Effective Date: March 14, 2026
Last Updated: September 30, 2026
Creative Scale LLC ("Creative Scale," "we," "us," or "our") is a limited liability company organized under the laws of the State of Florida, United States. We operate a two-sided marketplace platform at app.creativescale.co that connects content creators with brands for paid user-generated content (UGC) campaigns. Our users may be located anywhere in the world.
This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you access or use the Platform. It applies to all users, including Creators, Brands, and visitors, regardless of their location. By using the Platform, you agree to the practices described in this Policy. If you do not agree, you must discontinue use and contact us to request deletion of your data.
This Policy is designed to comply with applicable privacy laws including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR) for users in the European Economic Area, the Children's Online Privacy Protection Act (COPPA), and the data use requirements of third-party platforms including TikTok, Meta, Shopify, Amazon, and Stripe. Where applicable law provides rights that exceed what is described here, those rights apply.
From Creators:
From Brands:
When a Creator connects their TikTok account to the Platform using TikTok's Login Kit API, we collect and store the following data retrieved from TikTok's API on the Creator's behalf:
How TikTok Data is Used:TikTok data is used solely to: (a) populate Creator profiles visible to Brands within the Platform; (b) calculate engagement metrics for brand-creator matching; (c) display recent TikTok content so Brands can evaluate Creator fit for campaigns; and (d) use the Creator's authenticated @handle to look up their own TikTok Shop creator marketplace performance, so Brands see their real sales record rather than self-reported figures. TikTok data is not used for advertising targeting, is not sold to any third party, is not transferred to any platform other than as necessary to provide the Service, and is not exported outside the Platform.
TikTok Data Retention:TikTok data is retained while your TikTok account remains connected to the Platform. If you disconnect your TikTok account (via Platform settings or by revoking access in TikTok's app settings at tiktok.com/settings) or delete your Platform account, we will delete all TikTok-derived data from our systems within thirty (30) days.
TikTok Token Storage:OAuth access and refresh tokens are encrypted at rest using industry-standard encryption before storage and are used only to retrieve Creator profile data from TikTok's API. Tokens are refreshed automatically via our systems and can be revoked at any time.
TikTok Data Refresh: We run automated daily tasks to refresh TikTok statistics (follower count, engagement metrics, video data) to keep Creator profiles current. You may revoke this access at any time.
Creator side (Instagram API with Instagram Login).When a Creator connects their Instagram professional account, we collect and store: their Instagram user ID and username; profile and media metadata including follower count, media IDs, captions, thumbnails, and like and comment counts; view counts retrieved from Instagram's media insights endpoint; and OAuth access tokens, encrypted at rest using AES-256-GCM before storage. With the Creator's authorisation we publish Reels to their own account on their behalf, read comments on their own posts, and send one-time private replies to people who comment a keyword the Creator chose.
Comment and messaging data.For the opt-in comment-to-DM feature we store, for each comment we have replied to, the Instagram comment ID and the commenting person's Instagram ID and username. This is retained solely to ensure we never reply to the same comment or message the same person twice. We do not access Creators' general Instagram Direct inboxes or existing conversations, and we do not hide, delete or moderate comments.
Automated processing.Where a Creator switches on auto-repost, a scheduled task republishes new videos from their connected TikTok account to their own Instagram account until they switch it off. A scheduled task also polls comments on posts a Creator has attached an automation rule to. Both act only on that Creator's own accounts and their own content.
Brand side (Facebook Login for Business and the Marketing API).Brands may voluntarily provide their Instagram handle as part of their brand profile; this is stored as brand profile metadata and used only to display brand context within the Platform. Brands may also connect their Meta Ads accounts. When connected, we collect and store: their Meta user ID, ad account ID, Business Manager ID, Facebook Page ID and linked Instagram business account ID; campaign, ad set and ad performance metrics we retrieve on their behalf; and OAuth access and refresh tokens, encrypted at rest using AES-256-GCM before storage. We use this to create and manage the advertising campaigns the Brand explicitly sets up, and to display performance metrics to that Brand. Brands are solely responsible for their compliance with Meta's Platform Terms, Business Tools Terms, and applicable advertising laws.
