Privacy Policy

1. Introduction

TeaTrade ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the TeaTrade platform, including the Creator Hub, Brand Dashboard, and all associated services (collectively, the "Platform").

TeaTrade is operated from England, United Kingdom. By using the Platform you acknowledge that your data will be processed in accordance with this policy and applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

The data controller responsible for your personal data is TeaTrade. For any data protection queries, please contact us at [email protected].

3. Information We Collect

We may collect and process the following categories of personal data:

• Account Information: Email address, name, and authentication credentials (stored securely via Supabase Auth).
• Creator Profile Data: Tea expertise assessment results, niche categories, and self-reported experience.
• Social Media Data: When you connect a social media account (e.g. TikTok, Instagram, YouTube), we retrieve and store your public profile information and aggregate metrics such as follower counts, engagement rates, and video/post statistics. We do not access your private messages or non-public content.
• Payment Data: Stripe processes all payments. We store your Stripe customer or connected account ID but never store full card numbers, CVVs, or bank account details on our servers.
• Campaign Data: Brief details, content submissions, approval and dispute records, and associated payment transactions.
• Usage Data: Pages visited, features used, browser type, device information, and IP address (collected automatically).

4. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your account and authenticate your identity.
• To verify creator credentials via the vetting assessment and social media metric verification.
• To match creators with brand campaign briefs.
• To process escrow payments, transfers, and withdrawals via Stripe.
• To display verified, API-sourced metrics to brands considering creators for campaigns.
• To communicate with you about your account, campaigns, and Platform updates.
• To detect and prevent fraud, abuse, and violations of our Terms of Service.
• To improve the Platform through aggregated, anonymised usage analytics.

5. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract: Processing necessary to perform our contract with you (e.g. account management, campaign fulfilment, payments).
• Legitimate Interest: Processing necessary for our legitimate interests (e.g. fraud prevention, platform improvement), provided those interests are not overridden by your rights.
• Consent: Where you have given explicit consent (e.g. connecting a social media account). You may withdraw consent at any time by disconnecting the account.
• Legal Obligation: Processing required to comply with our legal obligations (e.g. financial record keeping).

6. Social Media Data & Third-Party APIs

When you connect a social media account, we use the official platform APIs (TikTok, Instagram, YouTube) to retrieve your public metrics. We encrypt stored OAuth tokens using AES-256-GCM. You can disconnect any linked social account at any time from your Creator Dashboard, which will delete the stored tokens and revoke our access.

We do not post to your social media accounts, access your direct messages, or retrieve private or non-public content.

7. Data Sharing

We do not sell your personal data. We may share your data with the following categories of recipients:

• Brands (for Creators): When you accept a campaign brief, brands can see your public profile, verified metrics, and submitted content. They do not receive your email address or payment details.
• Creators (for Brands): Creators see the brand name and campaign brief. They do not receive your billing details.
• Stripe: Our payment processor. Subject to Stripe's Privacy Policy.
• Supabase: Our infrastructure provider for authentication and database hosting. Subject to Supabase's Privacy Policy.
• Law Enforcement: Where required by law, regulation, or valid legal process.

8. Data Retention

We retain your personal data for as long as your account is active. After account deletion, we retain transaction records for up to 7 years to comply with financial record-keeping obligations. Social media tokens are deleted immediately upon account disconnection or deletion. Anonymised, aggregated data may be retained indefinitely for analytics.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• AES-256-GCM encryption for stored social media OAuth tokens.
• All data transmitted over HTTPS/TLS.
• Row Level Security (RLS) policies on all database tables to enforce access controls.
• Service-role-only access for sensitive tables (e.g. payment data, social tokens).
• Stripe handles all card and bank data — no raw payment credentials touch our servers.

10. International Transfers

Our infrastructure providers (Supabase, Stripe) may process data in locations outside the United Kingdom. Where data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in compliance with UK GDPR.

11. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data (subject to legal retention requirements).
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

12. Cookies

The Platform uses essential cookies for authentication and session management. We do not currently use third-party tracking or advertising cookies. If this changes, we will update this policy and obtain your consent where required.

13. Children's Privacy

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Platform. Continued use of the Platform after changes constitutes acceptance of the revised policy.

15. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

16. Contact

For any questions about this Privacy Policy or your personal data, contact us at [email protected].