Privacy policy
How your information is used, what becomes public, and the choices you have.
Version 2026-11-06 · Effective 2026-11-06
Who is responsible
The operator below is responsible for platform processing described here. Instagram and Google also have their own responsibilities for the services you use with them.
- Legal operator
- palmstudio GmbH
- Legal form
- GmbH
- Address
- Pfalzgrafenstraße 38, 67434 Neustadt an der Weinstraße, Germany
- Country of establishment
- DE
- Contact
- hey@creatorspop.com
- Privacy contact
- hey@creatorspop.com
Your account and sign-in
Firebase Authentication handles Google, email-link and Instagram sign-in. We store a platform user ID, available email/contact verification, account name/image where supplied by the sign-in provider, provider associations and account timestamps. Google and Instagram also process sign-in under their own services. We do not receive your Google or Instagram password.
An Instagram-to-platform identity mapping keeps the same Instagram account associated with one platform account across our data environments. Instagram sign-in need not provide an email. A contact email is optional and is not a condition of participating in a Round; verifying it enables future Entry lifecycle messages and an additional email-link sign-in method. Account and provider identifiers are personal data, even when they are not public.
- Purpose / legal basis
- Provide the account and requested sign-in: GDPR Art. 6(1)(b). Protect account integrity and prevent duplicate identities: Art. 6(1)(f).
- Account retention
- We keep account details and the age declaration while the account is active. There is no automatic inactivity-deletion rule. On a verified erasure request, we remove data that is no longer needed and separately assess any records required for an unresolved dispute, security incident or legal obligation. Restricting sign-in is not account erasure.
- Provider-identity retention
- Instagram access credentials are removed on disconnection or verified revocation. Short-lived OAuth attempts expire and are cleaned up hourly. The separate Instagram-to-platform login mapping is retained while it is needed to reconnect the same platform account; disconnecting alone does not remove it. Full account erasure removes that mapping after both environments and managed images are cleared. Minimal account/provider suppression markers prevent old login attempts or recovery copies from restoring erased links. They expire 8 days after the relevant cleanup phase or case completion and are removed by a daily job. Incomplete erasure cases retain the identifiers necessary to finish cleanup and verify external deletion; they are not silently expired.
Connected Instagram profiles
When you connect a professional Instagram account, Meta supplies its account ID, username, account type and available display name, biography and profile image. We store ownership/verification state and an encrypted access token, synchronize profile information and refresh the token while the connection remains authorized. We copy profile images into managed storage; a permitted fallback image can be uploaded when no usable Instagram image is available.
The current product does not import Instagram posts, messages, follower lists or insights. Connection authorization is not consent to product analytics. Connecting creates a public creator profile: its name, handle, biography/image where available, category and public platform activity can be seen by visitors.
- Purpose / legal basis
- Verify the profile you manage and provide requested creator features: GDPR Art. 6(1)(b); prevent impersonation and protect access: Art. 6(1)(f).
- Retention
- Usable credentials are removed on disconnection or verified revocation/deletion. Public-content removal, retained identity records and storage recovery copies follow the distinct deletion rules below.
Entries, votes, support and Awards
We store creator/category selections, Entry descriptions, submission and Round dates, profile snapshots, individual Upvotes and support relationships, aggregate scores, ranking versions, Awards, notification state and correction/audit records. Entry pages, public creator profiles, rankings and share images expose the corresponding public identity and results. Account login details and individual voter/supporter identities are not published to other creators or visitors.
Authorized administrators can inspect engagement and audit records to investigate manipulation. Rule-based rankings calculate results from valid votes; review signals do not themselves invalidate votes. An administrator must confirm corrections. We do not use these rankings to decide employment, credit or access to essential services.
- Purpose / legal basis
- Run requested participation and engagement: GDPR Art. 6(1)(b). Investigate abuse and preserve reliable results: Art. 6(1)(f), limited to what is necessary for those purposes.
- Retention
- Published Round results and Awards form a continuing competition archive. On verified full account erasure, creator identity is removed from public presentation and account links are detached from retained competition records. Individual outgoing vote records are removed while their valid contribution remains only in unlinked totals; active support relationships are removed. Identifying account and moderation references are removed, subject to a separately assessed exception for an unresolved dispute or legal obligation. Such an exception is limited to that matter and ends when the reason ends. Retained competition records and opaque identifiers are not automatically anonymous.
Service emails and support
Resend delivers requested sign-in links, contact verification and Entry scheduling, start and result messages. It receives the destination email and the message content, which may include a sign-in link, creator details and Entry/Round references. We retain delivery/handoff status to handle failures without intentionally sending the same accepted message again.
