Privacy Policy

Welcome to CreatoHunt ("we," "our," or "us"), operated by Tran Gia LLC. CreatoHunt is an influencer discovery, campaign management, and outreach platform designed to connect brand marketers and agencies with social media creators across platforms including YouTube and TikTok.

This Privacy Policy describes how we collect, use, store, disclose, and protect your personal information, campaign data, and third-party API data when you visit or use our application located at creatohunt.com (the "Platform" or "App").

1. Information We Collect

We collect information directly from you, automatically through your use of the Platform, and via third-party integration services (such as Google and TikTok APIs).

A. Information Provided Directly by You

• Account & Profile Data: When registering for CreatoHunt, we collect your full name, work email address, company name, and account password.
• Campaign & Financial Data: When managing influencer campaigns, we collect custom campaign names, targeted creator lists, outreach templates, private notes, internal status tags, negotiated creator rates, and allocated campaign budgets.
• Payment & Subscription Data: Payment details (credit card information and billing addresses) are collected directly by our PCI-DSS compliant payment processor, Stripe. CreatoHunt does not store or process raw credit card numbers.

B. Google Workspace & Gmail API Data (OAuth Data)

With your explicit consent via Google OAuth, CreatoHunt connects your Gmail account for send-only outreach. We request only the following permissions:

• User Identity (openid and userinfo.email): We identify your connected Google account and display its email address.
• Gmail API Access (gmail.send): We send outreach emails from your connected Gmail account to the recipients you select, using the subject and content you provide and only after you initiate sending in CreatoHunt. We process and store outgoing email subjects and content, recipient addresses, campaign associations, and send results (including message identifiers, sending status, timestamps, and error details) to queue your outreach, support retries, and display its sending history. We transmit the outgoing message and recipient addresses to Google to send the email.

CreatoHunt does not request Gmail read, modify, or delete permissions. This integration does not read your inbox, retrieve incoming replies, synchronize Gmail conversations, or modify or delete messages in your mailbox.

If you previously connected Gmail with broader permissions, you must reconnect with send-only permission before sending outreach. The current integration does not use older read or modify grants to access your mailbox.

C. TikTok Platform & Creator Data

When searching for or analyzing TikTok creators on CreatoHunt, we collect and process public platform data made available via official TikTok APIs or public creator listings:

• Creator Public Information: TikTok handle, display name, profile avatar, creator biography, verified status, primary category, and location.
• Public Performance Metrics: Follower counts, video view counts, total likes, video upload metadata, and calculated engagement rates.

D. Automatically Collected Technical Data

• Log files, IP address, browser type, operating system, timestamped access logs, and user interaction data within the dashboard.

2. How We Use Your Information

We use the collected information solely for the following legitimate business purposes:

1. Core Platform Functionality: Enabling discovery, evaluation, and outreach for YouTube and TikTok creators.
2. Campaign & Budget Management: Storing and organizing your private campaign lists, target creator sets, notes, and commercial budget allocations.
3. Gmail Integration: Allowing you to send outreach emails to influencers directly from your own Gmail account inside CreatoHunt and view the sending status of those user-initiated outreach jobs. Incoming replies are read in your own email client, rather than retrieved by CreatoHunt.
4. Platform Analytics & Support: Maintaining system security, debugging errors, and providing customer support.

3. Google API Services & User Data Policy Compliance

CreatoHunt's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Key Google API Warranties:

• Limited Use Commitment: Gmail API data is strictly used to send user-initiated outreach emails and display their sending status inside CreatoHunt.
• NO AI/ML Model Training: We explicitly state that Google API user data (including connected account information, outgoing email content, send results, and OAuth tokens) is NEVER used to train, retrain, fine-tune, or improve artificial intelligence (AI) or machine learning (ML) models.
• No Selling or Advertising: We do not sell, rent, trade, or transfer your Gmail data to third parties, data brokers, or advertising networks under any circumstances.
• Human Inspection Limits: Human employees or contractors do not read your stored outreach email content unless:
  1. You provide explicit permission for troubleshooting a specific bug;
  2. It is necessary for security investigation (e.g., abuse prevention); or
  3. Required by law.

