Privacy Policy

Last updated: September 30, 2026 · Version: 1.4 · Effective: from October 30, 2026 for existing users, immediately for new sign-ups and for the iPhone and iPad app

This privacy notice describes how Matteo Alba, who operates the CreatorHive service (hereinafter “we”, “Data Controller”), processes the personal data of users of the SaaS service available at creatorhive.app, in compliance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (as amended by Legislative Decree 101/2018).

1. Data Controller

• Data Controller: Matteo Alba
• Business address: Vicenza (VI), Italy
• VAT number: IT04459140242
• Privacy contact email: privacy@creatorhive.app

A formal Data Protection Officer (DPO) under Article 37 GDPR has not been appointed because the processing does not fall within the cases of mandatory appointment. For any matter concerning your data you can write directly to the Data Controller at the email address above.

2. Categories of data processed

We process the following categories of personal data:

• Identification and contact data: username, email, date of birth (mandatory, used to verify that whoever uses the account is of legal age), optionally first name, last name, address (if provided by the user).
• Authentication data: password (stored as a non-reversible bcrypt hash), optional two-factor authentication secret (Fernet-encrypted), backup codes (one-way hashed).
• Professional profile data: bio, business email, content categories, games (for creators).
• Session and usage data: IP addresses (partially masked in generic logs), device type, access logs and logs of relevant actions.
• Data related to connected social channels (for creators): channel name, platform identifier, aggregated statistics retrieved via OAuth authorized by the user. OAuth tokens are encrypted and never exposed to the user or third parties.
• Data related to sponsorships: contractual references, deliverables, statistics screenshots, campaign values.
• Expense documents (receipts): photos or PDFs of receipts and invoices uploaded to account for sponsorship expenses, and the document data confirmed by whoever uploaded it (total, number, date, merchant and any VAT number or tax code, document type, currency, taxable amount and VAT, breakdown by category). A document may contain data of third parties, for example the merchant.
• Mobile app data (for creators who use it): phone model (shown in the list of sessions), the installation’s push notification identifier (token), operating system, app language and active notification categories, linked to the app session. Push notifications contain the notification title and text, including the name of the sponsorship or task they refer to; they never contain amounts or other payment data, which stay visible only inside the service.

3. Purposes and legal basis of processing

4. Recipients of data and providers (Art. 28 GDPR)

Data may be processed by third-party service providers acting as Data Processors. All providers are bound by a Data Processing Addendum.

The updated list is available on request at privacy@creatorhive.app.

Notifications on iPhone and iPad. On Apple devices, push notifications are delivered by the Apple Push Notification service (APNs), the iOS and iPadOS service operated by Apple Distribution International Ltd. (Ireland). Expo passes it the notification title and text and the installation identifier. Apple operates this service as part of its own relationship with the device user and under its own privacy policy, and does not offer app developers a Data Processing Addendum for notifications: this is why our push notifications carry only what is needed to understand what they are about, never amounts or payment data. Apple may process data outside the European Economic Area, under Standard Contractual Clauses. Notifications can be turned off in the device settings (see §7).

Automatic reading (artificial intelligence). CreatorHive enables it for each organization, separately for documents uploaded by the organization’s staff and for those uploaded by creators. When it is enabled, the images of statistics screenshots and expense documents (for a PDF, only the first page) are sent to Google Cloud (Vertex AI), which reads their data and returns it to CreatorHive. The reading takes place in the European Union. Google does not use this data to train its models and does not keep it beyond the time of the reading, except for a temporary 24-hour memory and, only if an automated check flags a possible abuse of the service, logs kept for up to 90 days, always in the European Union.

Only when Google Cloud does not respond, the reading moves to the backup provider, Anthropic (Claude, via API). Anthropic stores the data in the United States and may also process it in other countries outside the European Union (see §5); it does not use it to train its models and deletes it within 30 days, except for data that an automated check flags as a possible violation of its usage policies, kept for up to 2 years. If neither provider responds, the data is entered manually.

The data read does not become final on its own: whoever uploaded the document confirms or corrects it, and no decision with legal effects is taken by automated means (Art. 22 GDPR).

5. Transfers outside the EU

Some of our providers (Cloudflare, the Expo, Google and Apple push notification services, Anthropic as backup provider of the automatic reading, possible US fallbacks) may process data outside the European Economic Area. Google Cloud processes the documents of the automatic reading in the European Union; maintenance and support access from outside the EU remains possible. Anthropic, used only when Google Cloud does not respond, stores the documents it receives in the United States, under the Standard Contractual Clauses included in its Data Processing Addendum. In such cases, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission with Decision 2021/914 (“SCCs”), as provided by Article 46 GDPR and in compliance with the Schrems II ruling, or, for certified providers, by the EU-US Data Privacy Framework, covered by the Commission’s adequacy decision of 10 July 2023 (Article 45 GDPR).

6. Retention period

7. Data subject rights (Art. 15-22 GDPR)

You can exercise the following rights at any time:

• Right of access (Art. 15) — obtain a copy of your personal data. Available self-service in your account settings (“Export my data”) or by request to privacy@creatorhive.app.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure / right to be forgotten (Art. 17) — available self-service in settings (“Delete account”) with a 30-day grace period during which you can cancel the request. Full procedure, also without signing in: Delete your account.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — covered by the same export function.
• Right to object (Art. 21). Push notifications can be turned off at any time from your phone settings, for all or for individual categories, or from the CreatorHive notification preferences.
• Right to withdraw consent at any time, where processing is based on consent (e.g. marketing, once activated).

To exercise rights not covered by self-service functions, write to privacy@creatorhive.app. We will respond within one month, except for justified extensions under Art. 12(3) GDPR.

8. Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority. In Italy: Italian Data Protection Authority — Garante per la Protezione dei Dati Personali.

9. Security measures

We adopt technical and organizational measures appropriate to the nature of the data processed, including:

• Passwords protected with bcrypt (cost factor 12).
• Two-factor authentication mandatory for all accounts (authenticator app or passkey).
• Encryption in transit (TLS 1.2+) and encryption at rest for sensitive data (Fernet on OAuth tokens and MFA secrets).
• Multi-tenant segregation at the database and application level.
• Rate limiting, brute-force protection, HTTP security headers (CSP, HSTS, X-Frame-Options).
• Automatic cleanup of sessions, logs, screenshots and expired tokens.
• Internal incident response procedure with notification to the Italian Data Protection Authority within 72 hours under Art. 33 GDPR.

10. Minimum age

The service is reserved for adults. During registration, the user enters their date of birth, which is mandatory, and confirms being at least 18 years old; the date of birth cannot be changed to one indicating a lower age.

A minor creator does not have their own account and does not use the service: the account is held and used by a parent or guardian, who acts on the minor’s behalf, and the date of birth entered is that of the parent or guardian. In this case we also process the minor’s data (for example the channel, statistics and fees) for the contract entered into by the parent or guardian (Art. 6(1)(b)). When the creator turns 18, the account can be transferred to them: the creator becomes its user and updates their own data (credentials, email, date of birth).

11. Changes to this notice

We reserve the right to update this notice. Substantial changes (new processing, new provider, significant retention change) are communicated to registered users at least 30 days before they take effect, with a notice in the service and possibly by email. In the notice the user can mark it as read, and this acknowledgement is recorded; no new acceptance is required. The version in force is always on this page, with the date of the last update at the top. The version history is maintained internally.

12. Contact

For any questions regarding the processing of your personal data: privacy@creatorhive.app.