Privacy Policy

The short version

We collect what the marketplace needs. Your account and profile details and, for Creators, your date of birth, so we can check you're 16 or older. For 16- and 17-year-olds, we also ask for a parent or guardian's name and email.
We check Creators are real. To apply, a Creator sends a selfie, a screenshot of their own Instagram or TikTok, or both, so our team can check it's really them. Only our team sees these, never Brands or other Users, and we don't use facial recognition.
Anyone can report an account. If someone is using your name or photos, or an account looks fake or unsafe, you can tell us, with or without an Account. We don't tell the person you reported who you are.
We don't sell it. We share it only with those who need it: other Users once matching opens, the service providers who run the Platform for us, our payment partner, and authorities when the law requires it.
It's stored outside South Africa. Our database is hosted in Europe. Our email providers, and the AI service that helps us sort the email sent to us, are in the United States. We use providers that protect it to a standard similar to POPIA.
Extra care for under-18s. Creators aged 16 and 17 need a guardian's consent, and a Creator must have a parent's consent before a child appears in their Content.
No tracking cookies. We don't use advertising or analytics cookies. Your browser stores one sign-in token so you stay signed in.
You're in control. You can see, correct and delete your information, object to how we use it, and opt out of marketing at any time. If we can't sort out a complaint, you can go to the Information Regulator.

This summary helps you find your way around. The full policy below is what applies.

What POPIA says we must tell you

Section 18 of POPIA lists what we must tell you when we collect your personal information. Here is where to find each item:

who we are, our address and our Information Officer: clause 2
what we collect, and where it comes from if not from you: clauses 4 to 6
why we collect it, and the lawful basis for each use: clause 7
whether you have to give it, and what happens if you don't: clause 4.7
laws that require or allow us to collect it: clause 7.4
who we share it with: clause 10
sending it outside South Africa: clause 11
your rights to access, correct and delete it, and to object: clause 16
your right to complain to the Information Regulator, and its contact details: clause 18

1. About this policy

1.1This Privacy Policy explains how [registered company name], trading as CreatorMatch ("CreatorMatch", "we", "us" or "our"), collects, uses, shares, stores and protects personal information when you use creatormatch.co.za, our apps, and every related service and communication (together, the "Platform"), and what rights you have. We process personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA") and its regulations.

1.2This policy applies to everyone whose personal information we process, including:

Creators;
Brands, and the people who act for them;
Guardians of Creators aged 16 or 17;
people who visit our website or contact us;
people who report an account, and people named in a report, including someone who says their identity has been used without their permission; and
people who appear in Content but don't have an Account, such as a Creator's friends, family or children.

1.3This policy forms part of our Terms and Conditions (the "Terms"), as clause 18.1 of the Terms says, and should be read with them. If the two conflict, clause 1.4 of the Terms explains which applies, but nothing in either document takes away a right you have under POPIA.

1.4POPIA protects information about companies and other juristic persons as well as individuals. This policy therefore also covers information about a Brand as a business, such as its name, website, budget and campaign plans.

1.5This policy explains only what CreatorMatch does with personal information. It doesn't cover the services of others, such as social media platforms or our Payment Partner, even when we link to them: their own privacy policies apply (clause 19 of the Terms). When another User receives your personal information through the Platform, that User is responsible for it themselves (clause 17).

1.6You can print or save this policy using the button at the top of this page. We keep every version, and we will email you a copy of the version that applied on any date if you ask.

2. Who we are and our Information Officer

2.1CreatorMatch is the responsible party for the personal information described in this policy. That means we decide why and how it is processed, and we are responsible for complying with POPIA.

Responsible party	[registered company name], trading as CreatorMatch, a private company incorporated in South Africa
Registration number	[registration number]
Physical address	[street address]
Information Officer	[name and position of the Information Officer]
Deputy Information Officer	[name and position, or "None appointed"]
Registered with the Information Regulator	[Information Officer registration number and date]
Email	hello@creatormatch.co.za, with "Privacy" in the subject line
Telephone	[phone number]
Website	creatormatch.co.za

2.2Our Information Officer makes sure we comply with POPIA, deals with requests from people exercising their rights under this policy, and works with the Information Regulator. Contact them about anything in this policy.

3. Words we use

In this policy, these words have the following meanings. Words with capital letters that aren't defined here, such as Account, Brand, Brief, Content, Creator, Deal, Deliverables, Guardian, Payment Partner and User, have the meanings in clause 3 of the Terms.

Child: Anyone under 18. POPIA calls them a child; the Terms call a Creator who is 16 or 17 a minor.
Competent person: Someone legally able to consent on a child's behalf, usually a parent or legal guardian.
Data subject: The person, or the company or other juristic person, that personal information is about.
Information Regulator: The independent body that enforces POPIA in South Africa (clause 18).
Operator: Someone who processes personal information for us under a contract without coming under our direct authority, such as our hosting and email providers.
Personal information: Information about an identifiable, living person or an identifiable, existing company or other juristic person. Examples are names, email addresses, dates of birth, photos, videos, voice recordings, online identifiers such as IP addresses, and opinions about someone.
Processing: Anything done with personal information, including collecting, storing, using, changing, sharing, sending and deleting it.
Responsible party: The person or organisation that decides why and how personal information is processed.
Special personal information: Information about someone's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour (clause 9).

