Privacy policy

Inflo operates a marketplace connecting businesses in Malta with social media creators. This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have over it. It applies to our website and our API.

We are the data controller for the data described here. For anything in this policy, contact us at privacy@inflo.mt.

1. Data you give us directly

• Account data: your email address, a hashed password, and the role you sign up as. We never store your password itself.
• Creator profile data: display name, profile photo, biography, location, content niches, languages spoken, portfolio items, the collaboration types you accept and your indicative rates.
• Business profile data: business name, logo, description, industry, website and contact details.
• Campaign and collaboration data: campaign briefs, offers and counteroffers, agreed terms, submitted deliverables, revision requests, messages exchanged with the other party, and reviews.

2. Data we obtain from social media platforms

If you choose to connect an Instagram, Facebook or TikTok account, we access data from that platform using its official API and only with the permissions you grant during the connection. You are never required to connect an account in order to hold an Inflo profile.

Instagram and Facebook (Meta)

• Your account identifier, username, account type, profile picture and biography.
• Account metrics: follower count, media count, reach, profile views and impressions.
• Your published media: identifiers, media type, captions, permalinks, thumbnails and publication timestamps.
• Per-post metrics: impressions, reach, likes, comments, saves, shares and video views.
• Aggregated, anonymous audience insights where Instagram makes them available: country, city, age bracket and gender distribution. These are statistical aggregates about your followers, never information about identifiable individuals. Instagram does not provide them for accounts below approximately 100 followers.

TikTok

• Your open identifier, display name, avatar, biography and profile link.
• Account metrics: follower count, following count, total likes and video count.
• Your public videos: identifiers, titles, cover images, share links, durations and per-video view, like, comment and share counts.
• Not collected: TikTok does not expose audience demographics, watch time or completion rates through its API, so we do not hold them and do not present estimates of them as fact.

How we use platform data

Solely to populate your Inflo profile, to let businesses assess whether you fit a campaign, and to confirm that a deliverable you submitted was genuinely published. We record where every figure came from and display that provenance, so a number we calculated is never presented as one the platform verified, and a figure you told us yourself is always labelled as self-reported.

We do not sell platform data, do not use it for advertising, and do not share it with third parties for their own purposes. We store our own periodic snapshots of your metrics because the platforms retain historical metrics for a limited period only — typically 90 days for Meta — and your performance history on Inflo would otherwise disappear.

Access tokens are encrypted at rest using AES-256-GCM. They are never written to our logs. When you disconnect an account we delete the stored tokens immediately.

3. Data we collect automatically

• Session data: authentication cookies that keep you signed in. These are strictly necessary and set without consent, as permitted by law.
• Technical logs: IP address, user agent, requested path and timestamps, retained for security and abuse investigation. We do not run third-party analytics or advertising trackers, and we self-host our fonts so that loading a page discloses nothing to a third party.
• Audit records: a log of security- and money-related actions, such as sign-ins, permission changes, payment funding and payment release.

4. Payments

Payments are processed by Stripe, which acts as an independent controller for the payment data it collects. Creators receiving payment complete Stripe’s own onboarding, providing identity and bank details directly to Stripe under its privacy policy. We never receive or store your full bank details or card numbers. We retain transaction records — amounts, dates, parties and status — as we are required to for accounting and tax purposes.

5. Legal bases

• Contract: operating your account, campaigns, collaborations, messaging and payments.
• Consent: connecting a social media account and the collection of platform data described in section 2. You may withdraw this at any time by disconnecting the account.
• Legitimate interests: securing the platform, preventing abuse, and maintaining performance history that makes the marketplace trustworthy.
• Legal obligation: retaining financial and tax records.

6. Who your data is shared with

Your public creator or business profile is visible to other Inflo users and, for creator profiles, may be indexed by search engines. Data you exchange within a collaboration — messages, offers, deliverables — is visible to the other party to that collaboration.

Beyond that we share data only with processors acting on our instructions: our hosting provider, our email delivery provider, and Stripe as described above. All of our infrastructure is located in the European Union.

7. How long we keep it

• Account and profile data: until you delete your account.
• Social access tokens: until you disconnect the account or delete your account, whichever comes first.
• Metric snapshots: retained while your account is active, because they are your performance history.
• Collaboration and message history: retained while your account is active, then anonymised where we must keep the transaction record.
• Financial records: ten years, as required by Maltese accounting and tax law.
• Technical logs: 90 days.

8. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. You can exercise access, export and deletion yourself from your account settings, or via our data deletion page. We respond to all requests within one month.

If you are unhappy with how we have handled your data you may complain to the Information and Data Protection Commissioner in Malta.

9. Children

Inflo is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a minor holds an account, contact us and we will remove it.

10. Changes

If we change this policy materially we will notify you and record your acknowledgement against the new version, so it is always clear which version you agreed to.