Privacy Policy

1. Scope

This Privacy Policy explains how VeroKit collects, uses, discloses, and protects personal information when you visit VeroKit, create an account, appear in a public creator profile, use a workspace, communicate with us, or participate in a transaction.

It applies to creators, brands, agencies, team members, clients, contacts, visitors, and other people whose information is processed through the Service.

2. Information we collect

Depending on how you use VeroKit, we may process:

• Account and profile information: name, email, company, role, phone, profile photo, logo, biography, location, website, preferences, and authentication identifiers;
• Creator and social information: public handles, platforms, content, audience and performance metrics, media-kit settings, rates, packages, public profile information, and—when an owner authorizes the feature—comments on the owner’s content;
• Giveaway and comment-picker information: private comment snapshots, uploaded CSV or Excel entry files, selected column mappings, eligibility rules, exclusions, random-selection evidence, selected and alternate entrants, winner status, replacement history, and fulfillment notes;
• Business and CRM information: clients, contacts, notes, activities, opportunities, campaigns, project terms, deadlines, tasks, costs, invoices, payment status, and reports;
• Transaction and support information: orders, agreements, approvals, files, messages, reviews, disputes, notifications, and support requests; and
• Technical information: IP address, device and browser information, session cookies, security logs, page interactions, referral information, and timestamps.

3. Where information comes from

We receive information directly from users, from public social and web sources, from transaction counterparties, from authorized service providers and integrations, and automatically when people use the Service.

A brand or agency may add a creator to its relationship workspace. A creator may add a brand contact or outside project to creator CRM. If another user adds your information, that user is responsible for having authority or another lawful basis to do so.

4. Sensitive information VeroKit does not request

VeroKit’s public-data workflow does not ask for or store creator social-media passwords and does not use them to post content. Complete payment-card and bank-account numbers are collected and handled by Stripe, not stored by VeroKit.

Do not place passwords, government identification, full financial-account details, health information, or other unnecessary sensitive data in CRM notes, briefs, messages, invoices, or uploads.

5. Public creator data

Creator profiles and insights may use information already public on social networks or the open web, as well as information provided by creators and data providers. Public availability does not remove privacy responsibilities. We use this information to create media kits, discovery results, analytics, rate-range estimates, campaign-fit signals, reporting, and marketplace context.

The first Brand or Agency search for a public creator may create one deduplicated, unclaimed profile and a prospect record. An unclaimed profile is non-bookable, does not publish creator-set pricing, and is marked not to be indexed by search engines. Ownership is granted only through a reviewed claim or a private invitation sent to a verified public business contact.

Creators may request correction, re-sync, review, removal, or ownership verification through the contact page or by emailing us. Some transaction, security, suppression, and legal records may need to be retained even if a public profile is removed.

6. How we use information

We use information to:

• provide, personalize, maintain, and improve the Service;
• authenticate users and protect accounts;
• create profiles, recommendations, CRM relationships, project briefs, creator matches, campaigns, agreements, invoices, analytics, and reports;
• deduplicate public creator searches and place potential invitation recipients into a reviewed outreach queue;
• process and reconcile transactions, transfers, refunds, and payout status;
• deliver operational messages and user-controlled communications;
• provide support, investigate disputes, prevent abuse, and enforce terms; and
• meet legal, tax, accounting, security, and compliance obligations.

7. Creator discovery invitations

A public search alone does not automatically send an email. When an authorized brand or agency identifies a creator as a potential project fit, VeroKit may prepare an invitation for administrator review. An invitation is sent only after the contact source and message are reviewed, uses a promotional email stream, identifies why the creator was contacted, and includes a one-click opt-out.

Suppression, bounce, complaint, cancellation, and unsubscribe records are used to prevent repeat contact. Campaign matching and rate ranges are estimates and are not promises of work, payment, or creator availability.

8. Legal bases

Where a legal basis is required, we process information to perform a contract, take requested pre-contract steps, pursue legitimate interests such as operating and securing the Service, comply with law, protect vital interests, or act with consent. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.

9. Cookies and authentication

VeroKit uses essential cookies and similar technologies to keep users signed in, remember theme preferences, protect authentication flows, maintain security, and understand product use. Essential cookies are required for signed-in workspaces.

