GuahvaGuahva hand-picks Instagram and TikTok creators for brand campaigns. This policy explains what we collect when you send us a brief, apply as a creator, connect Instagram or TikTok, or use your Guahva dashboard, and what we do with it. Questions: hello@guahva.com.
What we collect
From brands
- What you put in a campaign brief: your website, product, goals, markets, platforms, budget range, timing, name, work email, company, and optional phone number and notes.
- If you get access to a campaign space: your email, name and when you last signed in, plus your decisions on shortlisted creators and drafts.
From creators
- Your application: name, age, city, country, content niches, languages, platform handles, WhatsApp number, optional email and portfolio link, and how you heard about us.
- Work on campaigns: drafts and post links you submit, and the public performance of those posts.
- Our assessment of your public content (for example audience size, engagement and an estimated rate range), used to match you with campaigns.
From Instagram, if you choose “Continue with Instagram”
- Your Instagram user ID, username, name, available bio and website, account type, profile picture, follower and following counts, and number of posts.
- Your available posts and Reels: IDs, links, captions, thumbnails/media URLs, publishing dates, likes and comment counts. Where you grant insights access, we read available views, reach, shares, saves, interactions and Reels watch-time metrics.
- Where you grant comments access, comments and replies on your account's posts: comment ID, text, available username, time, likes and hidden state. We receive new comment events through Meta webhooks and periodically refresh comment threads. These support your account and campaign analytics.
- An access token so we can refresh these numbers. It is encrypted at rest, never shown in the browser, and never shared.
From TikTok, if you choose “Continue with TikTok”
- Your TikTok open ID, username, display name, profile picture, bio, verified badge, and follower, following, like and video counts.
- For videos you make for a Guahva campaign: view, like, comment and share counts and the caption. We look these up only for the campaign videos you submit.
- An access token and a refresh token so we can refresh these numbers. Both are encrypted at rest, never shown in the browser, and never shared.
We only request the permissions listed on Instagram’s or TikTok’s consent screen. We never post on your behalf, read your messages, or see your password.
Automatically
- A sign-in cookie for the team workspace and brand campaign spaces, and a sign-in key stored in your browser for the creator dashboard. These are needed for the site to work; we don’t use advertising or tracking cookies.
- Your browser’s draft of a form you haven’t sent yet, stored only on your device.
- Your browser type when you apply, to help us spot fraudulent applications.
How we use it
- To review creator applications and match creators with brand campaigns.
- To show brands a shortlist of creators. Brands see your name, public handles, location, niches, languages, audience size and engagement, and why we picked you. They do not see your contact details or your rate.
- To run campaigns: collect drafts, gather approvals and report on live posts.
- To email you about your brief, application or campaign, including one-time sign-in links.
We don’t sell personal data, and we don’t use it for advertising.
Who processes it for us
- Google Cloud hosts the website and database in Singapore.
- Resend delivers our emails.
- Meta provides Instagram Login, under Instagram’s own privacy policy.
- TikTok provides TikTok Login, under TikTok’s own privacy policy.
How long we keep it
We keep creator profiles while you’re part of the network, and briefs and campaign records for as long as we need them to deliver and account for the work. Sign-in links expire after 30 minutes, or 7 days for invitations. If you disconnect Guahva from Instagram or TikTok, we delete the access tokens immediately.
Your choices
- Access, correction, deletion: email hello@guahva.com from the address you used, or tell us your handle, and we’ll act within 30 days.
- Instagram: use Disconnect under Your accounts in the creator dashboard, or remove Guahva in Instagram under Settings → Apps and websites. On disconnect or Meta's deletion notification we delete your token, copied Instagram profile, post catalog, comments and Instagram-origin campaign measurements. See data deletion.
- TikTok: remove Guahva in TikTok’s settings under Security and permissions → Apps and services. We’re notified and delete your tokens straight away.
- Emails: we only send emails about your own brief, application or campaigns. Reply to any of them to opt out.
Security
All traffic is encrypted in transit. Instagram and TikTok tokens are encrypted at rest with AES-256-GCM. Team passwords are stored as salted scrypt hashes, and sign-in links are single-use.
Age
The creator network is for people aged 18 and over.
Changes
If we change this policy in a way that matters, we’ll update the date above and, where we can, tell you by email.