Privacy Policy

1. Who we are

Creamatch (crea-match.com) is run by Vantora Creative Sdn Bhd (202501019613 (1621026-X)), "we" in this policy. We decide how the personal data described here is used. This policy follows Malaysia's Personal Data Protection Act 2010 (PDPA).

2. What we collect

Brands and agencies

• Name, company name, work email, phone or WhatsApp number, industry.
• Campaign briefs, product details, files you upload, messages and review feedback.
• Billing details and payment records. Card details are handled by our payment providers, not stored by us.
• How you found us (for example a referral code or the ad or page you came from), where you allowed it.

Creators

• Name, email, phone or WhatsApp number, date of birth, home address (for product delivery).
• Nationality and ethnicity, used only to match creators to briefs. Never shown publicly or to brands.
• Social accounts, follower and post counts, portfolio uploads, niches and the languages you create in.
• Bank details and IC number for payouts and tax records.
• Your campaign work: applications, scripts, videos, posts, deadlines, strikes and earnings.
• If you sign in with Google: your Google name, email and profile photo.
• If you use the Creator mobile app: a push notification token, and access to your camera, photos and microphone when you choose to submit content.

Visitors and people who contact us

• Details you type into our forms, estimator, creator score tool or lead sheets.
• Messages you send us on WhatsApp, Facebook, Instagram or Threads, and our replies (including replies written by Aria, our AI assistant).
• Device and usage data: pages viewed, browser, rough location from your IP address. See section 9.

Public information

• Public profile numbers (followers, posts, views) for creators who register or apply, read through our social data provider, to review accounts and report campaign results.
• Creator Insights: an index of public creator profiles (including creators not on Creamatch) that brands can search. Creators can ask to be removed at /creator-insights/remove.
• Public posts that mention Creamatch or our industry, so we can answer questions and complaints. These are deleted after 90 days.

3. How we use it

• To run campaigns: matching creators to briefs, reviews, shipping, payments and payouts.
• To review creator accounts and keep the platform free of fake accounts and fraud.
• To send service messages by email, WhatsApp, in-app and push notifications.
• To send marketing emails, only where you have not opted out. Every marketing email has an unsubscribe link.
• To improve Creamatch and fix problems.
• To meet our legal, tax and accounting duties.

4. AI in Creamatch

We use AI models from two providers:

• Anthropic (Claude) powers Aria, our assistant on WhatsApp and in campaign chats, and helps our team draft support replies and content ideas.
• Google (Gemini) checks submitted videos and drafts against the brief, scores portfolio videos for our showcase, and helps our team search the creator directory.

AI checks are advice only. They never approve or reject your work on their own: that is done by the brand, our team or by rules you can see in the app. Creator account reviews use automatic checks of public follower and post counts; an account that does not pass goes to a person or is asked to fix something, never rejected by the AI.

5. Where creators appear publicly

• Your profile at crea-match.com/creators/<username> shows your name, username, photo, bio, niches, city and state, checked stats, portfolio and (only if you publish them) your rates. A complete profile can appear in Google. Phone, email, address, bank details and social account links are never shown publicly. Switch off “Show my profile on Google” or hide your profile in Settings → Privacy & visibility.
• Our marketing pages and showcase may show your first name, last initial, your own profile photo and your uploaded portfolio videos. If you switched off “Show my profile on Google”, you appear as “Creamatch creator” without your photo.
• Our creator roster is a page our sales team shares by link with brands. It is not listed on Google. It shows approved creators' first name, last initial, photo, niches, state, rounded follower counts and one portfolio video. If your profile is set to private, you appear as an unnamed card.
• Leaderboards and the Creator Challenge board show first name, last initial and photo. You can opt out of leaderboards in Settings → Privacy.
• Signed-in brands considering you for a campaign can see your social account links and the shortlist details of that campaign.

