1. Who is responsible
The operator of profit.social is responsible for the personal data described here. To ask anything about it, or to use any of your rights, write to hello@profit.social.
For the videos you make in a campaign, the brand behind that campaign (the Promoter) also decides how it uses them. Section 6 explains what we pass to the Promoter.
2. What we collect and why
When you visit the site
Our server records ordinary technical data with each request: IP address, browser type, the page requested and the time. We use it to deliver the site, to keep it secure and to find faults. We do not use analytics or advertising tools, and we do not build profiles of visitors.
When you click a creator's tracking link
Creators are paid partly for the installs their videos bring in, so we record the click. We store a salted, one-way hash of your IP address (never the address itself), your browser's user agent, your approximate country, the campaign labels in the link (UTM parameters) and the time. We use this only to work out which creator, if any, should be credited for an install. On iPhones this is a probability, not a certainty: if a match is ambiguous, we drop it rather than guess.
When you sign up or create an account
Your email address, name or display name, handle, and the referral code you joined with, if any. If you fill in a profile, we also store your bio and picture. Because there are no passwords, we create one-time sign-in links and record when they were used.
When you connect TikTok
With your permission, TikTok shares your account identifier, basic profile information and the list of your videos with their view counts. We use them to verify that the account is yours and to measure your campaign videos. We store the access tokens TikTok gives us, so that we can keep reading those counts until you disconnect. We cannot post for you, and we cannot see your messages.
When you sign a creator agreement
The name you give, your typed name, your drawn signature, the time, the exact version you signed with its fingerprint (hash), and a hashed IP address, your user agent and your country. This is the evidence that you signed, and it is kept so that either side can prove what was agreed.
When you get paid
Your payout method (PayPal, Wise or bank), the account details you give for it, your country, and a record of every amount earned, held, reversed and paid. We need this to pay you, to keep accounts and to meet our tax obligations.
When you use the community
Your posts, comments, images, reactions, direct messages, reports, the members you block, your points and level, and when you were last active. We use these to run the community, to send you notifications and to keep it safe.
When we email you
We send sign-in links, replies to your messages to us, notifications and a daily digest of community activity. If you are a lead, we may also send occasional updates about campaigns. Every message that is not essential has an unsubscribe link, and we honour it before every send.
3. Legal bases
Where the GDPR or a similar law applies, we rely on:
- Performing our agreement with you: your account, the community, measuring views, paying you and running referrals.
- Legal obligations: accounting and tax records, and answering lawful requests from authorities.
- Legitimate interests: keeping the service secure, preventing fraud such as fake views or duplicate accounts, crediting creators for the installs they bring in, and keeping evidence of signed agreements. We use hashing and short retention to keep the impact on you low.
- Consent: connecting TikTok, and update emails that are not part of using your account. You can withdraw consent at any time. Doing so does not affect what happened before.
4. Cookies and browser storage
- ps_session: a cookie that keeps you signed in, for up to 30 days. It is strictly necessary, so it is set without asking.
- ps_theme: remembers whether you chose the light or dark theme. It is kept in your browser's local storage and never sent to us.
- ps_ref: remembers the referral code from the link you arrived on, so that the person who shared it is credited if you sign up. It is kept in local storage, and you can clear it at any time.
We use no analytics, advertising or social-media tracking cookies or pixels.
5. What other people can see
- Other signed-in members can see your handle, display name, bio, picture, your posts, comments and reactions, and your points and level.
- Anyone can see the leaderboard, which shows handles, points and levels.
- Direct messages are seen only by the people in the conversation. If a message is reported, our moderators can read it in order to deal with the report.
- Your email address, payout details and earnings are never shown to other members.
6. Who we share data with
We do not sell personal data, and we do not share it for advertising. We share it only with:
- The Promoter of a campaign you join: your campaign videos, your public handle, the view and install figures for your content, and your signed agreement where that is needed to prove its rights.
- Payout providers (PayPal, Wise or your bank): the details needed to send your payment.
- Service providers who work for us under contract: our hosting provider and our email delivery provider. They may use the data only to provide their service to us.
- TikTok: when you connect your account. What TikTok does with data is covered by its own privacy policy.
- Authorities, advisers or a successor: where the law requires it, to protect rights or safety, or if the business is transferred, in which case this policy continues to apply.
7. Transfers outside the EU
Our servers are in the European Union. Some providers, such as payout and email services, may process data in other countries. When that happens, we rely on an adequacy decision or on the European Commission's standard contractual clauses to protect it.
8. How long we keep it
- Account and community data: for as long as your account exists. When you delete a post or comment, it is removed from view straight away.
- Sign-in links: they expire within a short time and are erased a week after expiry.
- TikTok access: until you disconnect, or remove our access in TikTok. The tokens are then deleted.
- Click and install records: as long as needed to credit installs and settle questions about payouts.
- Signed agreements, earnings and payout records: for as long as accounting, tax and limitation periods require, which can be several years after your account closes.
- Unsubscribe records: indefinitely, but only the email address and the reason. That is how we make sure we never write to you again.
9. Security
The site runs only over HTTPS. Sign-in uses one-time links instead of passwords, so there is no password to leak. IP addresses used for tracking are stored as salted hashes, and access to personal data is limited to the people who need it to run the service. If a breach puts your data at risk, we will tell you and the regulator as the law requires.
10. Your rights
Depending on where you live, you have the right to:
- get a copy of your data;
- correct data that is wrong;
- have your data deleted, except where we must keep it;
- restrict how we use it;
- receive the data you gave us in a portable format;
- withdraw consent you gave us.
Email hello@profit.social from the address on your account, and we will reply within one month. You can also complain to a data protection authority, either in the country where you live or in Romania (ANSPDCP). We would appreciate the chance to fix the problem first.
11. Your right to object
Where we rely on legitimate interests, you can object to that use of your data, on grounds relating to your situation. We will then stop, unless we have compelling reasons that override your interests, or we need the data for a legal claim. You can always object to direct marketing, and we will stop without asking why.
12. Age limit
profit.social is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think a minor has signed up, tell us and we will delete the account.
13. Changes to this policy
When this policy changes, we update the date at the top. If a change matters to you, we will also tell you by email or on your dashboard before it takes effect.