Creator Analytics Privacy Policy

1. About this service

Creator Analytics (the «Service») is a public SaaS analytics platform for content creators, managers and teams. The Service collects public and OAuth-authorised metrics from social accounts on TikTok, Instagram, YouTube, Threads and Facebook, and displays them to the owner of the corresponding workspace. Anyone can sign up and connect their own accounts; each team's data is isolated and is never visible to other users of the Service.

2. What data we collect

2.1 Authorised creators (via OAuth)

When a creator connects their account via OAuth, we obtain access to:

• Basic profile information: name, avatar, follower count
• List of published videos and posts with metadata (title, description, publish date)
• Aggregated metrics per publication: views, likes, comments, shares
• Aggregated audience insights: countries (Geo), gender, age ranges — anonymised, never tied to identifiable individuals

We do not access:

• Direct messages
• Contacts
• Financial information
• Individual subscriber lists

2.2 Registered users

For registered users of the Service we store:

• Email, name
• Password hash (bcrypt, work factor 12) — original password is never stored
• Role (admin / manager / analyst / viewer / creator)
• TOTP secret for 2FA (if enabled)
• Audit log of actions

3. How we use this data

• Displaying the data in your team's dashboard for content performance analytics
• Generating automatic summaries (daily / weekly / monthly briefs)
• AI-based aggregated analysis of comments under videos (sentiment + topics; no individual targeting)
• Calculating KPI and creator compensation formulas

We do not use the data for advertising, marketing, machine learning outside the analytics described above, or for sale or transfer to third parties.

4. Data sharing

We do not transfer your data to third parties for marketing, advertising or resale. Access to your team's data is limited to authorised users of that same team.

Sub-processors (GDPR Art. 28): we use the following service providers strictly for technical operation of the Service. They process data on our behalf under contractual data-protection commitments:

• Hetzner Cloud GmbH (Germany) — server hosting + daily backups
• Cloudflare, Inc. (USA, EU presence) — DNS, DDoS protection, R2 object storage for off-site backups
• SociaVault — supplementary aggregation service for cross-platform public creator metrics
• EnsembleData — fallback provider for supplementary cross-platform public metrics
• Google LLC — YouTube Data API v3 (public channel + video metrics) and YouTube Analytics API (creator-authorised demographics/geo, OAuth only)
• Meta Platforms, Inc. — Instagram + Facebook Graph API (creator-authorised insights, OAuth only)
• AI providers for comment sentiment summaries: Cerebras Systems, Mistral AI, Groq, OpenRouter. Only the text of public comments is sent; no personally-identifying creator data.

Lawful disclosure exceptions:

• Upon a lawful request from competent authorities
• To prevent fraud or to protect rights / safety

TikTok Open Platform — Data Use Disclosure

The Service uses TikTok Login Kit and TikTok Display API (TikTok Open Platform) under the TikTok Platform Terms of Service. When a creator authorises the Service via TikTok OAuth, we obtain access to the following permissions:

• user.info.basic — display name, avatar, follower/following count
• user.info.profile — extended profile information (bio, profile URL)
• user.info.stats — aggregated account statistics (total video count, total likes)
• video.list — list of published videos with title, description, publish date and aggregated engagement metrics (views, likes, comments, shares)

Why we need these permissions: solely to display content performance analytics to the creator's own team workspace. No data is shared with other teams, used for advertising, or processed for purposes beyond the analytics described in this policy.

TikTok data retention: TikTok metrics and profile data are retained while the creator's TikTok account remains connected. Upon OAuth revocation or account deletion, all TikTok-derived data is erased within 30 days. To revoke access, go to TikTok → Settings → Security → Authorised Apps and remove «Creator Analytics», or use the disconnect button on your creator page in this Service.

We do not access TikTok direct messages, contacts, purchase history, or any data beyond the permissions listed above. Our use of TikTok data complies with the TikTok API Services Agreement.

Google API Services — Limited Use

Creator Analytics' use of information received from Google APIs — the YouTube Data API and the YouTube Analytics API — adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use YouTube / Google user data only to provide and improve the analytics features described in this policy.
• We do not use this data to develop, improve or train generalized or foundational AI / ML models.
• We do not sell, rent or transfer this data, and do not share it with data brokers or information resellers.
• We do not use it for advertising, retargeting, personalized advertising, or credit-worthiness / lending purposes.
• No human reads this data except: with the creator's explicit consent, for security purposes (e.g. investigating abuse), to comply with applicable law, or in aggregated / anonymized form for the operations of the Service described above.

5. Data retention & deletion

Metrics and publications are retained while the corresponding account remains connected. A creator may request deletion of their data at any time from their creator page in this Service («Delete my data» button) — we anonymise identifying information (name → «Deleted creator #N») and erase OAuth tokens within 30 days.

Data Deletion request: to request a full deletion of your account and associated data, email [email protected] with subject «Data deletion request». We will respond within 7 business days and complete deletion within 30 days. This satisfies Meta Data Deletion requirements and Google Account Data Deletion requirements.

Step-by-step data deletion instructions, including requests coming from Facebook and Instagram: data deletion page.

6. Your rights (GDPR-style)

Users and connected creators have the right to:

• Access: request a copy of all data we hold about you
• Rectification: correct inaccurate information
• Erasure: request complete deletion from your creator page or by emailing [email protected]
• Withdraw OAuth: at any time, revoke our app's access in your social network's settings (TikTok / Instagram / YouTube)
• Portability: obtain your data in a machine-readable format (CSV)

7. Security

• All traffic over HTTPS (TLS 1.2+)
• Passwords hashed with bcrypt
• 2FA available for admin roles
• OAuth refresh tokens are encrypted at rest (Fernet symmetric encryption)
• Team access — login + 2FA only
• Daily database backups, 30-day retention
• All mutating actions written to an audit log

8. Cookies

We use only the cookies strictly necessary for operation:

• access_token, refresh_token — session (HttpOnly, Secure)
• lang — UI language preference (ru / en)
• theme — UI theme preference (light / dark)

No analytics, advertising, or third-party tracking cookies.

9. Children

The Service is intended for professional adult users (16+).

10. Changes

For material changes to this document, all users and connected creators will be notified via the Service UI at least 14 days before the changes take effect.

11. Contact

For any data and privacy questions: [email protected]

This page satisfies the OAuth review requirements of Meta, Google and TikTok. URL: https://creator-analytics.com/privacy/en