Last updated: 24 May 2026

Privacy Policy

This Privacy Policy explains how The Build Brain Ltd (“we”, “us”, “our”) collects, uses and protects personal data through the Influencr platform at influencr.co.uk (the “Service”).

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For the purposes of these laws, we are the data controller of the personal data described below. Where you upload personal data about other people to use a Service feature (for example, including an employee's details in a brief), we act as a processor on your behalf — see “Acting as a processor” below.

1. Who we are

• The Build Brain Ltd, a company registered in England and Wales.
• Company number: 15035752 — registered office address available on our Companies House public record.
• Contact for privacy queries: dpo@influencr.co.uk.

2. Personal data we collect

We collect personal data in three circumstances.

2.1 When you join the waitlist

• Email address (required).
• Name (optional).
• Whether you are a brand or a creator (optional).
• Free-text message you send us (optional).
• A one-way hash (SHA-256) of your IP address at the time of submission, used solely for abuse detection. We do not retain raw IP addresses for waitlist submissions.

2.2 When you create or use an account

• Email address, name and password (managed by our authentication provider, Clerk).
• Authentication metadata: session tokens, sign-in timestamps, IP addresses and user-agent strings of devices you sign in from.
• Profile and business information that you choose to provide (company name, industry, niche, region, social handles, brand or creator profile content).
• Content you upload to the Service (campaign briefs, creator content submissions, message drafts).

2.3 Automatically as you use the Service

• Server logs (request paths, timestamps, response codes, request IP, user agent).
• Strictly-necessary cookies that keep you signed in and protect against cross-site request forgery — see Cookies below.

3. How we use your personal data and our lawful basis

If you object to processing we rely on legitimate interests for, email dpo@influencr.co.uk. We will stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.

3A. Creator directory

To make the Service useful from day one, we maintain a directory of public creator data we have collected from public listings, public social-media profiles and other openly-available sources. This is so a brand searching for “UK fitness creators with 10–50k Instagram followers” gets results without us having to wait for every creator on the internet to sign up first.

We process this data under UK GDPR Article 6(1)(f) (legitimate interests). Our specific interest is making creator discovery efficient for the brands using the Service; the data we collect is limited to what is already public; we do not collect or store private contact details, private messages, or content behind a login. We have weighed this against the rights of the creators in our directory and concluded the processing is proportionate and within reasonable expectation for a person who has chosen to publish their work to a public audience.

If you are a creator and you would like to be removed from our directory:

• Email dpo@influencr.co.uk with the subject line “Erasure request” and tell us which platform and handle, or
• Use our right-to-erasure intake at POST /creators/forget on the API.

We will record your request, verify it (typically by asking you to confirm from an address tied to the public profile, or by asking you to post a short proof string on your profile bio temporarily), and on confirmation we will delete your profile and add a suppression record so subsequent discovery runs do not re-ingest you. We will respond within one calendar month.

We never sell or rent the directory, and we do not republish creator content — we link to it on its source platform.

3B. Creator-side platform connections (Instagram Login flow)

When a creator connects their Instagram, TikTok or YouTube account to Influencr (an optional step on the creator side of the Service), we use the platform’s official developer API to retrieve information about that creator’s own account. For Instagram specifically, we use the Instagram Platform provided by Meta Platforms, Inc.

Connecting your account is a deliberate two-step action: you click “Connect Instagram” inside Influencr (the entry-point lives at /creator/connections), you are taken to Instagram to authorise the specific permissions, and only then does data flow back to us. You can disconnect at any time from /creator/connections.

