What we keep, and why.

1. The short version.

We collect what we need to pair brands with creators, verify submissions, and route payouts. We don't sell personal data, we don't run third-party ad tracking on first-party authenticated surfaces, and you can request erasure.

2. What we collect.

• Account data: email, display name, password hash (never the password itself), platform handles.
• Creator data: uploaded clips and URLs you submit to campaigns, public-platform view counts we fetch from those URLs.
• Brand data: company name, campaign treatments, budget amounts.
• Payment routing: handled by Stripe; we store an account reference, not card or bank account numbers.
• Logs: request metadata for security and abuse prevention.

3. What we don't collect.

• Raw payment card numbers — Stripe handles those.
• Third-party social media passwords. We use public APIs and URL parsing only.
• Browsing data from outside the platform.

4. Who else sees your data.

• Stripe — payment processing.
• Resend — transactional email delivery.
• Supabase — our database + auth provider.
• Sentry — error monitoring (no PII attached to error reports).
• Counterparties within an active campaign — brands see the creators submitting to their campaigns; creators see the brands running campaigns they apply to.

Nothing else. No data brokers, no advertising networks.

5. Your rights.

• Access: ask us for a copy of your data.
• Correction: fix anything we got wrong via your profile or by emailing support.
• Erasure: request deletion. Financial records may be retained where law requires.
• Portability: we'll export your data in a machine-readable format on request.

Contact privacy@obscurexhibit.com for any of the above.

6. Retention.

We keep account data while your account is active and for a reasonable window after closure for audit and dispute resolution. Anonymized aggregate statistics may be kept indefinitely.

7. International users.

Our infrastructure is hosted in the United States. By using the platform you consent to data being processed there, subject to applicable cross-border transfer protections.

8. Changes.

We'll notify you of material privacy changes at least 14 days before they take effect, by email and in-app.