Google sign-in, when enabled and chosen by you, provides a verified account identifier, email address, and optional profile image. VeroKit does not receive your Google password.

10. Google and YouTube connections

Connecting a YouTube channel is separate from using Google to sign in to VeroKit. When you connect a channel, VeroKit uses YouTube API Services to identify the channel you authorize and retrieve its name, identifier, profile image, uploaded-video information, and available channel and video statistics. With your permission, the YouTube Analytics API supplies performance reports and aggregate audience information, such as views, watch time, subscriber changes, geography, age groups, traffic sources, and device types. Available data depends on what YouTube returns.

The analytics connection requests youtube.readonly and yt-analytics.readonly. Optional comment tools read comments on content owned by the connected channel, including comment identifiers, text, author identifiers, timestamps, and available engagement information. When you separately enable comment replies, VeroKit requests youtube.force-ssl and uses it to post the public replies you configure. Google describes this permission as allowing editing and permanent deletion of YouTube videos, ratings, comments, and captions. VeroKit’s comment-reply feature uses it for replies and does not delete videos, ratings, or captions. If you enable publishing, VeroKit uploads only the video, metadata, channel and visibility you review and approve. Publishing accepts an existing compatible Google grant or requests youtube.force-ssl for the connected YouTube tools. Upload-specific youtube.upload grants are also accepted. A connected account alone does not publish a video.

VeroKit stores connection credentials encrypted on its servers so it can refresh authorized data and operate enabled features. Channel information, video records, analytics snapshots, and comment-tool results are stored in VeroKit’s databases or file storage. They support your workspace, media kit, reports, comment exports, giveaways, and configured automations. Information shown on your public media kit or a report you share is available to that page’s viewers. Hosting, database, and storage providers process the information to operate these features; Google receives API requests and the replies you instruct VeroKit to publish.

YouTube’s handling of information is described in the Google Privacy Policy. YouTube features also use services governed by the YouTube Terms of Service.

11. Invoice email connections

Invoice email connections are optional and separate from Google sign-in, calendars, and email marketing. If you connect Gmail or Google Workspace, VeroKit requests gmail.send together with your verified Google account identifier and email address. VeroKit uses this permission to send the invoices and client reminders you request, including recipient addresses, invoice details, links, and PDF attachments. It does not request permission to read your inbox. Google processes these messages and keeps sent copies in your mailbox.

VeroKit stores the connected account identifier, email address, encrypted access credentials, and delivery records. Disconnecting in Invoice email settings deletes those stored credentials and stops future sending through that connection. It does not remove messages already sent or revoke other Google connections. You can also revoke VeroKit’s access in your Google Account permissions. Invoice and payment records remain subject to the retention rules below.

Business-domain sending uses Postmark after mailbox ownership and domain authentication are verified. Postmark receives the verified sender address and invoice message contents needed for delivery. Invoice payment check-ins are sent to the creator in VeroKit, with optional email to their account address; they do not automatically send collection reminders to clients.

12. Calendar connections

Google Calendar and Apple Calendar connections are optional and separate from Google sign-in. When you connect Google Calendar, VeroKit requests permission to create a dedicated VeroKit calendar and manage events on calendars it creates. VeroKit sends the event titles, dates, reminder settings, completion status, and links to the corresponding VeroKit pages. These events can include project and brand names, task titles, contact follow-ups, and ad-access dates. VeroKit does not import your personal Google calendar events or use calendar data for advertising.

VeroKit stores the connected Google account identifier, email address, calendar identifier, encrypted access credentials, and synchronization records. Disconnecting in Calendar connections deletes the stored credentials and stops updates. Existing event copies remain in Google until you remove them there. You can revoke the Google permission from your Google Account.

Apple Calendar uses a private subscription URL. Anyone with that URL can read the event information in the feed, so keep it private. The subscription does not give VeroKit access to your Apple account or personal calendars. You can replace or disable the URL in Calendar connections; copies previously received by a calendar app may remain until you remove the subscription there. Updates flow from VeroKit to your connected calendars.