3B.1 Instagram permissions we request (Creator Connect)

The Instagram Login flow for Influencr’s Creator app requests the three permissions below. For each permission we quote Meta’s published “allowed usage” verbatim, followed by a plain-English description of how Influencr actually uses the permission. See §3D for the policy stance we take on usage Meta permits but Influencr declines.

instagram_business_basic

The instagram_business_basic allows your app to read an Instagram Business account profile’s info and media. The allowed usage for this permission is to get basic metadata of an Instagram Business account profile, for example username and ID. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. We display a snapshot of your Instagram profile (username, display name, follower count, profile picture, recent media) at /creator/connections during onboarding and inside the campaign content-review surface, so the brand evaluating you sees accurate information about the account you have linked. We do not use aggregated or de-identified data from this permission for marketing or advertising — see §3D.

instagram_business_content_publish

The instagram_business_content_publish permission allows an app to create organic feed photo and video posts on behalf of a business user. The allowed usage of this permission is to allow an app to manage the organic content creation process for Instagram (for example, post photos and videos) on behalf of an Instagram business account. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. When a brand and a creator agree to publish a campaign deliverable through Influencr, you (the creator) can publish the brand-approved post to your connected Instagram Business account from /creator/campaigns/[id]. Publishing is always creator-initiated and per-post: each post requires a fresh click on “Publish” against a specific draft. We do not publish automatically, we do not schedule posts, and we do not let brands trigger publication on your account. See the publishing-licence clause in our Terms.

instagram_business_manage_insights

The instagram_manage_insights permission allows your app to get access to insights for the Instagram account linked to a Facebook Page. Your app can also discover and read the profile info and media of other business profiles. The allowed usage for this permission is to get metadata, data insights and story insights of an Instagram Business account. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. We read your account-level insights (audience country, city, age and gender breakdown; 28-day reach; follower count) on a roughly weekly refresh. This data feeds our brand-creator matching reranker so brands looking for, say, “UK creators with a majority female audience aged 25–34” see better-matched results, and it powers the engagement summary on your own creator dashboard. We do not use this insights data for marketing or advertising — see §3D.

3B.2 What we do NOT receive on the creator side

• Your password — the authorisation flow is handled entirely by the platform.
• Private messages or direct-message conversations from your inbox.
• Any data about other users from accounts you don’t own (for example, we do not pull lists of who follows you as identifiable individuals).
• Information from any third party who has not personally connected their own account.

3B.3 Lawful basis, retention and revocation (creator side)

Our lawful basis is UK GDPR Article 6(1)(b) (performance of a contract — the connection is part of how you use the Service) for the parts that are necessary for the Service to function, and Article 6(1)(a) (consent) for any optional richer data we ask for and you grant. Inside Influencr, your connected-account data is visible to you and to brands who are evaluating you for a specific campaign you have been suggested for, who you have applied to, or who have explicitly invited you — not to other creators or to the public. We do not sell, rent, license, transfer or otherwise share this data with advertising networks, data brokers or analytics aggregators outside the sub-processors listed in section 6. We do not combine data obtained from one platform with data from another to build cross-platform audience profiles.

To revoke a creator-side connection:

• Inside Influencr: visit /creator/connections and click “Disconnect” on the relevant platform. This revokes our access token and queues the corresponding cached data for deletion.
• On the platform itself: remove Influencr’s permission from the platform’s own “Apps and Websites” settings. The platform invalidates the access token; we mark the local token revoked within the next session.
• For a full erasure of your Influencr account and the connected-platform data we have held about you, follow the data deletion procedure.

When you publish a brand-approved deliverable via Influencr, we retain a record of each publish attempt (timestamp, content hash, the Meta-issued post ID, success or failure) for auditing and brand-creator dispute resolution. The content media itself is stored on our infrastructure for the duration of the campaign and is deleted on data-erasure request.

3C. Brand-side platform connections (Facebook Login flow)

Brands using Influencr connect their Facebook Business Manager and the Instagram Business account linked to their Facebook Page via Facebook Login. The connection is a deliberate action initiated from the brand-onboarding flow; permissions are granted by the brand user to Influencr’s Brand Connect app and can be revoked at any time from the brand’s Meta Business settings, or via Influencr’s own UI (see §3C.4).

The Brand Connect flow currently operates in two modes: (a) a back-channel discovery use, where The Build Brain Ltd holds a token used to read public Instagram business-profile metadata for creator matching; and (b) a brand-initiated OAuth use, in active development, where the brand directly authorises Influencr to manage their branded-content partner list and read their Page+IG metadata. The policy below covers both modes.

