Privacy Policy

1. Who we are

Creator ToolBox is operated by Kota LLC, a limited liability company registered in Alabama, United States. We are the controller of the information described in this policy.

Questions, requests or complaints: admin@creatortoolbox.io.

2. What this policy covers

This policy explains what information Creator ToolBox collects, why, who we share it with, how long we keep it, and what control you have. It covers our website, our web application, our editor tools and our admin tools.

It is a notice, not an agreement. Where the law requires a legal basis for using your information, we rely on performance of our contract with you, your consent for the optional integrations described below and for marketing, our legitimate interests in operating and securing the platform, and our legal obligations.

3. Information we collect

Information you give us when you sign up. Your name and email address, then your TikTok handle. You can also add your follower count, country, city, category and a note, all of which are optional. We take the handle as text; connecting your TikTok account is a separate step described in section 6.

Your password. You choose a password when you sign up. We store it only as a one way hash, never as the password itself. We also email you a link, valid for seven days, to confirm your address.

Information you add afterwards. Anything else you choose to put on your profile or into a deal, which may include your niches, your rates, sample content, and performance figures you enter yourself. If you are a brand, your company name, website, contact details and campaign requirements.

We never ask you for the password to your email, TikTok or any other third party account, and we do not store one. When you connect one of those services it happens through that provider's own authorisation screen, and what we hold is an access token rather than a password. The token is encrypted before it is stored.

Your Creator ToolBox account password is stored only as a one way hash, which means it cannot be read back, by us or by anyone else.

Deal and platform activity. Deals you create, accept or are invited to, messages you send through the platform, videos and links you submit, deliverable and approval status, ratings and reviews, disputes, and payment status.

Editing orders. Where you order editing, the raw footage, reference material, instructions and notes you upload.

Email you forward to us. See section 5.

Payment information. Payments are handled by Stripe, our third-party payment processor. We receive confirmation of payment and limited details such as the last four digits of a card. We do not store full card numbers.

Technical information. We record your IP address when you sign up, so that we can rate limit signups and stop bulk account creation, and we log your IP address and browser user agent once, at the moment you set your password. That is ordinary sign in security. We do not track how you move around the product, and we do not collect referrer, campaign or device profiling information.

4. Connecting your Google account

This section explains our use of Google user data. It applies only if you choose to connect a Google account.

• What we access: your Google account email address and basic profile information, to confirm the connected account, and permission to send emails on your behalf via the Gmail API (gmail.send). We do not access, read, download, or store the contents of your inbox, sent mail, drafts, or any other messages.
• How we use it: solely to send the outbound emails you compose or schedule within Creator ToolBox. We do not use this data for any other purpose.
• How we store and protect it: we store your Google OAuth authorization tokens in encrypted form and use them only to send email on your behalf. We do not retain copies of Google user data beyond what is necessary to provide this feature.
• How we share it: we do not sell, rent, or transfer Google user data to third parties, and we do not use it for advertising or to train AI or ML models.
• Revoking access: you can disconnect Gmail at any time from the Inboxes tab of your Email Agent page, or revoke Creator ToolBox's access directly at myaccount.google.com/permissions. On disconnection, we delete the stored authorization tokens.
• Limited Use: Creator ToolBox's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, information received from Google APIs is not used or transferred for serving advertising; is not sold or transferred to data brokers or other information resellers; is not used to train generalized AI or ML models; and is not read by humans unless (a) you give affirmative consent for specific messages, (b) it is necessary for security or to comply with applicable law, or (c) the data is aggregated and anonymized for internal operations.

5. Email you forward to us

This is separate from section 4 and does not involve access to your mailbox.

You may choose to forward incoming brand emails to an address we provide for you, either message by message or by setting up a forwarding rule in your own email provider. This is optional and set up by you.

What we receive. The contents of the messages you forward, including the sender's address and name, the subject and body, any attachments, and the message identifiers needed to keep a reply in the same conversation.

What we do with it. We process the message to determine whether it is a brand enquiry, to extract the terms being offered, to create or update the matching deal in your dashboard, and to prepare a draft reply for you to review. This processing is automated and includes processing by an artificial intelligence model operated by a third party provider under contract to us. Under our agreement with that provider, it is prohibited from using this content to train or improve its models, and it deletes the content within 30 days. The exception is content flagged under the provider's own usage policies, which it may keep longer in order to review it.