How Meta and Instagram data is used. This data is used solely to provide the Service. It is not used for advertising targeting of our own, is not sold to any third party, is not combined with data from other sources to build profiles, and is not re-identified from aggregated insights. Ad account data is shown only to the Brand that connected the account.
Retention and deletion.Meta and Instagram data is retained while the account remains connected to the Platform. Disconnecting from Platform settings immediately clears the encrypted tokens and all Meta-derived fields. We also operate a Meta data deletion callback at https://app.creativescale.co/api/meta/data-deletion, which verifies Meta's signed request and deletes the associated data. All Meta-derived data is deleted from our systems within thirty (30) days of disconnection or account deletion.
Our Shopify integration exists for a single purpose: attribution and commission payment— connecting a merchant's sales back to the creator and content that drove them. This section is written to comply with Shopify's Protected Customer Data requirements.
Data collected by our Web Pixel. When a shopper visits a participating merchant's store through a Creative Scale link, our Web Pixel reads our own attribution parameters from the page URL (cs_creator, cs_submission, cs_campaign), stores them in the shopper's browser for the session so attribution survives to checkout, and on a completed checkout reports those parameters together with the order identifier and order value to our attribution endpoint. The pixel is configured under Shopify's customer-privacy framework for an analytics purpose only — no marketing purpose and no sale of data.
Order-level data. From a completed order we receive only: order ID / order token, order value, currency, and the Creative Scale attribution parameters. When a Brand connects via OAuth we also process store-identifying data (shop domain, store ID, contact/billing details, and access tokens) needed to operate and bill for the integration.
Data minimization — no customer PII. Our Web Pixel does not collect customer personally identifiable information — no names, email addresses, phone numbers, or shipping/billing addresses. We do not build shopper profiles, do not track shoppers across unrelated merchants, and do not use the pixel for advertising or retargeting. Merchants receive aggregated attribution data only (order values and traffic source by creator), not individual visitor PII.
Retention & deletion.We retain order-level and attribution data only as long as needed to complete attribution, calculate and disburse creator commissions, and meet reconciliation, financial-reporting, dispute, and legal/tax obligations, after which we delete or anonymize it. Upon merchant uninstallation we cease processing new data from the store and delete or anonymize associated data in line with our retention schedule and Shopify's data-erasure webhooks.
Consent.The Web Pixel operates within Shopify's customer-privacy and consent framework and honors the consent signals Shopify provides. Where a shopper has not consented to analytics tracking, the pixel does not collect attribution data.
Sub-processors. We use a limited set of trusted sub-processors under a Data Processing Agreement: Stripe (payments and payouts), Supabase (application database), Resend (transactional email), Vercel (hosting), Shopify (store integration and order/event data), and Meta and Amazon where a merchant connects them. We do not sell merchant or customer data.
Shopify GDPR/privacy webhooks. We register and honor Shopify's mandatory compliance webhooks: customers/data_request (we provide any attribution data we hold for the request — noting we do not store customer PII via the pixel), customers/redact (we delete or anonymize any data for the identified customer), and shop/redact(following uninstallation, we delete or anonymize the shop's data within Shopify's required timeline).
Data Processor Relationship.With respect to personal data of Shopify merchants' customers accessed via Shopify's API, Creative Scale acts as a data processor on behalf of the Brand (data controller), processing such data only as directed by the Brand and as necessary for attribution and commission tracking. Brands are responsible for ensuring they have appropriate legal bases to share their customers' data with Creative Scale.
Brands may connect their TikTok Shop through two separate, independently authorized TikTok Shop apps: one for the Brand's product catalog, and one for affiliate (creator) data. Each uses TikTok Shop's own authorization page with the Brand's explicit consent, and each can be disconnected independently. Both are read-only: we do not create, change or delete anything in the Brand's TikTok Shop.
