Privacy Policy

Who we are

Activated Creators Global, LLC operates activatedcreators.com and the Activated apps for iPhone and Android. We are the data controller for the information described here. Contact us about anything on this page at hello@activatedcreators.com.

What we collect

Your account

• Your name, email address and account type (creator, business or member).
• A password, stored only as a bcrypt hash. We cannot read your password.
• If you sign in with Google or Apple, your name and email address from them (with Apple you may choose a private relay address). For Apple we also keep a token, encrypted, so we can disconnect your Apple sign-in when you delete your account.
• When you signed up and which version of our Terms and this policy you accepted, including your confirmation of your age.

Your profile, as you choose to fill it in

• Photo, cover image, bio, interests, languages, nationality, and for a business its name, category and details.
• Your base city or area and areas you are available in. We work at city and area level, never your street address.
• Social accounts and audience numbers. Each number is labelled by where it came from: what you entered, what you showed us (for example a screenshot of your account insights), or what we verified.
• Rates and services, which you can mark public or private.
• Portfolio photos and videos.

Creator profiles are visible to businesses on Activated, and parts of a profile (name, photo, bio, public rates) can be seen by anyone with the link. Be deliberate about what you put there.

What you do on Activated

• Campaign applications, the choices and commitments you make, visit bookings and check-ins, the work you submit, reviews of it, and your reliability record (deliveries and no-shows).
• Messages: in communities, in campaign chats and in Resources requests, including photos and videos you send.
• Event registrations and tickets; service listings, requests and quotes.
• People you block, and reports you make about messages.

Payouts and payments

Card payments are processed by Stripe; card numbers never reach our servers. We keep Stripe’s references and what was bought, when and for how much. If you are paid as a creator, we keep the payout profile you give us: legal name, whether you are paid as a person or a company, country of residence and tax residence, whether you are a US person for tax, where you usually work, and the country and currency of your bank. We do not ask for bank account numbers in the app.

Location

Only when you tap “Use my location”, your device’s approximate position (rounded to about 100 metres or more) is used once to find the nearest city area. The coordinates are not stored; the area you choose is.

Devices and technical information

• If you allow notifications in the app: the device’s push token, its platform, and a random identifier for that installation.
• Your IP address, used briefly to limit sign-in attempts and other abuse-prone actions, then discarded.
• Error reports (the page, the error and the browser name — never what you typed, your cookies or your messages), so we can fix faults.
• A record of actions taken by our team (for example approving a campaign), so we can answer for them.

We do not use advertising identifiers, analytics trackers or ad networks, and we do not track you across other apps or websites.

Why we use it, and on what basis

• To provide Activated to you (performing our contract with you): your account, your profile, campaigns, chat, events, Resources, notifications, and paying creators.
• To keep Activated safe and working (our legitimate interests): preventing abuse and fraud, moderating reports, fixing errors, and keeping a record of our team’s actions.
• To meet legal duties: tax and accounting records for payments and payouts, and answering lawful requests.
• With your consent: push notifications, device location, and emails about new campaigns and news. You can withdraw consent at any time in your device settings or in Settings → Email, or with the unsubscribe link in those emails.

Emails about your own account, applications, campaigns and tickets are part of the service and are always sent.

Who else sees it

We do not sell your personal data, and we do not share it with advertisers.

Other people on Activated see what the service shows them: businesses see the profile and application of creators who apply to them, and both sides of a campaign see their conversation and the submitted work. Members of a community see its chat. A business keeps the work delivered to it as the campaign agreed.

Service providers process data for us, under contract, and only to provide their service:

• MongoDB Atlas — our database (Asia-Pacific region).
• Vercel — hosts the website and the app’s pages (its servers for Activated run in Singapore).
• Cloudflare R2 and Cloudinary — store and serve photos and files you upload.
• Mux — stores and streams videos you upload (with viewer analytics turned off).
• Stripe — card payments.
• Resend — sends our emails.
• Google Cloud Translation — translates campaign text between English and Thai.
• Apple and Google — deliver push notifications, and handle sign-in if you use them.

Embedded posts. When a message or profile shows a post from YouTube, Instagram, TikTok, X or Facebook, that post is loaded from that company, which receives your IP address and may set its own cookies under its own policy. YouTube posts load in its privacy-enhanced mode.

We may also disclose information where the law requires it, to protect someone from serious harm, or to a buyer of our business, who would be bound by this policy.

International transfers

Our servers are in the Asia-Pacific region, and some providers process data in the United States and elsewhere. Where data leaves Thailand, the UK or the EU, we rely on our providers’ contractual protections (such as standard contractual clauses) as the law requires.

Cookies and storage on your device

We use only cookies and storage that make Activated work. There are no advertising or analytics cookies, so we do not ask you to accept any.

• Sign-in — keeps you signed in and protects sign-in (session, security and the Google/Apple sign-in steps).
• Language and area — remember the language and the city area you chose.
• Sign-up in progress — carries the details you entered across a Google or Apple sign-up; deleted when it completes.
• Campaign link — remembers the campaign link you arrived through.
• Request source — remembers, for 30 days, which page or partner sent you to Resources, so a request can be attributed. It holds a label, not anything about you.
• On your device only — your light or dark theme, and whether we already asked about notifications.

How long we keep it

• Account and profile — until you delete your account.
• Messages you sent in other people’s conversations — kept as their record after you delete your account, shown as “[deleted user]”.
• Payment, ticket and payout records — as long as tax and accounting law requires (usually 5 to 10 years), without your name after deletion.
• Push tokens — until you sign out, or 270 days after the device last opened the app.
• Sign-in limits and one-time codes — minutes to hours.
• Error reports — 90 days after the error was last seen.
• Records of our team’s actions — 12 months.
• Backups — overwritten on our database provider’s backup cycle.

Your rights

You can:

• Get a copy of your data — Settings → Download my data (on the website) gives you everything we hold about you as a file.
• Correct it — most of it you can edit yourself; for the rest, email us.
• Delete your account — Settings → Delete account, or see how to delete your account.
• Object, restrict processing or withdraw consent — for notifications and emails use Settings; for anything else, email us.

These rights come from Thailand’s Personal Data Protection Act (PDPA), the GDPR in the UK and EU, and similar laws elsewhere, including US state privacy laws. Email hello@activatedcreators.com; we answer within 30 days. If you are not satisfied, you can complain to your data protection authority (in Thailand, the Personal Data Protection Committee).

Children

Activated is for adults: at least 20 in Thailand and 18 elsewhere. We do not knowingly collect information from anyone younger. If you believe a child has an account, tell us and we will delete it.

Security

Everything travels over HTTPS. Passwords and one-time tokens are hashed. Videos, chat files and campaign work are private and served through links that expire. Our team’s access is limited by role, and its actions are recorded. No system is perfect; if a breach affects you, we will tell you and the authorities as the law requires.

Changes

If we change this policy in a way that matters, we update the date at the top and tell you in the app before it takes effect.