4. TikTok Developer Platform & API Compliance

CreatoHunt adheres to all TikTok Developer Terms of Service and API Guidelines:

• Public Creator Metrics Only: TikTok creator data displayed on CreatoHunt is limited to public performance metrics and public video statistics.
• No Data Resale or Cross-Profiling: We do not sell TikTok creator data, compile off-platform personal dossiers on creators, or use TikTok API data for target advertising.
• Data Refresh & Accuracy: We regularly sync and refresh creator statistics from TikTok to ensure displayed information is accurate and up to date.

5. Security & Data Protection Controls

We prioritize the security of your sensitive personal, commercial, and email data. We implement industry-standard technical, organizational, and physical safeguards:

• Encryption in Transit: All communications between your browser, our servers, and third-party APIs (Google, TikTok, Stripe) are protected using TLS 1.2+ (HTTPS) encryption.
• Encryption at Rest: Sensitive data stored in our databases—including OAuth access/refresh tokens, user account credentials, campaign financial budgets, negotiated creator rates, and stored outreach email content and sending records—is encrypted at rest using AES-256 encryption.
• Multi-Tenant Data Isolation: We enforce strict Row-Level Security (RLS) policies at the database layer. This ensures your private campaign budgets, creator deal terms, and outreach sending records are strictly isolated and accessible only by authenticated users within your organization.
• Token Security: OAuth tokens for Gmail are stored securely with restricted access and rotated according to Google OAuth security recommendations.

6. Data Retention, Account Deletion & Revocation Rights

A. Data Retention Policy

We retain your personal data, campaign information, and OAuth tokens only for as long as your account remains active or as needed to provide you with the Platform's features.

This includes outgoing outreach content and sending records stored in CreatoHunt. Historical email records collected by an earlier version of the integration may remain subject to the same retention and deletion policies. Switching to send-only permission or revoking Gmail access does not itself delete data already stored in CreatoHunt; the current integration does not retrieve new inbox messages or incoming replies.

B. Self-Service Account & Data Deletion

You have the right to request or perform complete deletion of your account and associated data at any time:

• In-App Request / Email: You can request permanent account deletion by emailing us at quanth@creatohunt.com.
• Purge Process: Upon account deletion:
  1. All Google/Gmail OAuth tokens are immediately invalidated and permanently removed from our backend.
  2. All stored campaign budgets, notes, influencer lists, outgoing outreach content, sending records, and any historical email records associated with your account are permanently wiped from active databases within 30 days.

C. Revoking OAuth Permissions Directly

You may revoke CreatoHunt's access to your third-party accounts at any time directly through the respective platform settings:

• Google / Gmail Access: Revoke access at Google Security Settings - Connected Apps.
• TikTok Access: Revoke access via your TikTok Account Security and App Permissions settings.

Revoking Google / Gmail access prevents CreatoHunt from sending further emails through that connection. Revoking TikTok access prevents further authorized access to TikTok data on your behalf.

7. Third-Party Data Processors (Sub-processors)

We share information only with trusted service providers necessary to operate our platform:

We do not sell, rent, or share personal information with third-party advertisers or data brokers.

8. Your Global Privacy Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you possess the following rights regarding your personal data:

• Right to Access & Portability: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): Request permanent deletion of your personal data.
• Right to Restrict Processing: Request restriction of processing under certain conditions.

To exercise any of these rights, please contact us at quanth@creatohunt.com.

9. Children's Privacy

CreatoHunt is intended strictly for professional marketers, business representatives, and creator managers aged 18 and older. We do not knowingly collect personal data from children under the age of 13 (or 16 in certain jurisdictions).

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our platform capabilities, legal requirements, or third-party API policies (e.g., Google or TikTok policy updates). When updates occur, we will revise the "Last Updated" date at the top of this document. Continued use of the Platform after an update signifies your acceptance of the revised terms.

11. Contact Us

If you have questions, concerns, or privacy requests regarding this Privacy Policy or our data handling practices, please contact us:

• Entity Name: Tran Gia LLC (Operator of CreatoHunt)
• Email: quanth@creatohunt.com
• Website: https://creatohunt.com