4. Information you give us

4.1Most of the personal information we hold comes directly from you, when you sign up, complete your profile, use the Platform or contact us.

4.2Everyone who signs up.

Whether you are joining as a Creator or a Brand.
Your name and email address.
A password. Our sign-in provider stores it only in scrambled (hashed) form, so nobody at CreatorMatch can see it.
The version of the Terms you agreed to, that you agreed to this policy, and when.

4.3Creators.

At sign-up, your main niche and your date of birth.
On your profile, your city, the languages you create in, your Instagram and TikTok handles, links to examples of your work (your portfolio), a short bio and, if you add them, a profile photo, a banner image and a one-line headline. We remove location details from photos when you upload them.
To show it's really you, a selfie, a screenshot of your own Instagram or TikTok account, or both (clause 4.8).
Anything else you choose to add to your profile or send us.

4.4Brands.

At sign-up, the company name, your name, and an email address (a work email at a domain the business controls, if you have one).
On the Brand's profile, its website, city and category, its Instagram and TikTok handles if you add them, what content it needs, and its budget range.
The Briefs you post, and anything else you tell us about your products and campaigns.

4.5Guardians. If a Creator tells us they are 16 or 17, they must give us the name and email address of a parent or legal guardian. Because these details come from the Creator and not from the Guardian, we tell the Guardian when we contact them (clause 8.3). We may later ask the Guardian for proof of identity and guardianship (clause 6.3 of the Terms), and for their bank details if payouts go into their account (clause 6.5 of the Terms).

4.6When you contact us. Whatever you include when you email us, report a problem, make a complaint or ask to exercise your rights, and our replies.

4.7Whether you have to give it. Giving us personal information is voluntary, but the Platform can't work without some of it:

without a name, email address and password, we can't create an Account;
Creators must give their date of birth, and 16- and 17-year-olds their Guardian's details, or we can't accept them, because the Platform is only for Creators aged 16 or older and minors need a Guardian's consent;
we ask Brands to sign up with a work email if they have one, because it is our first check that you really act for the Brand, but an address from a free email service such as Gmail or Outlook is accepted;
Creators must add a selfie or a screenshot of their own Instagram or TikTok account, or both, before we can review their application, because that is how we check that the person applying is in control of the account; and
before we can review an application, Creators must add their city, niche, an Instagram or TikTok handle and at least one portfolio link, and Brands their city, website and what content they need.

Other details, such as languages, bio, category and budget, are optional: leaving them out just means Brands and our team know less about you. When a feature needs more information, such as bank details for payouts, we will tell you at the time whether it is required and what happens if you don't give it.

4.8Verification images (Creators, artists and labels). To apply, a Creator must add a selfie, a screenshot of their own Instagram or TikTok account, or both. We ask for them so that our team can check that the person applying is real and is in control of the account they listed, which helps keep fake and stolen accounts off the Platform. Artists, their managers and labels (Music Accounts in our Terms) don't send a selfie. Instead they send both a screenshot of the artist's or label's own Instagram or TikTok, signed in, and a screenshot of Spotify for Artists or Apple Music for Artists, signed in to the artist's page, so that our team can check they act for the artist whose music they want to promote. Everything else in this clause applies to them in the same way.

The selfie is a photo of your face. We ask you to hold a piece of paper with a short code on it next to your face, so that we know the photo is new and wasn't taken from somewhere else. The code is made from your Account number. It isn't a password.
The screenshot shows your own profile while you are signed in to it, so it shows your @handle and things only the account's owner can see. Please don't send a screenshot that shows other people's private messages.
Your browser shrinks each image and saves it again as a plain image before it is sent, which removes hidden details such as the place a photo was taken.
The images are kept in a private storage area. Only you and the named members of our team who review applications and reports can open them, and our team opens them through links that expire after 30 minutes. They never appear on your profile, and we never show them to Brands or other Users (clause 10.2).
A person on our team looks at them and compares them by eye with your profile and social media accounts. We don't use facial recognition or any other automated way of identifying people (clause 9.3).
You can replace or remove your images until you submit your application, and again if we ask you to send it again. While we review your application they are locked.
How long we keep them is in clause 12, and what applies to Creators under 18 is in clause 8.9.

4.9When you report an account. Anyone can report an account, whether or not they have an Account of their own, using the report form, or the Report button in a chat, on a Creator's profile or on a Brief. We collect:

the kind of problem (for example, that someone is using your identity) and what you tell us happened;
the account you are reporting, or the name or @handle you give us, and the chat or Brief you were reporting from, if any;
who you are: your Account if you are signed in or, if you are not, the email address you give us, which we use only to ask you about the report and to stop spam; and
a note of the reported account's name as it was when you reported it, so the record stays useful if that account is later deleted.

Only our team reads reports. We don't tell the person you reported that it was you, unless the law requires it or it is needed to protect someone's safety.

5. Information we collect automatically or from others

5.1Sign-in and security records. Our sign-in provider records when you sign up, confirm your email, sign in, ask for a sign-in link or reset your password, with the IP address and browser used.

