Privacy notice

1. Who we are

Kindling is the organisation responsible for the personal data described here. The company's name and contact details will be added before launch, and Kindling will be registered with the Information Commissioner's Office.

This notice applies to founders, creators and anyone who visits the Kindling website or uses its apps.

2. What we collect

• Account details: email address, display name, country, and for creators your date of birth, which we use to confirm you are 18 or over.
• Phone number, when you verify it. We use it to check that one phone is linked to one account.
• Payout and tax details, such as legal name, address, date of birth, tax identifier and bank details. Stripe collects most of these. We receive what we need to pay you and to meet tax reporting duties.
• Social account data, for creators: your handle, follower count, a list of your recent posts, the stats for each post (views, likes, comments and shares, and reach or watch time where the platform provides them), and whether each post is still live.
• Campaign and product details, for founders: the product link, its name, icon and description, your brief and campaign settings.
• Payment records: payment status and amounts. Stripe handles card details, and we do not store full card numbers.
• Fraud signals: device identifiers, sign-in records, and IP addresses in a hashed form for tracked-link clicks. These help us spot one person running several accounts.
• Messages and reports you send us through Help or the report button.

3. How we use it

• To run campaigns, claims, reviews, earnings and payouts.
• To check that posts are genuine and meet the Creator rules, and to detect fake views, duplicate accounts and bait-and-switch changes.
• To pay creators, take payments from founders and send refunds.
• To keep the accounts, tax and payments records the law requires.
• To answer support questions and deal with appeals.
• To send service messages, such as a video that needs a decision or a payout that has been sent. We do not send marketing without your agreement.

Our legal grounds are performing our contract with you, our legitimate interest in preventing fraud and keeping the service safe, our legal obligations (for example tax reporting), and your consent where we ask for it.

4. Data from TikTok, Instagram and YouTube

We read your posts and their stats only through each platform's official interface, and only after you connect your account and agree to it. We do not scrape platforms.

We follow each platform's rules. Instagram data is deleted when we no longer need it, and is never sold. YouTube statistics are refreshed or deleted within 30 days.

We do not sell platform data. We use it to pay creators, check posts and detect fraud.

5. Who we share it with

• Stripe, for payments, payouts, refunds and identity checks.
• Providers that send our email, SMS and push messages, and providers that host and run our systems.
• Founders see a creator's handle, the video, and its stats for their own campaign. They do not see a creator's personal details or payout details.
• The social platforms, through their official interfaces, to read your posts.
• Authorities or advisers where the law requires it, or to defend a legal claim.

Some of our providers process data outside the UK. Where they do, we rely on the safeguards the law requires.

6. How long we keep it

• Raw post metrics are kept only while a post is being tracked and its earnings are settled. They are then deleted.
• What we keep afterwards is our own record: what was paid, the decision made, and a hash of the evidence used. Hashes let us show a decision was based on specific evidence without keeping the full evidence.
• For TikTok and Instagram, we keep your baseline, meaning your median views before you joined, as our own threshold. For YouTube we fetch the baseline again rather than keep it for longer than 30 days.
• Account details are kept while your account exists. When you close it, we delete or anonymise them, except payment and tax records, which we keep for as long as the law requires.

The exact periods for each category are being confirmed as part of the legal review.

7. Your rights

• Ask for a copy of your data.
• Ask us to correct data that is wrong.
• Ask us to delete your data, where we no longer need it for the purposes above and the law does not require us to keep it.
• Ask us to restrict or object to some uses, and withdraw any consent you gave.
• Ask for your data in a portable form.

Use the Help page in the app to make a request. We reply within one month, as UK data protection law requires. You can also complain to the Information Commissioner's Office at ico.org.uk.

8. Security

Platform access tokens are encrypted, and the keys are kept apart from the database. Money decisions are logged with the inputs used, so they can be explained later.

Access to personal data is limited to the staff who need it, and staff access is logged.

No system is perfectly secure. If something goes wrong that puts your data at risk, we will tell you and the regulator as the law requires.

9. Cookies and browser storage

We use a session cookie to keep you signed in, and a random device identifier kept in your browser to help spot misuse. We do not use advertising cookies in this version.

10. Age

Kindling is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think someone younger has given us data, contact us and we will delete it.

11. Changes to this notice

We may update this notice. If a change is significant, we will tell you in the app or by email before it takes effect.