privacy policy

who we are

infloo is operated from the United Kingdom. we're the data controller for the personal data described on this page — the party responsible for looking after it. you can reach us any time at help@getinfloo.com.

what we collect

• account details — your name, email address and password when you sign up. passwords are stored hashed; we can't read them.
• valuation data — the numbers behind a valuation run: handle, follower count, engagement, niche, platform. these come from the platform login you connect (plus the niche you pick) — nothing is typed by hand. you don't need an account to run a valuation. anonymous runs are stored so the calculator works, but they aren't tied to a name or email unless you sign up and claim the result.
• connected platform data — if you choose to connect TikTok, Instagram or YouTube, we receive data from that platform with your consent, through its official login. exactly what we receive: TikTok — your profile plus follower and video stats. Instagram — your profile and account insights. YouTube — your public channel statistics. we use this data for one thing: showing your stats on your page and calculating your rate.
• booking details — when a brand books a creator we collect the brand's name, business email and the brief they write.
• payment data — payments are handled by Stripe. card numbers go straight to Stripe; we never see or store them.
• brand waitlist — if you join the brand waitlist we store your email, and the company name and budget band if you give them. we use this for exactly one thing: telling you when brand browsing opens. it's never sold or shared.

connected platforms

• access tokens are stored securely on our servers, never in your browser. we never share or sell them, or the data behind them.
• connections are read-only. we pull your stats — we never post to your accounts.
• you can disconnect a platform at any time from your dashboard. disconnecting deletes the stored connection and its tokens.
• you can also revoke infloo's access from inside each platform's own settings (for YouTube, via your Google account permissions).
• Instagram data deletion — we honour deletion requests sent through Meta's data deletion callback, and you can email help@getinfloo.com to have your Instagram data deleted directly.

we comply with the Meta Platform Terms, the TikTok Developer Terms and the Google API Services User Data Policy. infloo's use of information received from Google APIs adheres to that policy, including its Limited Use requirements — YouTube data is used only to provide the features described here, never for advertising, and never sold. because we use YouTube API Services, the Google privacy policy also applies to that connection.

why we're allowed to use it

UK GDPR requires a legal basis for everything we do with personal data. ours are:

• performing our contract with you — running your account, your page and your bookings.
• your consent — connecting a platform. you can withdraw it at any time by disconnecting.
• our legitimate interests — preventing fraud and abuse, and understanding how the service is used so we can improve it.

how long we keep it

• account data is kept while your account exists. you can delete your account yourself from your dashboard settings — the "delete my account" section at the bottom — and your personal data is deleted within 30 days. you can also email help@getinfloo.com and we'll do it for you.
• platform tokens are deleted as soon as you disconnect the platform.
• we may keep valuation statistics in anonymised form — nothing that identifies you — to improve the calculator.
• booking and payment records may be kept longer where the law requires it (tax and accounting rules).

your rights

under UK GDPR you can:

• ask for a copy of the data we hold about you (access)
• have it corrected (rectification)
• have it deleted (erasure) — the account-deletion flow in your dashboard settings does this directly
• take it elsewhere in a portable format (portability)
• complain to the ICO, the UK regulator, if you're unhappy with how we've handled your data

to exercise any of these, email help@getinfloo.com and we'll sort it.

cookies and analytics

the only cookies we set are essential ones — the session cookies that keep you logged in and the site secure. no advertising cookies, no tracking you across other sites.

for analytics we use two privacy-respecting tools: Vercel Analytics and Plausible Analytics. both are cookieless — they count page views and product events (like "a valuation was run") in aggregate, without building a profile of you, and we never put names, emails or anything personal in those events.

who else touches your data

a small set of providers, each getting only what it needs to do its job:

• Stripe — payment processing and holding booking payments until delivery is approved
• Supabase — database, authentication and storage
• Vercel — website hosting and Vercel Analytics
• Plausible — cookieless site analytics, hosted in the EU
• Resend — sends our transactional emails (receipts, booking updates)
• the platforms you connect — TikTok, Meta (Instagram) and Google (YouTube) process your connection on their side under their own policies

what we never do

• we never sell personal data.
• we never use platform data for advertising.

changes

if this policy changes, we'll update the date at the top. for significant changes we'll tell you properly — by email or a notice on the site. questions this page didn't answer: help@getinfloo.com.