5.2Technical information. When you visit the Platform, our hosting, security and content delivery providers receive and log your IP address, browser and device type, the pages and files requested, the page you came from, and the date and time. We use this to deliver pages, keep the Platform secure and fix problems, not to build a profile of you.

5.3Application records. Where your application is at (draft, waiting for review, approved or not approved), when you submitted it, when and by whom on our team it was reviewed, and any note we send you about it.

5.4Email records. Which emails we have sent you, such as approval emails, when, and whether they were handed to our email provider. Our emails don't contain tracking pixels, and we don't track whether you open them or click their links.

5.5Browser storage. A sign-in token kept in your browser while you are signed in (clause 14).

5.6From other sources.

The public social media profiles, websites and portfolio links you give us, which our team looks at to review your application. We see only what is public, and we never ask for your social media passwords.
For Brands, the Brand's website and public company information, such as records of the Companies and Intellectual Property Commission (CIPC), and whether the email domain you signed up with matches the website.
From Creators, their Guardian's details (clause 4.5).
From other Users, such as messages, reviews, ratings, Deal records, and Content in which you appear.
From anyone who reports an account, what they tell us about the account and the person behind it (clause 4.9). We may use it to decide whether to restrict or close an Account, but we don't tell you who made the report (clause 16.6).
From our Payment Partner and banks, such as whether a payment went through, payout and verification results, refunds and chargebacks.
From authorities, courts and others, where the law allows or requires them to share it with us.

5.7People who appear in Content. If you appear in a Creator's Content but don't have an Account, we receive your image, your voice and anything said about you through the Creator. The Creator must have your consent and, for a child, the consent of the child's parent or guardian (clause 13.7 of the Terms). You can contact us about it, or ask us to remove it from the Platform (clause 16).

6. Information from features still to launch

6.1We are launching the Platform in stages (clause 4.7 of the Terms). At the moment you can sign up, build a profile and apply. Swiping, matching, chat, Content uploads, payments, reviews and Guardian approvals are still to come. This clause explains what those features will collect, so you know in advance. If a feature turns out to need anything different, we will update this policy before it launches (clause 19).

6.2Matching. The Briefs and profiles you swipe on, your Super likes and Matches, how many swipes you have used, and your Plan.

6.3Chat. The messages, files and links you send and receive, and when. As clause 17.1 of the Terms explains, we may review and automatically scan them to keep Users safe and enforce the Terms.

6.4Content. The videos, photos, audio, captions and other files you upload, including the faces and voices of everyone in them. Files can also carry hidden details, such as when they were made, the device used and sometimes the location. If you don't want to share your location, turn off location tagging in your camera settings before you film.

6.5Deals. The terms of each Deal, the Deliverables, Deadlines, approvals and revisions, Usage Rights, and any dispute and our decision on it.

6.6Gifting Deals. The delivery address and phone number a Creator gives so a product can be sent to them. We share them only with the Brand in that Deal, which may use them only to send the product (clause 8.10 of the Terms).

6.7Payments and payouts. Brands pay through our Payment Partner, which collects card or bank details directly; we don't see or store full card numbers. We receive confirmation of each payment and refund. Creators, or their Guardians, give bank account details for payouts, which we or our Payment Partner verify. We also keep records of Subscriptions, Fees and invoices, and any VAT number you give us.

6.8Verification. Where the selfie and screenshot check in clause 4.8 isn't enough and we need to check someone's identity, age or guardianship, a business, or control of a social media account (clauses 5.6, 6.3 and 16.4 of the Terms): copies of identity documents, proof of guardianship or company registration, and the results of our checks.

6.9Reviews and badges. The reviews and ratings you give and receive, and any badge you are awarded.

6.10Guardian consent. How and when a Guardian gave or withdrew consent, and what they agreed to.

6.11Linked accounts. If we let you connect a social media account, the information that platform shares with your permission, such as follower numbers and engagement statistics. We will show you what we will receive before you connect.

7. Why we use it, and our lawful basis

7.1POPIA allows us to process personal information only for specific, lawful purposes and on one of the grounds in its section 11. The table shows what we use your information for and the ground we rely on. Contract means the processing is needed to give you the Platform under the Terms, or to take steps you ask for before agreeing to them. Legitimate interests means it is needed for our legitimate interests, or those of the people we share it with, and we have checked that those interests don't override your rights. Legal obligation means a law requires it.

