Last updated: 24 May 2026
This Privacy Policy explains how The Build Brain Ltd (“we”, “us”, “our”) collects, uses and protects personal data through the Influencr platform at influencr.co.uk (the “Service”).
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For the purposes of these laws, we are the data controller of the personal data described below. Where you upload personal data about other people to use a Service feature (for example, including an employee's details in a brief), we act as a processor on your behalf — see “Acting as a processor” below.
We collect personal data in two circumstances.
| Purpose | Lawful basis |
|---|---|
| Operate your account and deliver the Service to you. | Performance of a contract (UK GDPR Article 6(1)(b)). |
| Send service-related messages (e.g. invitation emails, security notices). | Performance of a contract (Article 6(1)(b)). |
| Detect and prevent abuse, fraud and service disruption. | Legitimate interests (Article 6(1)(f)) — our interest is keeping the Service secure and available. We use only the minimum data needed (IP hashes, request metadata) and do not profile users for any unrelated purpose. |
| Comply with legal obligations (tax, accounting, court orders). | Legal obligation (Article 6(1)(c)). |
If you object to processing we rely on legitimate interests for, email dpo@influencr.co.uk. We will stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
To make the Service useful from day one, we maintain a directory of public creator data we have collected from public listings, public social-media profiles and other openly-available sources. This is so a brand searching for “UK fitness creators with 10–50k Instagram followers” gets results without us having to wait for every creator on the internet to sign up first.
We process this data under UK GDPR Article 6(1)(f) (legitimate interests). Our specific interest is making creator discovery efficient for the brands using the Service; the data we collect is limited to what is already public; we do not collect or store private contact details, private messages, or content behind a login. We have weighed this against the rights of the creators in our directory and concluded the processing is proportionate and within reasonable expectation for a person who has chosen to publish their work to a public audience.
If you are a creator and you would like to be removed from our directory:
POST /creators/forget on the API.We will record your request, verify it (typically by asking you to confirm from an address tied to the public profile, or by asking you to post a short proof string on your profile bio temporarily), and on confirmation we will delete your profile and add a suppression record so subsequent discovery runs do not re-ingest you. We will respond within one calendar month.
We never sell or rent the directory, and we do not republish creator content — we link to it on its source platform.
Creators do not connect their own social accounts to Influencr. Influencr does not ask creators to authorise Instagram, TikTok or YouTube via OAuth, and we do not collect or store any creator platform OAuth tokens or first-party platform API data on the creator side. There is no creator-side “Connect Instagram” flow and no creator-side platform-disconnect surface.
The creator information we hold comes only from two sources: (a) what the creator enters themselves when they set up their profile or deliver content for a campaign, and (b) public profile information (for example, a public follower count or public posts) gathered for the creator directory as described in section 3A. We do not retrieve private account data, account-level insights, or audience demographics from a creator’s own platform account, because no creator-side platform connection exists.
Creators are content contributors on Influencr: they are discovered or invited, they draft and upload content for a campaign, and the brand reviews, approves and publishes that content through the brand’s own connected platform account (see §3C). Publishing to a social platform is performed on the brand side, never from a creator’s own connected account.
For a full erasure of your Influencr account and any creator profile data we hold about you, follow the data deletion procedure.
Brands using Influencr connect their Facebook Business Manager and the Instagram Business account linked to their Facebook Page via Facebook Login. The connection is a deliberate action initiated from the brand-onboarding flow; permissions are granted by the brand user to Influencr’s Brand Connect app and can be revoked at any time from the brand’s Meta Business settings, or via Influencr’s own UI (see §3C.4).
The Brand Connect flow currently operates in two modes: (a) a back-channel discovery use, where The Build Brain Ltd holds a token used to read public Instagram business-profile metadata for creator matching; and (b) a brand-initiated OAuth use, in active development, where the brand directly authorises Influencr to manage their branded-content partner list and read their Page+IG metadata. The policy below covers both modes.
