Privacy Policy

Information we collect

• Account information: your email address, name, and authentication data when you create an account or sign in.
• Brand and campaign data: the briefs, campaigns, shortlists, and settings you create in the workspace.
• Public creator discovery data: publicly available profiles, public videos, engagement signals, and business contact details a creator shares publicly or through professional sources. This data powers matching, evidence, and the outreach invitations described below. We do not access creators' private social accounts or non-public social content.
• Private creator marketplace information: if you choose to build a marketplace profile, you may provide your exact date of birth; country, region, city, and time zone; personal TikTok and Instagram profiles; profile photo; bio, languages, niches, and content formats; rates, availability, capacity, and turnaround time; and self-declared collaboration names and links.
• Outreach data: if you use outreach features, the messages sent on your behalf and their delivery/reply status.
• Usage data: product analytics events (pages viewed, features used) and standard log data such as IP address and browser type.

Creator marketplace privacy

We use private creator marketplace information to operate your profile, assess eligibility, find potentially relevant opportunities, and support human review. Your exact demographic, location, social-profile association, rate, capacity, and other raw answers are visible to you and authorized Octohog operators. They are not shared with brands as raw private fields.

Creator marketplace information does not enter our published creator corpus or final-v13 matching model in version 1. Collaboration names and links you submit remain self-declared and are not treated as verified brand work unless a separate verification process is added later.

Leaving the marketplace pauses discovery without removing your campaign access. We retain your marketplace profile so you can review it or return later. You can edit it, delete your account from account settings, or ask us to delete your information as described below.

Google user data (Gmail)

If you connect a Gmail account for outreach, we access it only to send the messages you approve and to read replies to those messages so they appear in your workspace inbox. OAuth tokens are stored encrypted and are never exposed to your browser or to third parties. You can revoke access at any time from your Google Account security settings.

Octohog's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Gmail data for advertising, and no humans read it except with your permission, for security purposes, or as required by law.

Creator contacts and outreach invitations

To power outreach, we maintain a database of creator business contact details collected from public and professional sources. These contact details are stored encrypted, are never sold, and are shared only with the service providers listed below. They are used solely to send individual invitation emails about specific brand collaborations.

If you are a creator: you can ask what information we hold about you, ask us to correct it, or opt out of all future outreach at any time by emailing support@octohog.com or by replying to any invitation. Opt-outs are recorded on a permanent suppression list that applies across every brand and campaign.

How we use information

• To operate the product: matching, evidence, campaign management, and outreach you initiate.
• To operate private creator profiles and find potentially relevant opportunities for creators who join the marketplace.
• To improve Octohog: aggregate usage analytics and debugging.
• To communicate with you about your account and the service.
• We do not sell your personal information, and we do not use your private data to train third-party AI models.

Legal bases (GDPR)

• Contract: operating your account, workspace, billing, and the features you use.
• Legitimate interests: product analytics, service security and fraud prevention, and business outreach to creators based on their public professional activity. You can object to processing based on legitimate interests at any time.
• Consent, where required by local law (for example certain marketing communications).
• Legal obligations: accounting and tax records, and responses to valid legal requests.

Service providers

We rely on infrastructure providers to run Octohog, each processing data only to provide their service to us: Vercel (web hosting), Supabase (database and authentication), Render (background services), Stripe (payments and billing), Google (Gmail API for outreach you enable), Microsoft Azure OpenAI and xAI (analysis of public creator content), RapidAPI data providers (public TikTok and Instagram data), PostHog (product analytics), Sentry (error monitoring, including fully masked session replays), and Resend (transactional email).

Business customers who need a data processing agreement (DPA) covering their workspace data can request one at support@octohog.com.

International transfers

Octohog operates from the United States, and the providers above process data in the United States and the European Union. Where GDPR or UK data protection law applies to a transfer, we rely on standard contractual clauses or an equivalent recognized transfer safeguard.

Cookies

We use strictly necessary cookies for authentication and session management, and first-party product analytics (PostHog) to understand how the product is used. Error monitoring (Sentry) may record fully masked session replays for debugging. We do not run third-party advertising cookies.

Data retention and deletion

We keep your data while your account is active. Pausing or leaving the creator marketplace stops discovery but retains the private profile until you resume, edit it, delete your account, or request deletion. You can delete your account from account settings or request deletion at any time by contacting us; we delete or anonymize personal data within 30 days except where the law requires longer retention.

Your rights

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact us and we will honor verified requests. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority.

Security

Data is encrypted in transit and at rest. Sensitive credentials (such as OAuth tokens) and creator contact details are additionally encrypted at the application layer, and access to production systems is restricted.

Children

Octohog accounts and the creator marketplace are not available to anyone under 18. We reject an under-18 date of birth before saving a marketplace draft and do not knowingly retain a minor's creator marketplace profile.

Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced in the product or by email.

Contact

Questions or requests about this policy, including creator opt-outs and data requests: support@octohog.com.