Privacy Policy

The data controller for personal data processed through the Service is 1Dataworld Inc., the operator of iCype. You can contact our privacy team at privacy@icype.com. If we are required to appoint an EU or UK representative or a Data Protection Officer, their contact details will be published here.

• Account data: name, email address, password hash, role (Vendor, Creator, Follower, Admin), profile information, language and country.
• Identity and payout data: bank or payout account details, tax identifiers, and identity verification documents required by law or by our payment partners.
• Content data: campaigns, pitches, messages, posts, ad creatives, and metadata you submit through the Service.
• Transaction data: campaign budgets, fees, payouts, invoices, and supporting records.
• Technical data: IP address, device identifiers, browser type, operating system, log files, access times, and pages viewed.
• Usage data: interactions with the Service, performance metrics, and aggregated engagement statistics.
• Communications: support requests, feedback, and correspondence with us.
• Cookies and similar technologies: as described in Section 9.

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health, sex life or sexual orientation, genetic or biometric data). Please do not submit such data through the Service.

• To provide and operate the Service (account creation, role-based access, campaigns, payouts) — performance of a contract (Art. 6(1)(b)).
• To process payments and prevent fraud — performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c)) and our legitimate interests in securing the platform (Art. 6(1)(f)).
• To comply with legal obligations (tax, accounting, anti-money-laundering, responding to lawful requests) — Art. 6(1)(c).
• To secure the Service and detect abuse — legitimate interests (Art. 6(1)(f)).
• To improve and develop the Service using aggregated and pseudonymised data — legitimate interests (Art. 6(1)(f)).
• To send service communications (transactional emails, security notices) — performance of a contract (Art. 6(1)(b)).
• To send marketing communications, where required, only with your prior consent — Art. 6(1)(a). You can withdraw consent at any time.

Where we rely on legitimate interests, you have the right to object as described in Section 7.

We share personal data only as necessary, with the following categories of recipients:

• Service providers (processors) acting on our instructions: cloud hosting, database, authentication, email delivery, analytics, customer support, and payment processors.
• Other users of the Service, where the nature of the platform requires it (for example, a Vendor sees the Creators participating in their campaign).
• Professional advisers (lawyers, auditors, accountants) under duties of confidentiality.
• Authorities when required by law, court order, or to protect our rights, users, or the public.
• Successors in the context of a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations.

We do not sell personal data and we do not "share" personal data for cross-context behavioural advertising as defined under the CCPA/CPRA.

We may transfer personal data to countries outside the European Economic Area ("EEA"), the United Kingdom, or your country of residence, including the United States. Where we do so, we rely on a valid transfer mechanism such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision, or your explicit consent. You may request a copy of the safeguards we use by contacting privacy@icype.com.

We retain personal data only for as long as necessary for the purposes described above and to comply with our legal obligations. Typical retention periods include:

• Account data — for the lifetime of your account and up to 24 months after closure for security and dispute-resolution purposes.
• Transaction and tax records — generally up to 10 years to comply with accounting and tax law.
• Server logs — typically up to 12 months.
• Marketing data — until you withdraw consent or object, and a short cool-down period thereafter.

Subject to applicable law, you have the right to:

• access the personal data we hold about you and obtain a copy;
• request rectification of inaccurate or incomplete data;
• request erasure of your data ("right to be forgotten");
• request restriction of processing or object to processing based on legitimate interests;
• data portability for data you provided based on consent or a contract;
• withdraw consent at any time, without affecting prior lawful processing;
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you;
• lodge a complaint with your local supervisory authority (in the EEA) or the UK Information Commissioner's Office.

To exercise any right, contact us at privacy@icype.com. We will respond within one month, extendable by two further months for complex requests.

If you are a California resident, you have additional rights to know, delete, correct, and limit the use of your personal information, and to opt out of any "sale" or "sharing" (which we do not engage in). We do not discriminate against users for exercising these rights. Residents of other US states with comprehensive privacy laws have analogous rights, which can be exercised by contacting privacy@icype.com.

We use cookies, local storage, and similar technologies to operate the Service, remember your preferences, secure sessions, and measure performance. Strictly necessary cookies do not require consent. Where required by law (for example in the EEA and UK), non-essential cookies and tracking technologies are only set after you provide consent through our cookie banner. You can change your preferences at any time from the cookie settings in the Service.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Measures include encryption in transit, access controls, role-based permissions, audit logging, secure software development practices, and vendor due diligence. No system is 100% secure; please use a strong, unique password and notify us promptly of any suspected compromise.

The Service is not directed to children under 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so we can delete it.

We do not make decisions producing legal or similarly significant effects based solely on automated processing. Some features (for example fraud detection or content ranking) involve automated processing as a support tool, with human review available where required.

We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be communicated through the Service or by email at least 14 days before they take effect, where feasible. The "Last updated" date at the top of this page indicates the most recent revision.

For privacy questions or to exercise your rights, contact privacy@icype.com. If you are not satisfied with our response, you have the right to lodge a complaint with your data protection authority.