What we use it for	Information	Lawful basis
Creating and running your Account: signing you up, confirming your email, signing you in and resetting your password	Name, email, password, whether you're a Creator or a Brand, sign-in records	Contract
Checking eligibility: that Creators are 16 or older, that minors have a Guardian, and that a Brand's email matches its business	Date of birth, Guardian details, email domain, company name and website	Contract; legitimate interests in a safe, genuine marketplace; for minors, Guardian consent (clause 8)
Reviewing applications and telling you the outcome	Profile, public social media and portfolio, review notes, email records	Contract; legitimate interests
Checking that a Creator is the person applying and controls the account they listed, using the selfie and screenshot they send (clause 4.8)	Selfie, screenshot of the Creator's own Instagram or TikTok account, the code on the paper, the result of our check	Your consent when you add them; contract; legitimate interests in keeping fake and stolen accounts off the Platform. For Creators under 18, Guardian consent (clause 8)
Checking that an artist, manager or label acts for the artist whose music they want to promote, using the screenshots they send (clause 4.8)	Screenshot of the artist's or label's own Instagram or TikTok account, screenshot of Spotify for Artists or Apple Music for Artists, the result of our check	Your consent when you add them; contract; legitimate interests in making sure only the people behind the music can promote it
Showing profiles and Briefs to other Users, matching and chat (when live)	Profile, Briefs, swipes, Matches, messages	Contract
Deals, delivering Content, payments, payouts, refunds and disputes (when live)	Deal records, Content, payment and bank details, messages	Contract; legal obligation to keep financial and tax records
Keeping Users safe, preventing fraud and off-platform dealing, and enforcing the Terms, including reviewing and scanning messages and Content (clause 17.1 of the Terms)	Messages, Content, account activity, reports, technical information	Legitimate interests; contract
Receiving and acting on reports about accounts, including reports that someone's identity has been stolen (clause 4.9)	The report, the reporter's Account or email address, the account reported, the chat or Brief it came from	Legitimate interests in protecting people from impersonation, fraud and abuse; legal obligation where the law requires us to act
Verification and badges	Identity and business documents, social media handles, bank details	Contract; legitimate interests; legal obligation where the law or our Payment Partner requires checks
Service messages about your Account, applications, Deals, payments, security and changes to our terms	Name, email	Contract; legal obligation, for example to tell you about a security compromise
Marketing our own services to you (clause 15)	Name, email, whether you're a Creator or a Brand, Plan	Your consent or, for existing Users, section 69(3) of POPIA, with the right to opt out
Promoting CreatorMatch with Users' public profiles and portfolio Content (clause 13.11 of the Terms)	Name, business name, logo, profile picture, public profile, ratings, portfolio Content	Contract; legitimate interests; for Creators under 18, Guardian consent (clause 8.4)
Improving the Platform, fixing problems and producing statistics	Technical information, how the Platform is used, feedback, de-identified where possible	Legitimate interests
Answering questions, complaints and requests to exercise your rights	What you send us, your Account details	Legal obligation under POPIA and PAIA; contract; legitimate interests
Complying with the law, keeping records, responding to authorities, and making or defending legal claims	Whatever is relevant	Legal obligation; legitimate interests in protecting our rights
Selling or restructuring our business (clause 29.4 of the Terms)	Whatever is relevant to the transaction	Legitimate interests

7.2Consent. Clause 18.2 of the Terms records your consent to us processing your personal information as this policy describes. Where we rely on consent, you can withdraw it at any time (clause 16). That doesn't make our earlier processing unlawful, and we may continue to process information where another ground in the table applies, for example to complete a Deal or keep records the law requires.

7.3New purposes. We use personal information only for the purpose we collected it for, or a purpose compatible with it. If we want to use it for something new and unrelated, we will tell you first and, where the law requires, ask for your consent.

7.4Laws that require or allow us to collect information. These include POPIA; the Consumer Protection Act 68 of 2008 and the Electronic Communications and Transactions Act 25 of 2002; the Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991 and the Companies Act 71 of 2008, which require us to keep financial and company records; the Financial Intelligence Centre Act 38 of 2001, which may apply to our Payment Partner; and the Promotion of Access to Information Act 2 of 2000 ("PAIA").

7.5Automated decisions. We don't make decisions about you based solely on automated processing that have legal consequences for you or affect you to a substantial degree. A person on our team reviews every application. Once matching and chat launch, we will use automated tools to rank and suggest Briefs and profiles and to flag messages that may break the Terms, but a person will review the matter before we suspend an Account or decide a dispute. We also use an AI service, Claude, made by Anthropic, to read the email sent to hello@creatormatch.co.za and pick out the messages that need a person, such as support requests, complaints and privacy requests. It doesn't reply to anyone or make decisions about you, and a person on our team deals with every message it picks out. You can always ask for a person to look again at a decision.

8. Children's personal information

8.1POPIA treats everyone under 18 as a child. We may process a child's personal information only in the cases section 35 of POPIA allows, which for us mainly means with the prior consent of a competent person, usually a parent or legal guardian.

8.2Under 16. The Platform is not for anyone under 16. Our sign-up form and our database both refuse a Creator Account for anyone younger. If we learn that an Account belongs to someone under 16, we close it and delete their personal information, keeping only a brief record of what we did and why. A parent who thinks their child has signed up can contact us (clause 2).

8.3Creators aged 16 and 17. When a Creator tells us they are 16 or 17, we:

collect only what we need to set up the Account and contact the Guardian: the Creator's name, email address, niche and date of birth, and the Guardian's name and email address, plus the selfie or screenshot every Creator sends to show it is really them (clause 4.8);
email the Guardian to explain what we hold, how we will use it and where to find this policy, and ask for their consent [the Guardian consent email isn't built yet (stage 2)];
keep the Account on hold until the Guardian consents: the Creator can fill in their profile, but we won't approve it or show it to Brands, the Creator can't Match, agree Deals or be paid (clause 6.3 of the Terms), and we don't send them marketing; and
close the Account and delete the information, other than a brief record of our request and the outcome, if the Guardian refuses or hasn't consented within 30 days.

