Privacy policy

Last updated 23 September 2026. Yap Factory Ltd is the data controller. We are registered with the ICO. Contact: privacy@yapfactory.com.

What we collect

Account data: email, name, country, role.
Creator profile: bio, niches, languages, rates, availability, and the public videos and metrics imported from social accounts you link. OAuth tokens are encrypted at rest and never logged.
Brand data: company, app store listings, campaign briefs.
Deal data: offers, drafts you upload, posted video URLs, metrics polled from platforms, messages, disputes.
Payments: handled by Stripe. We store Stripe identifiers, never card or bank numbers.
Usage: product analytics (PostHog) and error reports (Sentry), pseudonymous where possible.

Data from TikTok and other linked accounts

Creators can link a TikTok account with TikTok Login Kit. We only ask for what the marketplace needs, and TikTok shows you each permission before you agree:

Basic profile (user.info.basic, user.info.profile): your TikTok ID, display name, username, avatar, bio and profile link, so brands see who you are and we can stop duplicate accounts.
Public stats (user.info.stats): follower, following, like and video counts, used to rank shortlists. Brands see plain-English reasons, never raw follower counts.
Your public videos (video.list): titles, cover images, links and view, like, comment and share counts, used to show your portfolio and to verify that a paid video was posted and track its results.

We do not post to TikTok, read your messages, or access private or draft videos. We never sell TikTok data or use it for advertising outside your deals. Access and refresh tokens are encrypted at rest. You can disconnect TikTok at any time from Settings, or in the TikTok app under Settings and privacy → Security → Manage app permissions. When you disconnect, we delete the tokens straight away and the imported profile data and videos within 30 days, except post URLs and metrics tied to a completed deal, which we keep as payment records.

Why (lawful bases)

Performing the contract with you (running deals and payouts), our legitimate interests (matching, fraud prevention, improving the service) and legal obligations (tax records, KYC via Stripe).

Who sees it

Creator profiles are private by default and visible only to brands with an active shortlist or deal with you. Processors: Neon (database), Vercel and Cloudflare (hosting), Stripe (payments and identity), TikTok (account linking and public video metrics, as described above), Clerk (authentication), Resend (email), Anthropic (brief and summary generation, no training on your data), PostHog and Sentry.

Your rights

To exercise any right or ask a question, email privacy@yapfactory.com; we reply within 30 days. Access, export, correction and deletion are self-serve from Settings. Deletion is soft immediately and hard-purged after 30 days, except records we must keep for tax. UK GDPR, EU GDPR and CCPA requests are served by the same controls. You can complain to the ICO.

Retention

Deal and payment records: seven years (tax). Everything else: until you delete it or your account.