Privacy
Policy

Intricate Influence is a professional discovery tool that helps brands and agencies identify suitable creators for paid campaigns. The Service consists of an iOS application, a web administration interface (admin.intricateinfluence.com), and a backend API (api.intricateinfluence.com).

This policy explains what personal data we process, why, on what legal basis, how long we keep it, and the rights you have. It is written to comply with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and Regulation (EU) 2016/679 ("EU GDPR"). If you are located outside the United Kingdom or the European Economic Area, equivalent local protections may also apply.

Two distinct groups of people are described in this policy and we treat them separately:

• Section A — Service Users. Brand-side personnel who sign in to TSP to plan campaigns and review creator shortlists.
• Section B — Creator Profiles. Individuals whose publicly available professional content is indexed and presented inside TSP so that Service Users can evaluate suitability for campaigns.

Read whichever section applies to you. Both groups have rights under data protection law and we explain how to exercise them in Section 8.

Kojent Partners LLC-FZ is the data controller for all processing described in this policy. You can contact our privacy contact at Tim@KojentPartners.com for any matter relating to your personal data, including requests to access, correct, delete, restrict, or object to processing.

We do not have an obligation under UK GDPR to appoint a Data Protection Officer. If that obligation becomes triggered as the Service grows, we will update this policy with contact details.

• Account identifiers. Email address, display name, the organisation you act on behalf of, and the role assigned to your account (for example: administrator, brand lead, viewer).
• Authentication data. A hashed credential and, where you choose, an OAuth token from your identity provider. We never store passwords in plain text.
• Usage data. Records of which clients, briefs, and creator profiles you viewed, opened, shortlisted, saved, or exported, together with the timestamps of those actions. This data supports an audit log so that decisions made inside the platform are accountable.
• Device and connection data. Device model and operating system version, IP address, application version, crash logs, and diagnostic events sufficient to operate the Service reliably.
• Communications. Any messages you send us, including support requests sent to the privacy contact above.

We do not collect special category data (for example data about your health, ethnicity, political views, religion, or sexual orientation) from Service Users. Please do not provide this information when contacting us unless it is strictly necessary to handle your request.

We do not use Service User data for advertising, profiling outside the Service, or for any automated decision-making with legal or similarly significant effects on you.

• Account data: for the duration of your account, plus up to 24 months after closure to handle disputes, security investigations, and statutory obligations.
• Audit log entries: for up to 36 months from the date of the action, after which they are aggregated or deleted unless a longer period is required to defend legal claims.
• Crash and diagnostic logs: for up to 90 days.
• Support correspondence: for up to 24 months from the last message.

We may retain anonymised, aggregated information beyond these periods because it can no longer be associated with you.

• Public profile information obtained from your public-facing professional accounts on social platforms, including: handle, display name, biography, profile photo, post images and captions, follower and engagement metrics, language, the country or region disclosed in your public profile, and category labels you have applied to yourself.
• Derived attributes that we compute by applying machine-learning models to the public information above. These include visual style descriptors, brand-safety signals, an estimate of your modelling suitability for specific commercial categories, and a numeric matching score against an individual campaign brief.
• Operational metadata generated when Service Users interact with your profile inside TSP (for example whether a Service User shortlisted, rejected, or saved your profile against a brief). This metadata never leaves TSP and is never published.

We do not collect or store private messages, password-protected content, or content from accounts that have been set to private at the time we read them. We do not attempt to bypass authentication on any platform.

• Publicly accessible social media profiles (for example Instagram and TikTok). We read what is shown to a logged-out visitor of those platforms and what those platforms expose through their public APIs in accordance with their terms.
• Models we operate. Visual style descriptors, brand-safety signals, modelling suitability, and matching scores are produced by our own machine-learning models running inside our infrastructure.

We do not buy creator data from data brokers and we do not infer your identity, address, or contact details beyond what your public profile discloses.

We process creator data on the basis of our legitimate interests under Article 6(1)(f) UK GDPR. The legitimate interest is to operate a professional discovery tool for the influencer marketing industry that surfaces creators with suitable professional reach, aesthetic, and category alignment for a brief.

We have balanced that interest against the rights and freedoms of creators and consider that the processing is proportionate for the following reasons:

• We only process information that you have already chosen to publish to a general audience on professional platforms.
• The Service is used by vetted brand-side professionals, not by the general public, and the data is not made publicly searchable.
• The output of the Service is a suggestion to a human reviewer, never an automated commercial outcome.
• We provide a clear and prompt way for any creator to object to processing or request deletion (see Section 8).
• We do not process special category data and we do not enrich your record with private information.

A creator who is featured in TSP has the right to object to this processing at any time, including by emailing Tim@KojentPartners.com. We will action a substantiated objection within 30 calendar days as described in Section 8.

We do not rely on consent under Article 6(1)(a) as the lawful basis for processing creator data, because we have not asked you for consent and you have not given it. If you do not wish your public professional content to be processed by TSP, you can object as set out in Section 8 and we will remove and exclude your profile.

