This policy explains how vvault handles personal data in its Creators Program, which pays dedicated channels, Influencers and Affiliates to talk about vvault: what we process, why and on what legal basis, who receives it, how long we keep it, and your rights.
1Who is responsible for your data
vvault is operated from Belgium by Tom Nsengiyumva (sole proprietor), company number BE 1022.549.155, registered office Minderbroedersstraat 10, 8000 Brugge, Belgium ("vvault", "we", "us"). For the personal data described here, vvault is the data controller within the meaning of the EU General Data Protection Regulation (GDPR).
This policy covers the vvault Creators Program (the "Program"): the creators panel on creators.vvault.app, the Program's page at vvault.app/creators, and everything we do with your data to run the Program. It adds to the vvault Privacy Policy, which still applies to your vvault account and to everything else you do on vvault. The Creators Program Terms describe how the Program works.
For any privacy question, write to contact@vvault.app. We have not appointed a Data Protection Officer: that address reaches the operator directly.
2Who this policy is for
The Program is only for people aged 18 or older, in one of three roles: dedicated channels, who open a TikTok or Instagram account only to talk about vvault and post there; Influencers, who post about vvault on their own TikTok, Instagram or YouTube accounts; and Affiliates, who share a tracked vvault link. What we process depends on your role, as the sections below say.
This policy also concerns people who can be seen or heard in content submitted to the Program. Section 6 explains what that means for them.
3What we process
Besides your vvault account (your name, email address, handle, profile picture and language, as described in the Privacy Policy), the Program processes the following:
- Your creator profile: the role you chose, the language of your content, the answers you gave when you signed up, the rate that applies to you, and whether your participation is active or paused.
- Connected social accounts (Influencers and dedicated channels): the access tokens the platform gives us, which we store encrypted, and what we read through the platform's official API: your handle, display name, profile picture, account identifier and follower count, and your recent posts with their link, caption, thumbnail, publication date and view count. Section 4 says more.
- What you submit: the links to the posts you submit and, for your first 3 videos, the links you send us for the check, the notes you add to them, and the videos themselves when we download them to use them.
- Views and reviews: the view count of each submitted post, read again regularly while it counts and kept as a history, our decision on each post and video, the reason we give when we reject one, who reviewed it and when, and any notes we keep about a review or a fraud check.
- Tracked links: the clicks, sign-ups and subscriptions that come through a vvault link we give you, and the payments made by the accounts you referred. If you are an Affiliate, they decide your commission. For the other roles, we use them only to measure what the Program brings to vvault, and they never change what you are paid. You never see the identity of the people you bring.
- Payouts: the identifier of your Stripe account, its country and whether payouts are enabled on it, what we paid you, for which period, when, and the reference of each Stripe transfer. Stripe collects your identity documents and bank details itself (section 5).
- Messages: what you write to us, at contact@vvault.app or otherwise, and what we write to you about the Program.
- Preferences and technical data: the language and the theme you choose in the creators panel, kept on your device in your browser's local storage or a cookie, and the technical data the Privacy Policy describes, such as server logs.
5Payouts and identity checks through Stripe
We pay creators only through Stripe Connect. When you set up payouts, you open your own Stripe account, and Stripe collects and verifies your identity and your bank details, as the law requires of payment providers. Stripe does this as an independent controller, under its own privacy policy: https://stripe.com/privacy.
We receive only the identifier of your Stripe account, its country, whether payouts are enabled on it, and the record of each transfer we make. We never see your identity documents or your bank details.
6Your content and its use in our advertising
Content you submit or post in the Program can become public through vvault. We may use content from the Program, whatever the role of the person who made it, on our accounts, website, apps and emails, in the rest of our marketing and in our paid advertising, on platforms such as Meta (Instagram and Facebook), TikTok (including Spark Ads) and Google (including YouTube), under the licence in section 14 of the Creators Program Terms. Your name, handle, image, likeness and voice, as they appear in the content, are then shown to the public and processed by the platforms that carry it, under their own terms and privacy policies.
We do this to perform our agreement with you, which includes that licence (Art. 6(1)(b) GDPR), and on the basis of our legitimate interest in promoting vvault (Art. 6(1)(f)).
If you appear in content that a creator submitted, the creator has promised us that you agreed to its use by vvault, advertising included. You can write to contact@vvault.app at any time to exercise your rights over that content, and we answer as the law requires.
A video we don't clear at the check is not used: we delete any copy we made of it.
7Why we use your data, and on what legal basis
The table below sets out each purpose, the data it uses and its legal basis under Article 6 of the GDPR. Where we rely on our legitimate interests, you can object at any time (section 13). We do not sell your personal data.
