Privacy Policy

1. Who we are

[COMPANY NAME] OÜ, registry code [REGISTRY CODE], of [STREET ADDRESS], Tallinn, Estonia, is the controller of the personal data described here. Contact us about anything in this policy at [email protected]. We are not required to appoint a data protection officer, so that address reaches the people who actually handle these requests.

Where you upload personal data about your own staff, clients or contacts into your workspace, you are the controller of that data and we process it on your instructions in order to run the platform for you. We will sign a data processing agreement with you on request.

2. What we collect

• Account. Name, email address, password in hashed form, handle, avatar, language and appearance preferences, two factor enrolment, sessions and devices, and the identifier your Google or LinkedIn account returns if you sign in that way. We never receive your password from those providers.
• Workspace and team. Company name, workspace type, members, roles, invitations and the access grants you give to colleagues, clients and contractors.
• Onboarding answers. The site, niche, budget, quality thresholds and services you tell us about when you register, which we use to shape what you are shown.
• Commercial activity. Projects, campaigns, markets, listings, baskets, orders, briefs, drafts and published content, delivery states, verification results, reviews, offers and their history.
• Payments. Billing details, plan and subscription state, invoices, escrow and payout records, refunds and disputes. We do not receive or store card numbers. Card data goes directly to Stripe. For sellers, Stripe also collects the identity and business information it needs to pay you.
• Verification. Domain control records, channel verification codes, and the company details we check against public registers, including company number, address, status and VAT number.
• Communications. Messages between members, order threads, feed posts and comments, support correspondence, notification preferences and delivery records.
• Files. Attachments, documents and media kits you upload, including PDFs submitted for import. These are stored in our database, not with a third party file host.
• Assistant conversations. What you type to the AI assistant and what it replies, together with the platform data it read to answer.
• Technical. IP address, browser and device information, timestamps, pages and endpoints requested, API key usage, presence and error logs.
• Credentials you give us to hold. API keys you connect for SEO data providers. These are encrypted at rest with AES-256-GCM and used only to make the calls you asked for.
• Trust and safety. Reports you file or that are filed about you, moderation decisions, staff notes, audit records of actions taken in the account, and signals we use to detect fraud and abuse.

We do not ask for special category data, such as health, political opinions or biometric data, and you should not put it into free text fields.

3. Where it comes from

Most of it comes from you. The rest comes from:

• Your colleagues, when they invite you to a workspace or act on an order with you.
• Google or LinkedIn, if you use them to sign in, limited to the basic profile information you authorise.
• Stripe, which tells us the state of your payments, payouts and verification, but not your card or bank details.
• SEO data providers, for domain metrics, and social platforms, for public channel statistics and profile images. We mirror platform avatars onto our own storage because the original links are signed and expire.
• Public company registers and a search provider, used to confirm the company and VAT details a workspace claims.
• Search results, where the optional indexation check is enabled, to record whether a published page appears.

4. Why, and on what basis

Under the GDPR we need a lawful basis for each purpose. Ours are performance of a contract with you, compliance with a legal obligation, our legitimate interests, and consent.

• Running your account and the marketplace. Registration, workspaces, listings, orders, escrow, delivery, payouts, messaging and support. Basis: performance of our contract with you.
• Verification of domains, channels and companies. So that members can rely on who they are dealing with. Basis: contract, and our legitimate interest in a marketplace that is not full of impostors.
• Security, fraud prevention and enforcement. Detecting abuse, rate limiting, investigating reports, keeping audit records and enforcing our terms. Basis: our legitimate interest in protecting the platform and its members, and legal obligation where the law requires us to act.
• Accounting, tax and reporting. Invoices, statutory books, sanctions screening and reporting seller information to the tax authority where a platform operator is required to. Basis: legal obligation.
• Service messages. Order updates, delivery and dispute notices, security alerts and changes to these documents. Basis: contract. You cannot opt out of these while you hold an account, though you control how much detail arrives by email.
• Product improvement and support. Understanding what breaks and what confuses people, and answering your questions. Basis: our legitimate interest in improving a product you pay for.
• AI features. Running the assistant, recommendations and imports. Basis: contract, because you asked for the feature.
• Analytics. Understanding how the interface is used. Basis: consent in the EU, EEA and UK, where nothing loads until you agree.
• Marketing about Influensia. Occasional email about features relevant to your business. Basis: consent, or our legitimate interest in marketing to existing business customers. Every message carries an unsubscribe link that works in one click.

Where we rely on legitimate interests we have weighed them against your rights, and you can object at any time under section 8. Where we rely on consent you can withdraw it at any time, which does not affect what we did lawfully before you did.

