Privacy Policy

What we collect

Information you give us

• Account details -- your email address, name, and login credentials. If you sign in with Google, we receive your name, email, and profile picture from Google.
• Profile details -- for creators: profile photo, date of birth (to confirm eligibility for age-restricted campaigns and for contracts), gender, city/region, languages, and content categories. For brand users: company name and role.
• Content you upload -- photos, videos, portfolio items, campaign drafts, and messages you send in Sync chat.
• Social media accounts -- the TikTok, Instagram, or YouTube handles you connect, and the public performance data of the content you post for campaigns (views, likes, comments, shares).
• Payment details -- to pay you, we collect your bank/beneficiary details. These are processed by our payment partners (Airwallex, and Stripe where identity verification is required); we do not store full bank account numbers on our own servers. We also collect billing and tax details (name, address, and GST/HST/QST or business tax numbers where applicable) for invoices and tax records.
• Reports and blocks -- if you report content or block another user, we keep your report (including a snapshot of the reported content at the time of the report) and your block list to operate our moderation process.

Information collected automatically

• Usage data -- which screens and features you use, so we can improve the product (PostHog analytics, tied to your account).
• Diagnostics -- crash reports and performance data (Sentry), linked to your account; session replays are masked.
• Device data -- device type, app version, and a push notification token (Firebase Cloud Messaging) if you allow notifications.

Phone permissions (only used when you trigger the feature, always with your permission): camera and microphone for recording portfolio/verification videos; photo library for choosing uploads and saving downloads; notifications for campaign, chat, and payout alerts.

What we use it for

• Run the service: match creators with campaigns, track content performance, process contracts, chat, and payouts
• Send you service notifications (new campaign activity, messages, payment updates) -- you control push notifications in your device settings
• Keep the platform safe: verify identity where required, prevent fraud and abuse
• Improve Sync: understand which features are used and fix crashes
• Meet legal obligations (tax and payment records)

We process your information to perform our contract with you, to comply with legal obligations, for our legitimate interests in securing and improving the platform, and with your consent where required (for example, push notifications).

We do not sell your personal information. We show no ads and do not track you across other companies’ apps or websites.

Who we share it with

We share personal information only as needed, with service providers acting on our behalf:

• Supabase -- database, authentication, and file storage
• Airwallex / Stripe -- payouts and identity verification
• Google -- sign-in (optional) and location autocomplete
• Firebase (Google) -- push notifications
• PostHog -- product analytics; Sentry -- error monitoring; Featurebase -- in-app support/feedback
• Brands and campaign managers you work with see your creator profile, connected account statistics, and the content you submit. This sharing is a core function of the service
• Authorities, if the law requires it

These providers are bound to protect your information to at least the standard described in this policy and may not use it for their own purposes.

How long we keep it

We keep your information while your account is active. When you delete your account, it is deactivated immediately and permanently deleted after a 30-day grace period (during which you can restore it), except records we must keep for legal, tax, or dispute purposes. Payment records are retained as required by financial regulations.

Your rights

Depending on where you live (including under Canada’s PIPEDA, Quebec’s Law 25, and the EU/UK GDPR), you can:

• Access a copy of your personal information
• Correct it or update it (most of it directly in your profile settings)
• Delete your account and data -- in the app under Settings → Delete account (30-day grace period during which you can restore it), or by emailing us
• Withdraw consent (e.g., disable push notifications or disconnect a social account)
• Complain to your data protection authority, including the Commission d’accès à l’information du Québec (CAI), the Office of the Privacy Commissioner of Canada, or your local EU/UK authority. Complaints to us are handled by our person in charge of the protection of personal information

To exercise any of these, contact contact@makeitsync.com. We respond within 30 days.

Where your data lives

Our servers are hosted in the United States (AWS). Some of our providers also process data in the United States. Where required, these transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses; contact us for more information about these safeguards.

Cookies and similar technologies

We use essential browser storage to keep you signed in and to operate the platform -- this is required for the service to function. We also use first-party analytics (PostHog) to understand how features are used; analytics activity is associated with your account. You can limit cookies and site storage through your browser settings, and you may request deactivation of analytics for your account by contacting us at contact@makeitsync.com.

Children

Sync is not for children. You must be at least 18 years old to use Sync. Some campaigns have their own higher age requirements, which we verify against your date of birth.

Changes

If we make meaningful changes to this policy, we will notify you in the app or by email before they take effect.