Privacy policy

ZeroLotus Ltd is the data controller. Yap Factory is a trading name of ZeroLotus Ltd, registered in England and Wales. Contact: privacy@yapfactory.com.

What we collect

• Account data: email, name, country, role.
• Creator profile: bio, topics, languages, rates, ad-rights prices, availability, and the public videos and metrics imported from social accounts you link. OAuth tokens are encrypted at rest and never logged.
• Brand data: company, app store listings, campaign briefs.
• Deal data: offers, drafts you upload, messages, reviews, disputes.
• Payments: handled by Stripe. We store Stripe identifiers and the last four digits and brand of a saved card, never full card or bank numbers.
• Optional ID check (creators): if you choose to verify your identity, see “ID checks” below.
• Usage: only where enabled, product analytics (PostHog) and error reports (Sentry), pseudonymous where possible.

Data from TikTok, Instagram and other linked accounts

Creators can link a TikTok account with TikTok Login Kit. We only ask for what the marketplace needs, and TikTok shows you each permission before you agree:

• Basic profile (user.info.basic, user.info.profile): your TikTok ID, display name, username, avatar, bio and profile link, so brands see who you are and we can stop duplicate accounts.
• Public stats (user.info.stats): follower, following, like and video counts, used to rank shortlists. Brands see plain-English reasons, never raw follower counts.
• Your public videos (video.list): titles, cover images, links and view, like, comment and share counts, used to show your portfolio to brands.

We do not post to TikTok, read your TikTok messages, or access private or draft videos. We never sell TikTok data or use it for advertising outside your deals. Access and refresh tokens are encrypted at rest. You can disconnect TikTok at any time from Settings, or in the TikTok app under Settings and privacy → Security → Manage app permissions. When you disconnect, we delete the tokens straight away and the imported profile data and videos within 30 days. Records of completed deals are kept as set out under Retention.

Creators can also link an Instagram Creator or Business account with Instagram Login. Instagram shows you each permission before you agree, and we ask for two:

• Basic profile and media (instagram_business_basic): your Instagram account ID, username, name, profile photo, follower count, and your posts’ captions, thumbnails, links, likes and comments, so brands see who you are and your reels, and we can confirm a deal’s post is yours.
• Insights (instagram_business_manage_insights): views, likes, comments and shares on your reels, used for your portfolio and a deal’s post, and which countries your followers are in, used to match you with brands’ target countries. Brands see plain-English reasons, never raw follower counts.

We do not post to Instagram, read or send your Instagram messages, or manage your comments. We never sell Instagram data or use it for advertising outside your deals. Access tokens are encrypted at rest and refreshed automatically while you stay linked. You can disconnect Instagram at any time from Settings, or in the Instagram app under Settings → Website permissions → Apps and websites. When you disconnect, we delete the tokens straight away and the imported profile data and videos within 30 days; asking Instagram to delete your data with us deletes the linked account and its imported videos straight away. Records of completed deals are kept as set out under Retention.

ID checks

Verifying your identity is optional. It only adds a verified badge to your profile; you can find work, accept offers and get paid without it. If you start a check, Didit (our ID verification provider) asks for a photo of an identity document and a selfie, and compares your face with the document photo and checks you are a real person in front of the camera. That comparison uses biometric data, which is special category data.

• Lawful basis: your explicit consent (UK GDPR Article 9(2)(a)), which you give in the check before anything is captured. You can withdraw it at any time by emailing privacy@yapfactory.com; we then delete what we hold from the check and remove the badge. Nothing else on your account changes.
• Who processes it: Didit processes the document images and face data on our behalf, under a data processing agreement. We do not receive or store your document images, selfie or face data.
• What we keep: the outcome of the check (verified, declined or unfinished) and, from the document, your legal name, date of birth, document type and issuing country. We use these to show the badge, confirm you are 18 or over, and match the name on your payout account.
• How long: we keep the outcome and those fields while your account exists and delete them with it. Didit keeps the images and face data only as long as needed to complete the check and meet its legal obligations, then deletes them under our instructions. The exact period is being confirmed with Didit before launch.