| Purpose | Data used | Legal basis |
|---|---|---|
| Signing you up and running your participation, support included | Account, creator profile, messages, preferences | Contract (Art. 6(1)(b)) |
| Checking that you are 18 or older | Stripe's verification status | Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Reading your posts and counting their views (Influencers) | Connected accounts, posts, view counts | Contract (Art. 6(1)(b)) |
| Reviewing posts and videos and deciding what earns | Submitted content, review decisions and reasons | Contract (Art. 6(1)(b)) |
| Using Program content in our marketing and paid advertising | Your content, with your name, handle, image, likeness and voice as they appear in it | Contract (Art. 6(1)(b)), through the licence in the Creators Program Terms, and legitimate interests (Art. 6(1)(f)) |
| Attributing subscriptions and calculating commissions (Affiliates) | Tracked link clicks, referred accounts, their subscription payments | Contract (Art. 6(1)(b)) |
| Paying you through Stripe | Stripe account identifier, country and status, payout records | Contract (Art. 6(1)(b)) |
| Preventing fraud and enforcing the Program's rules, including the ban on paid advertising | View count history, tracked link data, information from the platforms | Legitimate interests (Art. 6(1)(f)) |
| Measuring what the Program brings to vvault | Tracked link data, view counts | Legitimate interests (Art. 6(1)(f)) |
| Keeping accounting and tax records | Payout records and what supports them | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | What the case requires | Legitimate interests (Art. 6(1)(f)) |
8Reviews are made by people
A person at vvault reviews every post and every video. We decide ourselves what earns and what we refuse, from the content and the information we have, including the view counts and the signals the platforms give us. We do not make decisions about you by automated means alone that have legal or similarly significant effects.
To detect fraud, such as fake or bought views, paid advertising that the Creators Program Terms forbid, or self-referrals, we look at the history of your view counts, your tracked link data and what the platforms tell us. If we act on a suspicion, we tell you why, and you can contest the decision.
9Who receives your data
We share your data only as described here. Other creators never see it.
- Our service providers, as processors under contract and only to provide their service: Supabase (database, sign-in and file storage, hosted in the EU), Vercel (hosting and request logs) and Resend (the emails we send). The sub-processors page lists them with where they process data.
- Stripe, for payouts and identity checks, acting as an independent controller for its own legal obligations.
- The platforms you connect (TikTok, Meta for Instagram, Google for YouTube), through whose official APIs we read your data, and the platforms where we post or advertise content from the Program, which handle it under their own policies.
- The public: content we post or use in advertising is public, with everything it shows.
- Discord, if you join the Program's optional community there, under Discord's own terms.
- Authorities, our advisers and a successor to the business, in the cases the Privacy Policy describes.
10Transfers outside the EEA
Your data is hosted in the EU, with Supabase. Some providers process limited data outside the European Economic Area, in particular in the United States: Vercel and Resend under the European Commission's Standard Contractual Clauses, and Stripe under the Standard Contractual Clauses and, where it applies, the EU-US Data Privacy Framework, as the sub-processors page details.
The platforms you connect, and those where we post or advertise content, process it in the countries where they operate, under their own transfer mechanisms. Write to us if you want to know which mechanism applies to a specific provider.
11How long we keep it
We keep your creator data while you take part. When your participation ends, we delete or anonymise it within a reasonable period, except: payout records and what supports them (the posts, view counts and review decisions behind each payout), which accounting law requires us to keep for up to ten years; data needed for a fraud case or a dispute, until it is closed; and content we have already published or used in advertising, which stays covered by the licence in the Creators Program Terms.
The stored tokens of a connected account are deleted as soon as you disconnect it. Your vvault account data is kept as the Privacy Policy describes.
12Security
Access tokens for connected accounts are stored encrypted. Only vvault's administrators can see the admin side of the creators panel, and creators never see each other's data. Your identity documents and bank details stay with Stripe. The security measures described in the Privacy Policy apply too.
No system is perfectly secure. Where the GDPR requires it, we notify the competent authority and, where the risk to you is high, you.
13Your rights
You can ask us to give you access to your data, correct it, delete it, give you a portable copy, restrict how we process it, or object to processing based on our legitimate interests. Where processing rests on your consent, you can withdraw it at any time, without affecting what came before.
Write to contact@vvault.app. We answer within one month, and tell you if we need longer or if we cannot act on a request and why. We may ask for information to confirm that it is really you.
Some requests affect your participation: we cannot run the Program with you, or pay you, without the data it needs, and we keep what the law requires us to keep (section 11). Deleting your data does not withdraw content we have already published or used in advertising under the licence you gave us. Deleting your vvault account ends your participation in the Program.
You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be), or to the supervisory authority where you live or work.
14Age
The Program is only for people aged 18 or older. By joining, you confirm it, and Stripe verifies your identity before your first payout. If we learn that someone under 18 has joined, we end their participation and delete their creator data, except what the law requires us to keep.
15Changes and contact
We may update this policy. We post changes here and update the date above, and for a material change we tell you in the creators panel or by email.
Questions: contact@vvault.app, or Minderbroedersstraat 10, 8000 Brugge, Belgium.
4Connected social accounts
If you are an Influencer, you connect your TikTok, Instagram or YouTube accounts through each platform's official sign-in. We ask the platform for read access only: we cannot post, comment, send messages or change anything on your account. We use that access to read your profile basics, your recent posts and their view counts, so that you can submit a post and so that we can count its views as the Creators Program Terms describe.
Disconnecting an account in the creators panel deletes its stored tokens straight away. Posts you already submitted keep their link and the last view count we read. You can also remove vvault's access from the platform's own settings.
Each platform knows that you authorised vvault and handles your data on its side under its own terms and privacy policy: TikTok, Meta for Instagram, and Google for YouTube.