Privacy Policy

Creator Guard LLC (“Creator Guard”, “we”, “us”) runs creator-guard.com, a free matching service that connects creators with vetted OnlyFans management agencies. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have — in plain language. It applies to the website, our quiz funnel, our free guides, our contact channels, and the Partner, Agency and Creator portals (see Section 5). For anything privacy-related, you can always reach us at info@creator-guard.com.

We comply with the EU General Data Protection Regulation (GDPR), the UK GDPR and, where applicable, the California Consumer Privacy Act (CCPA). Our service is intended for adults only (18+).

1. Who is responsible for your data (controller)

The controller responsible for the processing of personal data described in this policy is:

We are a company established in the United States. For every privacy matter — questions, requests, complaints — write to info@creator-guard.com; that address reaches the people who handle your data directly.

Representative in the EU (Art. 27 GDPR): MOXAMO GROUP Ltd, Palaion Patron Germanou 11, 8011 Paphos, Cyprus — info@moxamogroup.com. You and the EU data protection authorities can also contact our representative about any privacy matter.

2. What data we collect

a) Data you give us

• Matching quiz (“Get Started”): your name, phone number, e-mail address (optional), Instagram handle, OnlyFans handle (optional), and your answers about your current situation — for example earnings range, whether you already work with an agency, available time, privacy preferences, content comfort level and income goals.
• Writing to us on WhatsApp, Telegram, iMessage or SMS: our chat button and the quiz offer to write to us directly. The chat window on our site only prepares your first message; nothing you type there is stored on our website. When you tap send, WhatsApp (Meta), Telegram or your device’s messages app opens and the conversation runs through that service under its own terms: iMessage through Apple, SMS through your and our mobile network operators. We use what you write us there, your name and number or username, only to answer you and to match you with agencies.
• Free guides (Platform Onboarding, Content Strategy, Monetization Tactics): your first name, e-mail address, phone number and a short qualification answer. We deliver these guides via WhatsApp, so your phone number is used for that delivery.
• Contact form: your name, e-mail address, the topic you select and your message.
• Agency application (for agencies that want to be listed): agency name, website, country (optional), your name, e-mail address and Telegram username, and your confirmation that we may store these details to process the application.
• Referral program (for businesses that recommend agencies and referral partners to us): your name, company, e-mail address, Telegram username and website (both optional), who you reach, the referral code you entered and your confirmation that we may store these details. If you take part: your referral code, which accounts were created with it, the commissions and bonuses they earned you, your business and invoice details (company name, address, country, registration number or VAT ID), the invoices you upload and your payout details.
• Business contacts we find ourselves (agencies and referral partners we would like to work with): company name, website, market and language, the name of a contact person where it is public, business e-mail addresses and public social-media or messenger handles (for example Instagram, Telegram, X or LinkedIn), the page where we found them, and a record of our messages and your replies. We take these from public sources: the company’s own website, business directories and public social-media profiles.

b) Data we collect automatically

We run our own, privacy-friendly usage measurement: which pages are visited, how long a visit lasts, scroll depth, rough interaction counts and how far visitors get in the quiz. These records use a random session identifier stored for the duration of your browser tab — they are not used to identify you personally and are stored in our own database, not with an advertising network.

We also count visits with Ahrefs Web Analytics. It sets no cookies and stores nothing on your device. Your browser sends the page address, the referring page, browser and device type and your IP address to Ahrefs (Ahrefs Pte Ltd, Singapore). According to Ahrefs, it derives country and city from the IP address and then discards it — the raw IP is not stored. To count unique visitors, Ahrefs keeps a one-way hash of IP address and browser data whose random salt is replaced every 24 hours, so you cannot be recognised from one day to the next.

Error reports. If a page or our server runs into a technical error, we record an error report so we can fix it: the error message, the technical steps that led to it in this browser tab (for example which of our pages were opened and which requests to our servers were made), the page address (with access codes and other secrets removed), your browser and operating system type and your browser language. Error reports can therefore contain details of the action that failed. They do not contain your IP address or cookies. They are processed with our own error-tracking software (GlitchTip) on our server in Frankfurt am Main, Germany; no third party receives them. Legal basis: our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR).

c) Data collected only with your consent

If — and only if — you click “Accept all” in our cookie banner, we load Google Analytics, Google Ads conversion tracking and the Meta (Facebook) pixel. These services set their own cookies and process usage data (including your IP address) to measure our marketing and show relevant ads. If you choose “Only essential”, none of these are loaded. You can change your choice anytime via “Cookie settings” in the footer. Details are in our Cookie Policy.