Emails to hey@creatorspop.com are forwarded through Cloudflare Email Routing to our ALL-INKL.COM mailbox, where the operator handles your enquiry. Both providers process the message, sender/recipient details and delivery metadata along that route. We also process relevant account/request references you supply.
These service messages are not a marketing newsletter. This implementation does not add an email-open tracking feature to the product; provider delivery processing is separate.
- Purpose / legal basis
- Requested messages and account support: GDPR Art. 6(1)(b); handling other enquiries and protecting rights: Art. 6(1)(f), or Art. 6(1)(c) where a legal obligation applies.
- Delivery retention
- Resend documents 30 days of email/log retention for the delivery service. In our database, recipient addresses and provider/payload identifiers in terminal SENT or REVIEW_REQUIRED handoff records are removed by a daily job after 90 days without an update. Active delivery leases and pending/retryable jobs are excluded until resolved. A minimal Entry/type/status record remains to prevent duplicate messages; it is still linked to the Entry and follows its retention criteria.
- Support retention
- Ordinary support correspondence is deleted 12 months after the enquiry is closed. We retain only a minimal record of a completed privacy request for three years after the end of the year of completion to demonstrate its handling. Correspondence required for a legal obligation or an ongoing dispute is separated and kept only for that purpose and its applicable period. These rules also apply to mailbox and downloaded mail copies.
Hosting, security and operational records
Vercel serves the public website. Google/Firebase provides authentication, the database, Functions/API, managed images, internal-app hosting and infrastructure logging. Requests necessarily disclose network details such as IP address, time and browser/request metadata to the receiving service. Operational logs and error/security records are separate from optional product analytics.
Firebase App Check with reCAPTCHA Enterprise assesses application requests using browser/device and network signals. Our API currently observes attestations in monitoring mode. Authentication and administrative authorization remain separate checks. reCAPTCHA Customer Data is processed by Google under its Cloud processing terms. Security processing is not described as anonymous or as being disabled by an analytics rejection.
- Purpose / legal basis
- Deliver a reliable service and resist abuse: GDPR Art. 6(1)(b)/(f). Security-related device storage is also subject to applicable local rules.
- Operational retention
- The configured Google Cloud Logging default bucket retains logs for 30 days; the provider-managed Required audit-log bucket retains its mandatory logs for 400 days. Vercel documents one day of runtime logs for our Pro plan. A relevant incident extract may be retained separately until the incident or related legal claim is resolved, with access limited to that purpose.
Optional analytics and consent
CookieHub records your choices. Only after analytics consent, PostHog counts visitors, visits and page views and measures traffic sources and progress through sign-in, Instagram connection and participation, including safe error categories. It also measures confirmed Entries, Entry/category views, first Upvotes/support relationships, Instagram-profile clicks and sharing actions. Events contain fixed page labels, approved campaign codes, coarse referral sources, relevant opaque product IDs, category/Round context and browser/device/session information. Signed-in activity uses your platform user ID; otherwise PostHog uses a browser identifier. Consented anonymous activity may be linked when you later sign in.
With the same Analytics choice, we also use our own website analytics to count visits, time spent on visible pages, Join clicks, new registrations, Instagram connections and confirmed Entries. It uses a random browser identifier and a session identifier. It receives grouped routes, approved campaign codes, known referring domains, and approximate location and device information. Account identifiers, profile details, raw links and payment information stay out of this measurement.
Our website analytics uses ml_vid for up to one year and ml_sid for up to 30 minutes after the last activity. You can withdraw consent through Cookie settings. The tracker then stops collecting and clears these cookies.
CookieHub consent logging is enabled. Its current widget can record consent actions and session entries, including visits before an analytics choice. These records can include a visitor token, time, browser information, a truncated IP address/country and the relevant host/path. This is consent-management processing, not PostHog product analytics, and is not described as anonymous.
We do not send email addresses, Instagram usernames, biographies, authentication credentials, raw page URLs or raw referrer URLs to PostHog. Page addresses are reduced to fixed routes; profile identifiers, query strings and fragments are removed. Campaign values are restricted to approved codes. Autocapture and session recording are disabled. The client disables IP/geolocation enrichment; this does not mean that service infrastructure never receives an IP address. No analytics consent means no product event collection, and the core platform remains usable.
You can change your choice through Cookie settings. Withdrawal stops new capture and clears the local analytics identity; it does not recall requests already sent or erase earlier events. CookieHub may retain a consent record. Analytics relies on consent (GDPR Art. 6(1)(a)); consent records support consent management and accountability (Art. 6(1)(c)/(f)).