Human access. Our staff do not read your forwarded mail. The limited exceptions are where you ask us to look into a problem with your account, where it is necessary for security such as investigating abuse, or where the law requires it.

What we never do. We do not sell forwarded email content, we do not use it for advertising, and we do not use it to train or improve general purpose artificial intelligence models.

Stopping it. Remove the forwarding rule in your own email provider, or ask us to disable the address, and we stop receiving new messages immediately. Deals already created from forwarded email remain in your dashboard unless you ask us to delete them.

6. Connecting your TikTok account

Connecting TikTok is optional and started by you. We request only the permissions needed to confirm the account is yours and to show your handle and basic public profile information, so that brands can find and assess you. We do not post to your TikTok account and we do not read your private messages.

Performance and sales figures shown on your profile are the figures you enter yourself, unless the page states they are verified through TikTok.

You can disconnect TikTok at any time from your account settings.

7. Why we use your information

To create and run your account, to operate the marketplace and match creators with brands, to run the email features you switch on, to provide editing and other paid services you order, to process payments and subscriptions, to provide support, to keep the platform secure and prevent fraud and abuse, to send service messages about your account and your deals, and to comply with our legal obligations.

8. Marketing

We send service messages about your account and your deals, and you cannot opt out of those while you hold an account. Marketing emails are separate and you can unsubscribe from them at any time.

9. Who we share information with

We do not sell your personal information.

With other users, where you direct it. Your profile and the figures on it are shown to brands when you choose to be discoverable, and the details of a deal are shared with the other party to that deal.

With editors. Where you order editing, the files and instructions for that job are made available to the editor who takes it. Editors are independent contractors, may be located outside your country, and are subject to confidentiality obligations.

With service providers, each acting under contract and only for that purpose. These currently include our cloud hosting provider, our email sending and deliverability providers, Stripe, and the artificial intelligence provider used for the drafting and extraction features described in section 5. We do not use analytics or advertising services.

Where required by law, to enforce our terms, or to protect the rights and safety of users and the public.

In a business transfer, in connection with a sale or reorganisation of the business, in which case we will tell you.

10. International transfers

Creator ToolBox is operated from the United States. Our team, our contractors and our service providers are located in several countries, which may be outside your country of residence. Where information is transferred internationally we use appropriate safeguards, including contractual protections with the people and companies who receive it.

11. How long we keep information

We keep your account information for as long as your account is open. After you close it we delete or anonymise your personal information within 90 days, except where we need to keep records longer to meet legal, tax, accounting or dispute resolution obligations.

Google authorization tokens are deleted when you disconnect your Google account.

Forwarded email content is kept only as long as needed to produce and show the resulting deal and draft, and is deleted on the same schedule as your account. Deal records you have chosen to keep remain in your dashboard until you delete them.

Files uploaded for editing are kept until the job is complete and the review period has passed, and are then deleted on the schedule above.

12. Cookies and similar technologies

We use a small number of cookies, all of them our own. A session cookie keeps you signed in; it is httpOnly and lasts fourteen days. We also store your theme preference, and, if you begin signing up, the partly completed form, so that refreshing the page does not wipe what you have typed.

We do not use analytics cookies, advertising cookies or tracking pixels, and no third party scripts run in your browser.

13. Security

We use encryption in transit for your information, store authorization tokens in encrypted form, and restrict internal access to what each person needs for their role. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Where a breach affects you and the law requires it, we will tell you and the relevant authorities.

14. Your rights

Depending on where you live, you may have the right to access the information we hold about you, to correct it, to delete it, to object to or restrict how we use it, to receive a copy in a portable format, and to withdraw consent for optional integrations at any time. Withdrawing consent does not affect anything we did before you withdrew it.

You can update your profile and disconnect TikTok or Google yourself from your account settings. For anything else, email admin@creatortoolbox.io. We will respond within the time the law allows. You can also complain to your local data protection authority.

15. Age

Creator ToolBox is not for anyone under 18. We do not knowingly collect information from people under 18, and we delete it if we discover we have.

16. Changes to this policy

We may update this policy. We will post the new version here and update the date above. If a change is significant, particularly any change to how we handle Google user data or forwarded email, we will tell you in the product or by email before it takes effect.

17. Contact

Kota LLC

admin@creatortoolbox.io