Message screening

To keep deals and payments on Yap Factory (Terms 6b) and to prevent fraud, we automatically check messages and other text you write to other users (deal messages, feedback, app access notes, reasons, reviews, profiles and briefs) for contact details, requests to pay outside the platform, and scams.

• What the check does: a message with an email address, phone number, messaging-app or payment details is not sent, and you see why. A social handle in a message is replaced with “[hidden]”. Other things that might be a way to leave, such as unknown links, are sent and flagged.
• Who reads it: only when something is flagged or the other person reports a message, our team reads it together with the messages around it. We do not otherwise read your messages.
• Decisions: blocking or hiding part of a message is automatic. Warnings, pauses on messaging, suspensions and any other decision about your account are always made by a person, and you can ask us to review one by writing to support@yapfactory.com.
• Lawful basis: our legitimate interests in enforcing our terms, keeping payments protected and preventing fraud.
• How long: the text of a flagged or blocked message is kept for 12 months, then deleted. A record that a flag existed, and any warning, stays with your account.

Why (lawful bases)

Performing the contract with you (running deals and payouts), our legitimate interests (matching, fraud prevention, message screening, keeping the service secure and improving it), your consent (the optional ID check) and legal obligations (tax records, and the identity checks Stripe runs before it pays you out).

Who sees it

Signed-in brands can find creators by default: your profile can appear in brand browse, on campaign shortlists and in brands’ daily match emails. Brands see your topics, rates, videos and plain-English reasons, never your follower count. You can turn this off at any time with “Show me to brands” in Settings; deals you already have and campaigns you asked to join are not affected. Your profile is not public on the open web.

Brands you have a deal with see what the deal needs: your drafts, posted videos and messages on that deal. Creators see a brand’s company name, apps, live campaigns and track record.

Processors

We use these services to run Yap Factory. Each processes personal data only on our instructions.

• Neon: database.
• Vercel: website and app hosting.
• Cloudflare: file storage for uploaded drafts and videos (R2), and the scheduler that runs deal timers.
• Stripe: card payments, holding payments and paying creators out (Stripe Connect), including Stripe’s own identity checks for payouts.
• Resend: email delivery.
• Didit: the optional ID check described above.
• TikTok: account linking and your public videos, as described above.
• Meta (Instagram): account linking, your reels and their insights, as described above.
• PostHog and Sentry: only when enabled, for product analytics and error monitoring.

Cookies

We don’t use advertising or tracking cookies, so there’s no cookie banner. We set only these, to run the service:

• yap_session: keeps you signed in. Strictly necessary.
• yap_google: set for up to 10 minutes while you sign in with Google, to check the sign-in came from you. Strictly necessary.
• yap_tz: remembers your browser’s time zone (for example Europe/London) for a year, so deadlines show in your local time. Functional.
• yap_id_nudge: remembers for 30 days that you chose “later” for the optional ID check, so we stop asking. Functional.

On our website, if you choose to see prices in £ or $, your browser remembers that choice on your device (local storage). Product analytics (PostHog), where enabled, runs without cookies. When you press play on a TikTok video on our website, TikTok’s player loads and TikTok may set its own cookies under its own policy.

Your rights

To exercise any right or ask a question, email privacy@yapfactory.com; we reply within 30 days. Access, export, correction and deletion are self-serve from Settings. When you delete your account, it closes straight away and your data is erased 30 days later, except records we must keep for tax. UK GDPR, EU GDPR and CCPA requests are served by the same controls. You can complain to the Information Commissioner’s Office (ICO).

Retention

Deal and payment records: seven years (tax). ID check outcomes: while your account exists. The text of flagged or blocked messages: 12 months. Everything else: until you delete it or your account.