Privacy Policy

1. Data Controller

The controller of your personal data within the meaning of Art. 4(7) GDPR is [CONTROLLER NAME / COMPANY], with its registered office at [REGISTERED ADDRESS], entered in the [COMMERCIAL REGISTER] under number [NUMBER], VAT no.: [VAT], company no.: [REG NO] (“Vereel”, “we”, “us”), operator of the Vereel platform — a marketplace connecting content creators with brands (the “Platform”).

For all matters relating to the processing of personal data and the exercise of your rights, you can contact us at privacy@vereel.com or in writing at our registered address.

[IF APPLICABLE] We have appointed a Data Protection Officer (DPO) whom you can contact on all matters relating to the processing of your data at privacy@vereel.com.

2. Personal Data We Process

We process only the data necessary to deliver the purposes described in this Policy:

• Account & authentication data: name, email address, password (stored in encrypted form), role (creator or brand), display name.
• Profile data: social media handles, reach statistics and metrics, portfolio links, bio, categories, profile picture.
• Transaction & billing data: cooperation details, invoicing data, payment history. Card payments are handled by an external payment provider (Stripe) — we do not store full card numbers.
• Communication content: messages, attachments, and files exchanged between creators and brands via the Platform, and correspondence you send us.
• Technical & usage data: IP address, device and browser type, cookie identifiers, pages visited and features used, event logs.

3. Sources of Data

We collect most data directly from you — when you register, complete your profile, and use the Platform.

If you connect a social media account (e.g. Instagram / Meta), with your consent we retrieve public data and account statistics from it (e.g. follower count, engagement metrics) to verify and display your profile. The scope of this data is governed by the terms and settings of the relevant service.

4. Purposes & Legal Bases for Processing

We process your data for the following purposes and on the following legal bases:

• Providing the Platform’s services (creating and operating your account, matching creators with brand offers, handling cooperations and communication) — Art. 6(1)(b) GDPR (performance of a contract).
• Handling payments and settlements and issuing and retaining accounting documents — Art. 6(1)(b) and (c) GDPR (performance of a contract and a legal obligation under accounting and tax law).
• Ensuring security, preventing abuse, and improving the Platform (analytics, logs, error handling) — Art. 6(1)(f) GDPR (legitimate interest of the controller).
• Handling enquiries and complaints — Art. 6(1)(b) and (f) GDPR.
• Handling GDPR rights requests and demonstrating compliance (accountability) — Art. 6(1)(c) GDPR.
• Marketing communications (e.g. newsletter) — Art. 6(1)(a) GDPR (consent), which you can withdraw at any time.
• Establishing or defending against claims — Art. 6(1)(f) GDPR (legitimate interest).

5. Data Retention

We keep your data no longer than necessary for the purposes for which it was collected:

• Account and profile data — for as long as you hold an account on the Platform; after deletion, data is erased or anonymised, subject to the exceptions below.
• Billing data and accounting documents — for the period required by law, as a rule 5 years from the end of the year in which the tax obligation arose.
• Data needed to establish, pursue, or defend claims — until the relevant limitation periods expire.
• Data processed on the basis of consent — until consent is withdrawn.
• Technical logs and security data — typically up to 12 months.

6. Recipients & Processors

We do not sell your personal data. We may share it with, or entrust its processing to, the following categories of recipients:

• Other Platform users — to the extent necessary to establish and carry out a cooperation (e.g. your profile and name visible to a brand you apply to).
• Infrastructure and IT service providers acting as processors under data processing agreements, in particular: Supabase (database hosting, authentication, file storage), Vercel (application hosting), Sentry (error monitoring), Resend (email delivery).
• The payment provider — Stripe, to process and settle transactions.
• Social media providers (e.g. Meta / Instagram) — to the extent of the integration you have consented to.
• Bodies authorised under the law (e.g. law enforcement, courts) — only upon a justified request and to the extent required.

7. Transfers Outside the European Economic Area

Some of our service providers (including Supabase, Vercel, Sentry, Resend, Stripe, Meta) are based or have infrastructure outside the European Economic Area (EEA), including in the United States. This means your data may be transferred to third countries.

In such cases we ensure the appropriate safeguards required by the GDPR, in particular the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) or transfers to entities covered by a Commission adequacy decision (e.g. under the EU–U.S. Data Privacy Framework). You can obtain a copy of the safeguards applied by contacting us at privacy@vereel.com.

8. Automated Decision-Making & Profiling

To present relevant offers and match creators with brands, we may profile data to a limited extent (e.g. matching offers based on categories, reach, and activity). This profiling does not produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR — final decisions to enter into a cooperation are made by users.

9. Your Rights

In connection with the processing of your data, you have the following rights:

• Right of access to your data and to obtain a copy of it.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure of your data (“right to be forgotten”).
• Right to restriction of processing.
• Right to data portability in a structured, commonly used format.
• Right to object to processing based on legitimate interest, including profiling.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us at privacy@vereel.com. We respond without undue delay and no later than one month from receipt of the request.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

11. Is Providing Data Mandatory?

Providing data is voluntary; however, to the extent necessary to conclude and perform a contract (e.g. creating an account, carrying out a cooperation) and to meet legal obligations (e.g. issuing an invoice), it is a condition of using the Platform — without this data we will not be able to provide the relevant services.

12. Cookies & Similar Technologies

We use strictly necessary cookies required for the Platform to function (e.g. maintaining authentication sessions). With your consent, we may use cookies and similar technologies for analytics and statistics.

You can change your cookie settings at any time in your browser. Restricting strictly necessary cookies may affect the availability of Platform features.

13. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. Data is transmitted over encrypted connections (HTTPS/TLS), and only authorised persons have access to it.

14. Minors

The Platform is intended for persons aged 16 or older. We do not knowingly collect data of persons below this age without the consent of a parent or legal guardian. If you become aware that such a person’s data has been provided to us, please contact us — the data will be deleted without delay.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will inform you of material changes by email or a prominent notice on the Platform, with appropriate advance notice. The current version is always available on this page, along with the date of the last update.

16. Instagram API (Meta)

Creators may optionally connect their Instagram professional account to Vereel by logging in with Instagram (the “Instagram API with Instagram Login” provided by Meta Platforms Ireland Limited). When you connect your account, with your consent we receive the following data from Meta:

• Profile data: your Instagram username, account type, follower count, and media count.
• Account insights: reach, profile views, engaged accounts, and interaction totals.
• Audience demographics: aggregated age, gender, and location breakdowns of your followers (only available for accounts with at least 100 followers).
• Media data: your recent posts (thumbnails, captions, links) and their engagement metrics.

We use this data solely to present your creator statistics to brands on the Platform. It is stored on Supabase infrastructure in the EU (Frankfurt). We do not post on your behalf, send messages, or access your Instagram inbox. You can revoke access at any time by disconnecting the account in your Vereel settings or by removing Vereel in Instagram (Settings → Website permissions → Apps and websites); upon disconnection or a Meta data-deletion request, the data obtained through this connection is deleted. You can also request deletion at privacy@vereel.com. Your use of Instagram remains subject to Meta’s own terms and privacy policy. Vereel is not affiliated with, or endorsed by, Meta Platforms.

Contact — Personal Data

For privacy matters or to exercise your rights, contact us at privacy@vereel.com or in writing at the controller’s registered address.