3. Why we use your data (and the legal bases)

• Matching you with agencies — reviewing your quiz answers, contacting you (WhatsApp, phone or e-mail) and introducing you to suitable vetted agencies. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR). Some quiz answers (for example about OnlyFans or the content you create) can reveal information about your sex life, a special category of personal data. We process and share them only with your explicit consent (Art. 9(2)(a) GDPR): with one checkbox in the first step of the quiz you confirm that you are 18 or older and give that consent. Your contact details are saved when you finish that first step, and your later answers are added step by step, also if you stop before the end. We store the confirmation, its time and the version of the text with your submission. You can withdraw your consent at any time with effect for the future by writing to us.
• Delivering guides and answering messages — sending the free guide you requested and replying to contact form messages. Legal basis: Art. 6(1)(b) GDPR.
• Reviewing agency applications — checking an agency’s application, contacting it by e-mail or Telegram and, if we work together, inviting it to the agency portal. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Running our referral program — reviewing applications, giving you a referral code, recording which accounts were created with it, calculating commissions and bonuses, checking your invoices and paying you. Legal basis: our contract with you (Art. 6(1)(b) GDPR). To stop self-referral, we compare the IP address used when an account is created with your code against the IP addresses of your own logins; we store only whether they match, never the address, and only our admins see the result. Before the first payout we check your business name against the US sanctions lists, which we must observe as a US company. Legal basis for both checks: our legitimate interest in preventing fraud and in paying lawfully (Art. 6(1)(f) GDPR). An account created with your code is not told that you referred it.
• Winning new partner agencies and referral partners — contacting businesses we found in public sources about working with us, following up, and keeping track of the conversation. Legal basis: our legitimate interest in building our network (Art. 6(1)(f) GDPR). You can object at any time; a short reply such as “please don’t contact me again” is enough. We then stop contacting you and keep only what we need to respect that.
• Improving the site — first-party usage measurement and Ahrefs Web Analytics as described above. Legal basis: our legitimate interest in understanding and improving our funnel (Art. 6(1)(f) GDPR).
• Marketing measurement and advertising — Google Analytics, Google Ads and Meta pixel. Legal basis: your consent (Art. 6(1)(a) GDPR), revocable at any time.
• Showing the right language — when you open our homepage without having chosen a language, your browser’s language setting decides; only if it names none we support, our server looks up the country of your IP address in an offline database (IP Geolocation by DB-IP, licensed CC BY 4.0) and opens the matching language. The lookup happens on our own server and nothing is stored. Legal basis: our legitimate interest in showing you the site in your language (Art. 6(1)(f) GDPR).
• Security and abuse prevention — protecting our database with role-based access controls and keeping minimal technical logs. Legal basis: Art. 6(1)(f) GDPR.

4. Who we share your data with

Partner agencies — the core of our service

Matching means sharing: when we believe a vetted partner agency fits your profile, we share the information from your quiz submission (your name, contact details, social handles and quiz answers) with that agency so it can offer you a collaboration. In the Creator portal the stricter rules in Section 5 apply: agencies first see your profile under your creator number only, and your name and contact details go to one agency only, after it has paid its placement fee. We only share your data for this purpose — it is the service you signed up for. We may receive compensation from partner agencies; this never changes what data is shared.

Agencies with a portal account are bound by our Agency Terms. Agencies can receive offers in our portal or through our API, which sends the offer and links to the photos you agreed to share to the agency’s own systems. Until your contact details are released to them, they may use what they receive only to evaluate the introduction — no keeping it after the evaluation, no sharing, no AI use. If you withdraw your consent, your profile goes offline for every agency that has not completed a placement with you, we tell those agencies that you are no longer available, and they must delete what they received. Once an agency has received your contact details, it is an independent controller and processes them under its own privacy policy; our Agency Terms still oblige it to use them only to set up the collaboration with you, never to pass them on, to protect them appropriately, and to delete them within 30 days if no agreement with you is reached.

