What we do with data, in plain English.

Who we are

Creahunt is operated by [FILL IN: legal entity operating Creahunt], [FILL IN: registered postal address]. We are the controller for the processing described on this page. Privacy questions and requests go to privacy@creahunt.com.

What we collect about public creator profiles

Agencies use Creahunt to find creators for paid collaborations. When an agency runs a search, we collect these things about public Instagram, TikTok and YouTube accounts:

• your handle, display name, profile picture, bio and whether the account is verified;
• your follower, following and post counts;
• your recent public posts: the images or video thumbnails, captions, hashtags and @-mentions, like, comment and view counts, publish dates and links to the posts;
• for videos we analyse in depth: a temporary copy of the video file, a few still frames taken from it, and a transcript of the first 90 seconds of speech when transcription is enabled;
• the links you put on your profile: Instagram's website field and bio links, TikTok's profile link. When one of those links, or your bio text, names a paid-subscription platform (OnlyFans, Fansly, Fanfix, Fanvue, Patreon, MYM, LoyalFans, JustFor.Fans, ManyVids, FanCentro, Passes) or a link hub (Linktree, Beacons and similar), the agency sees a note that you list it — the platform's name only, never the link. We read only what you published on the profile itself: we do not open the linked pages and we never search those platforms for your handle;
• a contact email, only when you publish one in your bio, the platform lists it as your public business email, or — for Instagram accounts an agency measures through our statistics provider (next bullet) — that provider lists one in its record of your profile;
• for Instagram accounts, our statistics provider's record of your profile, fetched and cached when an agency saves you to its Collection (or opens a Collection in which you are saved and have not been looked up yet) — opening your saved entry's details also fetches the provider's list of your posts from the last 90 days. Discovery runs, the Profile Analyzer and reports only read what is already cached. What those records contain and how long they stay is under "How long we keep it";
• daily snapshots of your follower and engagement counts, so growth can be charted, plus past follower counts from a statistics provider for Instagram accounts when that provider is enabled. The growth chart in a report reads this history for a signed-in agency user only; when fewer than five snapshots exist, that provider is enabled and you are saved in that agency's Collection, opening the chart triggers one request to the provider for your past follower counts (at most once per creator per day);
• copies of your avatar and post images, re-hosted on our storage (Vercel Blob) so a saved report keeps its pictures after the platform's links expire. Our code stores each copy as a private object whenever the store allows it: a private copy cannot be fetched from the web at all and is served only through our app, to a signed-in agency user or to a viewer of a share link whose shared report contains that exact picture. The store we use today was created with public access, which cannot be changed in place, so on it each copy is written as an unlisted public object instead: its address ends in a random 30-character suffix, so it cannot be guessed or built from the platform, your handle and the post id — but anyone who obtains the address (for example from a share page) can fetch the copy until it is deleted. Copies stored before 2026-09-04 still sit at older addresses that do follow that predictable pattern, until the retention sweep or an erasure removes them. Moving to a private store is on our upcoming page;
• for the comment-sentiment estimate on Instagram: up to 20 public comments on each of your 3 most recent posts, with the commenters' handles and text. Only the positive / neutral / negative / spam counts are kept — the comments and the commenters' handles are discarded once classified;
• for YouTube channels: the country and the public contact email you list on your channel's About page, and the profile links you declare there;
• when your bio links to a link-in-bio page you publish (Linktree, Komi, Pillar, lnk.bio or Linkme): the public links on that page, and a contact email only when you publish one there;
• for TikTok accounts, only when a brief asks for an audience country or the audience-demographics extra is on: a public sample of your most recent followers — their country and language only, never their handles or names — kept as country percentages;
• for a brand-safety report an agency requests on your account: public comments on your recent posts, transcripts of your recent videos, and public web pages that mention you (news, forums, Reddit), used to classify content risks and sentiment; the report keeps short quoted examples with a link to their source;
• while an agency writes a brief and our Google image search is not configured: recent public Instagram posts under the brief's hashtags — image, caption, author handle and link — shown to the agency as visual references for that step only and not stored; up to 12 of those post images (the image alone — no caption or handle) are also sent to OpenAI together with the brief text, to check that they visually match the brief, and are then discarded;

Where it comes from

From the public parts of your profile, retrieved through third-party social-media data providers — ScrapeCreators and Desearch, the providers reached through the RapidAPI marketplace, or Phyllo when we enable it, all listed under “Who receives it” — and from web search results that link to your profile: we use OpenAI's web search tool and Google search results (fetched through ScrapeCreators) to find profile links and public roundup pages for a brief. We never log in to a platform as you, and we never ask you for anything.

