Privacy Policy

Last updated April 2025

Nuwave Creators Ltd (“Nuwave”, “we”, “us”) is committed to protecting your personal data. This policy explains what information we collect across our influencer marketing platform, how we use it, and your rights — including those under GDPR and CCPA.

What We Collect

Account registration data: your full name, email address, password hash, and preferred language.
Creator profile data: social media handles, follower counts, niche categories, engagement metrics, bio, and portfolio content you upload.
Brand profile data: company name, registered address, industry vertical, billing contacts, and campaign briefs.
Influencer campaign data: campaign names, deliverable requirements, submission files, revision history, and approval records.
Payment and billing information processed securely through our PCI DSS-compliant payment provider (Stripe). We never store full card numbers.
Platform usage data: pages visited, campaigns viewed or applied to, messages sent, and session duration.
Communications between brands and creators conducted through the Nuwave in-platform messaging system.
Device and technical information: IP address, browser type, operating system, and referring URL.
Social platform API data: when you connect your Instagram, TikTok, or YouTube account, we read verified follower counts and public engagement metrics via official OAuth integrations.

How We Use It

To create and maintain your Nuwave account and provide access to platform features.
To match creators with relevant brand campaigns using our recommendation system.
To facilitate influencer campaign agreements, including brief distribution, content submission, and approval workflows.
To process payments, release creator payouts, and generate financial records for both brands and creators.
To send transactional notifications: campaign updates, application status changes, content approval events, and payment confirmations.
To verify creator audience authenticity and detect fraudulent metrics or bot activity.
To provide aggregated, anonymised campaign performance analytics to brands.
To improve platform features through anonymised usage pattern analysis.
To enforce our Terms of Service and respond to trust and safety issues.
To comply with legal obligations in applicable jurisdictions including Japan, South Korea, the United States, and the European Union.

Data Sharing

We do not sell your personal data to third parties.
Creator profile data (bio, handle, verified follower count, niche, engagement rate) is visible to brand accounts browsing our creator marketplace.
Brand campaign data (brief, budget range, brand name) is visible to creators browsing open campaigns.
When a campaign agreement is formed, brands and creators can see each other's contact details as specified in the agreement.
We share data with trusted sub-processors — including Stripe (payments), Vercel (hosting), and analytics providers — under strict data processing agreements that prohibit further sharing.
We may disclose information if required by a valid legal order from a court or regulatory authority in Japan, South Korea, the United States, or the European Union.
In the event of a merger or acquisition, your data may be transferred to the successor entity, subject to equivalent privacy protections.

Creator Data

Creator social metrics are sourced directly from platform APIs (Instagram Graph API, TikTok for Developers API, YouTube Data API v3) and refreshed every 24 hours.
Content you submit for campaigns — images, videos, captions — is stored securely and shared only with the relevant brand for the duration of the campaign and the agreed licence period.
Creator earnings history is retained for seven years for financial reporting and tax compliance purposes, even after account deletion.
Influencer campaign performance data (impressions, engagement, reach) reported by connected platforms is stored and may be used in aggregate form to generate platform-wide benchmarks.

Brand Data

Campaign briefs, budget figures, and brand assets you upload are stored securely and shared only with creators who are accepted into the relevant campaign.
Brand billing records and invoice data are retained for seven years for financial and tax compliance.
Aggregated campaign performance reports are retained indefinitely in anonymised form for platform analytics purposes.

Cookies

Essential cookies: required to maintain your login session and core platform functionality. These cannot be disabled without breaking the platform.
Analytics cookies: anonymised session data that helps us understand how users navigate Nuwave. No personal identifiers are shared with analytics providers.
Preference cookies: store your language and display settings between sessions.
You may disable non-essential cookies in your browser settings or through our cookie preference centre. This will not affect your ability to use core platform features.

Data Retention

Account data is retained for as long as your account remains active.
Upon account deletion, personal data is deleted within 30 days, except where we are legally required to retain it.
Financial records (campaign payments, payouts, invoices) are retained for seven years for tax and accounting compliance.
Campaign content submitted by creators is deleted within 90 days of campaign closure unless an extended licence is in effect.
Anonymised usage and analytics data may be retained indefinitely.

Cross-Border Data Transfers (JP / KR / US)

Nuwave operates infrastructure across Japan, South Korea, and the United States. Your data may be processed in any of these regions depending on platform load and feature availability.
Transfers of personal data from the European Economic Area to third countries (including Japan and the US) are made under Standard Contractual Clauses (SCCs) approved by the European Commission.
Japan-based data processing is conducted in compliance with the Act on the Protection of Personal Information (APPI).
South Korea-based data processing complies with the Personal Information Protection Act (PIPA).
US-based data processing complies with applicable state privacy laws including the California Consumer Privacy Act (CCPA).

Your Rights (GDPR / CCPA)

Access: you may request a copy of all personal data we hold about you at any time.
Correction: you may update inaccurate or incomplete data directly in your account settings, or request a correction from us.
Deletion (Right to be Forgotten): you may request deletion of your personal data. Financial records and legally required retention data are exempt.
Portability: you may request a machine-readable export of your personal data.
Objection: you may object to data processing based on legitimate interests, including marketing communications. We will stop unless we have compelling grounds to continue.
Restriction: you may request that we limit how we use your data while a dispute about its accuracy or lawfulness is resolved.
Opt-out of sale (CCPA): we do not sell personal data. California residents may confirm this or request disclosure of any data sharing.
To exercise any right, email privacy@nuwavecreators.com. We respond within 30 days. If you are in the EEA, you may also lodge a complaint with your local supervisory authority.

Contact

Data Controller: Nuwave Creators Ltd, registered in Japan.
Privacy enquiries: privacy@nuwavecreators.com
For EU/EEA residents, our EU Representative can be reached via the same privacy email address.
Our Trust & Safety team handles data breach notifications. If we become aware of a breach affecting your data, we will notify you within 72 hours as required by applicable law.

Questions about this policy?

privacy@nuwavecreators.com