Telegram

Agencies and referral partners can choose to connect our Telegram bots to their account. An agency then also receives its offers in Telegram, including your photos and profile details — never your name or contact details, which it receives only in our portal or through our API after it has paid. In Telegram and through our API, each offer also shows the agency how your profile fits the search profile it set up with us, criterion by criterion (a match, close, or no match; for your niche and platforms only a match or no match). A referral partner receives updates about the creators it introduced, identified only by creator number.

A referral partner can also introduce you through the bot instead of our portal. It then sends us your details in Telegram — your name, your Instagram or another contact, your age, country, languages, the kind of content you make and photos of you. It can add further details, as in our portal: your follower count, niche, whether you have an OnlyFans account and what you earn there, when you could start, how many hours a week you have, and a note for agencies. Agencies read that note before they pay, so the bot refuses a note that contains your name or contact details. If the partner sends a longer text about you, Anthropic suggests these entries as described below for “Fill with AI”; the partner checks them before saving. We store what the partner saves exactly as if it had been entered in our portal, and the bot deletes the photos the partner sent from the chat once they are saved. Until the partner saves, our server in Germany keeps what it has entered so far for at most 24 hours; an introduction that is not finished by then is deleted, and so is one still open when the partner disconnects. The bot then gives the partner the link with which you yourself confirm your consent and that you are 18 or over; the partner forwards it to you. Neither the partner nor the bot can give these confirmations in your place.

Telegram carries and stores these messages on its servers outside the EU under its own terms; we have no data processing agreement with Telegram, and the transfer happens because the agency or partner chose to use Telegram for their messages with us. We send photos so that Telegram does not allow forwarding or saving them, and our Agency Terms apply to everything an agency receives through the bot exactly as in the portal: use only to evaluate the introduction, no sharing, and deletion when you withdraw your consent. When you withdraw it, we also delete our own messages with your photos in Telegram where Telegram still allows it (up to 48 hours after sending); older photos are replaced by a neutral picture. Once an offer or introduction is finished, the bot also tidies the chat the same way: it deletes or replaces its own messages about it, and for this our server keeps only the numbers of those messages, not their content. We can do both only while the person is connected; after a disconnect our server no longer knows these messages, and the agency’s duty to delete under our Agency Terms still applies.

To know whom to send messages to, we store each connected person’s Telegram user ID, chat ID and Telegram username in our database (Supabase, USA) and on our server in Germany, together with the settings the person chooses in the bot (language, time zone, quiet hours and the time of a daily summary). Messages held back during quiet hours or for the daily summary wait on our server until they are sent and are then deleted; they contain creator numbers only, never your name, contact details or photos. When the person disconnects, or after 90 days without use, we end the connection: the bot stops sending, its access key is revoked and our database deletes the Telegram user ID, chat ID and username at once. Our server in Germany deletes everything it holds about the person — these Telegram details, the settings, held messages, the numbers of its messages, reminders and any unfinished introduction — at once, or within about a minute if the connection was ended in our portal. Our database keeps only a record that the connection existed, without these Telegram details, until the person leaves the agency’s or partner’s account or the account is deleted. Our security log keeps the Telegram username given when the connection was made for 90 days. Legal basis for the bot: as for the same steps in our portal (Art. 6(1)(b) GDPR towards the agency or partner, Art. 6(1)(f) GDPR — our and the partner’s legitimate interest in introducing you — for your data the partner sends us).

Agencies outside the EU and the UK

Our partner agencies are not limited to Europe. An agency can be based outside the EU/EEA and the UK, including in a country for which the European Commission has not found an adequate level of data protection. If the agency’s country has an adequacy decision, that decision covers the transfer. Otherwise the transfer is based on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module One, controller to controller), which are part of our Agency Terms and which every agency must accept before it can receive offers or a creator’s contact details. Only where an agency has not accepted them do we rely on Art. 49(1)(b) GDPR: passing your details to the agency you are being introduced to is necessary to carry out the introduction you asked us for. Please be aware that in such countries public authorities may have wider access to data, and you may find it harder to enforce your rights there. The duties in our Agency Terms described above apply wherever the agency is based. You can ask us at any time in which country an agency that received your data is based.