- Analytics retention
- Our current PostHog Cloud EU Free plan documents a one-year event-retention window. Enforcement is rolled out by PostHog and the project API does not currently expose an enforceable retention window for this project, so we do not promise automatic deletion on day 365. We review this status before the first anniversary of collection and on any plan change, and use person-and-event deletion for verified erasure requests. Earlier events are not deleted merely by withdrawing browser consent.
- Consent retention
- CookieHub stores the browser choice for 365 days before asking again. Consent logging is enabled; CookieHub documents deletion of its consent-log entries after 12 months. Consent and session records are separate from PostHog analytics events.
Optional Meta advertising measurement
Only after you allow Marketing cookies, Meta Pixel measures page views on our homepage and participation page, and successful creator participation submissions. This includes completed submissions waiting for the first Round date. Account signups, unfinished drafts and failed submissions are not counted as participations. We use these events to attribute and optimize our Facebook and Instagram advertising.
Meta Platforms Ireland Limited receives event names, a pseudonymous event reference for a participation, permitted page URLs (including campaign, ad-click and any preselected creator reference), browser referrer, IP address, browser/device information and Meta cookie identifiers. Meta can associate this information with its users. This processing is not anonymous and can involve international processing, including in the United States.
We do not configure advanced matching or send email addresses, telephone numbers, Instagram usernames, profile descriptions, creator categories or platform account IDs as custom Pixel parameters. Automatic event configuration and automatic history tracking are disabled. We do not send participation events through the Conversions API. Our own event calls exclude authentication callback routes and unrecognized query parameters.
Marketing consent is separate from Analytics consent for PostHog. The service remains available if you decline either category. You can withdraw Marketing consent in Cookie settings. Withdrawal stops new event delivery and removes this website’s first-party Meta cookies where the browser permits it; it cannot recall requests already in flight, delete events already received by Meta, or clear cookies on Meta’s own domains. The CookieHub declaration describes the storage and expiry in use. Meta’s policies describe its retention and your options for information it has already received.
Our optional advertising measurement and associated browser storage/access rely on your consent. Meta’s Privacy Policy and Controller Addendum describe its processing and the respective responsibilities for data collected with its business tools. Contact the CreatorsPop privacy address about your consent or advertising-measurement data.
Cookies and other browser storage
Where German law applies, optional device storage/access requires consent under § 25 TDDDG; a necessary-service exception must be justified separately, not inferred from an “essential” label.
- Firebase uses browser persistence for sign-in sessions. Signing out is different from deleting your account.
- The email-link flow temporarily stores the email and continuation context in localStorage. Instagram sign-in keeps short-lived recovery/verification context in sessionStorage. It is cleared on completion or checked for expiry when used; expiry is not a guarantee of background removal from a closed browser.
- App Check/reCAPTCHA uses security-related browser state. CookieHub stores consent choices and can keep a consent log. The published CookieHub inventory gives the configured storage details.
- PostHog localStorage is enabled only after analytics opt-in. Essential sign-in/security state does not depend on that opt-in. You can also clear storage in your browser; this may sign you out or interrupt a sign-in flow.
Recipients and international processing
Authorized staff and service providers process data for the purposes above. Public creator/Entry content can be accessed by visitors, linked, downloaded and shared outside the platform. We cannot withdraw copies independently saved by other people.
The main SQL service is in Frankfurt; the Functions API is in Belgium and PostHog uses EU ingestion. These choices do not prove that all authentication, email, support, logs, subprocessors or remote access remain in the EEA. Exact contracting entities, locations and applicable transfer mechanisms are listed below once confirmed. Where required, appropriate transfer safeguards and copies can be requested from the privacy contact.
Google / Firebase
Authentication, SQL/database, Functions, image storage, internal hosting, logging, key management and App Check.
- Contracting recipient
- Google Cloud EMEA Limited (Google Cloud/Firebase under the standard EMEA contracting terms); Google Ireland Limited for Google account services in the EEA
- Locations and transfer safeguards
- SQL and managed production images use Frankfurt, and the Functions API uses Belgium. Firebase Authentication, Hosting, security services, support and subprocessors may involve processing outside the EEA. Applicable Google Cloud/Firebase data-processing terms provide Standard Contractual Clauses for restricted transfers; Google sign-in also involves Google’s own account processing. Regional database hosting is not a promise that every Google service stays in the EEA.
Vercel
Public website hosting, request delivery and associated operational processing.
- Contracting recipient
- Vercel Inc.
- Locations and transfer safeguards
- Website delivery uses globally distributed infrastructure and subprocessors, including processing outside the EEA. Vercel’s DPA for Pro and Enterprise includes EU Standard Contractual Clauses for applicable restricted transfers.
Meta / Instagram
Professional-account authorization, profile data and revocation/deletion callbacks; Instagram also operates its own service.