13. Control and delete connected Google data

You can disconnect official YouTube access in VeroKit’s connected-account settings. Disconnecting stops official refreshes and replies, requests revocation of the Google token, and deletes the connected channel’s saved analytics, video records, related comment records, and tool results from VeroKit’s active data. Related comment automations are paused. Generated files are deleted from VeroKit storage, with retries if a storage service is unavailable. This does not delete videos or comments on YouTube, or copies someone previously downloaded.

You can also revoke VeroKit’s access from your Google Account permissions. VeroKit checks connected YouTube authorization daily and deletes the associated saved data when it detects revoked access. Unrefreshed YouTube metadata and related tool results expire after 28 days. You can also request deletion of your connected Google/YouTube data by emailing getverokit@verokit.com. Identify the VeroKit account and channel in your request; do not send passwords or access tokens. Retention of saved records and backups is described below.

14. Payments and financial services

Stripe processes checkout, connected-account onboarding, identity and business verification, payment methods, transfers, refunds, disputes, and payouts. Stripe may act as an independent controller of information it collects. VeroKit receives transaction identifiers, status, amount, currency, risk or eligibility signals, and limited account details needed to display and reconcile activity.

Invoice and expense information entered in VeroKit is stored as business workspace data. Users decide what client and tax information to include.

15. How information is disclosed

We may disclose information:

• to counterparties and authorized team members when needed for a profile, relationship, order, agreement, invoice, campaign, approval, or report;
• to service providers supporting hosting, databases, object storage, payments, email, authentication, address search, analytics, customer support, security, and public-data processing;
• in a business transaction such as financing, merger, acquisition, reorganization, or sale, subject to appropriate safeguards;
• when required by law or reasonably necessary to protect rights, safety, users, or the Service; and
• with your direction or consent.

VeroKit does not sell personal information for money. If our practices later fall within a broader statutory definition of “sale” or “sharing,” we will provide the required notice and choices.

16. Public and shared pages

Media kits, public campaign reports, invoice share links, public marketplace listings, and other intentionally shared pages may be accessible to anyone who has the URL or discovers the public page. Do not publish information you do not want recipients or the public to see.

Workspace owners control many sharing settings, but recipients can copy or redistribute information after receiving access.

17. International processing

VeroKit serves users internationally and uses providers that may process information in Canada, the United States, and other countries. Those countries may have privacy laws different from your location. Where required, we use contractual or other recognized safeguards for cross-border transfers.

18. Retention

We retain information for as long as reasonably necessary to provide the Service, maintain security, comply with legal and financial obligations, resolve disputes, enforce agreements, and preserve legitimate business records.

Retention varies by record. Active account and workspace data is generally retained while the account is open. Private comment imports and giveaway records remain available to the workspace until the owner deletes them or the account is closed, subject to backups and any legal retention need. Transaction, agreement, invoice, tax, payout, dispute, audit, and security records may be retained longer. Backups and suppression records may persist for a limited period after deletion.

19. Security

VeroKit uses measures designed to protect information, including encrypted transport, access controls, hashed passwords, signed webhooks, restricted administrator access, durable storage, and security logging. No online service can guarantee absolute security.

You are responsible for a strong unique password, protecting devices and accounts, limiting team permissions, and avoiding sensitive information in free-text fields.

20. Your privacy choices and rights

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to certain processing; withdraw consent; opt out of certain marketing; or appeal a decision. You may also have the right to complain to a privacy regulator.

Account settings provide some direct controls. Other requests can be sent to getverokit@verokit.com. We may verify identity and authority before completing a request. Some information cannot be deleted immediately where retention is required or permitted by law.

21. Canada, United States, and other regions

For Canadian users, VeroKit handles personal information in accordance with applicable federal and provincial privacy requirements. For residents of US states with comprehensive privacy laws, applicable access, correction, deletion, portability, and opt-out rights will be honored. Users in the European Economic Area, United Kingdom, and other regions may have additional rights under local law.

Mandatory rights are not limited by this Policy.

22. Children

VeroKit is a business service and is not directed to children under 13. Users must be old enough to form a binding agreement in their jurisdiction or use the Service through an authorized parent, guardian, or business representative where legally permitted. Contact us if you believe a child’s information was submitted improperly.

23. Changes and contact

We may update this Policy as the Service or legal requirements change. We will revise the effective date and provide additional notice when required.

Questions and privacy requests may be sent to getverokit@verokit.com.