Referral partners, their apps and their servers

A referral partner who introduced a creator sees the progress of that creator’s profile and whether she has given her consent and age confirmation — never the IP address or browser of those records and never which agency is involved. Partners can connect their own systems to our API: we then send their servers notifications (webhooks) that tell them that something changed and which record it concerns; the details are fetched through the API with the same limits. We keep the event itself (its type, the record it concerns and what changed) and each delivery attempt for 30 days, but not the message sent to the partner’s server.

Apps you connect yourself (creators). A creator can connect an app — for example the dashboard of the partner who introduced her — to her Creator Guard account. Our authorization screen shows her which app it is, who runs it and what it will be able to do before she agrees. With her authorization we give that app what she allowed: her profile, where she stands, her consent status and, if she asks through the app, the file with a copy of her data. From then on the app’s operator is responsible for that data as an independent controller under its own privacy policy. If the app’s operator is based outside the EU, we pass her data to it because she explicitly asked us to on our authorization screen (Art. 49(1)(a) GDPR); data protection there may be weaker than in the EU. She can disconnect an app at any time in her portal. Her consent, her 18+ confirmation and her acceptance of our creator terms can never be given through an app of the partner who introduced her; she gives them on our own pages or in an app she connected herself. She can withdraw her consent through any app she connected.

Team members of partners and agencies. A partner or agency account can invite colleagues. The account’s owner and administrators see the members’ e-mail addresses, roles and the account’s audit trail, which records who changed keys, webhooks, members or security settings, when, and from which IP address.

Service providers that process data on our behalf

We use the following providers to run our website and portals. They process personal data only on our instructions and under a data processing agreement (Art. 28 GDPR) that forms part of their standard customer terms. We use them on the same legal basis as the processing they support (Sections 3 and 5) and in our legitimate interest in secure, reliable infrastructure (Art. 6(1)(f) GDPR).

• Supabase (Supabase Pte. Ltd., Singapore) — database, logins and file storage (for example creator photos) for the website and the portals, hosted on Amazon Web Services in the US region us-west-1 (Northern California). Everything you submit through our forms and portals is stored there. Your browser connects to Supabase directly when you submit a form and when our usage measurement records a page view, so Supabase also receives your IP address and browser data as part of that connection. Supabase is not certified under the EU–US Data Privacy Framework; the transfer is based on the EU Standard Contractual Clauses in Supabase’s Data Processing Addendum.
• Hostinger (Hostinger International Ltd.) — our own server in Frankfurt am Main, Germany, which runs the website, the portals, our API (api.creator-guard.com), the worker that delivers webhooks to our partners’ servers, our API documentation and our error tracking (GlitchTip, see 2 b). Every request to creator-guard.com, app.creator-guard.com and api.creator-guard.com passes through this server. It also keeps our encrypted nightly backup copies of our database (see Section 6). The data stays in the EU.
• Resend (Plus Five Five, Inc., San Francisco, USA) — when we send account e-mails (for example a password-reset message), we send them through Resend, which acts as our processor. It receives your e-mail address and the content of the message. The e-mails are sent from Resend’s EU region (Ireland); Resend stores the account data, including the sent messages, in the USA. Resend is certified under the EU–US Data Privacy Framework, and its Data Processing Addendum also provides for the EU Standard Contractual Clauses. We send no newsletters.
• IONOS (IONOS SE, Germany) — our domain name service and e-mail hosting. Every e-mail you send to an @creator-guard.com address, including privacy requests, is stored in our IONOS mailbox. The data stays in the EU.
• GitHub (GitHub, Inc., USA) — hosts our source code and internal working documents in a private repository. It receives no data you submit through our website or portals and no copies of our database. The working documents can contain business contact details of agencies that the agencies publish themselves (for example a contact e-mail address). GitHub is certified under the EU–US Data Privacy Framework, which covers this transfer.
• Anthropic (Anthropic, PBC, USA) — provides the AI model (Claude) behind two features. (1) “Fill with AI” in the portals: a referral partner, an agency or our team can paste text they have about a creator — for example a bio, chat messages or notes, up to 20,000 characters — and the model suggests entries for the profile form (such as name, social handle, age, country, languages, earnings and content preferences). The person who pasted the text checks the suggestions before saving them; we do not store the pasted text. Legal basis: our and the submitting partner’s legitimate interest in entering profiles quickly and accurately (Art. 6(1)(f) GDPR). (2) Translating our own blog articles and pages, which contain no personal data about you. Under its terms, Anthropic may not use this data to train its models. Anthropic is not certified under the EU–US Data Privacy Framework; the transfer is based on the EU Standard Contractual Clauses in Anthropic’s Data Processing Addendum.
• Ahrefs (Ahrefs Pte Ltd, Singapore) — cookieless visit statistics, see 2 b). Singapore has no EU adequacy decision; this transfer is based on the EU Standard Contractual Clauses (Module 2, controller to processor) in Ahrefs’ Data Processing Addendum.

