Privacy notice
Effective 1 August 2026 · Version 2026-08-01
CreatorBase ("we", "us") is the data controller for the personal data described below. This notice explains what we collect, why, and the rights you have under UK GDPR and the Data Protection Act 2018.
Who this applies to
Creators who hold a CreatorBase account, and visitors to a public media kit page hosted on kit.harry.cymru.
What we collect
Account data. Your email address, password (stored only as a hash by our authentication provider), date of birth, and the date and time you confirmed you are 18 or over.
Consent records. Which version of these documents you accepted, and when.
Creator profile. Display name, real name if you give one, biography, contact email, country, language, avatar and cover images, categories, content samples, past brand partnerships, and your chosen media kit URL.
Audience figures. Metrics you enter by hand, and metrics we read from platforms you choose to connect. Every figure is stored with its source, whether you locked it, and when it was captured.
Connected platform data. For each platform you connect we store an access token and refresh token, encrypted at rest, along with your username, the platform's account identifier and the permissions you granted. Exactly which fields we read from each platform is listed on your Account page.
Media kit views. When someone opens your public media kit we record the date, the referring site, an approximate country and the type of interaction. We do not set cookies and we do not use any cross-site identifier. Visitor IP addresses are never stored: they are combined with a secret that rotates every day and reduced to a one-way hash, used only to avoid counting the same visitor twice in a day.
Billing data. If you subscribe, our payment processor handles your card details — we never see them. We store your subscription status, plan, renewal date, billing country and the consent you gave at checkout.
Why we use it, and our lawful basis
- To provide your account and media kit — performance of a contract.
- To verify you are 18 or over — legal obligation and legitimate interests.
- To read figures from platforms you connect — your consent, given when you
authorise the connection, withdrawable at any time by disconnecting.
- To count media kit views — legitimate interests in giving you basic audience
reporting, using the least identifying method available.
- To take payment and meet tax and accounting duties — contract and legal obligation.
- To keep an audit trail of changes to important records — legitimate interests
in security and dispute resolution.
Who we share it with
Our hosting and database provider, our payment processor, our email provider, and the platforms you explicitly connect. We do not sell personal data and we do not share it for advertising.
What is public
Anything shown on your media kit is public to anyone with the link. Your account email address, date of birth, audience demographics and any unpublished data are never shown on a public page.
How long we keep it
Account and profile data are kept while your account exists. Metric history is kept for as long as your account exists because growth over time is part of the product. If you delete your account, everything goes with it — including your consent and age-verification records. We keep no shadow copy.
Your rights
You may access, correct, erase, restrict or object to our use of your data, and request a copy in a portable format. Your Account page provides one-click access to two of these: a full JSON export of everything we hold about you, and a permanent account deletion that removes your rows, your uploaded files, and revokes any platform tokens.
To exercise any other right, email support@harry.cymru. We respond within one month. If you are unhappy with our response you may complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this notice materially we will tell you and record your acknowledgement of the new version.