Why we process it

Our legal basis is legitimate interests, Art. 6(1)(f) GDPR: the agencies' interest in finding suitable creators for paid work, and our interest in providing that service, balanced against your interests and rights. We only use information you have chosen to make public, we let you object at any time, and a balancing test for this processing is documented and available on request.

What we infer

Beyond what your profile shows, our models and rules derive the following:

• how well your content fits an agency's brief: a score with a written rationale, produced by AI models reading your posts;
• an engagement rate from public like, comment and follower counts;
• the share of your recent posts that look sponsored (#ad, paid-partnership labels, brand tags) and how those posts perform compared with the rest;
• whether the account is run by one individual, and its apparent role: creator, model, influencer, photographer, brand, agency or repost / fan page ("unknown" when unclear);
• only when a brief requires a gender or an age range: an estimated gender and age range derived from your public profile picture by ScrapeCreators (an automated estimate with a confidence score; we ignore it below 70% confidence, we prefer a gender you declared yourself — pronouns on Instagram, the gender field on a Facebook page — whenever it exists, and the result is labelled as an estimate wherever it is shown). Our models are instructed not to guess your exact age;
• only when a brief requires a gender: whether the recurring on-camera person appears to be a woman or a man — recorded as "woman", "man" or "unknown" ("unknown" whenever nobody clearly recurs) and used as a filter for that brief. For every other brief the model is not asked, anything it volunteers anyway is discarded, and the field stays "unknown". The per-post vision pass tags who or what each post depicts (for example "person", "group", "couple", "product"); it may label a person as a woman or a man only for a brief that requires a gender — for any other brief such labels are replaced by "person" or "group" before anything is kept;
• only when a brief requires a location: whether you appear to be based there, together with the evidence used (a stated location, the business address or country a platform shows on your profile, caption language, location tags, and for TikTok the account's region as the platform reports it). Otherwise these location fields stay "unknown";
• an authenticity signal — likely real, uncertain or likely AI-generated — produced by the vision model from your posts. It is shown to the agency as a signal and affects ranking; an agency user can override it either way, and that human judgement then wins for their workspace;
• a fake-follower suspicion score from 0 to 5, from your engagement rate relative to accounts your size (unusually low or unusually high), how uniform like counts are across posts, and the comment-to-like ratio. For Instagram accounts, when our statistics provider is enabled, that provider's measured fake-follower share is used instead of this heuristic;
• your audience's age bands, gender split and top countries and cities: measured by a third-party audience-statistics provider when one is enabled (Instagram), otherwise estimated by an AI model from your public content — an estimate, not a measurement. When that provider is enabled we also store what it measured about your audience: its interests, a follower-quality mix (real, influencer, mass-follower and suspicious accounts), reachability buckets, and its finer age bands;
• the brands and brand categories you mention most, from @-mentions, tags and hashtags — and, for Instagram when the statistics provider is enabled, the accounts that provider has recently seen you mention, with their profile link and avatar;
• accounts on other platforms that look like yours, matched by handle and display name with a confidence score;
• the positive / neutral / negative split of comments on your recent posts, when comments were fetched — only these counts are kept, never the comments.

We instruct the models not to guess names, ages or ethnicity.

What we never do

• We do not log in to see private content. On Instagram and TikTok a private profile is refused by our integration and nothing about it is kept. YouTube channels are public by nature; we only receive what YouTube serves publicly.
• We do not collect stories.
• We do not store lists of your followers or of the accounts you follow — only the counts.
• We do not infer, and keep no field for, ethnicity, religion, health, political opinions or sexual orientation.
• We do not look your handle up on subscription or adult platforms. A note such as "Also on OnlyFans" appears only when you put that link or name in your own public bio, and it never carries the link.
• We do not contact you ourselves, and we have no access to any platform inbox. Any message you receive comes from an agency: either an email sent from that agency's own Gmail account on its instruction (including follow-ups it scheduled) — every such email ends with a line naming Creahunt and linking to this notice — or an Instagram or TikTok direct message that the agency copied from a draft we generated for it and pasted into its own account by hand. Direct-message drafts carry no such line.

