Privacy policy

1. Who is responsible for your information

Collab is operated by PostPaddy LLC, which determines how personal information is used for operating this service. This Policy covers Collab and its creator and brand workspaces. Other PostPaddy products and third-party services may have separate notices. Contact our legal and privacy team at legal@postpaddy.com, or account support at info@postpaddy.com. Postal address: 11900 Commerce Street, Apt 1307, Farmers Branch, Texas 75234, United States.

2. Information Collab processes

The information we process depends on the features you use:

• Account and profile information: name, email address, phone number, country, biography, account role, brand details and password hashes. We do not store your password in readable form.
• Social profile information supplied by you: platform, handle, profile URL and self-reported follower, view and engagement figures. We do not connect to social accounts, receive social passwords or independently verify those metrics in this version.
• Collaboration records: campaign briefs, applications and sample links, selection decisions, assignment terms and acceptance, task messages, submission links, review and revision history, and cancellation records.
• Payout and payment records: account holder name, bank name, an encrypted bank account number, agreed compensation, payment status, dates, notes and references. Collab does not process card purchases or move campaign funds.
• Security and accountability information: session and recovery-token records, policy versions acknowledged, timestamps, user-agent details, administrative activity and request-limit identifiers. Hosting services may also process network and diagnostic logs needed to deliver and secure the site.

3. Why we use information

We use information to create and secure accounts, deliver verification and recovery emails, present campaign requirements, handle applications and assignments, support communication and review, maintain manual-payment records, resolve support issues and investigate misuse. Eligibility checks compare information supplied by the creator with the brand's stated requirements; selection is made by brand reviewers rather than an automated hiring system.

Where a legal basis is required, we rely on providing the service and performing relevant agreements, complying with legal obligations, and proportionate legitimate interests in security and running the platform, subject to applicable rights. Where a use requires consent, we will ask separately and allow withdrawal. Acknowledging this Policy is not blanket consent to unrelated advertising or additional data uses.

4. Who can see information

Public visitors can view published campaign details and relevant brand information. Creator profiles and applications are not a public directory. The receiving brand can view an applicant's relevant profile, selected social information, pitch and samples, and the records needed to manage its assignments. Brand-internal review notes are not exposed to creators.

Authorised brand users and administrators can access payout details for approved cash assignments to arrange or reconcile manual compensation. Access to the full account number is logged. Platform administrators can access records needed to operate the service, investigate reports and assist workspaces; administrator management activity retains the actual administrator's identity.

We use hosting and database providers, including Hostinger when deployed there, and Amazon SES for transactional email. They process information needed for those services on our behalf. Linked files and published posts remain with the external services you choose. Those services, banks and a brand acting for its own campaign purposes may have their own privacy responsibilities and notices.

We may disclose information when required by applicable law, to protect legal rights or user safety, or in a business reorganisation with appropriate protections and notice where required. We do not sell personal information or share it for cross-context behavioural advertising in this version of Collab.

5. Storage, international processing and security

PostPaddy LLC is based in the United States. Depending on the hosting region and service provider used for your account, information may be processed in the United States and other countries. Where applicable law requires safeguards for an international transfer, we must use an appropriate contractual or other lawful transfer mechanism. Contact our privacy team for details about the processing arrangements for your account.

Account passwords are hashed, bank account numbers are encrypted in the application database, and access is restricted by account role and workspace. Session cookies are HTTP-only. These safeguards reduce risk but do not guarantee that a service, device or transmission can never be compromised. Keep your login and recovery links private and contact us if you suspect unauthorised access.

6. Cookies, saved gigs and external links

Collab uses a first-party session cookie to keep you signed in for up to seven days, subject to expiry or revocation. Recovery and verification links expire separately. Saved gig identifiers are stored locally in your browser on this device until you remove them or clear local storage. Request limits help protect accounts and forms from abuse.

This version does not include advertising pixels or non-essential analytics cookies. Removing or blocking session cookies can prevent sign-in. Clearing browser storage removes saved gigs on that device. Opening an external social post, file, website or email link takes you to a service governed by its own practices.

7. How long records are kept

We retain account and collaboration information while it is needed to provide an active account and its campaigns. After account closure, we review information for deletion or anonymisation when it is no longer needed. The retention criteria include open assignments, outstanding compensation, support requests, legal claims, fraud prevention and legal or accounting requirements; different records may therefore have different retention periods.

Session and recovery credentials have limited validity and can be revoked. An expired credential does not mean that every related audit record has been erased. Limited information may remain in protected backups until normal backup replacement, and legal holds may require specific evidence to be kept longer. We restrict retained information to the purpose that justifies keeping it. Contact us to ask about retention for a particular record; account closure and privacy requests are handled by our team rather than an automatic in-app erasure tool.

8. Access, correction, deletion and other choices

You can edit your profile, social accounts and payout details in your workspace. You can also ask us to confirm processing, provide access or a portable copy, correct information, delete information, or restrict or object to certain uses, where applicable law gives you those rights. If we rely on consent, you can withdraw it for future processing. We will not penalise you for exercising applicable privacy rights.

Send requests to legal@postpaddy.com or info@postpaddy.com, identifying the account and the request. We may verify your identity or an agent's authority before sharing or changing private records. We will respond within the applicable legal period and explain any permitted extension or refusal. Information may need to be retained for legal obligations or to protect another person's rights.

For Texas residents, where the Texas Data Privacy and Security Act applies, requests include access, correction, deletion, portability and opting out of targeted advertising, personal-data sales or certain significant profiling. Collab does not currently sell personal information or run targeted advertising. Eligibility checks use the requirements shown in a campaign; if you believe a check is incorrect, update your profile or contact support for review. Texas requests receive a response within 45 days, with an additional 45 days only where permitted and notified with reasons. Other jurisdictions may provide additional rights or shorter deadlines.

9. Privacy complaints and appeals

If you disagree with a decision on a privacy request, email legal@postpaddy.com with the subject “Collab privacy appeal” and explain the decision you want reviewed. We will review the appeal and provide a written outcome within the period required by applicable law; for a covered Texas appeal, within 60 days. If an appeal is denied, we will explain how to contact the relevant regulator, including the Texas Attorney General where applicable. You may also complain directly to the data protection authority that has jurisdiction over your circumstances.

10. Adults only

Collab accounts are intended for people aged 18 or older. We do not knowingly invite children to register. If you believe someone under 18 has provided personal information through an account, contact our privacy team so we can investigate, restrict the account and take appropriate action on the information.

11. Changes and contact

We will update the effective date and version when this Policy changes. Material changes will be communicated through the service or account email as appropriate, before new uses take effect where required. We will request consent for a new use when applicable law requires it.

Privacy and legal: legal@postpaddy.com. Account support: info@postpaddy.com. Telephone: +1 210 807 9106. Postal correspondence: PostPaddy LLC, 11900 Commerce Street, Apt 1307, Farmers Branch, Texas 75234, United States.