Privacy Policy
Last updated 14 Oct 2026 · InFrame Affiliates Ltd
This policy explains what personal data InFrame collects, why, who we share it with, how long we keep it, and the rights you have. We have tried to write it plainly. If anything is unclear, email privacy@inframeaffiliates.com.
1. Who we are
InFrame is operated by InFrame Affiliates Ltd, a company registered in England and Wales (company number 16332640), with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("InFrame", "we", "us").
For the personal data described in this policy, we are the controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. The one exception is data about a brand's shoppers that we process to attribute sales: there, the brand is the controller and we act as its processor (see section 3.7 and our Data Processing Addendum).
We have not appointed a Data Protection Officer, as we are not required to. Privacy questions go to privacy@inframeaffiliates.com, which is read by the person responsible for data protection at InFrame.
2. The short version
- InFrame is a platform where brands run paid campaigns with creators. To do that we need account details, information about the social accounts creators connect, the posts creators submit, and payment information.
- We do not sell personal data, and we do not use data from YouTube, Instagram or TikTok for advertising.
- Card payments and creator payouts are handled by Stripe. We never see full card or bank details.
- We use analytics cookies only if you agree to them.
- You can ask us to access, correct or delete your data at any time. See how to delete your data.
3. What we collect
3.1 Account information (brands and creators)
When you sign up: your name, email address, password (stored by our authentication provider in hashed form; we cannot read it), phone number, country, preferred currency and, for brands, your company name, website and business address. We also record when you accepted our terms and which page referred you to us (for example, a guide on our site).
3.2 Campaign information
Brands give us campaign details: briefs, content guidelines, budgets, payout terms, dates, images and website links. When a creator applies to or joins a campaign, we keep a record of the application, the participation agreement both sides accepted (with the date and time of acceptance), and the campaign's history.
3.3 Connected social accounts (creators)
Creators can connect YouTube, Instagram and TikTok accounts. Connecting is done through each platform's own login screen; we never see your password for those platforms. Depending on the platform, we receive:
- YouTube (Google): your channel ID, channel name, profile image and public statistics such as subscriber count. Scope requested: read-only access to your YouTube account (
youtube.readonly). - Instagram (Meta): your Instagram professional account ID, username, account type, follower count and the list of media you have published, which we use to confirm that a post you submit is yours.
- TikTok: your TikTok user ID, display name, username, profile image, profile link, verified status, bio and public account statistics (follower, following, like and video counts).
We store the access tokens the platforms issue so we can refresh this information. We use this data only to show brands who you are, verify that content submitted to a campaign belongs to you, and measure the posts you submit to campaigns. We do not post, comment or message on your behalf.
3.4 Content you submit and its performance
When a creator submits a post to a campaign, we store the link, the platform's identifier for it, and performance figures for it (such as views, likes and comments), collected from the platform or provided by the creator. Brands running that campaign can see these figures.
3.5 Payments and payouts
- Brands fund campaigns by card through Stripe Checkout. We receive confirmation of the payment, the amount, and a Stripe customer reference. We do not receive or store full card numbers.
- Creators are paid through Stripe Connect. Stripe collects the identity, bank and tax details it needs to pay you, under its own terms and privacy policy. We store your Stripe account reference, your balance, and a record of each earning and withdrawal.
- We keep transaction records (amounts, dates, currencies, fees and exchange rates applied) for accounting and tax purposes.
3.6 Shopify store information (brands that connect a store)
If a brand connects a Shopify store, we receive store details (store name, domain, plan, country, currency, timezone and owner contact email) and an access token that lets us read the order information needed to attribute sales to creators.
3.7 Data about shoppers (sales attribution)
When a campaign pays creators a commission on sales, a shopper may reach a brand's store through a creator's tracking link. We record the click (date and time, IP address, browser user agent and referring page) and, when an order is paid, the order reference, value, currency and the Shopify customer ID and email attached to the order. We use this only to attribute the sale to the right creator, calculate their commission, and detect fraud. We process order and customer data on behalf of the brand, which is the controller of its customers' data. Shoppers should read the brand's own privacy policy. We do not place cookies on brands' stores.
