1. Data we collect
Your account
Your name, email address and password (stored as a secure hash by our authentication provider), your workspace name, your team members and their roles, and an optional profile photo.
Content you create
Briefs, product facts, links you ask us to read, photos you upload (product photos and reference photos of virtual characters), and the photos, videos, narration, scripts and captions generated for you.
Connected social accounts
When you connect an Instagram professional account or a YouTube channel, we receive the account’s ID, username or channel name, and access tokens that let us publish on your behalf. We store the tokens encrypted. We use them only to publish the content you approve, at the time you choose, and to check that it was published. We do not read your followers, messages, comments or other accounts’ data.
Payments
Card and UPI payments are handled by Stripe (pounds) and Razorpay (rupees). We never see or store full card details; we keep the payment reference, amount, currency and package so we can add your credits and show your billing history.
Technical data
Server logs (such as IP address, browser and the pages requested) for security and troubleshooting, and essential cookies that keep you signed in. Your browser also stores small preferences, such as the currency you chose. We do not use advertising or tracking cookies.
2. How we use it
- To provide the service: generate, store and show your content.
- To publish to the social accounts you connect, only when you or your team approve it.
- To take payments, add credits and keep billing records.
- To send service emails, such as invitations, sign-in links and notices about your account.
- To keep the service secure, prevent abuse and fix problems.
Our legal bases are performing our contract with you, our legitimate interest in running and securing the service, and legal obligations such as keeping financial records. We do not sell personal data and do not use it for advertising.
3. AI generation and virtual personalities
The characters on Influnco are fictional, AI-generated personalities. To make content, we send your brief, the relevant reference and product photos, and text such as scripts to AI model providers, which return the generated result. Do not upload photos of real people unless you have their permission. Generated content is labelled as AI-generated.
4. Who processes data for us
We use these service providers, each only for the purpose given and under their own security and data protection terms:
- Supabase: database and sign-in.
- Amazon Web Services (S3): storage of photos, videos and audio, in the EU (Stockholm).
- Vercel: hosting of the website and app.
- OpenRouter: routes AI requests to model providers (such as Anthropic, Google, OpenAI and ElevenLabs) for scripts, photos, checks and narration.
- Kie.ai: AI video clips and photos.
- Firecrawl: reads web pages you ask us to read when the page blocks direct access.
- Resend: sends our emails.
- Stripe and Razorpay: payments.
- Meta (Instagram) and Google (YouTube): receive the content you publish to your accounts there.
Some of these providers process data outside the UK and EU. Where they do, transfers are protected by the safeguards required by UK and EU law, such as standard contractual clauses.
5. How long we keep it
- Account and workspace data: for as long as your account is open.
- Content and media: until you delete it or your account is deleted.
- Temporary copies of photos sent to AI providers: deleted automatically within a few days.
- Social account tokens: deleted as soon as you disconnect the account.
- Payment records: as long as the law requires for tax and accounting (normally six years).
When you ask us to delete your account, we delete its personal data within 30 days, except records we must keep by law.
6. Your rights
You can ask to access, correct, export or delete your personal data, and object to or restrict how we use it. Email hello@crmmates.com and we will reply within one month. See our data deletion instructions. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
7. Security
Data is encrypted in transit; social account tokens are also encrypted at rest. Media is stored privately and shown through short-lived signed links. Access within a workspace follows the roles its owner assigns.
8. Children
Influnco is a business service for people aged 18 and over. We do not knowingly collect data from children.
9. Changes
We will update this page when our practices change, and tell account owners by email about significant changes.
10. Contact
Questions or requests about privacy: hello@crmmates.com.