3C.1 Instagram and Facebook permissions we request (Brand Connect)

The Facebook Login flow for Influencr’s Brand app requests the eight permissions below. As in §3B.1, we quote Meta’s published “allowed usage” verbatim, followed by a plain-English description of Influencr’s actual use. Three of these permissions (instagram_business_basic, instagram_business_manage_messages, instagram_manage_comments) are enabled by the “Manage messaging & content on Instagram” use case shell Meta requires us to apply under, but Influencr does not exercise them on the brand side — see §3D.

business_management

The business_management permission allows your app to read and write with the Business Manager API. The allowed usage for this permission is to manage business assets such as an ad account and to claim ad accounts. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. We operate at Business Manager scope so we can access the brand’s connected Instagram Business account and Page assets (which themselves live under the brand’s Business Manager). We do not create or manage ad accounts on the brand’s behalf and we do not use this permission for advertising or analytics purposes — see §3D.

instagram_basic

The instagram_basic allows your app to read an Instagram account profile’s info and media. The allowed usage for this permission is to get basic metadata of an Instagram Business account profile, for example username and ID. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. We read basic metadata about the brand’s own Instagram Business account during onboarding so we can verify that the brand’s Facebook Page is correctly linked to a real Instagram Business account.

instagram_branded_content_brand

The instagram_branded_content_brand permission allows your app to add, remove and view creators from a specific brand’s approved creators list. The allowed usage for this permission is to manage a specific brand’s Instagram creator content settings. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. When the brand and a creator agree to collaborate, Influencr authorises the creator as an approved branded-content partner of the brand on Instagram, so the creator can attach Instagram’s native paid-partnership tag to the brand-approved post at publish time without the brand having to approve each creator manually through Meta Business Suite. We do not use this permission for any other purpose.

instagram_business_basic (Brand Connect)

The instagram_business_basic allows your app to read an Instagram Business account profile’s info and media. The allowed usage for this permission is to get basic metadata of an Instagram Business account profile, for example username and ID. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. Enabled by the “Manage messaging & content on Instagram” use case shell Meta requires us to apply under, but not exercised on the brand side — coverage for the brand’s own IG Business metadata is provided by instagram_basic above. See §3D.

instagram_business_manage_messages

The instagram_business_manage_messages permission allows an app to access messages on an Instagram professional account. The allowed usage for this permission is to view, manage and respond to messages, and to use third-party customer relationship management (CRM) tools to manage messages. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. Enabled by the use case shell but not exercised. Influencr does not view, send, read or store Instagram direct messages on any brand or creator account. See §3D.

instagram_manage_comments

The instagram_manage_comments permission allows your app to create, delete and hide comments on behalf of the Instagram account linked to a Page. Your app can also read and respond to public media and comments that a business has been photo tagged or @mentioned in. The allowed usage for this permission is to read, update and delete comments of Instagram Business Accounts. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. Enabled by the use case shell but not exercised. Influencr does not read, post, edit, hide or delete comments on any brand or creator account. See §3D.

instagram_manage_insights (Brand Connect)

The instagram_manage_insights permission allows your app to get access to insights for the Instagram account linked to a Facebook Page. Your app can also discover and read the profile info and media of other business profiles. The allowed usage for this permission is to get metadata, data insights and story insights of an Instagram Business account. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. We read reach and engagement metrics for the collaboration posts the brand is tagged in (paid-partnership posts the creator has published as part of a campaign on Influencr) and surface them on the brand’s /brand/reports screen. We do not pull insights for non-collaboration content on the brand’s account, and we do not use this data for marketing or advertising — see §3D.

pages_read_engagement

The pages_read_engagement permission allows your app to read content (posts, photos, videos, events) posted by the Page, read followers data (including name, PSID), and profile picture, and read metadata and other insights about the Page. The allowed usage for this permission is to help a Page Admin administer and manage a Page. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. We read the brand’s Facebook Page metadata (Page name, Page ID, the Instagram Business account ID linked to it) to verify the Page → Instagram link during onboarding. We do not read the Page’s followers, posts, comments, PSIDs or any individual user data from the Page’s audience.

pages_show_list

The pages_show_list permission allows your app to access the list of Pages a person manages. The allowed usage for this permission is to show a person the list of Pages they manage and verify that a person manages a Page. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).

