Privacy Policy

1. Data controller

The controller of the personal data collected via trykred.com is the company Kred Corp, a société par actions simplifiée (French simplified joint-stock company) with a share capital of €1,000, registered with the RCS (French Trade and Companies Register) of Fort-de-France under number 107 539 876, whose registered office is at 7 rue Bethléem, Résidence Arc-en-ciel, 97233 Schœlcher (Martinique, France).

Contact: contact@trykred.com

2. Data collected

We collect the following data:

• Email address (authentication by 6-digit one-time code, and notifications)
• Display name, bio and profile photo that you enter on your KRED profile — the photo is stored on our infrastructure (Supabase Storage) and is never the TikTok one, whose URL expires (see article 3 below)
• TikTok identifier (open_id) and TikTok display name, provided by TikTok when you connect your account
• Identifier and username of your Instagram account, provided by Instagram when you connect your account
• Identifier and public name of your YouTube channel, provided by the YouTube API when you connect your account
• TikTok, Instagram and YouTube OAuth access and refresh tokens (encrypted with AES-256-GCM)
• URLs of the videos you submit as part of campaigns (TikTok, Instagram, YouTube)
• Public metrics of submitted TikTok videos (views, likes, comments, shares)
• View count of submitted Instagram videos, provided by Instagram
• View count of submitted YouTube videos, provided by the YouTube API
• PayPal email address, if you provide one for your withdrawals
• Stripe Connect account identifier, if you enable payments via Stripe
• Legal name, postal address, status (individual, auto-entrepreneur (French sole trader), company) and SIRET (French company number) where applicable, when the total of your earnings from a single brand reaches the threshold shown in your account (see our Terms of Service, article 8)
• First name, last name, date of birth, country of tax residence and tax identification number (encrypted with AES-256-GCM for the tax number), collected at your first withdrawal, so that KRED can fulfil its legal obligation to report to the tax authorities (see our Terms of Service, article 20 — DAC7 framework)
• If you choose to provide it, your town (a commune, or an arrondissement in Paris, Lyon and Marseille). From it we derive the coordinates of the centre of the commune; we do not ask for your address for this
• Browsing data and technical logs (security, fraud prevention)
• Audience measurement and advertising data, depending on the choices you make (see article 10)
• Dates and times at which you open and click the emails we send you, without retaining the IP address or the user-agent

3. Use of the TikTok, Instagram and YouTube APIs

KRED uses the TikTok API to authenticate creators and measure the performance of their videos. Two TikTok products are used, under the permissions you explicitly grant when connecting your account:

• Login Kit (user.info.basic permission): we retrieve your unique identifier open_id, which is used exclusively to link your TikTok account to your KRED account, as well as your TikTok display name, used to identify you in our interfaces. We do not keep your TikTok avatar — its URL, provided by TikTok, expires and is never copied. If you add a profile photo on KRED, it is a separate file that you choose to upload yourself (see above, article 2).
• Video Query (video.list permission): for only the videos whose URL you submit, we retrieve the video identifier, its title, its publication date, and its public counts of views, likes, comments and shares.

This data serves two purposes, and no other: verifying that you are indeed the author of the submitted videos, and calculating your earnings based on the campaign’s CPM (cost per thousand views). The likes, comments and shares counts also feed our internal fraud detection checks, designed to spot artificial engagement. They are never disclosed to brands.

If you connect an Instagram professional or creator account, KRED uses the Instagram API with Instagram Login, under the permissions you explicitly grant:

• Basic information (instagram_business_basic permission): we retrieve the identifier and username of your Instagram account, which are used to link it to your KRED account and to show you which account is connected, as well as the list of your recent posts (identifier, media type, permalink, date) for the sole purpose of verifying that the video whose URL you submit belongs to you.
• Insights (instagram_business_manage_insights permission): for only the videos whose URL you submit, we retrieve the view count, which is used to calculate your earnings.

If you connect a YouTube account, KRED uses the YouTube API Services (YouTube Data API v3), under the single read-only permission you explicitly grant when connecting (scope https://www.googleapis.com/auth/youtube.readonly):

• Channel identification: when you connect, we retrieve the identifier and public name (title) of your YouTube channel, which are used exclusively to link your YouTube account to your KRED account.
• Verification of submitted videos: for only the videos whose URL you submit, we verify that they belong to your channel, and we check their publication date, their duration and their visibility status, in order to confirm that each one is a Short that you published and that has not been made private.
• View measurement: for these same videos, we retrieve their view count, which is used to calculate your earnings.

The requested scope is read-only: KRED performs no write operation on your YouTube account (no publication, no modification, no deletion).

KRED’s use of the YouTube API Services is subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke KRED’s access to your Google account at any time from the third-party access page of your Google account.

Apart from the videos whose URL you submit yourself, we do not access any of your content: not your other videos, not your messages, not your list of followers. For the videos you submit only, we check their visibility status in order to exclude those that have become private or have been deleted. We do not publish anything on your TikTok, Instagram or YouTube accounts. No TikTok, Instagram or YouTube data is sold or rented. One of your videos is run as an ad only if you have yourself agreed to grant a brand the ad rights to that video, under the conditions described in article 3 bis.

