Privacy Policy

1. General information

We only use data that we receive or process from you within the framework of data protection law.

You can find information on our site without having to provide personal information. You remain anonymous during your visit to our site. All connection information that your internet browser provides with every site view — such as the date, duration of stay or the name of your internet provider — is used without any personal connection with us, unless you have logged in with your username and password.

You provide personal information voluntarily. For example, when you use functions that require registration for the first time, your data will be saved to create an account. This will allow you to use our platform faster and easier in the future.

2. Data about Creators

We store the following information about creators:

How we use creator data

3. Data about Brands

We store the following data about brands and the users who represent brands:

How we use brand data

Connected stores

A brand can connect its online store to its workspace: Shopify, WooCommerce or Squarespace. Connecting is optional. What we can access depends on the platform:

• Squarespace: we read products, stock, orders, discount codes and the payment and refund records of your orders, so a sale can be linked to a creator's discount code. For the features you use, we also make changes on your site: free orders for products you gift to creators (we then read their shipping status), discount codes for creators, and creator content added to a product as an image when you choose that.
• Shopify: we read products, stock, orders and discount codes. For the features you use, we also make changes in your store: draft orders for products you gift to creators, creator content and the Creator Wall on your products, discount codes and store credit for creators, and an ambassador page with a link in your store menu.
• WooCommerce: your store gives us an API key with read and write access. We use it to read products, stock, orders and coupons, to create orders for products you gift to creators, to add creator content to your products, and to register webhooks so changes in your store reach us.

From your store's orders we keep only what we need to link a sale to a creator's code or link: order and customer numbers, amounts, discount codes and a hashed email address. We do not store your customers' names, addresses or phone numbers. We delete these order records after 24 months.

We store the access credentials for your store encrypted.

We use this data to show your products in your workspace, to run your campaigns and gifting with creators, and to show which sales came from creators. We do not sell it.

You can disconnect your store at any time under Integrations. We then delete the stored access credentials straight away, on all three platforms. The app or API key stays listed in your store until you remove it there: on Squarespace under your site's extensions, on Shopify in your store admin, and on WooCommerce by revoking the API key.

Messages between brands and creators

We store the messages brands and creators send each other on the platform. Our support team, including AI-assisted tools, may read these messages to help collaborations succeed, to provide support, to improve the quality of our service, and to prevent misuse. For example, we step in when a brand goes quiet, a package doesn't arrive or a creator gets stuck. We do this based on our legitimate interest in running a reliable platform. We don't use your messages for advertising and don't share them with anyone outside the collaboration, except with the service providers that run our support tools. You can object at any time by emailing meow@purrfluence.com.

4. Cookies

We have to use so-called cookies for some of our services. Cookies are small data files that your internet browser stores on your computer. Cookies can store information about your visit to our site.

5. Third-party service providers

We use trusted third-party service providers to operate our platform. Each provider only receives the data necessary for their service and is obligated to protect your personal data.

AI support tools

Customer support and quality

AI services help our support team read platform messages and spot collaborations that need help.

Instagram and Facebook (Meta)

When you connect an Instagram professional account, you log in with Facebook Login for Business and choose which Facebook Page and Instagram account Purrfluence may access. We only use Meta's official API. Meta's Terms and Privacy Policy also apply.

What we read

• Your profile: username, name, bio, profile photo, and your number of followers, accounts followed and posts.
• Your posts and stories: captions, photos and videos, date, likes and comment counts.
• Insights for your account and posts: reach, views, saves, shares, interactions, and your audience by age, gender and country.
• Comments on your posts, including the commenter's username and text, so you can read and answer them in Purrfluence.

How we use it

We use it to show your stats on your profile and to brands you work with, to match you with campaigns, to show how your posts perform, to help you reply to comments, and to publish posts you schedule. Nothing is posted on Instagram unless you click send, schedule or publish.

AI processing

To suggest replies, analyse your posts and draft captions, we send only the content needed (for example a comment, the caption and an image of the post) to AI services that process it on our behalf: the Google Gemini API, OpenAI, and OpenRouter as a backup. Through OpenRouter we only use providers that do not store or train on the data. These providers may not use your data to train their models or for any purpose of their own.

Who sees it

You, and brands you collaborate with: they see your stats and the content you deliver for their collaboration. We never sell your data.

Disconnect and deletion

• Remove connection in Channels stops our access and deletes our access tokens. The posts and stats we already collected stay in your profile history until you ask us to delete them.
• You can also remove Purrfluence under Facebook Settings, Business integrations. Meta then notifies us and we stop all access.
• If you choose to notify us, or email meow@purrfluence.com, we delete the posts, insights, comments and media that came from Instagram. The only exception is content you delivered for a paid collaboration: we keep that as proof of delivery for the brand.
• Meta gives you a confirmation code to check the status of your deletion request.
• When you delete your Purrfluence account, we remove your Instagram content within 30 days, with the same exception.

YouTube API Services

If you connect your YouTube channel, Purrfluence uses YouTube API Services to read information about your channel. By connecting YouTube you agree to be bound by the YouTube Terms of Service. Google's handling of your data is covered by the Google Privacy Policy.

What we read and why

We ask Google for read-only access. We never post, edit or delete anything on your channel.

• Your channel: its name, profile picture, subscriber count and number of videos. We show these on your Channels page so you can see which channel is connected.
• Your uploads: the titles, thumbnails and publish dates of your own videos, only when you open the list to pick the video you made for a campaign. We do not store this list.
• Results of a campaign video: for the video you attach to a YouTube deliverable, we read its views, minutes watched, likes and subscribers gained from YouTube Analytics.