8.4What a Guardian consents to. By consenting, a Guardian agrees, on the child's behalf, to us processing the child's personal information as this policy describes, including sharing it with Brands for Deals and storing it outside South Africa (clause 11), as well as to the things in clause 6.2 of the Terms. Although clause 13.11 of the Terms lets us use Creators' public profiles to promote CreatorMatch, we won't feature a Creator under 18 in our own marketing without first asking their Guardian.

8.5Guardians' rights. Until the Creator turns 18, their Guardian may exercise the Creator's rights under this policy (clause 16) on the Creator's behalf. A Guardian can withdraw consent at any time by emailing us. If they do, we close the Account, and any Deals already in progress are dealt with under clause 25 of the Terms. The Creator can also contact us directly about their own information.

8.6Sharing less. We don't show Brands a Creator's date of birth, Guardian's details or verification images. We may show that a Creator is under 18, so that Brands can follow the rules on age-restricted products in clause 6.4 of the Terms. We don't send marketing to Creators under 18 unless their Guardian has agreed, and we never send marketing to Guardians.

8.7Turning 18. When a Creator turns 18, the Guardian's role ends. We stop contacting the Guardian, except about Deals agreed before then, and keep the Guardian's details and consent record only as long as clause 12 allows.

8.8Children in Content. Some Content, especially in parenting, family and home niches, shows children. A Creator who includes anyone under 18 in Content confirms that they are that child's parent or guardian, or have that person's written consent (clause 6.7 of the Terms). We process the child's image, voice and other details in the Content on the basis of that consent. To protect children, Creators should not include a child's full name, school, home address or anything else that shows where the child can be found. A parent or guardian of a child in Content can ask us to remove it from the Platform. We will do so, and pass the request on to any Brand that received the Content.

8.9Selfies and screenshots from Creators under 18. A 16- or 17-year-old sends the same selfie or screenshot as every other Creator (clause 4.8). A child's selfie is a child's personal information, so the Guardian's consent in clause 8.3 covers it. It is seen only by our team, never shown to Brands, kept as clause 12 says, and deleted with the rest of the child's information if the Guardian refuses or doesn't consent in time. [Attorney to confirm whether a 16- or 17-year-old may send a selfie before their Guardian has consented, or should be offered the screenshot only.]

9. Special personal information

9.1Apart from the selfie in clause 9.5, we don't ask for special personal information, and we don't need it to run the Platform. Please don't add it to your profile unless you are happy for Brands to see it.

9.2Content and profile photos can reveal some special personal information anyway, such as someone's race or ethnic origin from their appearance, their religion from what they wear, or a health condition in a skincare or fitness video. We process it only as part of the Content you choose to create and share, on the basis of your consent (section 27(1)(a) of POPIA) or, where you have made it public yourself, section 27(1)(e).

9.3We don't use facial recognition, voice recognition or any other biometric technology to identify people in photos, videos or recordings.

9.4If we suspect illegal activity on the Platform, we may process information about alleged criminal behaviour to report it to the authorities (clause 15.2 of the Terms), or to establish, exercise or defend a legal right (section 27(1)(b) of POPIA). We do so only as the law allows.

9.5Selfies. A selfie shows your face, and a face can reveal things such as race or ethnic origin. We use a Creator's selfie only to check that they are the person applying (clause 4.8), and for nothing else. A person on our team looks at it; we don't run it through facial recognition or any other biometric technology (clause 9.3). We rely on your consent, which you give when you add it (section 27(1)(a) of POPIA). [Attorney to confirm whether a selfie used to check identity counts as special personal information (biometric), and whether this wording and the consent line on the account page are enough.]

10. Who we share it with

10.1We don't sell, rent or trade personal information, and we don't share it with anyone for their own marketing.

10.2Other Users. Users only see each other through matching, and only what matching needs:

when a Creator likes one of a Brand's Briefs, that Brand sees the Creator's first name and last initial, age (not date of birth), profile photo, banner and headline, city, niche, languages, social media handles, portfolio links and bio, and, once they launch, ratings and badges. Creators under 18 aren't shown to Brands until their Guardian has approved their account;
Creators see approved Briefs, with the Brand's name, category and website; and
after a Match, the Brand and Creator see each other's messages and the Deal details, and receive the Content and delivery details needed for that Deal. Our team can read these chats to handle disputes, reports and safety concerns (see clause 10.3).

We don't show other Users your email address, password, date of birth, Guardian's details, bank details or verification images, except where you share them yourself as clause 12.2 of the Terms allows.

10.3Our team. People on our team who need it for their work, such as reviewing applications, supporting Users and handling disputes and reports, and who must keep it confidential. Only the named members of our team who review applications and reports can open verification images and reports.

10.4Service providers. The operators who host, store and send information for us, and the AI service that helps us sort the email sent to us (clause 7.5), listed in clause 11. They may use it only on our instructions, and must keep it secure and confidential under written agreements, as section 21 of POPIA requires.

10.5Our Payment Partner, [payment partner name], which processes payments, holds Deal Funds and verifies bank details. It is a separate responsible party for its own legal duties, such as those under the Financial Intelligence Centre Act and card network rules, and its own privacy policy applies to those.

10.6Professional advisers, such as attorneys, auditors, accountants and insurers, who must keep it confidential.