Influencr’s actual use. During brand onboarding we present a list of the Facebook Pages the connecting user manages, so they can pick the Page associated with the Instagram Business account they want to use for Influencr campaigns.

3C.2 What we do NOT receive on the brand side

• The brand user’s Facebook or Instagram password.
• The Page’s followers (names, PSIDs, profile pictures) — we read Page metadata only.
• Instagram direct-message content, comment threads or any user-to-user conversation data (see §3D).
• Insights on any Instagram content the brand is not directly tagged in via a collaboration published through Influencr.

3C.3 Lawful basis (brand side)

Our lawful basis is UK GDPR Article 6(1)(b) (performance of a contract — the connection is part of how the brand uses the Service) for permissions necessary to deliver the matching, branded-content-tagging and reporting features, and Article 6(1)(a) (consent) for any optional features the brand admin opts into. As described in §3C, in the back-channel discovery mode The Build Brain Ltd is the controller of the token used to read public business-profile metadata; in the brand-initiated OAuth mode the brand is the data controller of its own Page+IG data and Influencr is its processor under our Data Processing Addendum (available from dpo@influencr.co.uk).

3C.4 Revocation (brand side)

Brands can revoke a connection at any time, either from the brand-side connections UI inside Influencr or from Meta Business settings → Business Integrations. Revocation removes Influencr’s ability to call the Meta API on the brand’s behalf; we mark the local token revoked within the next session and stop refreshing the cached metadata. Previously-attached branded-content authorisations on Instagram are removed via the same flow that created them; the brand can also remove individual creators from its approved list directly on Instagram.

3D. Permissions enabled but not exercised

Meta’s “Manage messaging & content on Instagram” use case bundles several permissions together as a precondition for App Review approval. Influencr applies under that use case for the Brand Connect features described in §3C, but does not actually call the API endpoints associated with the following permissions on either app:

• instagram_business_basic on the brand side — superseded on the brand side by instagram_basic (§3C.1); not used to collect any data on the brand’s own profile beyond what instagram_basic provides.
• instagram_business_manage_messages — Influencr does not access, read, send, store or moderate Instagram direct messages on any account, brand or creator. There is no DM-related feature in the product and no plan to add one.
• instagram_manage_comments — Influencr does not read, post, edit, hide or delete comments on any Instagram account. Comment moderation belongs to the account owner and stays on Instagram.

We declare this explicitly so users can see, before they authorise the connection, exactly which data we touch and which we do not, even where Meta’s permission grant would permit broader use.

3E. Other connected platforms (TikTok and YouTube)

When a creator connects TikTok or YouTube to Influencr, we use those platforms’ official developer APIs to retrieve information about the creator’s own account in the same shape as §3B — basic profile metadata, recent media list, and engagement-level insights on the creator’s own posts where the platform exposes them. The retention, sharing, revocation and erasure rules described in §3B.3 apply identically. We do not pull DMs, comments or any data about other users from these platforms.

4. Automated decision-making

The Service uses AI to score creator–brand matches, check content against campaign briefs, and surface review notes. These outputs are recommendations only: a person (the brand owner) reviews and decides every campaign action that affects a creator. We do not make solely-automated decisions with legal or similarly significant effects on data subjects within the meaning of UK GDPR Article 22.

5. Acting as a processor

When you upload personal data of third parties through the Service (e.g. an employee contact in a brief, audience demographics, a creator's personal details you have permission to share with us) we process it on your behalf as a processor under UK GDPR Article 28. We will:

• process that data only on your documented instructions;
• ensure persons authorised to process it are bound by confidentiality and act under appropriate technical and organisational measures;
• use only the sub-processors listed in section 6 below and notify you of any addition or replacement with reasonable advance notice;
• assist you with data-subject requests, data protection impact assessments and breach-notification obligations;
• return or delete the personal data at the end of our services, save where storage is required by law.

