Privacy Policy

1. Introduction

Find My Creator is a creator relationship management platform built for agencies and brands operating in South Africa and across Africa. We take the privacy of everyone who uses our platform seriously - whether you are an agency team member, a UGC creator, or a visitor to our website.

This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have. It is written in plain language because we believe you deserve to understand exactly how your data is handled.

2. Who We Are

Find My Creator is a product of FM Digital Solutions, a South African digital solutions business. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), FM Digital Solutions is the Responsible Party - meaning we determine the purpose and means of processing your personal information.

Our platform operates as a multi-tenant software-as-a-service (SaaS) product. When an agency uses Find My Creator to manage their creator campaigns, that agency also acts as a Responsible Party for the personal information of the creators they manage within the platform.

3. What Personal Information We Collect

The information we collect depends on how you use the platform.

If you are an agency or brand:

• Name, email address and login credentials
• Organisation name, billing currency and payment information (processed via PayFast)
• Email branding settings (sender name, from address, email signature)
• Team member details for users you invite to your workspace
• Campaign data you create, including campaign briefs, deliverables, usage rights and payment terms
• Audit log data recording actions taken within your workspace

If you are a creator:

• Full name, email address and login credentials
• Profile information: city, province, country, age range and years of content creation experience
• Content categories, content creation style and brands previously worked with
• Social media platforms, handles and follower counts
• Recommended rate per video and availability dates
• Media kit files you choose to upload
• Messages exchanged with agencies through the platform inbox
• Content submission links and notes on each submission
• Campaign history and earnings records

Technical information collected automatically:

• Standard WordPress session and authentication cookies
• Basic server logs (IP address, browser type, pages visited) retained for security purposes

4. How We Use Your Information

We use the personal information we collect to:

• Create and manage your account and provide access to the platform
• Enable agencies to build creator rosters, send campaign invitations, manage campaign pipelines and review content submissions
• Enable creators to receive invitations, read campaign briefs, submit content and communicate with agency teams
• Send transactional email notifications (campaign invitations, submission updates, deadline reminders) - these can be turned off in your account settings
• Process subscription billing through PayFast
• Sync approved creator email addresses to Klaviyo, if an agency has enabled this integration in their settings
• Maintain audit logs for data governance and POPIA compliance purposes
• Improve platform security and prevent fraud
• Respond to support requests and account queries

5. Legal Basis for Processing (POPIA)

Under POPIA, we must have a lawful ground to process your personal information. We rely on the following grounds:

• Contractual necessity - processing required to provide the platform service you have signed up for
• Legitimate interests - platform security, fraud prevention, service improvement and communication about your account
• Legal obligation - retaining records as required by South African law
• Consent - for optional features such as Klaviyo email sync, which can be enabled or disabled by the agency administrator at any time

6. Who We Share Your Information With

We do not sell your personal information. We share data only where necessary to operate the platform:

• PayFast - our payment processing partner for subscription billing. PayFast is a South African payment gateway subject to its own privacy policy.
• Klaviyo - if an agency enables this integration, approved creator email addresses are synced to the agency's Klaviyo list. This is entirely optional and controlled by the agency.
• WordPress hosting infrastructure - the platform runs on a WordPress installation hosted with our infrastructure provider. Server logs and database backups are processed by this provider.
• Within the platform - agencies can view creator profiles, campaign submissions and messages. Creators can view campaign briefs and communicate with the agency team managing their campaigns. Information is scoped by organisation - agencies cannot see data belonging to other agencies.

We do not transfer personal information outside South Africa except where explicitly required by an integration you or your agency has chosen to enable (such as Klaviyo, which may process data outside South Africa).

7. Data Retention

We retain personal information for as long as necessary to provide the service and comply with our legal obligations. Agency administrators can configure a data retention period within their workspace settings (between 12 and 36 months). When a record is deleted, it is first soft-deleted and then permanently purged at the end of the configured retention period in compliance with POPIA requirements.

Audit log records are retained for the same period to maintain an accurate record of data processing activities. When an agency account is closed, we permanently delete all associated data in accordance with a documented deletion cascade that covers all related records including creator profiles, campaigns, messages and submissions.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• Right to access - you may request a copy of the personal information we hold about you
• Right to correction - you may request that we correct inaccurate or incomplete personal information. For profile data, you can update most information directly within your dashboard.
• Right to deletion - you may request that we delete your personal information, subject to legal retention requirements
• Right to object - you may object to the processing of your personal information on grounds relating to your particular situation
• Right to lodge a complaint - if you believe your rights under POPIA have been infringed, you may lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg

To exercise any of these rights, contact our Information Officer using the details in Section 11.

9. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration or destruction. These include:

• Role-based access controls - agency team members only see data within their own organisation
• Authentication and session management through WordPress security standards
• Prepared database statements to prevent SQL injection
• Nonce verification on all state-changing actions
• Soft deletion with configurable purge schedules aligned to your retention settings

While we take reasonable steps to protect your information, no internet-based service can guarantee absolute security. If you become aware of any security concern, please contact us immediately.

10. Cookies

Find My Creator uses standard WordPress authentication and session cookies required for the platform to function. These cookies keep you logged in during your session and are deleted when you log out or close your browser. We do not use third-party tracking cookies or advertising cookies.

11. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the date at the top of this page and, where appropriate, notify registered users via email or an in-platform notification. Continued use of the platform after any changes constitutes acceptance of the updated policy.