10.7Authorities, such as the South African Police Service, the South African Revenue Service, the Information Regulator, courts and other regulators, when the law requires it, or where it is reasonably necessary to protect someone's safety, prevent fraud or crime, or enforce the Terms (clause 15.2 of the Terms). For example, we may give the police a report of stolen identity or fraud, with any verification images that are relevant to it.

10.8A buyer or successor, if all or part of our business is sold or restructured (clause 29.4 of the Terms). They must use your personal information in line with this policy, and we will tell you.

10.9Anyone else, with your consent or at your request.

11. Sending information outside South Africa

11.1Apart from one server of our own in South Africa, which checks the email sent to us and keeps a record of it, we don't run our own servers. The service providers we use to run the Platform and our email store and process personal information in other countries:

Provider	What it does for us	Where
Supabase, Inc.	Our database, Accounts and sign-in, and file storage, including verification images and, once Content uploads launch, Content	Hosted on Amazon Web Services in [London, United Kingdom, or Frankfurt, Germany: the region chosen in Supabase]. Supabase is a US company, and its staff and sub-processors may access information from other countries to support and secure the service.
Resend, Inc.	Sends our emails, such as sign-up confirmations, sign-in links, password resets and application updates, and the alerts we send our own team, such as a notice that a new report has come in, which includes what the reporter wrote	United States
Zoho Corporation	Hosts our mailboxes, including hello@creatormatch.co.za, so it holds the emails you send us and our replies	Zoho's data centres in the United States. Zoho's head office is in India, and its staff may access information from other countries to support and secure the service.
Anthropic, PBC (Claude)	An AI service that reads the emails sent to hello@creatormatch.co.za, picks out the ones that need a person on our team (clause 7.5), and answers our team's questions about them. It doesn't reply to anyone.	United States
Cloudflare, Inc.	Our domain name, protection against attacks and [website hosting: confirm the site is on Cloudflare Pages]	A global network that includes data centres in South Africa. Cloudflare is a US company.
Google Fonts (Google LLC)	Supplies the typefaces on our pages, which your browser fetches directly from Google	United States and Google's global network
jsDelivr	Delivers the code our pages use to sign you in	A global content delivery network
[payment partner name]	Payments, Deal Funds and payouts, once payments launch	[country]

11.2Section 72 of POPIA allows us to send personal information out of South Africa only in certain cases. We rely on these:

the recipient is bound by a law, binding corporate rules or a binding agreement that protects the information to a standard substantially similar to POPIA, including when it is passed on again. The United Kingdom and the European Union have data protection laws of this kind (the UK GDPR and the GDPR), and our providers commit, in data processing agreements, to protect personal information to this standard;
the transfer is needed to perform our contract with you, or to take steps you ask for before entering into it. For example, we can't send you a sign-in link without our email provider, or read the emails you send us without our mailbox provider; and
you have consented to it in clause 18.2 of the Terms.

11.3We require the same of any new provider, and we will update the table in this clause when our providers change.

12. How long we keep it

12.1We keep personal information only as long as we need it for the purpose we collected it for, unless the law requires or allows us to keep it longer, we reasonably need it for a lawful purpose connected with our business, a contract requires it, or you consent (section 14 of POPIA). As a guide:

Your Account and profile	While your Account is open. After it closes, we delete or de-identify it within 90 days, apart from the records listed below.
Applications never submitted, or not approved	We delete a draft Account after 12 months without a sign-in, after emailing you first. If we don't approve an application, we keep it for 12 months after our decision so you can update and resubmit it, and then delete it if you haven't.
A 16- or 17-year-old's Account without Guardian consent	Deleted if the Guardian refuses, or 30 days after sign-up if they haven't consented (clause 8.3).
Guardian details and consent records	While the Creator's Account is open, and then for 5 years, so we can show that consent was given for Deals the Creator agreed as a minor.
Records of what you agreed to	The Terms version you accepted and your consents: while your Account is open and for 5 years after it closes. If you opt out of marketing, we keep your email address and the date for as long as we need to make sure we don't contact you again.
Deal records, chat messages and Deliverables (once live)	5 years after the Deal ends, or after any dispute about it is resolved, as evidence of what was agreed (clause 17.2 of the Terms).
Payment, payout, invoice and tax records	At least 5 years, as tax law requires, and up to 7 years for the accounting records the Companies Act requires.
Identity and verification documents (once live)	Only until the check is complete, then deleted. We keep a record of the result while your Account is open.
Verification selfies and screenshots (clause 4.8)	We delete them 30 days after we approve your application, unless a report about your Account is open, in which case we keep them until it is resolved. If we don't approve your application, we keep them with it for 12 months after our decision so you can resubmit, and then delete them. If your Account closes, we delete them within 30 days. [Deleted automatically once the daily cleanup is switched on (see the README): confirm this rule before launch.]
Sign-in, security and technical logs	Up to 12 months, unless we need them longer to investigate a security incident or misuse.
Email records	While your Account is open, and deleted with it.
Messages to us, complaints and privacy requests	3 years after the matter is closed, which is the usual time limit for legal claims.
Reports about accounts (clause 4.9)	3 years after the report is resolved, which is the usual time limit for legal claims, and then deleted, along with the reporter's contact details. If the account reported is deleted before then, the report stays, with a note of the account's name at the time.
Profiles and portfolio Content in our own marketing	We stop using them in new material when you ask, or when your Account closes. Posts already published may stay up where removing them isn't reasonably possible, but we will remove any that feature a Creator under 18 if their Guardian asks.