Services used only with your consent

• Google (Google Ireland Limited and Google LLC, USA) — Tag Manager, Analytics and Ads conversion tracking, loaded only after you click “Accept all” (see 2 c). Google processes this data partly on our behalf (Analytics) and partly under its own responsibility (Ads), as set out in Google’s data protection terms for business customers. Data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Meta (Meta Platforms Ireland Limited and Meta Platforms, Inc., USA) — the Meta pixel, loaded only after you click “Accept all”. For collecting and transmitting this data, Meta and we are jointly responsible (Art. 26 GDPR) under Meta’s Controller Addendum; Meta alone is responsible for what it does with the data afterwards. Transfers to Meta Platforms, Inc. in the USA are covered by its certification under the EU–US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR).

Communication channels and other recipients

• WhatsApp (WhatsApp Ireland Limited, part of Meta) — when we contact you or deliver a guide via WhatsApp, the messages run through WhatsApp, which processes them under its own terms and may transfer data to Meta Platforms, Inc. in the USA (certified under the EU–US Data Privacy Framework). Legal basis: Art. 6(1)(b) GDPR.
• Telegram — for referral partners and agencies, Telegram is one of our support channels. We store the Telegram username you give us and talk to you there if you choose to. Telegram is operated outside the EU and processes messages under its own terms. Legal basis: Art. 6(1)(b) GDPR.
• iMessage and SMS — if you write to us by iMessage or SMS from our chat button or the quiz, the messages run through Apple (iMessage, Apple Inc., USA) or through your and our mobile network operators (SMS), each under its own terms; iMessage may transfer data to the USA. Legal basis: Art. 6(1)(b) GDPR.
• Banks and payment services — agencies pay our fees by bank transfer against our invoice; we pay referral commissions by bank transfer, PayPal or crypto transfer, as the partner chooses. The bank, PayPal or blockchain network involved receives the data needed for the payment (name, account details, PayPal address or wallet address, amount and reference); crypto transfers are publicly visible on the blockchain. We use no online payment provider on our website. Legal basis: Art. 6(1)(b) and (c) GDPR.
• Our EU representative (Section 1) receives the privacy requests and the correspondence from authorities that are addressed to it.

Transfers outside the EU in short: Supabase (Singapore, data stored in the USA), GitHub, Resend (account e-mails) and Anthropic (USA), Ahrefs (Singapore), Google and Meta (USA, only with your consent), WhatsApp, Telegram and Apple (iMessage) when we talk to you there, Telegram also for our bots’ messages to agencies and partners, partner agencies wherever they are based, and apps a creator connects herself, wherever their operator is based. The safeguard for each is named above. You can ask for a copy of the Standard Contractual Clauses we rely on at info@creator-guard.com. We never sell your personal data to data brokers, and we do not share it with anyone beyond the recipients listed here unless required by law.