3.8 Communications
If you contact us (including through the in-app Get help or Request a feature forms), we keep the message, your contact details, and the page you sent it from, so we can reply and improve the product. We also send you transactional emails about your account and campaigns.
3.9 Usage, device and analytics data
When you use our website and app we collect technical information such as IP address, browser type, device type, pages visited, and errors encountered. Error reports help us fix bugs. Product analytics (which features are used) are collected only if you accept analytics cookies. See section 10.
3.10 Creators we contact
To build our network, we look for creators whose public profiles fit brands' campaigns, using public information (such as channel name, public statistics, content topics and any business contact email the creator has published) and may email them about relevant campaigns. We rely on our legitimate interests for this. Every such email tells you how to opt out, and we stop contacting anyone who asks.
4. Why we use your data, and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Creating and running your account | Account information | Contract |
| Running campaigns: briefs, applications, participation agreements, posting, review | Campaign information, connected accounts, submitted content | Contract |
| Verifying that submitted content belongs to the creator, and measuring it | Connected accounts, submitted content and performance | Contract; legitimate interests (preventing fraud) |
| Taking campaign payments, paying creators, keeping financial records | Payments and payouts | Contract; legal obligation (tax and accounting) |
| Attributing sales and calculating commissions | Shopify and shopper data | Contract (with the brand); we act as the brand's processor for shopper data |
| Sending service emails (applications, contracts, payments) | Account information | Contract |
| Answering support requests | Communications | Legitimate interests (helping you) |
| Keeping the service secure, preventing fraud and abuse, fixing errors | Usage and device data | Legitimate interests |
| Understanding how the product is used | Analytics data | Consent (analytics cookies) |
| Contacting creators who may want to join campaigns | Public creator information | Legitimate interests |
| Complying with the law and defending legal claims | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 9).
5. Platform-specific commitments
5.1 YouTube and Google
InFrame uses YouTube API Services. By connecting a YouTube account to InFrame, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
InFrame's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke InFrame's access to your Google account at any time through your Google security settings. When you revoke access or ask us to delete your data, we delete the YouTube data we obtained through the API within 7 days, except where we must keep a record of a completed campaign (for example, the link to a post you were paid for). We refresh or delete stored YouTube API data at least every 30 days.
5.2 Instagram and Meta
Instagram data is obtained through the Instagram API with Instagram Login and used only for the purposes in section 3.3. You can remove InFrame's access in Instagram under Settings → Apps and websites, and ask us to delete the data we hold using the data deletion instructions.
5.3 TikTok
TikTok data is obtained through TikTok's Login Kit and Display API and used only for the purposes in section 3.3. You can remove InFrame's access in TikTok under Settings and privacy → Security & permissions → Apps and services permissions, and ask us to delete the data we hold using the data deletion instructions.
We never sell data obtained from these platforms, never use it for advertising, and never share it with third parties except as described in section 6.
6. Who we share data with
Other users, as part of the service. When a creator applies to or joins a campaign, the brand sees the creator's name, connected account handles and public statistics, the creator's application, the posts submitted and their performance. Creators see the brand's name, website and campaign details. Anyone with a campaign's invite link sees the campaign's public details (never anyone's personal data).
Service providers who process data on our behalf, under contracts requiring them to protect it:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database, authentication, background jobs | United Kingdom (London) |
| Vercel | Website and application hosting | United States and global edge network |
| Stripe | Card payments, creator payouts, identity checks for payouts | United States, Ireland |
| Resend | Sending email | United States |
| Google (Cloud, Analytics, YouTube API) | Order processing functions, website analytics (with consent), YouTube data | United States and others |
| Mixpanel | Product analytics (with consent) | United States |
| Sentry | Error monitoring | United States |
| Cloudflare | Domain name and network services | Global |
| Shopify | Store connection and order data (for brands that connect a store) | Canada, United States |
| Notion | Internal records of creator outreach | United States |
Platforms you connect to (Google/YouTube, Meta/Instagram, TikTok, Shopify) receive the requests needed to provide the connection, under their own terms.