The Facebook Login flow for Influencr’s Brand app requests the eight permissions below. For each, we quote Meta’s published “allowed usage” verbatim, followed by a plain-English description of Influencr’s actual use. Three of these permissions (instagram_business_basic, instagram_business_manage_messages, instagram_manage_comments) are enabled by the “Manage messaging & content on Instagram” use case shell Meta requires us to apply under, but Influencr does not exercise them on the brand side — see §3D.
business_managementThe business_management permission allows your app to read and write with the Business Manager API. The allowed usage for this permission is to manage business assets such as an ad account and to claim ad accounts. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. We operate at Business Manager scope so we can access the brand’s connected Instagram Business account and Page assets (which themselves live under the brand’s Business Manager). We do not create or manage ad accounts on the brand’s behalf and we do not use this permission for advertising or analytics purposes — see §3D.
instagram_basicThe instagram_basic allows your app to read an Instagram account profile’s info and media. The allowed usage for this permission is to get basic metadata of an Instagram Business account profile, for example username and ID. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. We read basic metadata about the brand’s own Instagram Business account during onboarding so we can verify that the brand’s Facebook Page is correctly linked to a real Instagram Business account.
instagram_branded_content_brandThe instagram_branded_content_brand permission allows your app to add, remove and view creators from a specific brand’s approved creators list. The allowed usage for this permission is to manage a specific brand’s Instagram creator content settings. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. When the brand and a creator agree to collaborate, Influencr authorises the creator as an approved branded-content partner of the brand on Instagram, so the creator can attach Instagram’s native paid-partnership tag to the brand-approved post at publish time without the brand having to approve each creator manually through Meta Business Suite. We do not use this permission for any other purpose.
instagram_business_basic (Brand Connect)The instagram_business_basic allows your app to read an Instagram Business account profile’s info and media. The allowed usage for this permission is to get basic metadata of an Instagram Business account profile, for example username and ID. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. Enabled by the “Manage messaging & content on Instagram” use case shell Meta requires us to apply under, but not exercised on the brand side — coverage for the brand’s own IG Business metadata is provided by instagram_basic above. See §3D.
instagram_business_manage_messagesThe instagram_business_manage_messages permission allows an app to access messages on an Instagram professional account. The allowed usage for this permission is to view, manage and respond to messages, and to use third-party customer relationship management (CRM) tools to manage messages. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. Enabled by the use case shell but not exercised. Influencr does not view, send, read or store Instagram direct messages on any brand or creator account. See §3D.
instagram_manage_commentsThe instagram_manage_comments permission allows your app to create, delete and hide comments on behalf of the Instagram account linked to a Page. Your app can also read and respond to public media and comments that a business has been photo tagged or @mentioned in. The allowed usage for this permission is to read, update and delete comments of Instagram Business Accounts. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. Enabled by the use case shell but not exercised. Influencr does not read, post, edit, hide or delete comments on any brand or creator account. See §3D.
instagram_manage_insights (Brand Connect)The instagram_manage_insights permission allows your app to get access to insights for the Instagram account linked to a Facebook Page. Your app can also discover and read the profile info and media of other business profiles. The allowed usage for this permission is to get metadata, data insights and story insights of an Instagram Business account. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. We read reach and engagement metrics for the collaboration posts the brand is tagged in (paid-partnership posts the creator has published as part of a campaign on Influencr) and surface them on the brand’s /brand/reports screen. We do not pull insights for non-collaboration content on the brand’s account, and we do not use this data for marketing or advertising — see §3D.
pages_read_engagementThe pages_read_engagement permission allows your app to read content (posts, photos, videos, events) posted by the Page, read followers data (including name, PSID), and profile picture, and read metadata and other insights about the Page. The allowed usage for this permission is to help a Page Admin administer and manage a Page. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. We read the brand’s Facebook Page metadata (Page name, Page ID, the Instagram Business account ID linked to it) to verify the Page → Instagram link during onboarding. We do not read the Page’s followers, posts, comments, PSIDs or any individual user data from the Page’s audience.
pages_show_listThe pages_show_list permission allows your app to access the list of Pages a person manages. The allowed usage for this permission is to show a person the list of Pages they manage and verify that a person manages a Page. You may also use this permission to request analytics insights to improve your app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information (provided such data cannot be re-identified).
Influencr’s actual use. During brand onboarding we present a list of the Facebook Pages the connecting user manages, so they can pick the Page associated with the Instagram Business account they want to use for Influencr campaigns.