How long we keep it

• Re-hosted images: 90 days after upload, unless still referenced by a saved collection, a frozen/shared report or a live report.
• Discovery reports: 365 days after their last update, unless the agency shared, froze or pinned them, they are demo reports, or a newer report builds on them.
• Logs of what agency users did in the app (which can mention a handle they typed): 30 days.
• The statistics provider's cached record of your Instagram profile: refreshed once it is older than 7 days, deleted 30 days after it was fetched. Its cached list of your recent posts: refreshed once it is older than 24 hours, deleted 7 days after it was fetched.
• Collection entries: until the agency removes them or you ask us to erase.
• Everything else about you (follower-count history, outreach records, feedback an agency's client left on a shortlist, the list of handles a saved search has already alerted an agency about): until you ask us to erase it.
• Your opt-out (the entry on our suppression list): kept indefinitely — it is what keeps you out.
• The record of your privacy request (the handle, the email address you used, your message and the outcome): kept indefinitely next to the suppression entry, as our record of having handled it.

These limits are applied by a retention sweep that runs automatically once a day and that our operators can also run from the privacy request queue.

The statistics provider cache.For Instagram accounts, our statistics provider is asked about you only when an agency has saved you to its Collection. Saving you — or opening a Collection in which you are saved and have not been looked up yet — reads your profile record; opening your saved entry's details also reads the provider's list of your posts from the last 90 days. The agency is not charged for it and no click is needed. Nothing else calls the provider: a discovery run, the Profile Analyzer and a report's Creator analytics panel only read what is already cached. A short summary of the profile record — engagement rate, quality score, fake-follower share, follower change over 180 days and the largest gender, country, city and age group of your audience — together with the measured audience breakdown and the contact email the provider lists, is also stored on the agency's Collection entry and stays there as long as the entry does. The profile record (the creators_statistics_profiles table) holds everything the provider returns about the account: the audience panel, engagement and growth figures, quality and brand-safety scores (including how much of the content the provider rates as religious or political — a measure of topics, not of opinions), your apparent gender, age band, country, city and language, a contact email when the provider lists one, your recent posts, and the accounts that mention you or resemble you. The posts list (the creators_statistics_feeds table) holds, for each post from the last 90 days, its link, date, format, text, hashtags, mentions, image and video links, like, comment and view counts and whether it is marked as an ad. Both tables are covered by erasure, by the access export and by the retention limits above.

Who receives it

Providers that process data on our behalf:

The agencies that run searches receive the results and decide what they do with them, including any outreach. When an agency shares a shortlist with its client through a share link, the client sees your handle, display name, follower count, score and the AI-written headline — never your email. A shared collection also shows your avatar and up to four post thumbnails; a frozen report link shows your avatar, the AI-written rationale and the brief it was scored against, without post thumbnails.

Demo replays. Our operators run real discovery runs in demo workspaces and replay them, step by step, to sales prospects during a demo. A replay shows the real creators that run found — handle, display name, profile picture, follower count, score, headline and rationale — to the prospect. Demo reports are exempt from the report retention limit above; erasure still reaches them.

International transfers

Several of these providers are established in the United States or may process data there: Vercel, Neon, OpenAI, ScrapeCreators, Desearch, Google, Resend (our email provider when configured — it delivers the confirmation links for privacy requests and the notification emails agencies opt into, which name creator handles), Phyllo and the RapidAPI hosts. Where a provider is certified under the EU-US Data Privacy Framework we rely on that certification, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data-processing terms. The RapidAPI hosts are individual vendors we reach through the RapidAPI marketplace: for them we rely on RapidAPI's terms — see RapidAPI's privacy policy. When an agency connects Slack, Discord or Telegram, the alerts and command replies described above go to that service under the agency's own agreement with it.

Your rights

You can:

• object to this processing and opt out of future discovery;
• ask us to erase what we hold about your handle;
• ask for a copy of what we hold;
• ask us to restrict processing while we look at a request — our operators put the handle on the suppression list by hand while they do;
• complain to a supervisory authority: [FILL IN: the data-protection supervisory authority of the country where the legal entity is established], or the authority where you live.

What happens when you use the form.We email you a confirmation link that is valid for 7 days. An opt-out takes effect the moment you confirm and is kept indefinitely. Our suppression list is checked by discovery sourcing and scoring (including example handles and web-search hits), the similar-accounts drawer and seeded searches, the Profile Analyzer, the Creator analytics panel, collections, outreach drafts, sends and scheduled follow-ups, saved-search alerts, the Slack commands and the growth chart. Erasure runs immediately after you confirm, across every store listed on the confirmation page, which then shows you what was deleted (in the agencies' billing ledgers your handle is replaced by “[removed]” and the debit itself is kept, so a workspace's balance history stays complete); a report that is mid-run at that moment is skipped and listed for a re-run from our operator queue. A copy of your data is assembled when you confirm and shown to you on the same page.