Product catalog app:
Affiliate app:
TikTok Shop data is used solely to show a Brand which Creators drove which sales, to calculate Creator commissions, and to show Brands a Creator's TikTok Shop sales record when choosing who to work with. A Brand can only read its own shop's orders. We do not access or store TikTok Shop buyers' personal data, do not use TikTok Shop data for advertising, and do not sell it or share it outside the Platform.
Data Retention.When a Brand disconnects either app, in the Platform or from TikTok Shop, that app's tokens and shop details are deleted immediately. Creator marketplace information is replaced on each daily refresh rather than accumulated, and is deleted when the Creator disconnects TikTok.
Creators who connect TikTok Shop:
A Creator may connect their own TikTok Shop affiliate account, through TikTok Shop's authorization page and with their explicit consent, so that the Platform can create their TikTok Shop affiliate links for them. We store:
These links are used only to send the Creator's own link to people who comment on the Creator's reposted videos (the Creator's automatic replies) and on the Creator's link settings. The order details are used only to show the Creator which reposted video drove each sale, and to show Brands browsing the Creator's profile the total sales and units sold from the Creator's reposts (never the Creator's commission or individual orders). TikTok Shop pays the Creator's commission on these sales directly; the Platform never pays or charges anything based on them. A Creator can disconnect at any time from their settings, which deletes the tokens and the stored order details immediately; their saved showcase link remains until they remove it.
Brands may connect Amazon to the Platform via two separate, independently authorized integrations: the Amazon Selling Partner API (SP-API) for catalog access, and the Amazon Ads API (Amazon Attribution) for sales-attribution measurement. Each integration uses its own OAuth flow with the brand's explicit consent and is independently revocable.
Amazon Selling Partner API (SP-API):
Amazon Ads API (Amazon Attribution):
Amazon data is used solely for generating creator attribution links, tracking product referral conversions, and calculating creator commissions within the Platform. We comply with the Amazon Ads API License Agreement and the Amazon Selling Partner API Data Protection Policy, and we do not use Amazon data for purposes outside of the Platform.
Creators who promote Amazon products through the Platform may have attribution links generated on their behalf. These links enable sales tracking to calculate earned commissions. We do not access or store Amazon customer personal data, end-shopper personal data, or any data outside the brand's own Amazon account.
Data Retention.Amazon tokens and attribution data are retained while the Brand's Amazon account is connected. Upon disconnection (initiated either from within the Platform or via Amazon's own revocation tools), OAuth tokens are deleted immediately and attribution data is retained for up to 90 days for commission reconciliation, after which it is permanently deleted.
All payment processing is handled by Stripe, Inc., a PCI DSS Level 1 certified payment processor. We do not store, process, or have access to raw payment card numbers, full bank account numbers, or other sensitive financial data. We receive from Stripe only transaction metadata, including transaction IDs, amounts, statuses, and payout records, which we use to maintain payment records and audit trails within the Platform.
Creator payouts are disbursed through Stripe Connect. By connecting a bank account for payouts, Creators agree to Stripe's Connected Account Agreement. Stripe may collect and retain identity verification information (including government-issued identification) as required by applicable financial regulations including KYC/AML requirements. Stripe's privacy practices are governed by Stripe's Privacy Policy at stripe.com/privacy.
When you use the Platform, we automatically collect:
We use Vercel Analytics for Platform performance monitoring. Vercel Analytics collects aggregated, anonymized usage data and does not use persistent cookies or track individual users across sessions. No personally identifiable information is transmitted to Vercel Analytics.
We use the information we collect for the following purposes:
Automated Decision-Making. The Platform uses algorithmic processes to display Creator profiles to relevant Brands based on content categories, follower count, engagement metrics, and campaign fit criteria. This process facilitates discovery but does not produce legally significant effects on individuals and does not constitute solely automated decision-making within the meaning of GDPR Article 22. Users may contact us at support@creativescale.co to request human review of any algorithmic outcomes that affect them.
