data retention

We retain your data for the following periods:

• Account data (profile, email, name): For as long as your account is active. On account deletion we anonymise personal identifiers within 30 days and initiate a hard-delete process within 30 days of the soft-delete request.
• Platform metric snapshots: Retained for 24 months, then automatically deleted or aggregated anonymously.
• Session tokens: Deleted on logout or after 30 days of inactivity.
• Support and email correspondence: Retained for 3 years for audit and fraud-prevention purposes.
• Newsletter subscription records: Retained while you remain subscribed. Deleted 30 days after unsubscription unless required by law.
• Billing records: 7 years as required by UK accounting law.

8. Cookies and tracking

We use a small number of cookies. See our Cookie Policy for the full list, including which are essential and which require consent. You can manage your preferences at any time via the cookie banner.

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access (Subject Access Request): Request a copy of all personal data we hold about you. Use the in-app export tool at Account > Privacy > Export my data or email privacy@creatrbase.com.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your account and personal data. Use the in-app deletion tool or email us. We will complete the process within 30 days.
• Right to data portability: Receive your data in a machine-readable format (JSON). Available via the in-app export tool.
• Right to restrict processing: Request we limit how we use your data while a complaint is resolved.
• Right to object: Object to processing based on legitimate interests, including profiling. Contact us and we will review within 30 days.
• Right to withdraw consent: Where processing is based on consent (e.g. newsletters), you may withdraw at any time without affecting prior processing.

To exercise any of these rights, email privacy@creatrbase.com with the subject line "Data Subject Request". We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We implement industry-standard security measures including encryption at rest for sensitive credentials, HTTPS for all data in transit, and access controls on our infrastructure. No system is perfectly secure; we cannot guarantee absolute security but we take reasonable steps to protect your data.

11. Children's privacy

Creatrbase is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at hello@creatrbase.com and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes. Continued use of the platform after changes take effect constitutes acceptance of the revised policy. The current version is always available at creatrbase.com/privacy.

13. Contact and DPO

For privacy-related questions, Subject Access Requests, or data deletion requests, contact our data protection contact at: privacy@creatrbase.com

For general enquiries: hello@creatrbase.com