Brand customers operating in regulated sectors should email dpo@influencr.co.uk for our Data Processing Addendum.

6. Sub-processors

We use the following sub-processors. Each is bound by a written agreement that requires equivalent or stronger data-protection obligations than this policy. See section 7 for the specific transfer mechanism that applies to each.

We will update this list at least 14 days before adding or replacing any sub-processor. Material additions on the near roadmap (PostHog for product analytics) will appear here before they are wired.

7. International transfers

Where personal data is transferred outside the UK to a country without UK adequacy regs, we rely on the following safeguards on a per-recipient basis:

• Clerk.com Inc. (US): transfer is covered by the UK Extension to the EU–US Data Privacy Framework where Clerk is self-certified; otherwise by Clerk's Data Processing Addendum incorporating the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Vercel Inc. (US): same — DPF where certified, otherwise SCCs + UK Addendum.
• Anthropic PBC (US): transfer is covered by Anthropic's Data Processing Addendum incorporating the EU SCCs with the UK Addendum.
• AWS Europe London (eu-west-2): primary data storage stays within the UK. Where AWS personnel based outside the UK provide support, transfers are covered by AWS's Data Processing Addendum incorporating the EU SCCs with the UK Addendum.
• Paddle.com Market Limited (UK / US / Ireland / Canada): transfers across Paddle's group entities and to its own sub-processors are covered by Paddle's published data-processing addendum, which incorporates the UK Extension to the EU–US Data Privacy Framework where the recipient is self-certified, and otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

Copies of these safeguards are available on request from dpo@influencr.co.uk.

8. How long we keep your data

9. Your rights

Under the UK GDPR you have the following rights:

• Right to be informed — this policy is how we discharge that obligation.
• Right of access — to obtain confirmation of, and a copy of, the data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your data in some circumstances. Account holders can self-serve via Settings → Danger zone → Delete account; full detail of what is deleted vs retained, and why, is on our data-deletion page.
• Right to restrict processing in some circumstances.
• Right to data portability — to receive your data in a structured, commonly-used, machine-readable format.
• Right to object to processing based on legitimate interests, including for direct marketing.
• Rights related to automated decision-making and profiling — we do not subject you to solely-automated decisions with legal/significant effect, as described in section 4.

To exercise any right, email dpo@influencr.co.uk. We will respond within one calendar month, extendable by two months for complex requests with explanation.

If you are unhappy with our handling of your data you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk or 0303 123 1113. If you are based outside the UK, you may also complain to your local supervisory authority.

10. Cookies

We use only strictly-necessary cookies. They are exempt from consent under regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 because they are essential to delivering a service you have actively requested. We do not use cookies for analytics, advertising or cross-site tracking. If we add any non-essential cookies in future, we will ask for your consent first.

11. Security

We use industry-standard measures to protect personal data — TLS encryption in transit, encryption at rest on our database and file storage, scoped access controls, audit logging, and rate-limiting + a web application firewall in front of the API. No system can be guaranteed perfectly secure; if a breach occurs that poses a risk to you, we will notify you and the ICO within the timeframes required by UK GDPR Article 33/34.

12. Children

The Service is intended for use by people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.

12A. We decline Meta’s “marketing and advertising” allowance

Each of the Meta permissions enumerated in §3B and §3C carries an allowed-usage clause that also permits us to “request analytics insights to improve [the] app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information.” Influencr explicitly declines that right. We do not use audience or insights data — aggregated, de-identified, anonymised or otherwise — for marketing, advertising, product analytics or any purpose outside the platform features described in §3B and §3C. Demographic and engagement data is used solely to power our brand–creator matching feature and to surface reports to brands you have collaborated with. We declare this here so the practice is on the record.

13. Changes to this policy

We may update this policy as the Service evolves. We will note the “Last updated” date at the top, and material changes will be communicated by email to registered users at least 14 days before they take effect.

Draft notice: This Privacy Policy has been prepared as best-practice boilerplate, cross-referenced against ICO guidance current at the date above. It is not a substitute for legal advice. We will have this document reviewed by a UK-qualified solicitor before opening the Service to public sign-up or accepting payment.