Privacy Policy

1. Information we collect

Information you provide

• Waitlist email — if you join our pre-launch waitlist, we collect your email address so we can email you when Vyndle is open.
• Account details — when you sign up, we collect information such as your name, handle, profile bio, and any profile media you choose to add.
• Payment information — payments are processed by third-party payment providers. Vyndle does not store full card numbers. We keep a reference to the transaction (amount, date, provider reference) so we can show you your history and help with support requests.
• Content you upload — posts, images, links, videos, and any other content you choose to publish on Vyndle.
• Media-kit enquiries— if you send an enquiry to a creator through their Vyndle media kit, we collect your name, email address, any company name and message you provide, and the time you consented to be contacted. We email you a confirmation link, and once you confirm we share your enquiry with that creator so they can respond. If the creator approves your enquiry, you can exchange messages with them through Vyndle without either party’s email address being shared; we store the content of those messages (both yours and the creator’s) alongside the enquiry so the conversation is available to you both. We keep a salted, one-way hash of your IP address (never the raw address) to prevent abuse. We retain enquiry data, including message content, for up to 90 days, after which it is deleted. If you or the creator report a conversation, we keep a moderation record of that report (the reason, category, timestamp, and our review outcome) so we can act on abuse and meet our record-keeping obligations. That moderation record is kept for up to three years and does not include the message content, which is still deleted at 90 days with the rest of the enquiry.
• Age-assurance and creator-KYC data — to keep Vyndle an 18+ platform and to enable creator payouts, we collect data used to verify age and identity. Today, age is confirmed by self-declaration at sign-up. When higher-assurance age checks or creator payouts are enabled, this will also include outputs from an accredited third-party age-assurance provider (for example, facial age estimation results and liveness signals) and, for creators, government-issued identity documents and proof of address. We collect only what is needed for verification and do not retain the underlying biometric data once the check has completed; we keep only the verification outcome and audit record.

Automatically collected

• IP address and approximate location derived from it.
• Browser type, device type, and operating system.
• Pages visited, referring URL, and timestamps.
• Cookies and similar technologies — see Section 5.

Information from third parties

When you connect an external platform (such as YouTube, Instagram, or TikTok) to your Vyndle profile, we receive information from that platform — for example your platform handle, follower count, and recent posts. What we receive is governed by the data-sharing permissions you grant on that platform and by that platform's own privacy terms.

Facebook Login

If you sign up or log in with Facebook, Vyndle requests only your name, email address, and public profile. We use this solely to create and authenticate your account. We do not access your friends, posts, Pages, or Instagram through this login, and we do not use this data for advertising.

Your Facebook data is also subject to the Meta Privacy Policy. You can revoke Vyndle's access at any time from your Facebook app settings.

YouTube API Services

Vyndle uses YouTube API Services to let creators connect their YouTube channel.

• What we access. Your channel title, custom URL, channel thumbnail, channel description, current subscriber count, video metadata (titles, IDs, thumbnails, view counts), and aggregated YouTube Analytics reports (engagement metrics, audience-retention curves, and aggregated viewer demographics by age, gender, and country).
• What we do not access. Private or unlisted videos, your comments, your subscriptions, your watch history, or any data identifying individual viewers. YouTube Analytics returns only aggregated percentages — we never receive per-viewer information.
• What we store. Your channel identity (title, URL, thumbnail), current subscriber count, and rolling 28-day and 90-day analytics snapshots. Snapshots are refreshed on a recurring schedule and older versions are overwritten; no per-day historical archive is kept.
• Why we use it. To verify channel ownership at signup, display your YouTube presence on your Vyndle profile, surface audience and engagement metrics to advertisers in our creator-discovery interface, and provide creator-facing analytics in your dashboard.
• Who we share it with. Aggregated metrics are visible to advertisers on Vyndle solely for brand-collaboration matchmaking. We do not sell YouTube data and do not share it with any other third party.

By connecting your YouTube channel to Vyndle, you agree to the YouTube Terms of Service. Your YouTube data is also subject to the Google Privacy Policy.

Scopes we request from Google

When you sign in with Google or connect your YouTube channel, Vyndle requests only the scopes listed below. Each scope is named verbatim and accompanied by the specific feature it powers — we do not request scopes we do not use.

• openid — establish a verified Google identity at sign-in.
• https://www.googleapis.com/auth/userinfo.email — receive your primary Google email for account creation and notifications.
• https://www.googleapis.com/auth/userinfo.profile — receive your name and profile picture for your Vyndle account.
• https://www.googleapis.com/auth/youtube.readonly — verify YouTube channel ownership and read public channel metadata for display on your Vyndle profile.
• https://www.googleapis.com/auth/yt-analytics.readonly — fetch aggregated YouTube Analytics for your creator dashboard and (for advertisers) discovery matching.

Revoking access. You can disconnect YouTube from Vyndle at any time from your Vyndle account settings, or revoke access directly via Google's security permissions page. Within 30 days of disconnection we delete the YouTube data associated with your account, except where retention is required by law.