- Contracting recipient
- Meta Platforms Ireland Limited (Instagram services for users in the EEA)
- Locations and transfer safeguards
- Instagram authorization and profile access involve Meta’s international infrastructure, including processing in the United States. Meta describes Standard Contractual Clauses and, where applicable, adequacy decisions as transfer safeguards. Meta also operates Instagram under its own privacy policy; it is not described here as merely our hosting processor.
Resend
Transactional email delivery and delivery records.
- Contracting recipient
- Plus Five Five, Inc. (Resend)
- Locations and transfer safeguards
- Transactional email delivery involves international processing and recipient mail systems. Resend’s DPA incorporates EU Standard Contractual Clauses for applicable restricted transfers.
PostHog Cloud EU
Optional product analytics after consent; EU ingestion endpoint.
- Contracting recipient
- PostHog, Inc.
- Locations and transfer safeguards
- Our project uses PostHog Cloud EU. EU hosting does not exclude international subprocessor or support access. PostHog’s DPA includes Standard Contractual Clauses for applicable restricted transfers.
Cloudflare Email Routing
Forwarding incoming support and privacy enquiries to the operator’s mailbox, including message content and delivery metadata.
- Contracting recipient
- Cloudflare, Inc.
- Locations and transfer safeguards
- Cloudflare Email Routing processes incoming email before forwarding it to our mailbox. Cloudflare uses global infrastructure and subprocessors; its Customer DPA includes safeguards for applicable restricted transfers.
ALL-INKL.COM
Mailbox hosting and storage for correspondence handled by the operator, including forwarded support and privacy enquiries.
- Contracting recipient
- ALL-INKL.COM - Neue Medien Münnich, Inhaber: René Münnich
- Locations and transfer safeguards
- ALL-INKL hosts our mailbox on its German hosting infrastructure under an agreement on processing on our behalf. Incoming mail first passes through Cloudflare Email Routing; external sender/recipient mail systems may be outside Germany or the EEA. The operator handles correspondence in this mailbox and any local mail copies.
Retention, removal and recovery copies
Data is not all deleted by the same action. Withdrawing a scheduled Entry removes that Entry and its notifications. Removing a completed Entry from public view clears its public presentation but preserves necessary non-public competition records. Disconnecting Instagram removes usable credentials; a verified Instagram data-deletion request additionally removes imported content across our data environments, while limited platform/identity and result-integrity records remain.
Those retained identifiers and records can still be personal data. Their retention requires its own purpose, basis and limits; “needed for integrity” does not mean unlimited retention. A complete platform-account erasure request is reviewed separately; please use the privacy contact for that request.
Recovery backups and soft-deleted images may remain for their configured windows after removal from live services. Backup recovery must respect prior erasure requests and avoid restoring removed data to normal use.
- Recovery retention
- The production SQL instance keeps seven daily automated backups and seven days of point-in-time recovery. Deleted managed images have a seven-day Storage soft-delete recovery window. Manual recovery copies, if created for an incident, are reviewed and deleted when that recovery purpose ends. Firebase documents up to 180 days for removal of deleted Authentication data from its live and backup systems. Recovery data is not returned to normal use without reapplying earlier erasure requests.
Your rights and requests
Where applicable, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent. Rights depend on the relevant conditions; withdrawal does not invalidate earlier lawful processing. You may complain to a competent supervisory authority, including in your habitual residence, workplace or the place of an alleged infringement.
Contact hey@creatorspop.com with enough information to identify your request. We may verify identity proportionately; do not send passwords, sign-in links or Instagram access tokens. We normally respond within one month under the GDPR; permitted extensions or exceptions must be explained.
- Operator’s supervisory authority
- Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Required information and age
Browsing public pages does not require a platform account. Account data is needed to sign in, vote or support creators; professional-account verification and Entry details are needed to participate. Without these details we cannot provide that requested feature. A verified contact email is optional and enables Round-update messages. Analytics is optional.
Accounts and participation are limited to people aged 18 and over. Public pages can be browsed without an account. This age policy does not mean that we have verified every user's age; applicable data-protection rules still apply.
Continuing with sign-in confirms the minimum age shown beside the sign-in controls. Accounts without a saved confirmation can confirm in the account or Entry area. We store the age-declaration version and server timestamp in the private account, not a date of birth or an identity-document copy. This record is self-declaration, not independent age verification, a separate Terms-acceptance record or analytics consent. You can still browse, sign out, remove existing participation and contact us about your data without confirming.
Updates to this notice
We will update this notice when processing changes. Material changes will be communicated appropriately; a new purpose is not automatically covered by an earlier analytics choice. The document version and, once approved, effective date appear above.