• We retain a creator's indexed profile data while it remains accessible on the source platform and for so long as it is useful to brand discovery.
• If a creator's source profile is deleted, made private, or otherwise becomes unavailable on the public source, we mark the record as inactive and remove its visual content within 90 days.
• If a creator objects to processing under Section 8, we remove their record and add an exclusion entry so that the profile is not re-indexed.
• Audit-log references that mention a removed creator (for example "this profile was rejected by Brand X for Brief Y on date Z") may be retained in pseudonymised form for up to 36 months for operational integrity. These references do not surface the creator's name, photo, or biography after deletion.

The score that a Service User sees next to a creator's profile is produced by a model and reflects an estimate of suitability for a specific campaign brief. The model is not a decision; a human Service User decides whether to invite a creator to participate in a campaign. We do not use the model to take any decision that produces legal effects on a creator, and the model output is not shared with the creator or with any third party.

Creators have the right to ask us, in writing, what factors most influenced their score for a given brief, and we will respond within 30 calendar days.

If you are a Service User or a Creator Profile described above, you have the following rights under UK GDPR and equivalent rights under EU GDPR. These rights apply regardless of where the data is processed.

• Right of access. You may ask us for a copy of the personal data we hold about you and a description of how it is used.
• Right of rectification. You may ask us to correct inaccurate or incomplete data.
• Right of erasure ("right to be forgotten"). You may ask us to delete personal data we hold about you. Note that, for creators, we will permanently exclude your profile from re-indexing once we have confirmed the request.
• Right to restrict processing. You may ask us to limit how we use your data while a question about it is being resolved.
• Right to object. You may object to processing carried out on the basis of legitimate interests, including all processing of creator data described in Section 4.B. We will stop processing on receipt of a substantiated objection unless we can demonstrate a compelling lawful ground that overrides your rights.
• Right to data portability. Where processing is based on consent or contract and carried out by automated means, you may ask for the data you provided to us in a structured, commonly used, machine-readable format.
• Right to withdraw consent. Where processing relies on consent (this does not currently include the processing of creator profile data), you may withdraw that consent at any time.
• Right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or with your local supervisory authority in the European Economic Area.

How to exercise your rights

Email Tim@KojentPartners.com with the heading "Privacy request — [right]" and include enough information for us to identify your record. For creator profiles, please include the public handle or profile URL.

We will respond within 30 calendar days. We may extend this period by up to 60 days for complex or numerous requests, and we will tell you within the first 30 days if that applies. We will not charge a fee unless your request is manifestly unfounded or excessive, in which case we will explain the charge in advance.

We may ask for proof of identity before acting on a right of access or erasure request. For Service Users this is usually verifying that the request is sent from the registered email address. For creators, we may ask for verification from an account that controls the public profile in question, such as a post or a message from the platform-verified handle.

We do not sell personal data. We use a small number of carefully selected processors to operate the Service. Each processor is bound by contract to process personal data only on our instructions and to implement appropriate security measures.

We will update this list when we add or change processors. We do not share Service User data or creator data with advertisers, brokers, or analytics aggregators.

We disclose personal data to courts, regulators, and law-enforcement authorities only where we are legally required to do so or where we believe in good faith that disclosure is necessary to protect rights, safety, or property.

Personal data is processed within the United Kingdom, the European Economic Area, and the United States, depending on the service in question. Where data leaves the UK or EEA, we rely on:

• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses where the recipient is in a country without a UK adequacy decision; and
• the EU Standard Contractual Clauses adopted by the European Commission where the recipient is in a country without an EU adequacy decision.

A copy of the safeguards in place for a specific transfer is available on request.

We maintain technical and organisational measures appropriate to the risks of processing the data described in this policy. These include encryption in transit (TLS) and at rest for stored data, restricted production access secured by individual accounts and multi-factor authentication, separation of production and non-production environments, logging and monitoring of administrative actions, regular dependency updates, and prompt remediation of identified vulnerabilities.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected individuals without undue delay where required by law.

The Service is intended for professional use by adults working in the influencer marketing industry. We do not knowingly process personal data of children under the age of 18 either as Service Users or as Creator Profiles. If we become aware that a creator profile in TSP belongs to a person under 18, we will remove it and add an exclusion entry so the profile is not re-indexed. If you believe a profile in TSP belongs to a minor, please contact us at Tim@KojentPartners.com.

We may update this policy from time to time. When we make a material change, we will update the "Last updated" date at the top and, where appropriate, notify Service Users by email or through the Service. Continued use of the Service after a change indicates acceptance of the updated policy by Service Users. The legal bases on which we process creator data do not depend on acceptance and are described above.

Questions, requests, and complaints about this policy or your data should be sent to:

Tim@KojentPartners.com

Operator: Kojent Partners LLC-FZ
Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates

If you are not satisfied with our response, you can lodge a complaint with the UK Information Commissioner's Office at ico.org.uk or with the supervisory authority in your country of residence.