We show these numbers exactly as YouTube reports them, labelled "Source: YouTube". We do not combine them into scores, rates or rankings of our own.

Who sees it, and how long we keep it

• Your channel details are visible to you.
• The results of a video you attach to a campaign are visible to you and to the brand that sponsored that campaign. That is why you attach it. We do not show YouTube data on your public profile, in your media kit, or to any other brand.
• We do not sell YouTube data and do not use it for advertising.
• We refresh YouTube data at least every 30 days, or delete it. Anything we could not refresh within 30 days is deleted automatically. Access tokens are stored encrypted.

Who we share YouTube data with

This is the complete list of everyone who receives Google user data, including YouTube data, from Purrfluence:

• The brand that sponsored your campaign. People on that brand's team in Purrfluence see the results of the one video you attached to that campaign: its title, thumbnail, publish date, views, minutes watched, likes and subscribers gained. They do not see your channel details, your other videos or your Google tokens.
• Service providers that run Purrfluence for us. They store or process the data only on our behalf, to provide their service to us:
  • Laravel Cloud, which hosts our servers and database on Amazon Web Services (AWS) in the United States (region us-east-1). This is where YouTube data is stored.
  • Cloudflare, which carries the encrypted traffic between your browser and our servers.
  • Sentry and Laravel Nightwatch, our error and performance monitoring. Our YouTube code does not send YouTube data to them. When something fails, they receive technical details such as a status code or an internal id.
• Authorities, only when the law requires it, such as a valid court order. We then disclose only what the order covers.

We never sell, rent or transfer YouTube data to advertisers, data brokers or information resellers, and we never use it for advertising.

We do not send YouTube data to any AI provider, such as Google Gemini, OpenAI or OpenRouter, and we do not use it to train AI models.

How we protect YouTube data

These are the safeguards in place today:

• Encrypted tokens. Your Google access and refresh tokens are encrypted with AES-256 before we store them. The key is kept outside the database. Tokens are never shown in the app or sent to anyone else.
• Encryption in transit. All traffic uses HTTPS (TLS): between your browser and Purrfluence, and between our servers and Google. Our API also sends HSTS, so browsers only connect over HTTPS.
• Access checks on every request. Only you can connect, view or disconnect your channel. The results of a campaign video can be opened only by you and by the team of the brand on that campaign. Anyone else is refused.
• Read-only access. We ask Google only for read-only permissions (youtube.readonly and yt-analytics.readonly), so we cannot change anything on your channel.
• Only what we need. We store your channel details and the results of videos you attach to a campaign. Your list of uploads is not stored.
• Automatic deletion. A daily job refreshes YouTube data or deletes it after 30 days. Disconnecting deletes it right away, and so does deleting your account.
• Short-lived backups. Database backups are kept for 7 days. Deleted YouTube data is gone from our backups within 7 days.
• Limited staff access. Our internal admin tools have no screen that shows YouTube data. Staff look at it only when you ask us for help, or to keep the service secure and working.

Disconnecting and revoking access

You can disconnect YouTube at any time on your Channels page in Purrfluence. We then revoke our access at Google and delete your channel details and the video results we got from YouTube right away. If you delete your account, your YouTube data is deleted with it.

You can also remove Purrfluence's access on the Google security settings page. When we notice that access was removed there, we delete the YouTube data we hold for you, within 30 days at the latest.

Questions about the YouTube data we hold, or a request to delete it: email meow@purrfluence.com.

Pinterest

If you connect your Pinterest account, Purrfluence uses the Pinterest API to read information about your account. Where posting is available, the same permission also lets you create pins from Purrfluence.

What we read and why

• Your account: username, account type, profile picture, followers, following, number of pins and monthly views. We show these on your Channels page. Your followers also appear on your creator profile, with a link to your Pinterest page.
• Your pins and boards: your own pins, only when you open the list to pick the pin you made for a campaign, and your boards, only when you create a pin. We do not store these lists.
• Results of a pin: impressions, saves, pin clicks and outbound clicks of a pin you attach to a campaign, as Pinterest reports them.

Posting pins

Where posting is available, Pinterest asks for this permission when you connect, together with the permission to read. It lets us create pins on your boards. Pinterest requires the board permission for creating a pin as well.

• We create a pin only when you press the button, or at the time you scheduled. We send Pinterest the image you chose, the board, and the title, description, link and alt text you wrote.
• We never edit or delete your pins, never create boards, and never post anything you did not make in Purrfluence yourself.

Who sees it, and how long we keep it

• The results of a pin you attach to a campaign are visible to you and to the brand that sponsored that campaign.
• We do not sell Pinterest data and do not use it for advertising.
• Access tokens are stored encrypted. We keep your account details while you stay connected, and the results of a pin for at most one hour in a temporary cache.

Disconnecting

• You can disconnect Pinterest at any time on your Channels page. We then delete your tokens and account details and remove the Pinterest channel from your profile. Pins that were scheduled but not yet posted will not be posted. Pins already on Pinterest stay there; you manage those on Pinterest. If you delete your account, your Pinterest connection is deleted too.
• You can also remove Purrfluence in your Pinterest settings.

6. Data retention

We retain your personal data for as long as necessary to provide our services and fulfill the purposes described in this policy.

7. Your rights

Under GDPR and other applicable privacy laws, you have the following rights:

Questions?