5. The Partner, Agency & Creator portals

Beyond the public website, we operate password-protected portals for referral partners, partner agencies and creators. If you hold a portal account, we additionally process:

• Account data: e-mail address, authentication data and role.
• Portal invitations: partner and agency accounts are opened only by invitation. We store the invited e-mail address, name, company and Telegram username and send a one-time link by e-mail, which works for 7 days. We keep the link only in a form that cannot be turned back into it. The invitation record stays with the account it opened; an invitation that is never used is deleted 90 days after it expired or was withdrawn.
• Creator profiles: the data needed to arrange a placement — name, social handles, languages, country, an 18+ self-declaration, earnings range, collaboration preferences and photos. Photos live in private storage and are shown to agencies only with the creator’s recorded consent, and only under a strict evaluation-only licence (no retention, no sharing, no AI use — see the Agency Terms in the portal).
• Consent and verification records: when a creator confirms her age, grants or withdraws consent or accepts our creator terms, we add an entry to a consent record that is only ever added to: the decision, the date and time, the version of the text she was shown, where she acted (her consent link or the creator portal) and the IP address and browser of the request, so we can prove it later. This is the legal backbone of the service.
• Login set-up links: a referral partner can send a creator a one-time link to set up her own login. When she uses it, we record the time, the IP address and browser and which partner account issued the link, so that nobody can set up a login in her place unnoticed. She sees this in her portal.
• Team members: partner and agency accounts can invite colleagues by e-mail address. We store the invited address, the role, who invited whom, and the invitation link’s status. An invitation that was accepted, revoked or expired is deleted 30 days later.
• API and app connections: for partners and agencies that use our API, the keys (stored only as hashes), a log of their requests (no request content, no IP address), an audit trail of security-relevant changes (with the IP address and client of the person who made them), the events we send to their servers and the delivery attempts; for a creator who connects an app, the connection, the scopes she allowed and short-lived access codes and tokens (stored only as hashes).
• Business records: partner and agency company details, offers, reservations, payment status and commissions.
• Support messages sent through the portal ticket system.

Passwords. When someone chooses a password on one of our own pages (for example a login set-up link or an invitation), we check it against known data breaches with the k-anonymity method of the “Have I Been Pwned” service: only the first five characters of a one-way hash of the password leave our server, never the password, the full hash or your e-mail address.

Legal bases (GDPR): performing our contract with you (Art. 6(1)(b)) for portal features, offers and payments; the creator’s consent (Art. 6(1)(a)) for sharing her profile and photos with agencies; legal obligations (Art. 6(1)(c)) for bookkeeping records; and our legitimate interest (Art. 6(1)(f)) in preventing fraud and documenting disputes.

Fraud check on consent records. When a creator’s consent or 18+ confirmation is recorded (on her consent link, in the creator portal or through an app), we compare its IP address with the IP addresses that the referral partner who submitted her and its team members used within 30 days before or after: their logins and sessions, two-factor checks, the changes recorded in the account’s audit trail (kept for 90 days) and their acceptance of our terms. These addresses are not copied for the check. We store only its result — whether the addresses matched, which kind of record and which of the partner’s logins matched and when, and whether the browser was the same — not the IP addresses themselves, and we keep it as long as the consent record it belongs to. If they match, our admins see a warning on her record and check with her that she gave the confirmation herself. Nothing is blocked automatically, no decision is taken on the warning alone, and the partner is not told. Only our admins see it. Legal basis: our legitimate interest in preventing consent being given in a creator’s place (Art. 6(1)(f) GDPR).

Who sees what: agencies first see a creator’s profile under her creator number only, without her name or contact details; her name and contact details are released to exactly one agency, only after that agency’s placement fee is received. Referral partners see the progress of their own leads and the status of her confirmations without learning which agency is involved. Apps a creator connects herself receive what she allowed (Section 4). Beyond that, portal data goes only to the service providers named in Section 4 — in particular Supabase, which stores it, and Anthropic when the “Fill with AI” feature is used.

Testing environment: partners can try our API in a separate test environment. To make tests realistic, it holds a copy of the partner’s own account profile; it holds no creator data from the live service.

Copy of your data and anonymization, built in: a creator can ask for a copy of her data or for its deletion at any time — with a support ticket in her portal, through an app she connected or by e-mail. A copy requested through an app is provided as a file that is deleted 7 days after it was made. On deletion, her profile data, photos, support tickets, app connections and portal login are permanently removed, and the IP addresses and browsers in her consent records are erased. What remains no longer identifies her: her consent decisions (what she decided, on which text version, when and through which channel), business records required for bookkeeping and profile attributes without her name, handles, contact details or photos. Portal business records are otherwise kept as described in Section 6.