Legal and safety. We may disclose data if required by law, to respond to valid requests from authorities, to enforce our terms, or to protect the rights, property or safety of InFrame, our users or others.
Business changes. If InFrame is involved in a merger, acquisition or sale of assets, data may transfer to the new owner, who will be bound by this policy. We will tell you before that happens.
We do not sell personal data, and we do not share it for advertising.
7. International transfers
Some of our providers process data outside the UK, mainly in the United States. When we transfer personal data outside the UK, we make sure it is protected by one of the safeguards the UK GDPR allows: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies to a particular transfer.
8. How long we keep data
| Data | How long |
|---|---|
| Account information | While your account is open, then deleted within 30 days of closure, except as below |
| Connected social account data and access tokens | Until you disconnect the account, ask us to delete it, or close your account (YouTube API data: see section 5.1) |
| Campaign records, participation agreements, submitted posts and their performance | 6 years after the campaign ends, as a record of the contract and payments |
| Payment, payout and invoice records | 6 years from the end of the financial year they relate to (UK tax and company law) |
| Shopper click and order data | While needed to attribute and settle commissions, then up to 6 years as a financial record; deleted earlier on the brand's instruction where the law allows |
| Support messages | Up to 2 years after the conversation ends |
| Analytics data | Up to 26 months |
| Creator outreach records | Up to 12 months after last contact, or immediately if you ask us to stop |
9. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we no longer have a reason to keep it;
- restrict how we use your data in certain cases;
- object to processing based on our legitimate interests, including outreach;
- receive your data in a portable format (portability);
- withdraw consent at any time where we rely on consent (for example, analytics cookies), without affecting earlier processing.
To exercise any of these, email privacy@inframeaffiliates.com from the address on your account, or use Get help in the app. We may need to confirm your identity. We will respond within one month.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.
10. Cookies and similar technologies
We use a small number of cookies and similar storage. Strictly necessary ones are always on, because the site cannot work without them. Analytics ones are used only if you choose "Accept" on our cookie banner. You can change your choice at any time with Cookie settings in the footer of any page.
| Name | Purpose | Type | Lasts |
|---|---|---|---|
sb-access-token, sb-refresh-token |
Keep you signed in | Strictly necessary | Up to 7 days |
inframe_consent |
Remembers your cookie choice | Strictly necessary | 12 months |
| Signup progress (browser session storage) | Lets you resume signup where you left off | Strictly necessary | Until you close the tab |
| Stripe cookies (on payment pages) | Fraud prevention for payments | Strictly necessary (set by Stripe) | Per Stripe's policy |
inframe_ref |
Records which page referred you, so we know which content brings people to InFrame | Analytics | 30 days |
_ga, _ga_* |
Google Analytics: how visitors use the site | Analytics | Up to 2 years |
mp_* (browser local storage) |
Mixpanel: which product features are used | Analytics | Until cleared |
Tracking links for sales attribution work through parameters in the link itself, which the brand's Shopify store records with the order. We do not set cookies on brands' stores.
11. Security
We protect data with encryption in transit (HTTPS), access controls that limit who can see what, hashed passwords, signed authentication flows for connecting social accounts, and providers with strong security practices. No system is perfectly secure; if a breach affects your data in a way that puts you at risk, we will tell you and the ICO as the law requires.
12. Children
InFrame is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has signed up, contact us and we will delete the account.
13. Changes to this policy
We will update this policy when our practices change. The date at the top shows when it last changed. If a change is significant, we will tell you by email or in the app before it takes effect.
14. Contact
InFrame Affiliates Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom Privacy: privacy@inframeaffiliates.com · Everything else: help@inframeaffiliates.com