We do not sell your personal information. We do not share personal information for third-party advertising purposes. We share information only in the following circumstances:
The Platform uses essential cookies required for authentication, session management, and security (including CSRF protection for OAuth flows with TikTok, TikTok Shop and Shopify). These cookies are strictly necessary for the Platform to function and cannot be disabled without impairing core features including the ability to remain logged in.
We use Vercel Analytics for aggregated performance monitoring. No third-party advertising cookies, cross-site tracking cookies, or behavioral profiling technologies are used by Creative Scale. You may configure your browser to block or delete cookies, but doing so may impair certain Platform features.
Do Not Track.The Platform does not currently alter its data collection or use practices in response to "Do Not Track" signals from browsers. We make this disclosure as required by applicable law, including California's Online Privacy Protection Act (CalOPPA).
We retain your personal information for as long as your account is active or as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:
California residents have the right to: (a) know what personal information is collected, used, shared, or sold; (b) request deletion of personal information (subject to certain exceptions); (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising); (e) limit the use and disclosure of sensitive personal information; and (f) non-discrimination for exercising these rights. To submit a CCPA/CPRA request, contact us at support@creativescale.co with "California Privacy Request" in the subject line. We will respond within forty-five (45) days.
If you are located in the European Economic Area or United Kingdom, you have rights under the GDPR and UK GDPR including: (a) right of access; (b) right to rectification; (c) right to erasure ("right to be forgotten"); (d) right to restriction of processing; (e) right to data portability; (f) right to object to processing; and (g) right not to be subject to solely automated decision-making. Our lawful bases for processing are: (a) performance of a contract (to provide the Services); (b) compliance with a legal obligation; (c) our legitimate interests (fraud prevention, platform security, service improvement); or (d) your consent (for optional integrations such as TikTok and Shopify). Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing. To exercise GDPR rights, contact support@creativescale.co. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.
We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:
No security system is impenetrable. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify affected users and applicable supervisory authorities within seventy-two (72) hours of becoming aware of the breach, as required by GDPR Article 33, and within the timeframes required by applicable U.S. state data breach notification laws. Notification to affected individuals will be made without undue delay where required by law.
The Platform is not directed at children under the age of thirteen (13). Users must be at least eighteen (18) years of age to enter into binding agreements and receive payment through the Platform. We do not knowingly collect personal information from children under the age of thirteen (13). If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will promptly delete such information. If you believe we have inadvertently collected information from a minor, please contact us at support@creativescale.co.
Creative Scale LLC is based in the United States, and your information is processed and stored on servers located in the United States. If you access the Platform from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.
For users in the European Economic Area or United Kingdom, we rely on appropriate legal transfer mechanisms for international data transfers, including Standard Contractual Clauses (SCCs) where required. By using the Platform, you acknowledge that your information will be transferred to the United States in accordance with applicable law.
The Platform integrates with third-party services and may contain links to third-party websites. This Privacy Policy does not apply to any third-party platform, website, or service. We encourage you to review the privacy policies of any third-party service you use in connection with the Platform:
Creative Scale is not responsible for the privacy practices or content of any third-party platform.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will notify you of material changes by updating the "Last Updated" date at the top of this page and, where required by applicable law or where appropriate, by sending an email notification to your registered address or displaying a prominent notice within the Platform. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. For material changes affecting how we use previously collected data, we will seek your consent where required by law.
For privacy-related inquiries, data requests, or to exercise your rights under applicable law, please contact:
Creative Scale LLC — Privacy
Email: support@creativescale.co
General & Legal: support@creativescale.co
Website: creativescale.co
We will acknowledge receipt of verifiable requests within ten (10) business days and respond fully within forty-five (45) days, or as otherwise required by applicable law. EEA users who are not satisfied with our response have the right to lodge a complaint with their national data protection supervisory authority.