1. Introduction
2. Data Controller & Operator Information
3. Information We Collect
3.1 Information You Provide Directly
- Account registration data: name, email address, username, password, profile photo, and biographical information.
- Creator profile data: portfolio links, content categories, audience demographics, and rate information you submit for the creator-brand marketplace.
- Business profile data: company name, industry, brand guidelines, campaign objectives, and billing information.
- Content you create, upload, or publish: videos, images, text, audio, comments, and other media.
- Communications: messages sent through the Platform, customer support inquiries, and survey responses.
- Payment and financial information: bank account details, tax identification numbers, and billing addresses processed through our third-party payment processors.
- Identity verification documents: where required for creator payout or compliance purposes.
3.2 Information Collected Automatically
- Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language preferences.
- Usage data: pages visited, features used, content viewed or interacted with, search queries, click patterns, referring URLs, and session duration.
- Location data: approximate geographic location derived from your IP address; precise location only with your explicit consent.
- Cookies and similar technologies: we use cookies, web beacons, pixel tags, local storage, and similar technologies. See Section 9 for full details.
3.3 Information from Third Parties
- Social media platforms: if you link or log in via third-party accounts (e.g., Google, Apple), we may receive your name, email, profile picture, and public profile information.
- Analytics providers: aggregated and pseudonymized usage data from third-party analytics services.
- Business partners and advertisers: campaign performance data, attribution information, and audience segment data.
- Publicly available sources: public social media profiles and publicly accessible databases for creator recruitment and partnership development.
3.4 Sensitive Personal Information
We do not intentionally collect sensitive personal information (such as racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or biometric data). If you voluntarily include such information in content you publish on the Platform, you do so at your own discretion and risk. We will treat any incidentally collected sensitive data with heightened safeguards as required by applicable law.
4. Legal Bases for Processing
GDPR, UK GDPR, LGPD
Processing necessary to perform our contract with you, including providing the Services, managing your account, facilitating creator-brand deals, and processing payments.
Where you have given clear, informed, and freely given consent — for example, for marketing communications, use of non-essential cookies, precise geolocation tracking, or processing of any special category data.
Processing necessary for our legitimate interests (or those of a third party), provided your rights do not override those interests. This includes fraud prevention, platform security, product improvement, analytics, and direct marketing to existing customers.
Processing necessary to comply with a legal or regulatory obligation, such as tax reporting, responding to lawful government requests, or maintaining records required by applicable law.
In rare cases, processing necessary to protect the vital interests of you or another person.
Where processing is necessary for a task carried out in the public interest or in the exercise of official authority, to the extent applicable.
You may withdraw your consent at any time by contacting us or adjusting your account settings. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
5. How We Use Your Information
5.1 Service Delivery & Operations
- Providing, maintaining, and improving the Platform and Services.
- Creating and managing your account, authenticating your identity, and enabling platform features.
- Facilitating the creator-brand marketplace, including matching creators with business campaigns, negotiating deals, and processing payments.
- Displaying content you publish and enabling other users to discover and interact with it.
- Processing transactions, sending confirmations, and managing billing.
5.2 Communications
- Sending service-related notices, including account verification, security alerts, technical updates, and policy changes.
- Responding to your inquiries, comments, and support requests.
- Sending marketing and promotional communications (with your consent where required by law).
5.3 Analytics, Personalization & Improvement
- Analyzing usage patterns and trends to improve our Services and develop new features.
- Personalizing your experience, including content recommendations and search results.
- Conducting research and analysis, including surveys and A/B testing.
5.4 Safety, Security & Legal Compliance
- Detecting, investigating, and preventing fraud, abuse, and other harmful activities.
- Enforcing our Terms of Service and Community Guidelines.
- Complying with applicable legal requirements and government requests.
- Protecting the rights, property, and safety of Historbit, our users, and the public.
5.5 Advertising & Measurement
- Facilitating ad placements on the Platform and measuring campaign effectiveness.
- Providing aggregated, anonymized reports to business partners. We do not sell your personal data to advertisers.
7. International Data Transfers
- Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO.
- Adequacy decisions by relevant authorities recognizing the destination country's data protection level.
- Binding Corporate Rules, where applicable.
- Your explicit, informed consent to the transfer, where no other mechanism is available.