6. How long we keep your data

We keep personal data for as long as we need it for the purpose we collected it for. Where a fixed period is named below for API, portal and app records, our database deletes the data automatically on a daily schedule; backups and error reports expire automatically on our server; bookkeeping records and consent decisions are deleted when their period ends; everything else is deleted on request or by hand when it is no longer needed:

• Quiz submissions, guide requests and creator profiles: as long as needed for the matching and placement — there is no fixed period. You can ask us to delete them at any time (Section 7).
• Contact messages and e-mails: as long as needed to answer your request.
• Referral program: applications as long as needed to decide on them; your code and the record of accounts created with it while you take part; commissions, bonuses, payouts and invoices for 10 years, as we keep all bookkeeping records.
• Business contacts for partner acquisition: until you object or we no longer need them for this purpose; on request we delete them at once.
• First-party usage data: as long as needed for our analytics. It is stored per page view and quiz step under a random session identifier; the identifier itself stays in your browser only until you close the tab.
• Consent proofs and contracts (consent and age confirmations, accepted terms, business records): for the duration of our relationship plus the statutory limitation periods; bookkeeping records, invoices and contracts for 10 years. When a creator’s data is deleted at her request, her consent decisions stay without the IP address and browser for 3 years after the placement ended or her data was deleted, and are then deleted.
• Login set-up links (creators): an unused link is deleted 30 days after it expired; a used link is kept with its record (time, IP address, browser) as long as her account exists, and the IP address and browser are erased when her data is deleted.
• Team invitations: deleted 30 days after they were accepted, revoked or expired.
• API records of partners and agencies: request log and audit trail 90 days; stored answers for repeated requests (idempotency) 24 hours; events and webhook delivery attempts 30 days.
• App connections: one-time authorization codes and access tokens are deleted one day after they expired; a connection that was ended is deleted 90 days later; background jobs (for example preparing a copy of her data) 30 days after they finished; the file with a copy of her data 7 days after it was made.
• Requests for a copy or deletion of her data made in the creator portal or through an app: the record of the request (when it was made, how, and how it ended) is deleted 3 years after the request was completed.
• Error reports: deleted automatically after 60 days.
• Backups: our database provider keeps daily backups for about 7 days. In addition we make an encrypted backup every night on our own server in Germany (Hostinger, Frankfurt): daily copies are kept for 14 days, weekly copies for 8 weeks, and then deleted automatically. Data we delete therefore disappears from the backups at the latest when they expire, after 8 weeks at most.
• Consent choice: stored in your browser until you clear it or change it.
• Language setting: the cg-lang cookie expires after 1 year.

You can ask us to delete your data at any time by writing to info@creator-guard.com. If the law requires us to keep something, we keep only that and use it for no other purpose.

7. Your rights

Under the GDPR (and, for UK residents, the UK GDPR) you can, at any time and free of charge:

• request a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure / “right to be forgotten”);
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format (data portability);
• withdraw any consent you have given, with effect for the future;
• lodge a complaint with a data protection supervisory authority — in particular the authority of the EU member state where you live, or the Information Commissioner’s Office (ICO) in the UK.

To exercise any of these rights, e-mail info@creator-guard.com from the address (or with the phone number) you used with us, so we can verify it is really you. We respond within one month.

California residents (CCPA): you have comparable rights to know, delete and correct. We share quiz data with partner agencies at your direction as part of the service you request; we do not sell personal information to third parties for money.

8. Security

All traffic to creator-guard.com is encrypted (HTTPS). Your submissions are stored in a database protected by row-level security: anonymous visitors can submit data but cannot read it back, partner agencies can only see the specific leads released to them, and full access is restricted to authenticated Creator Guard administrators.

9. Age requirement

Creator Guard is strictly for adults. You must be at least 18 years old to use this website or submit any form. If we learn that a person under 18 has submitted data, we delete it.

10. Changes to this policy

We update this policy when our service or our tooling changes. The date at the top always reflects the latest version; meaningful changes will be visible on this page.

11. Contact

Creator Guard LLC — privacy inquiries: 1209 Mountain Road Pl NE #11622, Albuquerque, NM 87110, USA · info@creator-guard.com