5. Who we share it with

We do not sell personal data, and we do not share it for anyone else advertising purposes. We share it with:

• Other members, deliberately. A counterparty to an order sees the workspace, the people acting on it, the brief and the messages. Your public profile, posts, comments and reviews are visible to other members, and public articles and public markets are visible to anyone.
• Stripe (Stripe Payments Europe, Limited and its group), for payments, escrow, payouts, identity verification and fraud prevention. Stripe acts as a controller in its own right for much of this, under its own privacy policy.
• Anthropic, for the AI assistant, recommendations and PDF import. Content you send to these features is processed to generate a response and is not used to train models.
• Resend, to deliver transactional email.
• Railway, which hosts the application and the database.
• Contentsquare, for product analytics, and only where analytics is permitted.
• A search data provider and a company registry search provider, for the optional indexation check and for company verification.
• Professional advisers, insurers, auditors and authorities, where we are required to disclose or need advice, including tax authorities and law enforcement acting on a valid request.
• A buyer of the business, if we are ever merged, acquired or reorganised, subject to the protections in this policy continuing to apply.

6. Transfers outside the EEA

Some of the providers above are outside the European Economic Area, principally in the United States. Where personal data is transferred there, we rely on an adequacy decision where one applies, including the EU-US Data Privacy Framework for providers that are certified under it, and otherwise on the European Commission standard contractual clauses together with additional technical and organisational measures. You can ask us for a copy of the mechanism used for a particular provider.

7. How long we keep it

• Account and profile: while your account is open. On closure your name, email address, profile and credentials are destroyed immediately and the account row is anonymised. It is not deleted outright, because the order and payment records below reference it and we are not permitted to destroy those.
• Orders, invoices and payment records: seven years from the end of the financial year, because accounting and tax law requires it.
• Messages and order threads: for the life of the account, since they are the evidence in any later dispute about what was agreed.
• Verification and company checks: for the life of the account plus the period we may need to show a check was done.
• Trust and safety records: up to five years after the event, so that repeat behaviour can be recognised.
• Technical logs: normally up to twelve months.
• Analytics: as set out on the Analytics & cookies page.

Content you published publicly, and content that forms part of another member record of a transaction, may remain visible after you close your account. We will disconnect it from your identity where we can do so without destroying the record.

8. Your rights

Subject to the conditions in the GDPR, you can ask us to:

• give you a copy of the personal data we hold about you, and tell you how we use it;
• correct anything inaccurate or incomplete;
• delete data we no longer have a reason to keep;
• restrict how we use it while a dispute about it is resolved;
• send the data you gave us to you, or to another provider, in a machine readable format;
• stop processing that relies on our legitimate interests, including a right to object to direct marketing at any time, which we always honour;
• withdraw consent you previously gave.

Write to [email protected]. We answer within one month and will tell you if we need longer because the request is complex. We do not charge, unless a request is manifestly unfounded or excessive. We may need to confirm who you are first.

If you are not satisfied, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at [email protected], or to the supervisory authority where you live or work. We would rather you came to us first, but that is your choice and not a precondition.

9. Automated decisions

Parts of the platform run automatically. Escrow releases on a schedule once a placement has been verified live and the waiting period has passed. Automated checks confirm that a link exists and matches what was agreed. Repeated automated checks are rationed to limit cost and abuse. Recommendations and search ordering are generated by algorithm.

These are contractual mechanics and cost controls, and each of them is visible to you on the order or the listing it affects. Decisions with real consequences for your standing, such as restricting or terminating an account, refusing a verification, or resolving a dispute, are made by a person. If you believe something automated has produced the wrong result, write to us and a person will look at it.

10. Security

Data is encrypted in transit. Passwords are hashed. Provider API keys you entrust to us are encrypted at rest with AES-256-GCM. Access to production data is limited to the people who need it, and privileged actions are recorded in an audit log. Two factor authentication is available on every account and we recommend it.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours where required, and tell you without undue delay where the risk to you is high.

11. Cookies and analytics

We set the cookies needed to keep you signed in, keep your session secure and remember your preferences. These are strictly necessary and are not optional, because the app does not work without them.

Analytics is separate and is described in full on the Analytics & cookies page, which also holds the switch. In the EU, EEA and UK nothing analytics related loads until you accept. We honour Global Privacy Control and Do Not Track signals. You can change your choice at any time there or under Settings, Privacy.

12. Changes and contact

We update this policy as the platform changes. Each version carries a number and an effective date, shown at the top and bottom of this page. Where a change materially affects how we use your data, we will tell you by email and in the app before it takes effect, on the notice period in section 11 of the Terms of Use.

Anything at all about this policy, including a request under section 8: [email protected].