What we keep, and why.

1. The short version.

We collect what we need to pair brands with creators, verify submissions, and route payouts. We don't sell your personal data, we don't run third-party ad tracking on authenticated surfaces, and you can request access, correction, or erasure.

2. What we collect.

• Account data: email, display name, password hash (never the password itself), platform handles.
• Creator data: clips and URLs you submit to campaigns, and public-platform view counts we fetch from those URLs.
• Brand data: company name, campaign treatments, budget amounts.
• Payment routing: handled by Stripe; we store an account reference and payout status, not card or bank-account numbers.
• Usage & logs: request metadata, device/browser information, and activity used for security, abuse prevention, and improving the service.

3. Why we use it (legal bases).

We use personal data to provide and operate the platform (to perform our contract with you), to keep it safe and prevent fraud and abuse, to comply with legal obligations (such as tax and financial recordkeeping), and — where we rely on legitimate interests or your consent — to communicate with you and improve the service. Where the law requires consent (for example, certain marketing), we ask for it and you can withdraw it.

4. What we don't collect.

• Raw payment card numbers — Stripe handles those.
• Third-party social-media passwords. We use public APIs and URL parsing only.
• Browsing data from outside the platform.

5. Who else sees your data.

We share personal data only with service providers that help us run the platform, and with campaign counterparties:

• Stripe — payment processing and payouts.
• Resend — transactional email delivery.
• Supabase — our database and authentication provider.
• Sentry — error monitoring (no personal data attached to error reports).
• Counterparties within an active campaign — brands see the creators submitting to their campaigns; creators see the brands running campaigns they apply to.

No data brokers, no advertising networks. We may also disclose data if required by law, to enforce our terms, or to protect the rights and safety of our users or the public.

6. Cookies & similar technologies.

We use cookies and similar local storage that are strictly necessary to sign you in and keep the platform secure, plus a minimal amount for remembering preferences. We do not use third-party advertising or cross-site tracking cookies on authenticated surfaces. You can control cookies through your browser, though disabling essential ones may break sign-in.

7. Your rights.

• Access: ask us for a copy of your data.
• Correction: fix anything we got wrong via your profile or by emailing support.
• Erasure: request deletion. Financial records may be retained where law requires.
• Portability: we'll export your data in a machine-readable format on request.
• Objection / restriction: where applicable law gives you the right to object to or limit certain processing.

Contact privacy@obscurexhibit.com to exercise any of these. We won't discriminate against you for doing so.

8. California residents.

If you're a California resident, you have the rights above plus the right to know what personal information we collect and how we use it, the right to delete it, and the right to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, email the address above.

9. Data security.

We use technical and organizational measures — encryption in transit, access controls, and row-level security on our database — to protect personal data. No system is perfectly secure, but if a breach affects your personal data we'll notify you and the relevant authorities as required by law.

10. Retention.

We keep account data while your account is active and for a reasonable window after closure for audit and dispute resolution. Financial and tax records are kept as long as the law requires. Anonymized, aggregate statistics that no longer identify you may be kept indefinitely.

11. Children.

The platform is for adults. It is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal data from anyone under 18; if you believe a minor has provided us data, contact us and we'll delete it.

12. International users.

Our infrastructure is hosted in the United States. If you use the platform from outside the U.S., you understand your data will be processed in the U.S., and we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers where required.

13. Changes.

We'll notify you of material privacy changes at least 14 days before they take effect, by email and in-app.