Confirming the link proves control of the email address you entered, not that you are the creator. Our operators see every request in a queue and can reject one before its link is confirmed; a confirmed request has already been carried out — a later rejection does not undo an erasure or recall an export.

What erasure cannot reach:emails an agency already sent you from its own Gmail account, or direct messages it pasted into its own Instagram or TikTok inbox; alerts already posted to an agency's Slack, Discord, Telegram or inbox; our application logs, which name a handle when a report runs or an erasure is performed and which our hosting provider keeps for a short period; short-lived in-memory copies on a server that is still running (at most an hour); content already sent to the AI-model providers, which they keep under their own API retention; and the copies held by the third-party data providers or by the platforms themselves.

You can also write to privacy@creahunt.com. Requests by email are handled by hand.

Accounts and workspaces

There is no self-serve sign-up: after a demo we provision a workspace for you and hand over a login. We store the login name, the workspace's plan and Token balance, and everything you create in it — briefs, chat messages, discovery reports, saved searches, collections with your notes and labels, outreach drafts and their status. Data is scoped to your workspace. Our operators, the people who run demos, can open a demo workspace as its user to prepare and present a run; the app shows an operator bar while they do. A run made in a demo workspace is marked as a demo run, kept beyond the usual report retention, and can be replayed step by step to the prospect during a demo.

Demo requests

When you book a demo we store your work email, name, company, the search brief you describe, the plan you were looking at, the page that referred you (referrer and UTM tags), your preferred time slots, timezone and scheduling note, plus our operators' notes and status. New requests are forwarded to our internal Slack/Discord-style webhook and/or Telegram chat when those are configured. The thank-you page may embed a Calendly calendar when we have enabled it; the embed is loaded with your name and email address pre-filled in its web address, and Calendly's own privacy policy applies to it. Your IP address is used in memory to rate-limit submissions and is not stored.

Billing and usage

Usage is metered in Tokens. We keep a ledger per workspace: plan, balance, every debit with the operation, the seat that triggered it and — for per-creator work such as audience measurements, outreach drafts, top-ups on a single creator and find-similar searches — the creator's handle, plus grants and top-ups. A usage audit ledger mirrors the provider cost of each call with the same keys. When a creator asks for erasure, their handle in those entries is replaced by “[removed]” and the debit itself is kept, so your balance history stays complete. The app takes no card payments today — top-ups are credited without payment from inside the app and plans are set by us — so no payment-card data reaches us.

Gmail for outreach

If you connect Gmail, Google gives us an access token, a refresh token and the connected address. We store them for your workspace and use them for exactly two things: sending the outreach emails and follow-ups you compose or schedule, and reading message headers — never bodies — to notice replies. The scopes we request are gmail.send, gmail.metadata and your email address. Disconnecting deletes the tokens and asks Google to revoke them.

Creahunt's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Slack, Discord, Telegram and email notifications

• Slack bot: installing it stores your Slack workspace id and the bot token, encrypted at rest. The slash commands you send are processed like searches in the app; /roster analyze posts the analysed creator's handle, a bio excerpt (up to 240 characters), follower count and engagement rate into the channel where you ran it.
• Notification channels: a verified email address, a Telegram chat id, or Slack and Discord webhook URLs, stored per workspace. Alerts contain the search name, new creator handles and a link back to the app.

Cookies

We set three cookies, all of our own:

• acct_session — a signed, httpOnly session cookie that expires after 30 days. It is the only thing the server trusts for who you are.
• acct_roster — an unsigned copy of your login name, same lifetime, that the browser uses for small conveniences and the server never trusts.
• a short-lived state cookie during the Google or Slack connection flow.

No analytics or advertising cookies, and no third-party trackers. Your browser's local storage keeps a cache of your collection and your interface preferences.

Retention

Workspace data stays while the workspace exists; the retention limits above apply to reports, images and activity logs. Demo requests stay in our operator desk. Write to us to have a workspace's data deleted.

Security

• Sessions are HMAC-signed cookies that the server verifies on every request; identity never comes from an unsigned cookie.
• Slack bot tokens are sealed with AES-256-GCM before they are stored.
• Public share links use random, unguessable tokens.
• Secrets live in environment configuration, never in the code.

Your rights and contact

You can ask for access, rectification, erasure, restriction, portability, or object to processing, and you can complain to a supervisory authority: [FILL IN: the data-protection supervisory authority of the country where the legal entity is established], or the authority where you are. Write to privacy@creahunt.com.