Legal

Privacy Policy

Last updated October 12, 2026

This is a draft under legal review and may change. Questions: support@collabs.so.

Who we are

Collabs (“Collabs”, “we”, “us”) runs collabs.so and app.collabs.so (the “Service”). The Service helps subscription brands run creator programs: brands invite creators to campaigns, creators upload videos, brands review and approve them, launch them as ads on Meta, and see which creators brought in subscribers.

This policy explains what personal information we collect, how we use it, and the choices you have. It covers brands and their team members, creators, visitors to our websites, and the shoppers whose orders brands share with us.

Our role for brand customer data

When a brand connects its Shopify store, we process information about the brand’s own shoppers (for example, the orders and subscriptions they place). For that information, the brand decides why and how it is used, and we act as the brand’s service provider (a “processor” under laws like the GDPR). We use it only to provide the Service to that brand. Shoppers who want to use their privacy rights should contact the brand directly; we will help the brand respond.

For everything else in this policy (accounts, creator profiles, website visitors) Collabs decides how the information is used and is responsible for it.

Information we collect

Information you give us

• Account details: name, email address, password (stored only in hashed form), company name, role, and team members you invite.
• Creator profile: name, social media handles, audience size, niche, location, and anything else you add to your profile.
• Content: videos you upload, captions, comments and timestamped review notes, approvals, and messages exchanged in the Service.
• Agreements: the campaign terms you accept, with the date, time and account that accepted them.
• Payout and tax details (when payouts launch): collected and stored by our payment provider. We keep only what we need to show payout status and meet tax obligations.
• Support: what you send us when you contact us.

Information from services you connect

• Meta (Facebook and Instagram): when a brand connects Meta, we receive an access token and the ad account, Page and ad set IDs the brand chooses. We use them to create ads from approved videos and to read each ad’s status and spend. We do not read your personal Facebook profile, friends or messages.
• Shopify: when a brand connects its store, we receive order and customer information, including order number, date, products, subscription status, amounts, discounts, refunds, the customer’s name and email, and the landing page and tracking parameters (such as UTM tags and Meta ad IDs) attached to the order. We use this to match new subscribers to the creator video that brought them in, and to credit renewals to that same creator.

Information collected automatically

• Usage and device data: IP address, browser and device type, pages viewed, and actions taken in the Service, recorded in server logs.
• Cookies and local storage: used to keep you signed in and remember settings such as dark mode. See our Cookie Policy.

How we use information

• Provide the Service: create accounts, run campaigns, host and stream videos, record approvals, launch ads, and show results.
• Attribute subscribers and renewals to creators, and send unclear orders to a review list instead of guessing.
• Calculate creator credits and, once launched, commissions and payouts.
• Send service emails such as invites, review requests, approvals and account notices.
• Keep the Service secure, prevent fraud and abuse, and fix problems.
• Understand how the Service is used so we can improve it.
• Meet legal obligations and enforce our Terms of Service.

We do not use shopper data from a brand’s store for any other brand, and we do not use it to build advertising profiles.

Meta Platform Data

Information we receive from Meta’s APIs (“Platform Data”) is used only to provide the features the brand asked for: creating ads from approved creator videos in the brand’s ad account, and showing each ad’s status and spend inside Collabs.

• We do not sell, license or buy Platform Data.
• We do not use Platform Data for advertising targeting, profiling, or eligibility decisions about people.
• We share Platform Data only with service providers that help us run the Service, under confidentiality obligations.
• Brands can disconnect Meta at any time in Collabs or in their Facebook Business settings.
• Anyone can ask us to delete their Platform Data. See Data Deletion or email support@collabs.so.

Shopify data

We access a brand’s Shopify data only after the brand installs our app, and only with the permissions shown during install. When a brand uninstalls the app, we stop collecting its data and delete it as described under How long we keep information. When Shopify tells us a shopper has asked for their data or for it to be deleted, we respond to the brand within the time Shopify requires.

How we share information

• Between brands and creators: a creator’s profile, videos and results are visible to the brands whose campaigns they join. A brand’s campaign details, comments and approvals are visible to its invited creators. Creators see counts of the subscribers and renewals they drove; they do not see shoppers’ names or contact details.
• Service providers: companies that host our servers and files, stream video (Mux), send email, process payments, and provide support tools. They may use the information only to provide services to us.
• Connected platforms: when a brand launches ads, approved videos and ad settings are sent to Meta. Meta’s own policies apply to what it does with them.
• Legal and safety: when required by law, or to protect the rights, safety or property of Collabs, our users or others.
• Business transfers: if Collabs is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

How long we keep information

• Account and creator profile data: while the account is open, then deleted within 30 days of closing, except what we must keep for legal, tax or dispute reasons.
• Videos: while the campaign is active and for as long as the brand’s license to them lasts under the Creator Agreement, then deleted from our storage. Copies a brand has already sent to Meta are controlled by the brand and Meta.
• Shopify order data: while the brand’s store is connected and credits or commissions may still be owed on those orders. If the brand uninstalls our app, we delete its store data within 30 days, except attribution records we must keep to settle amounts owed to creators.
• Meta tokens and IDs: deleted within 30 days of a brand disconnecting Meta.
• Server logs: up to 12 months.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict some uses, and to withdraw consent. Residents of California and other US states with privacy laws have these rights too, and we will not treat you differently for using them.

You can update most account information in the Service. For anything else, email support@collabs.so from the address on your account. We will confirm your identity before acting, and reply within the time the law requires (usually 30 to 45 days). You may use an authorized agent; we may ask them for proof. If you are in the EU or UK, you may also complain to your local data protection authority.

If you are a shopper of a brand that uses Collabs, please contact that brand first. We act on the brand’s instructions for your information.

Security

We protect information with encryption in transit, hashed passwords, access controls limited to staff who need it, and access tokens stored encrypted. No system is perfectly secure; if we learn of a breach that affects you, we will notify you and the authorities as the law requires.

International transfers

Collabs is based in the United States and stores information there. If you use the Service from another country, your information will be transferred to the US. Where the law requires, we use safeguards such as the European Commission’s Standard Contractual Clauses.

Children

The Service is not for children. You must be at least 18 years old (or the age of majority where you live) to create an account. If we learn we have collected information from a child, we will delete it.

Changes to this policy

We may update this policy. We will change the “Last updated” date above, and for significant changes we will notify account holders by email or in the Service before the change takes effect.

Contact us

Email support@collabs.so with any question or request about privacy.