Privacy policy

CreatorSponsors.ai is operated by 100X Better AI, 60 rue François 1er, 75008 Paris, France. We are responsible for how information is used in our service.

For privacy questions or requests, email privacy@outreach.creatorsponsors.ai.

Business contacts: names, job titles, companies, email addresses, LinkedIn profiles and other information used for professional partnerships.

Creator and sponsorship information: public creator profiles, brand mentions, videos and posts on YouTube, Instagram and TikTok, source links and dates.

Account information: your account details, email address, subscription and payment records, and how you use our service.

Messages: information you submit through support, listing requests, outreach tools or privacy requests.

Technical information: IP addresses, cookies and records used to run the service, check access and protect accounts.

We collect business contact information from public business websites, professional directories and third-party business data providers. An email address used for business may be a company address or an address hosted by a general email provider.

We organise these details so creators can find people responsible for sponsorships and brand partnerships. Registered users, including paying subscribers, can access available contact details for professional outreach.

If your information appears in our directory, you can ask to see it, correct it or remove it. You can also object to its use. Use our removal form or email our privacy address.

A privacy notice explains how we use contact information and how to request removal. Our existing notice tool currently sends only to approved test recipients; automatic notices to newly collected contacts are not enabled. We keep notice delivery records and, where email tracking is enabled, open and click records. Opens and clicks can include automated activity. Opening a notice, clicking a link or not replying does not count as consent or a removal request.

Business contacts and sponsorship research: our legitimate interest is helping creators find relevant brands and professional partnership contacts. This is the basis under GDPR Article 6(1)(f) for collecting, organising and sharing relevant professional information. You can object to this use.

Accounts and subscriptions: we use account and subscription information to provide the service you request and manage payments. This is necessary to perform our contract with you.

Legal duties: we process information needed to meet applicable legal obligations, including accounting and responding to privacy requests.

Security: we use technical records to protect accounts, prevent abuse and enforce access limits. This supports our legitimate interest in keeping the service secure.

Optional analytics: we use consent for optional analytics. You can refuse or withdraw it through Cookie settings.

Registered CreatorSponsors users can access available business contacts and sponsorship research. Users who receive contact details are responsible for their own use of those details.

We use providers to run the service: Clerk for sign-in, Supabase for database storage, Upstash for cache and access-control storage, Vercel for hosting and optional website analytics, Stripe for payments, Resend for email delivery and Google Analytics for optional website analytics. These providers receive information needed for their services.

Payment, account-administration and security information may also be handled by providers for their own legal and business duties. Their privacy policies explain those uses. We may disclose information when required by law.

Our primary Supabase database and selected Upstash Redis region are in Singapore. Our Vercel project has Singapore configured for functions. These settings do not mean all provider processing, support, logs or backups stay in Singapore. Clerk processes account information on US infrastructure, and other providers may process information in other countries.

Provider data-processing agreements include safeguards for transfers outside the European Economic Area. Depending on the provider and transfer, these include the European Commission’s Standard Contractual Clauses or an applicable adequacy framework, such as the EU–US Data Privacy Framework.

Contact our privacy address for information about the safeguards relevant to your data and how to obtain a copy.

Business contacts do not currently expire automatically, and there is no scheduled age-based review. You can request correction or removal through our removal form or privacy email address. Account closure and account-data deletion requests are handled separately from contact removal.

After a verified contact removal, we keep minimal hashed identifiers for known email addresses, LinkedIn profiles and provider records. These help block matching contacts from being imported again. They are not used as contact details.

For manual privacy requests, we keep a minimal record of the request, actions and outcome. Contact emails and working notes are cleared when the case closes.

Email ownership-verification links expire after 30 minutes. Expiry prevents use of the link; it does not itself delete every associated record.

Our optional usage analytics delete events older than 180 days when new analytics batches are processed. Log and backup retention follows each provider’s plan and settings. Deleting a record from the live application does not immediately remove every backup copy.

Linked-app access and its expiry are explained below.

Depending on applicable law, you can ask to access, correct, delete or restrict use of your information. You can object to processing based on legitimate interests, request a portable copy where that right applies, and withdraw consent for uses based on consent.

Use the removal form for business contact removal, or email privacy@outreach.creatorsponsors.ai for other requests. We may ask for information needed to verify your identity or authority to make the request.

The removal form checks that you control the email address before you confirm removal. We remove matching contacts and use known linked identifiers to block re-imports. A new address or profile with no known link may not be recognised automatically; contact us if your information appears again.

We handle requests within applicable legal deadlines. Some records may need to be kept to meet legal obligations. You can also complain to the French data protection authority, CNIL, or another relevant data protection authority.

Request contact removal · Contact CNIL

If a supported research connection is enabled, you can link it to your CreatorSponsors account. We use your account ID to check your plan, permissions and usage limits. Your CreatorSponsors password is not shared with the connected app.

The app sends the inputs needed for your request, such as a topic, country filter, brand ID or creator ID. The connection does not request your full chat history or unrelated files. Country filters describe the market you want to search, not your physical location.

The ChatGPT research connection returns saved brand and creator information with source links. It does not return contact details, send messages or process payments. Information returned to the other app is also subject to that app’s privacy policy and settings.

We keep access records and usage counters to run and protect the connection. These can include a hashed account identifier, response status, request duration and cache activity. The MCP application request log excludes chat messages, request inputs, contact values and result contents. Hosting providers may keep separate technical logs.

Use Connected apps to revoke linked access. Revocation does not delete your CreatorSponsors account or information already received by another app.

Manage connected apps

Sign-in requests for account linking expire after 10 minutes and authorisation codes after 2 minutes. Access tokens last up to 1 hour. Linked access ends after 180 days unless you authorise a new connection. Refreshing a token does not extend that end date.

We store account and app identifiers, permissions, expiry details and hashes of access and refresh tokens. Security markers used to invalidate old permissions can remain for up to 181 days. Revoking access does not automatically delete account records, usage counters, logs or backups.

Essential cookies help the website and sign-in work. Optional Google Analytics, Vercel Analytics and our own usage analytics run only if you choose Accept analytics. Choosing Essential only leaves optional analytics off. Vercel Analytics helps us understand page views and visitor activity. Our integration removes query strings and fragments from URLs sent to Vercel Analytics.

Our usage analytics record selected topics, countries and platforms, result counts, brand interactions and contact actions. These events use pseudonymous identifiers and exclude contact email addresses, message contents, raw IP addresses and free-text searches. We use the reports to understand which sponsor and contact coverage people need.

We remember your cookie choice in this browser for 180 days. You can change or withdraw consent through Cookie settings in the footer. Withdrawing consent stops optional analytics collection and clears Google Analytics’ accessible first-party cookies.

We use authenticated accounts, access controls and email ownership checks for contact removal. We limit access to administrative tools and use service providers to support secure hosting, storage, payments and email delivery.

We may update this policy when our service or data practices change. The latest published version will be available on this page.

100X Better AI 60 rue François 1er 75008 Paris, France

privacy@outreach.creatorsponsors.ai

Send a privacy request