Privacy Policy

Effective date: | Last updated:

Fluentryx ("we", "our", or "us") operates the influencer-marketing platform at fluentryx.com (the "Platform"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

By accessing or using the Platform you agree to this Privacy Policy. If you do not agree, please do not use the Platform.

1. Who We Are

Fluentryx is an influencer-marketing platform that connects brands with content creators ("influencers"). We act as the data controller for personal data collected through the Platform.

Data Controller contact:
Email: [email protected]
Website: https://fluentryx.com

2. Information We Collect

2.1 Information you provide directly

Account registration: first name, last name, email address, password (stored as a salted hash — never in plain text), role (brand, influencer, creator manager, brand manager).
Profile information: bio, niche/category, location, country, portfolio URL, website URL, rate card, audience demographics (age, gender, geography).
Social-platform data: social-media handles, channel codes, page IDs, follower counts, engagement metrics, and verification status that you enter or grant us access to read.
Campaign data: campaign titles, descriptions, goals, budgets, currency, deliverables, start/end dates, and application proposals.
Communications: messages sent to our support team via email or contact forms.

2.2 Information collected automatically

Usage data: pages visited, features used, search queries, clicks, and time spent on pages.
Device & network data: IP address, browser type and version, operating system, device type, and referring URL.
Cookies & similar technologies: see Section 7.

2.3 Information from third-party APIs

YouTube Data API: channel description, subscriber count, view count, recent video statistics — used for analytics and ownership verification.
Facebook Graph API: list of Facebook Pages you manage — used only to verify ownership of a claimed Page (see Section 4).
Twitter/X API v2: profile bio — used for ownership verification.
Instagram (HTML scrape): public bio text — used for ownership verification on public accounts only.
TikTok (HTML scrape): public bio text — used for ownership verification on public accounts only.

3. How We Use Your Information

Purpose	Data used
Create and manage your account; authenticate your identity	Email, password, name, role
Connect brands with influencers and facilitate campaigns	Profile, platform, campaign data
Verify ownership of social-media pages (anti-impersonation)	API data from YouTube, Facebook, Twitter, Instagram, TikTok
Process campaign applications and facilitate negotiations	Application data, proposed rates, proposal notes
AI-generated campaign briefs and influencer match scores	Campaign goals, niche, platform; influencer bio, niche, follower count
Send transactional emails (account verification, password reset, application updates)	Email address, name
Improve platform features through aggregated, anonymised analytics	Usage data (anonymised)
Comply with legal obligations and enforce our Terms of Service	As required by law

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

4. Facebook Login & Graph API Data Facebook App Review requirement

Fluentryx uses Facebook Login exclusively to verify that you are the legitimate administrator of a Facebook Page you claim to own on our platform. We do not use Facebook Login to sign in to Fluentryx.

What we request

Permission: pages_show_list — returns a list of Facebook Pages the authenticated user manages.

How we use it

You click "Verify Facebook Page" in your Fluentryx platform settings.
A Facebook Login popup opens, asking you to grant pages_show_list.
Facebook returns a short-lived authorisation code to our server.
Our server exchanges the code for a short-lived user access token and immediately calls GET /me/accounts.
We compare the list of returned Page IDs to the Page ID stored in your Fluentryx profile.
If there is a match, your platform record is marked Verified. The access token is discarded immediately after this comparison — it is not stored.

We explicitly confirm:

We do not post to your Facebook Page or Timeline.
We do not read your private messages, friend list, or personal profile data.
We do not store your Facebook user access token or Page access token beyond the single verification request.
We do not use Facebook data for advertising, profiling, or any purpose other than ownership verification.
We do not share any Facebook-derived data with third parties.
Data obtained via the Facebook API is used only for the single purpose described above. The only thing retained after verification is the boolean verified-status flag on your Fluentryx platform record.

For information on how Facebook processes your data, see Facebook's Data Policy. To revoke our app's access, visit Facebook App Settings.