3 bis. Running videos as ads (whitelisting): Meta Marketing API and TikTok

When this feature is offered to you, a brand may ask you for the right to run as an ad one of the videos you submitted to its campaign, for a duration and a flat fee set in advance. Nothing happens without your acceptance of the rights grant addendum in KRED.

If you are a brand, you link your ad account yourself from your settings, via Facebook Login for Business (Meta) or TikTok, choosing the accounts that you share with KRED. Under the permissions you explicitly grant, KRED:

• reads the ad accounts, Facebook Pages and Instagram professional accounts that you have shared, as well as the currency and status of the chosen ad account (permissions business_management, pages_show_list, pages_read_engagement, instagram_basic), to let you choose the advertiser and the sponsor account;
• sends on your behalf to the creator, once they have accepted the rights grant in KRED, the partnership ad permission request, tracks the response, verifies that their post can be promoted before your payment and withdraws the permission at the end of the rights grant (permission instagram_branded_content_ads_brand);
• creates, pauses and resumes, in your own ad account, only the ads that you launch from KRED (ads_management permission);
• reads every hour the performance of those ads only (spend, impressions, views, clicks) in order to report it to you (ads_read permission).

KRED does not read any other ad, campaign or audience in your account, does not modify its settings, its payment methods or its users, and does not publish anything on your Pages or your Instagram account. The budget is spent with Meta or TikTok, on your account, never by KRED. We keep the identifier, name, currency and status of the ad account, the identifiers of the chosen Page and Instagram account, the Instagram username displayed as sponsor, an encrypted access token (AES-256-GCM), the identifiers of the ads created and their daily statistics.

If you are a creator and you accept a rights grant, your Instagram username is sent to Meta for the permission request, which you accept or decline directly in Instagram, and the post concerned is promoted from the brand’s ad account for the agreed duration. KRED tells you the delivery period and the number of people who started watching the ad; it never discloses the brand’s spend to you, and these figures do not change the agreed flat fee. You can withdraw the permission at any time from Instagram: the ad is then stopped.

4. Purposes of processing

Your data is used to:

• Authenticate you and manage your account
• Verify that you are the author of the submitted videos
• Measure views every day, for a maximum of 30 days after publication, and calculate your earnings
• Credit your Wallet and process your withdrawal requests
• If you have provided your town, show how far local campaigns are and the nearest ones first
• Detect fraudulent behaviour and protect brands’ budgets
• Send you email notifications (earnings, reconnecting your social accounts)
• Measure the site’s audience and, with your separate consent, the conversions of KRED ads
• Check that transactional emails reach you and measure the deliverability quality of our sends (for example to diagnose a login email that was not received)

5. Legal basis

Processing is based on the performance of the contract (article 6.1.b of the RGPD (the EU General Data Protection Regulation, GDPR)) for everything that is necessary for the operation of campaigns and the calculation and payment of your earnings; on your consent (article 6.1.a) for connecting your TikTok, Instagram or YouTube accounts and for audience measurement; and on our legitimate interest (article 6.1.f) for fraud prevention, the security of the Service and the tracking of opens and clicks on our transactional emails.

For your legal name, postal address, date of birth, country of tax residence and tax identification number, processing is based on compliance with a legal obligation (article 6.1.c of the RGPD): KRED is required, as a platform operator, to collect and report this information to the tax authorities (DAC7 framework, see article 6 below and our Terms of Service, article 20).

For the source file of a video that you have sold to a brand, processing is based on the performance of the contract (article 6.1.b of the RGPD): keeping it and delivering it to the brand perform the rights grant addendum that you have concluded with that brand (see our Terms of Service, article 21).

For your town, processing is based on your consent (article 6.1.a of the RGPD): providing it is optional, and you withdraw this consent at any time by deleting it from the “Your town” section of your profile.

6. Recipients

Your data may be shared with partner brands solely in connection with the campaigns you take part in: display name, profile photo (if you have added one), URLs of submitted videos, view count and amount of earnings. Internal fraud detection indicators are never disclosed to them. Your data is neither sold nor rented to any third party.

Your town is never disclosed to brands.

Your identity (last name, first name, address, date of birth), your tax identification number and the amounts paid to you, quarter by quarter, are sent each year to the French tax authorities (DGFiP, Direction générale des Finances publiques), in performance of the legal reporting obligation that applies to KRED as a platform operator (DAC7 framework, see our Terms of Service, article 20). This transfer is neither a sale nor a rental of data: it is a legal obligation from which KRED cannot exempt itself.

