Privacy Policy

Last updated: July 8, 2026

1. Who We Are

CreatorFlow is a platform that partners with social media creators to build, host, and manage digital products. We are operated by a South African registered company. Our contact email is hello@getcreatorflow.co.

As a South African entity, we are subject to the Protection of Personal Information Act, 2013 (POPIA) and the Electronic Communications and Transactions Act, 2002 (ECTA). We are also subject to the General Data Protection Regulation (GDPR) in respect of personal information we process about individuals in the European Economic Area or United Kingdom, and the California Consumer Privacy Act (CCPA) for California residents.

2. Information We Collect

We collect information you give us directly and information generated automatically when you use our services.

Information you provide:

• Full name and email address (application form and contract)
• Social media handle, platform, and follower count (application form)
• Content niche and audience details (application form and program brief)
• Your digital signature and the date you sign any contract with us
• Any other information you submit through our forms or via email

Information collected automatically:

• IP address and approximate location (collected at contract signing for legal enforceability, and by our CDN provider Cloudflare for security)
• Browser type and device information
• Pages visited and time spent on our site

Payment information: Payment processing for product purchases is handled entirely by Whop. We do not store or process your payment card details. Please review Whop's privacy policy at whop.com/privacy.

3. How We Use Your Information

• To review and respond to your partnership application
• To provide and manage your CreatorFlow creator account and partnership
• To send you your partnership contract and related documents
• To process and record product sales and calculate your revenue share
• To send you transactional emails (contract confirmations, sale notifications, payout updates)
• To contact you about your application or partnership (not for general marketing)
• To comply with legal obligations and enforce our agreements
• To maintain the security and integrity of our platform

4. Legal Basis for Processing

Under POPIA (South Africa): We process your personal information on the following lawful grounds:

• Contractual necessity: Processing required to enter into and perform your partnership agreement
• Legitimate interests: Reviewing applications, fraud prevention, platform security — where not overridden by your rights
• Legal obligation: Complying with SARS tax reporting, POPIA, and other applicable South African law
• Consent: Where you have given explicit consent, such as receiving outreach communications

Under GDPR (EEA/UK users): The same grounds apply as described above. Our lawful bases map to: contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)), and consent (Art. 6(1)(a)).

5. Information Sharing

We do not sell your personal information. We share your data only with the following trusted service providers who process it on our behalf:

• Supabase (database and authentication infrastructure) — supabase.com/privacy
• Resend (email delivery) — resend.com/privacy
• Whop (payment processing and product delivery) — whop.com/privacy
• Cloudflare (CDN, DDoS protection, email obfuscation) — cloudflare.com/privacypolicy

We may also disclose your information if required by law, court order, or to protect our legal rights.

6. Data Retention

We retain your personal data for as long as your partnership is active. After termination of your partnership (or rejection of your application), we retain your data for up to 5 years to comply with legal and tax obligations, resolve disputes, and enforce our agreements. You may request deletion of certain data earlier — see Section 8.

7. Cookies

Our site uses minimal cookies necessary for the platform to function (session management via Supabase). We do not use advertising or tracking cookies. Our CDN provider Cloudflare may set a technical cookie (__cf_bm) for security purposes.

8. Your Rights

Under POPIA (all users, processed by our South African entity):

• Access: Request confirmation of whether we hold your personal information and a copy of it (POPIA s.23)
• Correction or deletion: Request correction of inaccurate, irrelevant, or incomplete information, or its deletion where we no longer have a lawful basis to retain it (POPIA s.24)
• Objection: Object to the processing of your personal information on reasonable grounds (POPIA s.11(3))
• Withdraw consent: Where we process on the basis of consent, withdraw it at any time without affecting prior processing
• Lodge a complaint: Submit a complaint to the South African Information Regulator at inforegulator.org.za if you believe we have breached POPIA

Additional rights for EEA/UK residents (GDPR):

• Portability: Receive your data in a structured, machine-readable format (Art. 20)
• Restriction: Request restriction of processing in certain circumstances (Art. 18)
• Lodge a complaint with your local data protection authority

California residents (CCPA): We do not sell your personal information. You may submit a request to confirm this at hello@getcreatorflow.co.

To exercise any of these rights, email our Information Officer at hello@getcreatorflow.co. We will respond within 30 days (POPIA requires response within 30 days of a request).

9. Marketing Communications

If you submit an application, we may contact you by email about your application and, if accepted, about your partnership. You may opt out of non-essential communications at any time by replying "unsubscribe" to any email or contacting us at hello@getcreatorflow.co.

10. Children's Privacy

Our services are intended for individuals who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly.

11. International Transfers

Your data may be transferred to and processed in countries outside your own, including the United States. When we transfer data from the EEA or UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) as required by applicable law.

12. Security

We implement industry-standard technical and organizational measures to protect your personal data, including encrypted data transmission (TLS), access controls, and infrastructure provided by Supabase. However, no system is completely secure and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be communicated by email to active partners. Continued use of our services after changes constitutes acceptance of the revised policy.

14. Information Officer (POPIA)

Under POPIA, we are required to designate an Information Officer who is responsible for ensuring our compliance with POPIA and handling data-related requests and complaints. Our Information Officer can be contacted at:

If you are not satisfied with our response to a privacy complaint, you may escalate to the South African Information Regulator:

EEA/UK residents who are not satisfied with our response may also lodge a complaint with their local supervisory authority (e.g. ICO in the UK, or the relevant EU DPA).