12.2We may keep information for longer when the law requires it, or while we need it to investigate a complaint, fraud or security incident, or to make or defend a legal claim, but only for as long as that lasts.

12.3Deleted information may remain in encrypted backups for a short time, normally no more than 30 days, until they are overwritten. We restore from backups only to recover from an incident.

12.4We may keep information that has been de-identified, so that it can no longer identify anyone, for statistics and to improve the Platform.

12.5How long a Brand keeps Content or other personal information it received through a Deal is up to the Brand, subject to POPIA, its Usage Rights and clause 18.3 of the Terms.

13. How we protect it

13.1We take appropriate, reasonable technical and organisational measures to prevent personal information being lost, damaged, accessed without authority, or unlawfully destroyed, as section 19 of POPIA requires. They include:

encrypting information sent between your browser and the Platform (HTTPS);
keeping our database with a provider that encrypts it where it is stored;
storing passwords only in hashed form, and making sign-in and password reset links expire;
database rules that let each member see and edit only their own profile, stop members changing their own approval status or role, and let only named members of our team see applications;
keeping verification images in a private storage area that only you and the named members of our team can open, with team access through links that expire after 30 minutes;
keeping secret keys, such as our email provider's key, in an encrypted vault rather than in the website's code;
giving people on our team access only to what they need, under a duty of confidentiality;
written agreements with our operators that require them to keep information secure (section 21 of POPIA); and
regularly checking for new risks and updating our safeguards.

13.2Security compromises. If we have reasonable grounds to believe that someone has accessed or acquired your personal information without authority, we will tell the Information Regulator and you as soon as reasonably possible (section 22 of POPIA), unless the police or another body investigating a crime tells us that this would hinder its investigation. We will give you enough information to help you protect yourself, including who was responsible, if we know.

13.3No system is completely secure, so we can't guarantee that information will never be compromised (clause 18.4 of the Terms). Keep your password private, secure your email account and devices, and tell us at hello@creatormatch.co.za straight away if you think your Account has been compromised (clause 5.4 of the Terms).

14. Cookies and local storage

14.1We don't use advertising cookies, analytics or tracking tools, or social media pixels, and we don't let advertisers track you on the Platform.

14.2Staying signed in. When you sign in, our sign-in provider keeps a sign-in token in your browser's local storage, under a name starting sb- and ending -auth-token. It keeps you signed in as you move between pages. It is strictly necessary for your Account to work, is removed when you sign out, and isn't used to track you. If you clear it, you will be signed out.

14.3Services that load with our pages. Our pages load typefaces from Google Fonts and sign-in code from jsDelivr. Your browser fetches these directly, so those providers receive your IP address and browser details. They don't set cookies through our pages. When you view a Creator's profile, their clips play in the players of the service that hosts them (TikTok, Instagram, YouTube or Google Drive). TikTok's player loads with the profile so you can see each clip's cover; the others load only when you choose to play a clip, and YouTube clips play in YouTube's privacy-enhanced mode. These services receive your IP address and browser details, and TikTok, Instagram and Google may set their own cookies under their own privacy policies.

14.4Security cookies. Cloudflare, which protects our website, may set strictly necessary cookies, such as __cf_bm, to tell real visitors from automated attacks. They are used only for security.

14.5Because we use only strictly necessary storage, we don't ask you to accept cookies. If we add analytics or any other storage that isn't strictly necessary, we will update this policy first and ask for your consent where the law requires it.

14.6You can block or delete cookies and local storage in your browser settings. If you block local storage for our site, you won't be able to sign in.

15. Messages we send you and direct marketing

15.1Service messages. While you have an Account, we send you messages about your Account, applications, Deals, payments and security, and about changes to the Terms or this policy, by email and on the Platform. You can't opt out of these, because the Platform can't work without them (clause 17.4 of the Terms).

15.2Marketing. We may send you news, tips, invitations and offers about CreatorMatch's own services, by email or on the Platform. We do so only as section 69 of POPIA, section 11 of the Consumer Protection Act and section 45 of the Electronic Communications and Transactions Act allow:

to Users, about our own services similar to the ones they signed up for, if we gave them a free and simple way to say no when we collected their details and they didn't use it; and
to anyone else, only with their consent, which we will ask for only once.

15.3We don't send marketing to Guardians, or to Creators under 18 unless their Guardian has agreed (clause 8.6).

15.4Opting out. Every marketing message says who it is from and includes a free, easy way to unsubscribe. You can also opt out at any time by emailing hello@creatormatch.co.za. We will stop within 5 Business Days, across every channel we market to you on.

15.5We don't currently market by SMS, WhatsApp or phone call. If we start, we will ask for your consent first.