6. Who we share data with

We do not sell personal data. We share it only with the services that help us run Creamatch:

• Hosting and database: Supabase (database, login, file storage) and Vercel (website hosting and cookie-free page-view counts).
• Payments: Stripe and CHIP.
• Messages: Resend (email), Meta (WhatsApp Business), Telegram (internal team alerts only).
• AI: Anthropic and Google, as described in section 4.
• Social data: ScrapeCreators, which reads public social profile and post numbers for us.
• Analytics and advertising: PostHog (product analytics, EU region), Google (Analytics and Ads), Meta and TikTok pixels. Section 9 explains which run only with your consent.
• Error reports and abuse protection: Sentry and Upstash.
• Brands and creators on the same campaign see what they need to work together: for example a brand sees the creator's delivery address only to ship the product.
• Authorities, when the law requires it.

7. Where your data is stored

Our main database and servers run in Tokyo, Japan. PostHog stores analytics in the EU, and some of the services above process data in other countries, including the United States. We choose providers that protect the data they handle for us.

8. Security

• All traffic is encrypted (TLS).
• Bank account numbers, IC numbers and connected social account tokens are encrypted at rest (AES-256-GCM) and never stored in plain text.
• Only staff who need the data for their job can see it.

9. Cookies and tracking

We use cookies and similar storage to keep you signed in, remember choices and measure our website and ads. Some run for every visitor and some only after you opt in. The Cookie Policy lists each one and when it runs. You can change your choice any time with “Manage cookie preferences”.

10. How long we keep it

• Account data: while your account is open. When you ask us to delete it, we remove or anonymise it.
• Payment, invoice and payout records: as long as Malaysian tax and accounting law requires, even after an account is deleted.
• Referral records: 24 months after the referral relationship ends.
• Public posts collected for social listening: 90 days.

11. Your rights

Under the PDPA you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong;
• stop using your data for marketing;
• delete your data. See Data Deletion for how.

Email privacy@crea-match.com. We may need to confirm it is you before we act.

12. Referral data

We record referral codes and who referred whom so we can pay rewards and stop fraud. This is used only to run the referral program and is not shared outside Creamatch.

13. Public tools and forms

• Creator score (/score) reads public profile data for the handle you enter, plus the email you give if you choose to, to build and share a score.
• Estimator, brief and contact forms keep the details you send so our sales team can follow up about your campaign. WhatsApp updates are only sent if you tick the box for them.

14. Connected AI assistants

If you connect an external AI assistant (such as Claude or ChatGPT) to Creamatch, it acts only after you sign in and approve access, and only for your own workspace. It can read your campaigns and the creator directory cards a signed-in brand already sees (never creator contact, address or bank details), prepare a private campaign draft for you, and approve or send back work waiting for you only when you tell it to. It cannot publish campaigns, select creators or make payments.

We log the account, tool name, outcome and record IDs of each call for security and support, not the brief or the reply itself. What you send to an external AI provider is also covered by that provider's privacy terms.

15. Connected social accounts

Creators and brands can choose to connect their own Threads, Instagram (professional account), Facebook Page or TikTok account through each platform's official sign-in. You approve the permissions on the platform's own screen and can disconnect at any time. We never see or store your social media password.

• What we read: your account ID, username, display name and profile picture; follower and post counts; and the numbers (views, likes, comments, shares, saves, reach) for posts you published through Creamatch, for up to 30 days after posting. We do not read your messages, other people's content, or posts you did not publish through Creamatch.
• What we post: only the video or photo you choose, with your caption and the settings you picked (for TikTok: who can view it, comments, Duet, Stitch and the branded content label), at the time you chose. Nothing is posted without your action.
• Campaign records: when a creator posts a campaign video through Creamatch, the public post link is added to that campaign, the same as submitting it by hand.
• Storage: access tokens are encrypted on our servers, never shown or shared, and used only for the actions above.
• Retention: tokens are deleted as soon as you disconnect. Scheduled post records and their numbers are deleted when you ask us, send a platform data deletion request, or delete your account.
• Disconnect and delete: in Creator Settings → Connected accounts or the brand portal's social scheduler, or in the platform's own settings (Facebook, Instagram and Threads: Settings → Apps and websites; TikTok: Settings and privacy → Security → Apps and services). Removing Creamatch there, or sending a data deletion request, deletes the connected account data we hold.

Use of information from these platforms follows their developer policies, including the Meta Platform Terms and the TikTok Developer Terms of Service.

16. Changes and contact

We may update this policy. The date at the top shows the current version.