Limited Use of Google User Data

Vyndle's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only for the features described in this policy.
• We do not use Google user data for serving advertising, including retargeting, personalized, or interest-based advertising.
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable law, or in connection with a merger, acquisition, or sale of assets with appropriate user notice.
• Humans do not read Google user data except (a) with the user's affirmative consent for specific data items, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for internal operations such as capacity planning.

2. How we use your information

We use the information described above to:

• Operate, maintain, and improve the Service.
• Process payments through our third-party payment providers.
• Personalise your experience — for example, what we show on your dashboard.
• Pass confirmed media-kit enquiries to the relevant creator, and confirm your enquiry by email before doing so.
• Communicate with you about your account, your waitlist entry, and important Service updates.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms.

3. Legal bases (for users in the UK and EEA)

Where the UK GDPR or EU GDPR apply, we process your personal data on the following legal bases:

• Contract — to provide the Service you've signed up for.
• Legitimate interests — to operate, secure, and improve the Service, and to communicate with you about it.
• Consent — for marketing emails and certain cookies. You can withdraw consent at any time.
• Legal obligations — where we are required by law to process your data.

4. Cookies

Strictly necessary cookieskeep the Service working — they keep you signed in and remember your cookie choices (the vyndle_consent cookie that stores this preference). These are always active, because the Service can't function without them.

Analytics cookies, which we set only with your consent, come from Google Analytics and PostHog and help us understand how the Service is used. None are set until you agree — for example, PostHog sets a ph_…_posthogcookie (analytics, lasting about a year) only after you consent. On your first visit a cookie banner lets you accept all, reject non-essential, or choose — and rejecting is as easy as accepting. You can change or withdraw your choice at any time using the “Cookie preferences” link in the footer.

Separately, we use privacy-preserving analytics to count aggregate views (for example, how many people viewed a profile or post). This sets no cookies and cannot identify you — your IP address is one-way hashed and never stored in raw form — so it runs under our legitimate interests and sits outside the cookie banner.

We do not currently set marketing cookies.

5. Sharing your information

We share personal information only in the following cases:

• Service providers — companies that help us operate Vyndle, such as hosting, payment processing, email delivery, customer support, and analytics. They only receive what they need to do their job and are bound to protect your data. For creators, identity and tax information is shared with our payment provider for the purposes of payment processing, KYC, sanctions and politically-exposed-person screening, and to support compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).
• Law enforcement and regulators — where we are legally required, or where we reasonably believe it is necessary to protect the safety of any person or the integrity of the Service.
• Other users — only to the extent you choose. Content you publish on your public profile is, by definition, public.

6. International transfers

Vyndle operates globally. Your data may be processed or stored in countries outside your own, including outside the UK or EEA. Where that happens, we rely on appropriate safeguards — for example UK or EU Standard Contractual Clauses — to ensure your data is protected to an equivalent standard.

7. Retention

We keep personal data only for as long as we need it to provide the Service or meet our legal obligations. In particular:

• Waitlist email addresses are kept until you unsubscribe, or for up to 90 days after the waitlist closes, whichever comes first.
• Account data is kept while your account is open and deleted or anonymised within a reasonable period after you close it, except where we are required by law to keep specific records longer.
• Transaction records are kept for the period required by applicable tax and accounting rules.

Moderation logs — including automated moderation decisions, user reports, human-review actions, and account-level enforcement records — are retained for a minimum of 12 months, and longer where required by Australian law. Evidence relating to child sexual abuse material is preserved under legal hold: it is exempt from routine deletion and kept under strict, access-controlled retention for as long as required, so that we can cooperate with the Australian Centre to Counter Child Exploitation, the Australian Federal Police, and the eSafety Commissioner.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your personal data (“right to be forgotten”).
• Port your data to another service.
• Object to certain processing, or ask us to restrict it.
• Withdraw consent where we rely on consent.

To exercise any of these rights, email us at privacy@vyndle.co. If you are in the UK or EEA and believe we have not addressed your concern, you also have the right to complain to your local data protection authority.

You can also delete your account and personal data yourself at any time from Dashboard → Settings → Delete account. If you are a creator with active campaigns or unreleased campaign funds, you will need to resolve those first. If you can't access your account, or self-serve deletion isn't available for your account type, email us at privacy@vyndle.co and we will process your request.

9. Children

Vyndle is not intended for children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

10. Security

We protect your data with industry-standard measures, including encryption in transit, access controls, and regular reviews of our security posture. No online platform is 100% secure, however, and we cannot guarantee absolute security. Please use a strong, unique password and take care of your account credentials.

11. Changes to this policy

We may update this policy as Vyndle grows and as the law evolves. When we make material changes, we will communicate them by email or on-platform banner before they take effect.

12. Contact

For any privacy question or request, reach us at privacy@vyndle.co.