Technical processors:

• Supabase — database hosting and authentication (EU)
• Vercel — website hosting
• Render — API hosting
• Resend — sending of transactional emails
• Upstash — caching and rate limiting (EU)
• Stripe — payment processing and payouts to creators
• PostHog — product analytics and session recording, EU hosting; measurement without storage on your device before consent, persistent storage and session recording after acceptance (see article 10)
• Sentry — technical monitoring and error logging

Some parties determine for themselves the purposes and means of processing the data they receive: they act on their own behalf, not on behalf of KRED. They are therefore not processors, but independent controllers:

• Google — YouTube API (authentication and reading of the videos and statistics you submit)
• Google — Google Tag Manager and Google Analytics, for audience measurement, subject to consent
• Meta — Instagram API and Marketing API (account connection, partnership ad permission requests, creation and tracking of ads in the brand’s account)
• Meta — KRED’s advertising Pixel, only with your separate consent, to measure visits and sign-ups linked to our ads
• TikTok — TikTok API and TikTok for Business API (account connection, Spark Ads in the brand’s account)

When you search for your town, the text you type, then the code of the commune you choose, are sent by our servers to the French State’s Geo API (geo.api.gouv.fr), a freely accessible public service, to find the commune and the coordinates of its centre. No identifier and no other data from your account is sent to it.

Some of the processors and controllers mentioned above may process data outside the European Union. These transfers are subject to appropriate safeguards: standard contractual clauses of the European Commission or an adequacy decision.

7. Retention period

• TikTok, Instagram and YouTube OAuth tokens: erased immediately when you disconnect the account concerned from your profile, or when your KRED account is deleted
• Access token to a brand’s ad account: erased as soon as the brand removes the account from its settings or links another one (ads launched from KRED are then paused), or withdraws KRED’s access from Meta
• Statistics of ads launched from KRED: kept with the history of the rights grant concerned, for which they substantiate the reporting
• TikTok (open_id), Instagram and YouTube (channel identifier and name) identifiers: kept as long as the corresponding account is linked; after disconnection, they are no longer associated with any access credential and are deleted with your account
• Metrics of videos already submitted: kept with the history of the campaign concerned, as they substantiate the earnings paid to you
• Campaign data (submitted videos, metrics, earnings): kept during your active participation, then deleted with your account. The only exception is records substantiating the amounts paid to you (measured views, amounts and corresponding earnings), archived for 3 years from their issue under our accounting and legal obligations
• Source file of a video sold to a brand: kept under the rights grant addendum, including after the deletion of your creator account, for as long as the rights grant remains in effect. It is erased only if the sale is cancelled following a dispute decided in the brand’s favour
• Town: kept until you delete it from your profile, which erases it immediately, and deleted with your profile at the latest
• Email address and profile: deleted within 30 days of a deletion request
• Technical logs: 12 months
• Dates and times of email opens and clicks: 12 months
• Audience measurement cookies and session recordings: see the specific retention periods in article 10 below

8. Your rights

In accordance with the RGPD, you have the following rights: access, rectification, erasure, objection, restriction of processing and portability. To exercise them, contact us at contact@trykred.com.

You also have the right to lodge a complaint with the CNIL (the French data protection authority, cnil.fr).

9. Data deletion

You can request the deletion of all your data at any time by sending an email to contact@trykred.com. You can also disconnect your TikTok, Instagram or YouTube account at any time from your profile, which results in the deletion of the associated data. For a YouTube account, you can also revoke KRED’s access directly from the third-party access page of your Google account. See our data deletion page for more details. You can also delete your town at any time from the “Your town” section of your profile.

The deletion of your account affects neither the delivery to a brand of the source file of a video that you sold to it, nor the retention of that file: both perform the rights grant addendum concluded between you and that brand, to which KRED is not a party (see our Terms of Service, article 21). The same applies to the records substantiating the amounts paid to you, mentioned in article 7.

10. Cookies, audience measurement and advertising

The Service uses technical cookies necessary for its operation (session, authentication). Meta advertising cookies are used only if you separately accept advertising measurement in the banner. Your data is not sold.

We measure the Service’s audience with PostHog (hosted in the European Union) and Google Analytics 4. Before any consent, this measurement works without placing any cookie or storing anything on your device: statistics are aggregated and the technical identifier associated with your visit is ephemeral; it disappears when the page is reloaded.

If you accept via the banner, audience measurement cookies are placed in order to recognise your browser from one visit to the next and obtain more reliable statistics. This data is kept for 12 months.

If you accept, we also enable session recording with PostHog: your browsing on the Service (movements, clicks, pages visited) is recorded to understand where users run into difficulties. The text displayed on screen and what you type in ordinary fields remain readable in these recordings, in order to understand what blocked you. However, email addresses, phone numbers and bank details are always masked, wherever they appear, as are sensitive fields (email, phone, password, login code) and all billing, payment and withdrawal pages. This session recording only starts after you accept the banner; if you decline, your browsing is never recorded. These recordings are kept for 30 days, a period separate from the 12-month retention of the audience measurement cookies mentioned above.

With your separate advertising consent, the Meta Pixel measures the pages visited and successful demo requests or sign-ups in order to evaluate KRED’s ads. We do not send it your email address, your form answers or your financial data. Meta may place its advertising cookies and processes the data it receives according to its own rules. The Pixel remains inactive without this consent.

You can decline with no consequence for the Service and change or withdraw your choices at any time with the “Manage cookies” button on the site. Withdrawal stops data being sent to Meta and deletes the Meta cookies placed on this domain.

Manage cookies

11. Contact

For any question about the protection of your personal data, write to us at contact@trykred.com.