Our lawful basis is UK GDPR Article 6(1)(b) (performance of a contract — the connection is part of how the brand uses the Service) for permissions necessary to deliver the matching, branded-content-tagging and reporting features, and Article 6(1)(a) (consent) for any optional features the brand admin opts into. As described in §3C, in the back-channel discovery mode The Build Brain Ltd is the controller of the token used to read public business-profile metadata; in the brand-initiated OAuth mode the brand is the data controller of its own Page+IG data and Influencr is its processor under our Data Processing Addendum (available from dpo@influencr.co.uk).
Brands can revoke a connection at any time, either from the brand-side connections UI inside Influencr or from Meta Business settings → Business Integrations. Revocation removes Influencr’s ability to call the Meta API on the brand’s behalf; we mark the local token revoked within the next session and stop refreshing the cached metadata. Previously-attached branded-content authorisations on Instagram are removed via the same flow that created them; the brand can also remove individual creators from its approved list directly on Instagram.
Meta’s “Manage messaging & content on Instagram” use case bundles several permissions together as a precondition for App Review approval. Influencr applies under that use case for the Brand Connect features described in §3C, but does not actually call the API endpoints associated with the following permissions on either app:
instagram_business_basic on the brand side — superseded on the brand side by instagram_basic (§3C.1); not used to collect any data on the brand’s own profile beyond what instagram_basic provides.instagram_business_manage_messages — Influencr does not access, read, send, store or moderate Instagram direct messages on any account, brand or creator. There is no DM-related feature in the product and no plan to add one.instagram_manage_comments — Influencr does not read, post, edit, hide or delete comments on any Instagram account. Comment moderation belongs to the account owner and stays on Instagram.We declare this explicitly so users can see, before they authorise the connection, exactly which data we touch and which we do not, even where Meta’s permission grant would permit broader use.
As with Instagram (§3B), creators do not connect their TikTok or YouTube accounts to Influencr. We do not collect or store creator-side OAuth tokens or first-party developer-API data for these platforms. Any TikTok or YouTube information we hold about a creator comes only from what the creator enters themselves and from public profile information, in the same way described in §3B.
The Service uses AI to score creator–brand matches, check content against campaign briefs, and surface review notes. These outputs are recommendations only: a person (the brand owner) reviews and decides every campaign action that affects a creator. We do not make solely-automated decisions with legal or similarly significant effects on data subjects within the meaning of UK GDPR Article 22.
When you upload personal data of third parties through the Service (e.g. an employee contact in a brief, audience demographics, a creator's personal details you have permission to share with us) we process it on your behalf as a processor under UK GDPR Article 28. We will:
Brand customers operating in regulated sectors should email dpo@influencr.co.uk for our Data Processing Addendum.
We use the following sub-processors. Each is bound by a written agreement that requires equivalent or stronger data-protection obligations than this policy. See section 7 for the specific transfer mechanism that applies to each.
| Sub-processor | Purpose | Location |
|---|---|---|
| Clerk.com Inc. | Authentication, user account storage, transactional email delivery. | United States |
| Amazon Web Services EMEA SARL (acting through AWS Europe London region) | Application hosting, database, file storage, logs, monitoring. | United Kingdom (eu-west-2) |
| Vercel Inc. | Hosting and CDN for the website front-end. | United States (CDN edge globally) |
| Anthropic PBC | Claude language and vision models used inside the Service for matching, brief compliance and review notes. Anthropic does not use API content to train models per their Commercial Terms. | United States |
| Functional Software, Inc. (Sentry) | Application error monitoring and performance traces. We send error stack traces, the URL where the error occurred, browser metadata, and (for signed-in sessions) the Clerk user identifier so we can attribute issues to a session. Source code, passwords and form-field values are masked client-side before transmission. | European Union (de.sentry.io) |
| Paddle.com Market Limited | Merchant of record for paid subscriptions. Handles checkout, payment-method storage, invoicing, VAT collection, refunds and chargeback handling. We do not store your card or bank details ourselves — Paddle issues an opaque customer reference we use to read subscription status. Paddle engages its own sub-processors (payment-card networks, acquiring banks, fraud-screening services) bound by its own data-processing terms. Paddle's full privacy notice is at paddle.com/legal/privacy and you can contact Paddle directly at privacy@paddle.com for any data-rights request relating to payment data. (This processor is in scope from the point we open paid plans; until then no data is sent.) | United Kingdom, United States, Ireland and Canada (Paddle group entities) |
We will update this list at least 14 days before adding or replacing any sub-processor. Material additions on the near roadmap (PostHog for product analytics) will appear here before they are wired.
