Your details, and who sees them.

The controller is the operator of Octoclip named in the imprint. Privacy questions and rights requests go to support@octoclip.io. Octoclip has not appointed a data protection officer because the law does not require one for its activities.

A brand that receives creator data through Octoclip, for example an applicant’s profile or a delivered video, is a separate controller for its own use of that data. Stripe is a separate controller for the identity, fraud and payment checks it performs under its own privacy policy.

Account data: email, name, role, date of birth (to check you are 18 or over), country, language, time zone, account state, and versioned acceptance records including time and request address.

Creator data: the social handles, sample links, languages and niches you add; public profile information we read for those handles (name, profile photo, follower count and bio); your verification state; your applications, the links you deliver, review decisions, earnings and payout state; and the tax and identity details platform tax law requires us to collect.

Brand data: company, contact, billing and VAT details, the website or app you ask us to analyse, jobs, briefs, offers, hire payments, fee and VAT records, refunds, credits and review decisions.

Payment data: Stripe collects card and bank details directly; Octoclip receives only references, the last digits, status and amounts. Creator payout onboarding, including identity checks, runs in Stripe’s own interface.

Communication and support data: messages you send us, reports and complaints, dispute evidence, and email delivery events such as bounces.

Technical data: IP address, browser and device information, requested pages, time stamps and error and security logs produced when you use the service, and, with your consent, analytics data.

Marketing data: the email address, interest and source page you give us when you ask for news, and your consent.

When a sign-in provider such as Google is offered and you choose it, Octoclip receives the email address, name, and provider identifier needed to authenticate your account. Social accounts are added by their public handle; Octoclip does not log in to your social accounts, ask for their passwords or read anything that is not public.

To show brands who you are and to verify that you control an account, we read the public profile page of the handles you add on TikTok and YouTube, and check that the personal code we give you appears in your bio. Instagram handles are checked by our team by hand. You can remove the code once the account is verified.

If you connect Octoclip to ChatGPT (OpenAI) or Claude (Anthropic), you sign in with your Octoclip account and choose to allow access. The assistant then receives what Octoclip answers to your requests: for a brand, its jobs and the profiles, pitches and delivered links of the creators who applied to them, as the brand sees them on Octoclip; for a creator, open jobs and their own applications, offers and deadlines. OpenAI and Anthropic handle that data under the terms and privacy policy of the account you use with them. Octoclip sends them nothing you did not ask for and does not use them to process data for itself.

Payments, payouts, bank details and creators’ ad codes never pass through the chat; they stay on Octoclip. To keep the service secure and limit abuse, we log each request from the app (which tool, when, how it ended and how long it took, never what you wrote) for 30 days, on the basis of our legitimate interest. You can disconnect an assistant at any time on octoclip.io/connect.

• Providing the service: accounts, profiles, jobs, applications, offers, collaborations, deliveries, reviews, payments, payouts, refunds, disputes and service emails. Basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Legal duties: bookkeeping, invoicing and tax records, platform tax reporting, age checks, responding to authorities and handling reports of illegal content. Basis: legal obligation (Art. 6(1)(c) GDPR).
• Security and fair use: preventing fraud, fake accounts, circumvention and abuse, rate limiting, logging, and keeping evidence of acceptances and transactions. Basis: our legitimate interest in a safe, trustworthy marketplace and in establishing and defending legal claims (Art. 6(1)(f) GDPR).
• Verifying social accounts and showing public profile information to brands. Basis: performance of the contract and our and brands’ legitimate interest in knowing that an applicant is who they say they are (Art. 6(1)(b) and (f) GDPR).
• Improving the service from aggregated usage and error data. Basis: legitimate interest (Art. 6(1)(f) GDPR).
• Analytics cookies and marketing emails. Basis: your consent (Art. 6(1)(a) GDPR and the rules on storage on devices), which you can withdraw at any time.
• Service and transaction emails to existing users about their account, jobs and payments. Basis: contract and legitimate interest. Product news to existing customers is sent only where the law allows, and every such email has an unsubscribe link.

You must provide the data needed for your account, payments and tax checks; without it we cannot provide the service. Everything else is optional.

Octoclip does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Automatic approval of a video after the review period is a contract rule both sides agree to, not a profiling decision. Fraud and abuse checks may flag an account for review; a person decides on any resulting restriction.

When a brand asks us to suggest job ideas, we read the public website or app listing it gives us and may send that public content to machine-learning providers to draft suggestions. We do not send account data, creator data or payment data to these providers for this purpose.

We use service providers that process data on our behalf under data-processing agreements:

• Vercel (hosting, content delivery and cookieless visit counts);
• Supabase (authentication, database and file storage);
• Resend (sending service emails);
• Google (sign-in, if you choose it, and Google Analytics, only with your consent);
• PostHog (usage analytics and error tracking, only with your consent, and service measurements without personal data, such as how long suggestions take);
• OpenRouter, Groq, Cerebras and Jina, and the model providers they route to (reading public websites and drafting job suggestions from public content only).

Stripe processes payments and payouts and performs its own checks as a separate controller. A brand sees the profile a creator applies with and the links they deliver for its jobs, not unrelated account data; a creator sees the brand, brief and offer. We also share data where needed with tax authorities (including the annual platform tax report about creators’ earnings), courts, law enforcement and other authorities when the law requires it, with professional advisers bound to confidentiality, and with a buyer or successor if all or part of the service is transferred.

We do not sell personal data and do not use it for third-party advertising.

Some providers are based in, or access data from, the United States or other countries outside the European Economic Area. Where a country has no adequacy decision of the European Commission, transfers are made on the basis of the EU–US Data Privacy Framework for certified providers or the European Commission’s standard contractual clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

• Account and profile data: while your account is open, then deleted or anonymised, except for the records below.
• Invoices, bookkeeping records, payment and payout records and platform tax reporting data: for the periods commercial and tax law require, generally up to ten years.
• Acceptance records, collaboration terms, review and dispute decisions and their evidence: until the end of the period in which claims can be brought, generally three years from the end of the year in which the collaboration ended, and longer while a claim or proceeding is open.
• Reports of illegal content and moderation decisions: as long as needed to handle them and any complaint, then up to the limitation period above.
• Server and security logs: short-term, generally no longer than 30 days, unless needed to investigate an incident.
• Job idea previews from the public site: about two days, unless a brand saves them to a job.
• Marketing email data: until you unsubscribe, plus proof of consent and unsubscription for as long as we may need to show it.
• Analytics data: according to the retention we set in Google Analytics and PostHog, at most 14 months.

Access is role-limited and logged; database tables deny access by default; sensitive provider credentials are server-only; traffic is encrypted in transit; and delivery events from providers are authenticated and deduplicated. No system is completely secure, so please use a strong, unique sign-in and tell us at once if you suspect misuse.

You have the right to access your data, to have it corrected, deleted or restricted, to receive it in a portable format, and to withdraw any consent at any time with effect for the future. Some records cannot be erased while a legal retention duty or active claim applies; we restrict them instead and tell you why.

Right to object: where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We then stop unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. You may object to direct marketing at any time without giving reasons.

Email support@octoclip.io to make a request. We may ask you to confirm your identity, and we answer within one month, which can be extended where the law allows. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you believe your rights were infringed.

Octoclip is only for people aged 18 or over. We do not knowingly collect data from anyone younger and close accounts we find were opened by a minor.

How we use cookies and similar storage is explained in the cookie policy.

We update this policy when our processing changes. Material versions are dated. Where a new version requires agreement, Octoclip records the document, version, time, and action at which it was accepted instead of replacing the old evidence.