5. Legal Basis for Processing (GDPR)

Processing activity	Legal basis
Account creation and authentication	Contract performance (Art. 6(1)(b))
Providing the Platform services	Contract performance (Art. 6(1)(b))
Facebook Page ownership verification	Legitimate interest / consent (Art. 6(1)(a) & (f))
Sending transactional emails	Contract performance (Art. 6(1)(b))
Analytics (aggregated, anonymised)	Legitimate interest (Art. 6(1)(f))
Legal compliance	Legal obligation (Art. 6(1)(c))

We share personal data only in the following limited circumstances:

Between platform participants: brands can view influencer public profile data (name, bio, niche, follower count, verified platform handles) to facilitate campaign matching. Influencers can view campaign details posted by brands.
Service providers: we use trusted third-party processors (listed in Section 10) that process data only on our behalf and under strict data-processing agreements.
Legal requirements: we may disclose data if required by law, court order, or to protect our legal rights.
Business transfers: in the event of a merger, acquisition, or asset sale, personal data may be transferred. We will notify affected users before data is transferred and becomes subject to a different privacy policy.

7. Cookies and Tracking Technologies

Cookie type	Purpose	Can be disabled?
Essential / Authentication	JWT-based session management; keeps you logged in during your session. No persistent cookies are set for auth — tokens are held in memory.	No — required for the Platform to function
Analytics (Google Analytics)	Aggregated, anonymised usage statistics to help us improve the Platform. IP addresses are anonymised.	Yes — disable in browser settings or use a browser extension such as uBlock Origin

We do not use advertising or tracking cookies.

8. Data Retention

Account and profile data is retained for as long as your account is active.
When you delete your account, personal data is anonymised or deleted within 30 days, except where we are required by law to retain it (e.g. financial records for 7 years).
Campaign and application data is retained for 3 years after campaign completion for dispute resolution and audit purposes, then deleted.
Server access logs are retained for 90 days.
Facebook API access tokens are discarded immediately after the ownership-verification request completes — they are never persisted.

9. Data Security

All data in transit is encrypted using TLS 1.2+.
Passwords are stored using a strong, salted cryptographic hash and are never recoverable in plain text.
Access to production databases is restricted to authorised personnel via role-based access controls.
API keys and secrets are stored in environment configuration — never hard-coded in source files committed to version control.
We conduct regular dependency-vulnerability reviews and apply security patches promptly.
In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

10. Third-Party Services

Service	Purpose	Privacy Policy
Google Analytics	Aggregated website usage analytics	policies.google.com/privacy
YouTube Data API v3	Channel analytics & ownership verification	policies.google.com/privacy
Facebook Graph API	Page ownership verification only	facebook.com/policy
Twitter/X API v2	Bio lookup for ownership verification	twitter.com/en/privacy
Groq / Meta LLaMA 3	AI campaign brief generation & influencer match scoring. No PII is sent beyond what is necessary to generate the brief.	groq.com/privacy-policy
SprintLite Chat	In-app customer support widget	sprintlite.com
Zoho Mail (SMTP)	Transactional email delivery	zoho.com/privacy.html

11. Your Rights

Depending on your location and applicable law, you may have the following rights:

Right	What it means
Access	Request a copy of the personal data we hold about you.
Rectification	Ask us to correct inaccurate or incomplete data.
Erasure ("right to be forgotten")	Ask us to delete your personal data, subject to legal retention requirements.
Restriction	Ask us to restrict processing in certain circumstances (e.g. while accuracy is disputed).
Portability	Receive your data in a structured, machine-readable format (JSON or CSV).
Objection	Object to processing based on legitimate interests or for direct marketing (we do not do direct marketing).
Withdraw consent	Where processing is based on consent, withdraw it at any time without affecting prior processing.
Lodge a complaint	File a complaint with your local data-protection supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days (or sooner where required by law).

12. Children's Privacy

The Platform is not directed at children under the age of 13 (or 16 in certain EEA countries). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, contact us immediately at [email protected] and we will delete it promptly.

13. International Data Transfers

Your data may be processed in countries outside your own, including countries that may not provide the same level of data protection as your home country. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognised transfer mechanisms.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by:

Posting the updated policy on this page with a revised "Last updated" date.
Sending an email notification to registered users where the change materially affects their rights.

Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

15. Contact Us

For any questions, concerns, or data-rights requests, contact our Data Protection team:

Fluentryx — Data Protection

Email: [email protected]

Website: https://fluentryx.com