Where personal data is transferred outside the UK to a country without UK adequacy regs, we rely on the following safeguards on a per-recipient basis:
Copies of these safeguards are available on request from dpo@influencr.co.uk.
| Data | Retention | Why |
|---|---|---|
| Account and profile data | Active period + 12 months. | To allow account recovery and to satisfy legal-hold or audit requests over the limitation period for civil claims. |
| Server logs | Up to 90 days. | To investigate security incidents and resolve service issues. |
| Content submissions (uploads, drafts, posted-URL records) | Active period + 6 years from completion of the campaign that contained them, or account deletion plus the counterparty's retention need (whichever is later). | The other party (brand or creator) retains a record of the work that was performed under their direction, plus statutory retention for evidence of contractual performance. |
| OAuth tokens (YouTube, Instagram, TikTok) | Until you disconnect the platform OR delete your account. Revoked tokens kept for up to 90 days for audit purposes, then purged. | To call the social platforms' APIs on your behalf for the features you have enabled. Tokens are encrypted at rest with AES-256-GCM. |
| Audit log entries | Indefinite (append-only). | Append-only forensic + compliance trail recording who changed what and when. Includes the record of any account-deletion action you took, so we can demonstrate we honoured it. |
| Transactional records (subscription invoices, refunds — if/when paid) | 6 years (HMRC) — held by Paddle as merchant of record. | UK Companies Act 2006 + HMRC tax-record requirements. Paddle, our merchant of record, is the primary holder of payment records; we hold a non-PII reference (Paddle customer + subscription IDs) to look them up. |
Under the UK GDPR you have the following rights:
To exercise any right, email dpo@influencr.co.uk. We will respond within one calendar month, extendable by two months for complex requests with explanation.
If you are unhappy with our handling of your data you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk or 0303 123 1113. If you are based outside the UK, you may also complain to your local supervisory authority.
We use only strictly-necessary cookies. They are exempt from consent under regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 because they are essential to delivering a service you have actively requested. We do not use cookies for analytics, advertising or cross-site tracking. If we add any non-essential cookies in future, we will ask for your consent first.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
__session | Clerk | Authenticated session. | Session. |
__client_uat | Clerk | Tracks user-active state across tabs for session refresh. | 1 year. |
__clerk_db_jwt | Clerk | Server-side session validation. | Session. |
We use industry-standard measures to protect personal data — TLS encryption in transit, encryption at rest on our database and file storage, scoped access controls, audit logging, and rate-limiting + a web application firewall in front of the API. No system can be guaranteed perfectly secure; if a breach occurs that poses a risk to you, we will notify you and the ICO within the timeframes required by UK GDPR Article 33/34.
The Service is intended for use by people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.
Each of the Meta permissions enumerated in §3B and §3C carries an allowed-usage clause that also permits us to “request analytics insights to improve [the] app and for marketing or advertising purposes, through the use of aggregated and de-identified or anonymized information.” Influencr explicitly declines that right. We do not use audience or insights data — aggregated, de-identified, anonymised or otherwise — for marketing, advertising, product analytics or any purpose outside the platform features described in §3B and §3C. Demographic and engagement data is used solely to power our brand–creator matching feature and to surface reports to brands you have collaborated with. We declare this here so the practice is on the record.
We may update this policy as the Service evolves. We will note the “Last updated” date at the top, and material changes will be communicated by email to registered users at least 14 days before they take effect.
Draft notice: This Privacy Policy has been prepared as best-practice boilerplate, cross-referenced against ICO guidance current at the date above. It is not a substitute for legal advice. We will have this document reviewed by a UK-qualified solicitor before opening the Service to public sign-up or accepting payment.