- Supplementary measures such as encryption in transit and at rest, access controls, and pseudonymization.
You may request a copy of the applicable safeguards by contacting us.
8. Data Retention
We retain your data for as long as your account remains active.
We retain certain data for up to three (3) years after account closure.
Retained for as long as you remain subscribed, plus any legally required period.
Retained for a minimum of seven (7) years, or as required by applicable tax law.
Published content remains visible until you delete it or your account is terminated.
When personal data is no longer required, we will securely delete or anonymize it.
10. Your Rights
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data ("Right to Be Forgotten").
Request that we limit how we use your data in certain circumstances.
Request a machine-readable copy of data you have provided.
Object to processing based on legitimate interests or direct marketing.
Withdraw consent at any time where we rely on consent as our legal basis.
Exercise your privacy rights without receiving discriminatory treatment.
Where applicable, opt out of the sale or sharing of personal information.
Direct us to limit our use of sensitive personal information.
File a complaint with a supervisory authority in your jurisdiction.
Not be subject to decisions based solely on automated processing with legal effects.
To exercise any of these rights, contact us at harry@historbit.com. We will respond within the timeframe required by applicable law (generally 30 days).
11. Jurisdiction-Specific Provisions
11.1 EEA, United Kingdom & Switzerland
Our legal bases are described in Section 4. You may lodge a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany). International transfers are governed by Section 7 safeguards. We process children's data under 16 only with verifiable parental consent.
11.2 United States — California (CCPA/CPRA)
California residents have rights to Know, Delete, Correct, Opt Out of Sale/Sharing, Limit Sensitive Data Use, and Non-Discrimination. We do not sell personal information or share it for cross-context behavioral advertising. To make a verifiable consumer request, contact us at the details in Section 2.
11.3 United States — Other State Laws
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights. We honor these rights as required by applicable state law.
11.4 Brazil (LGPD)
Brazilian users have rights to confirmation of processing, access, correction, anonymization, blocking/deletion of excess data, data portability, and information about data sharing. You may petition the ANPD with complaints.
11.5 Canada (PIPEDA)
We comply with PIPEDA and applicable provincial privacy laws. You have the right to access and correct your personal information. We obtain meaningful consent and limit collection to identified purposes.
11.6 South Africa (POPIA)
You have the right to access, correct, and delete your personal information and to object to processing. You may lodge a complaint with the Information Regulator.
11.7 Japan (APPI)
We obtain consent for cross-border transfers and provide information about destination country data protection. You may request disclosure, correction, suspension of use, and deletion.
11.8 Australia (Privacy Act 1988)
We comply with the Australian Privacy Principles. You have the right to access and correct personal information and to complain to the OAIC.
11.9 South Korea (PIPA)
We obtain consent for collection, use, and cross-border transfer. You may access, correct, suspend processing, and delete your personal information.
12. Children's Privacy
13. Data Security
- Encryption of data in transit (TLS/SSL) and at rest.
- Access controls and authentication mechanisms, including role-based access.
- Regular security assessments, vulnerability testing, and penetration testing.
- Employee training on data protection and security best practices.
- Incident response procedures for detecting, reporting, and responding to data breaches.
- Secure development practices and code review processes.
No method of transmission or storage is completely secure. In the event of a data breach that poses risk to your rights and freedoms, we will notify you and the applicable supervisory authority in accordance with applicable law.
14. Third-Party Links & Services
15. Automated Decision-Making & Profiling
16. Data Protection Impact Assessments
17. Changes to This Privacy Policy
- Post the updated Privacy Policy on our website with a revised "Effective Date."
- Provide prominent notice on the Platform (e.g., a banner notification or in-app alert).
- Where required by law, obtain your consent before implementing material changes.
- Notify you via email where the change is significant.
Your continued use of the Services after the effective date of the updated policy constitutes your acceptance of the changes.
18. Contact Us
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.
19. Governing Law & Dispute Resolution
20. Miscellaneous
If any provision of this Privacy Policy is found invalid or unenforceable, the remaining provisions continue in full force.
This Privacy Policy, together with our Terms of Service, constitutes the entire agreement between you and Historbit regarding the processing of your personal data.
This Privacy Policy is drafted in English. If translated, the English version prevails in the event of conflict.
Our failure to enforce any provision shall not constitute a waiver of that provision or any other provision.