16. Your rights and how to use them

16.1Under POPIA you have the right to:

be told when your personal information is collected and why, which is what this policy is for;
ask us, free of charge, whether we hold personal information about you, and ask for a copy or description of it, including who has had access to it (section 23);
ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and to destroy or delete records we are no longer allowed to keep (section 24);
object, on reasonable grounds, to processing based on legitimate interests (section 11(3)(a));
object to direct marketing at any time (sections 11(3)(b) and 69);
withdraw your consent at any time (section 11(2)(b));
not be subject to a decision based solely on automated processing that has legal consequences for you or affects you to a substantial degree (section 71);
complain to the Information Regulator (clause 18); and
bring civil proceedings if your personal information is interfered with (section 99).

16.2How to ask. You can update most of your profile yourself on your account page. To change your email address or date of birth, or for anything else, email hello@creatormatch.co.za with "Privacy request" in the subject line, saying what you would like us to do. You may use the forms in the regulations under POPIA, such as Form 1 to object and Form 2 to ask for a correction or deletion, which are on the Information Regulator's website, but you don't have to.

16.3Checking it's you. To protect your information, we will confirm who you are before acting on a request, usually by replying to the email address on your Account. We may ask a Guardian, or anyone acting for someone else, for proof that they are allowed to.

16.4How long it takes. We will acknowledge your request within 5 Business Days and respond within 30 days. If we need longer, for example because a request is complex, we will tell you why, and when you will hear from us, before the 30 days are up.

16.5Cost. Confirming whether we hold your information, correcting it, deleting it and opting out of marketing are free. For a copy of records, we may charge the fee PAIA allows, and we will tell you the cost before we go ahead. You can also ask for records under PAIA: see [link to our PAIA manual].

16.6When we can't do what you ask. We may refuse or limit a request where the law allows or requires us to, for example to protect someone else's privacy (including the identity of someone who reported an account), where the law requires us to keep the information, or where we need it to complete a Deal, resolve a dispute, or make or defend a legal claim. We will explain why. Deleting some information, such as your email address, means closing your Account (clause 25.1 of the Terms). If you're unhappy with our answer, you can complain to the Information Regulator (clause 18).

16.7If we correct or delete information we have already shared with others, and the change affects decisions about you, we will tell those we shared it with, where reasonably possible.

17. Other people's information you receive or give us

17.1Please keep the information in your Account accurate and up to date. If you give us someone else's personal information, such as your Guardian's details, make sure you are allowed to and that they know.

17.2When personal information about another User, or anyone in Content, reaches you through the Platform, you are responsible for it under POPIA as a separate responsible party. Clause 18.3 of the Terms says what you must do: use it only for the Deal it was shared for, keep it secure, don't share it further or use it for marketing, and delete it when you no longer need it.

17.3Brands that use Content showing children must also follow POPIA's rules for children's personal information (clause 6.7 of the Terms).

17.4If you think someone is misusing personal information they got through the Platform, tell us at hello@creatormatch.co.za.

17.5If someone is using your identity. If you think someone has set up an account with your name, photos or social media account, you don't need an Account to tell us: use our report form. We may ask you to show who you are, for example with a screenshot of your own social media account. If we are satisfied, we can restrict or close the other account (clause 25.2 of the Terms) and, where we can, tell you what we did.

18. Complaints and the Information Regulator

18.1If you're unhappy with how we have handled your personal information, please tell our Information Officer first (clause 2), with "Privacy complaint" in the subject line. We deal with complaints as clause 27.2 of the Terms describes: we acknowledge them within 5 Business Days and aim to resolve them within 20 Business Days.

18.2You may complain to the Information Regulator at any time, whether or not you have complained to us first (clause 27.4 of the Terms):

Website	inforegulator.org.za
Complaints	Fill in POPIA Form 5 from the Regulator's website and email it to POPIAComplaints@inforegulator.org.za, or lodge it through the Regulator's online portal
General enquiries	enquiries@inforegulator.org.za
Telephone	010 023 5200
Address	Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

These details were correct when this policy took effect. The Regulator's website has the latest.

19. Changes to this policy

19.1We may update this policy from time to time, for example when we launch new features, change service providers, or the law changes. We will publish the new version with a new effective date, and keep earlier versions available on request.

19.2We will give you at least 14 days' notice, by email or on the Platform, of any change that materially affects how we use your personal information before it takes effect, in line with clause 26.2 of the Terms. Changes needed for legal, regulatory, security or safety reasons may take effect sooner.

19.3If a change means we want to use your information for a new purpose that needs your consent, we will ask for that consent. We won't treat your continued use of the Platform as consent to it.

Questions about your information?

Email our Information Officer at hello@creatormatch.co.za with "Privacy" in the subject line. If you're 16 or 17, your parent or guardian can contact us too.

Version history

Version 1.0, effective 2 November 2026: first published.

Version 1.1, effective 3 November 2026: names Zoho, which hosts our mailboxes, and Anthropic, whose AI service sorts the email sent to hello@creatormatch.co.za (clauses 7.5, 10.4 and 11), and says that one server of our own in South Africa checks that email (clause 11.1).

Version 1.2, effective 3 November 2026: artists, their managers and labels can join, and instead of a selfie they send a screenshot of their own Instagram or TikTok and one of Spotify for Artists or Apple Music for Artists, so we can check they act for the artist (clause 4.8 and the table in clause 7). They are kept and deleted like Creators' verification images (clause 12).