Privacy Policy

This Privacy Policy applies to:

• Brands using the Platform
• Creators registered on Gems
• Visitors to our website
• Prospects and partners interacting with us

It does not apply to third-party platforms (e.g., Instagram, TikTok, Stripe), which have their own privacy policies.

2.1 Information You Provide Directly

Account & Profile Data

Brand Accounts

• Company name, legal entity information, registered address
• Account administrators and authorized users (name, email, role)

Creator Accounts

• Name, email, birth date, language, phone number
• Creator profile details (social-media handle, rates, formats, availability), country/region, avatar, and authentication identifiers
• Delivery information, in case creators need to receive a product

Campaign Data & Collaboration Data

• Campaign briefs, timeline, options, product details, budgets, target audience
• Communications between Brands and Creators
• Contracts and agreements
• Creative submissions and approvals: sample products to be shipped, draft content, feedback, approvals/declines, and posting confirmations

Financial & Billing Data

Brands

• Invoices
• VAT number, SIRET, or company registration details
• Wallet top-ups and payment method tokens
• Payment details via payment providers (we do not store full card numbers)

Creators

• Invoices
• VAT number, SIRET, or company registration details
• Bank account details (e.g., IBAN, BIC) provided by Creators for payment purposes

2.2 Information Collected Automatically

• Technical data: IP address, device, browser, OS, log data, session data
• Usage data: pages visited, actions performed, feature usage, performance metrics
• Campaign performance data: views, clicks, conversions, engagement metrics, posting URLs, and attribution signals from integrated analytics/short-link/UTM tools

2.3 Third-Party & API Integrations

If you connect social accounts (e.g., Instagram, TikTok, YouTube, Facebook, LinkedIn), we may collect:

• Public profile information
• Post-level analytics, only with your authorization and platform rules

If you connect Meta Business accounts, we may collect:

• Business profile information
• Business Manager data (including business portfolio and associated assets)
• Advertising account information
• Campaign, ad set, and ad performance data (e.g., impressions, reach, clicks, conversions, spend)
• Access tokens and permissions required to interact with Meta APIs

• Create and manage user accounts
• Match Brands with Creators
• Run campaigns and manage workflows
• Generate reports and campaign performance analytics
• Facilitate payments and invoicing
• Provide support
• Improve the Platform
• Ensure security and prevent fraud
• Comply with legal obligations

Gems uses algorithmic models and machine learning to rank and recommend Creators, suggest pricing benchmarks, predict campaign outcomes, analyze performance, and improve matching quality.

We do not use private campaign content to train general-purpose external AI models without explicit consent. Where third-party AI services are used, we configure them to prevent data reuse for external model training when possible.

Service Providers

• Hosting and cloud providers
• Payment processors
• Analytics tools
• Identity verification services
• Communication tools

All providers are bound by confidentiality and data protection agreements.

Between Brands and Creators

Certain data is shared between Brands and Creators to enable collaborations (e.g., profile information, campaign details, communications).

Legal & Compliance

When required by law or to protect rights and safety.

Business Transfers

In case of merger, acquisition, or restructuring.

We do not sell personal data.

Data may be processed outside your country. Where required, we rely on Standard Contractual Clauses (SCCs), adequacy decisions, and additional technical safeguards.

• Account data: duration of account + up to 24 months after closure
• Campaign data: up to 36 months after the related campaign completes
• Financial records: up to 10 years (legal obligation)
• Logs: 90 days, unless extended for security investigations or legal holds

After retention, data is deleted or anonymized, unless law requires longer retention.

Depending on your location, you may have the right to access your data, correct inaccurate data, request deletion, restrict processing, object to processing, withdraw consent, and request data portability.

To exercise your rights, contact us at [email protected]. Splash should respond within one month. Deletion requests covering data collected through Meta platforms follow our Data Deletion Policy.

You also have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL: www.cnil.fr.

We use cookies to maintain sessions, remember preferences, analyze usage, and improve performance. You can manage cookies via browser settings or our cookie banner.

We implement appropriate technical and organizational measures, including encryption in transit (SSL/TLS), access control and role-based permissions, secure infrastructure, monitoring, and logging.

No system is 100% secure, but we continuously improve our safeguards.

The Platform is not directed to children under 16. If we learn that we have collected personal information from a child below the applicable legal age threshold without proper consent, we will delete it promptly.

In the EU, the default GDPR age for independent consent is 16, and national laws may lower it down to 13. In France, this threshold is 15.

We may update this Privacy Policy. If changes are material, we will notify users by email or within the Platform. The latest version is always available on our website.

Splash (data controller and operator of Gems)

Email: [email protected]

Website: https://withgems.com

Splash has designated a Data Protection Officer for privacy-related questions and rights requests.

DPO contact: [email protected] (subject: "DPO Request").