Privacy policy

This policy explains what data WantedCreator processes, why, for how long and how to exercise your rights. WantedCreator is built to collect the minimum: no ads targeted on your profile, no third-party trackers or analytics tools. The only statistics are the internal ones described below (views and clicks shown to creators, campaign delivery, suggestions).

1. Data controller

Nureki, [legal form, address, company number]. Contact: [email protected].

2. Data we process

• Account: email address, display name, password (stored only as an Argon2id hash), preferred language, timestamps. If you confirm your email address, the confirmation date; the link sent is only kept as a hash, for 24 hours at most, and works once.
• Creator verification (if you ask for it): your optional message, the status and dates of the request, the team's messages addressed to you (information requested, reason for a rejection or removal), the admin who decided and possible internal notes of the team, which are not shown in your space. The team reviews your public profile and the activity already visible on WantedCreator; no additional document is requested. Only the “verified” information is public.
• Creator profile and content (public by nature): handle, public name, bio, specialties, languages, availability, external links, images, creations, services, posts.
• Identities: every account has a personal profile (nickname, handle, short bio, avatar), private until you activate it, and may manage a creator space and organizations. WantedCreator records the active identity of your session and, for each organization, the accounts managing it (technical permission, public role, invitations and answers, notification preferences). The link between your account and your identities is never shown publicly; it is used internally for security and so that interactions between identities run by the same people do not count towards reputation or ranking.
• Organizations (if you create or manage one): name, handle, type, description, public images and links; the organization's official e-mail address and the date it was confirmed (single-use link stored only as a hash, 24 hours at most); optional billing details (legal name, address, VAT number); a log of sensitive actions (creation, change of owner, members, permissions, e-mail, posts, billing) with the account that made them, visible to the organization's owner and administrators.
• Interactions: follows, likes, comments, mentions and contribution credits (request, acceptance or refusal), made on behalf of an identity; the account that made them is kept internally.
• Reports: reason, details and, for logged-out visitors, the email they choose to provide.
• Security: a salted hash of the IP address, used only to limit abuse (login attempts, spam). The application does not store IP addresses in clear. The hosting provider may keep technical logs under its own terms.
• Images are re-encoded on upload and their metadata (EXIF, location) is removed.
• Viewing statistics: opens and clicks on posts, profiles and creations, clicks to a creator's shop or Discord. For members these events are linked to the account; for logged-out visitors only an anonymous fingerprint (salted hash of IP address and browser, renewed every day, no cookie) is used so a view is counted once a day. Creators only see totals, never who viewed their content.
• Recommendations (members only): your searches, the categories, profiles, creations and posts you viewed and your follows are used to suggest creators and posts on WantedCreator. You can clear this history at any time from your account settings.
• Advertising campaigns (creators): content concerned, placement, duration and dates, message and the team's decision (reason for rejection). The message and the reason are only visible to the creator and to administrators.
• Campaign delivery: to count impressions and clicks without duplicates and avoid showing the same campaign too often, WantedCreator records, for each advertising card seen or clicked, the member's ID or, for a logged-out visitor, the daily anonymous fingerprint described above. A click is remembered for 30 minutes to know whether the next visit came from that card. Creators and advertisers only see totals.
• Payments and invoicing (paid campaigns): payment happens on Stripe's secure page; WantedCreator never receives or stores your card details. WantedCreator keeps the order reference (amount, currency, status, dates, test or live mode) and the related Stripe identifiers (customer, checkout session, payment, invoice). The name, billing address and, where applicable, the VAT number you enter are stored by Stripe and appear on the invoice.
• Notifications: the notices shown in your account (for example the progress of a campaign or a payment).
• Private messaging: the content and date of your messages, the creation or service concerned, the status of the request (accepted, declined), read and archive status, the members you block and the reports you file. Only the two participants can read a conversation: the WantedCreator team has no access to it, unless a participant reports it (the last 20 messages are then attached to the report). Anti-spam protections (rate limits, detection of identical messages sent in series) are automatic and rely on a fingerprint of the messages, without human reading; messages they refuse are recorded as “detections” (type and date).
• Reputation (Wanted Stars): a public star count (Wanted Stars) is computed automatically from your activity on WantedCreator (participation, interactions given and received, regularity, seniority, compliance with the rules), with an internal daily history. The details of the computation are not published, to prevent manipulation; Wanted Stars have no legal effect and do not condition access to any service. The event badges you obtain (and the ones you choose to show) are also stored.
• Automated analysis by the platform's assistant: posts, creations, services, some comments (those with a link, a signal or a long text), reports, verification requests and external ads may be analysed automatically to help the moderation team (spam, scams, suspicious links, category classification). Simple checks are made first by the site itself; the analysis then relies on a technical artificial-intelligence provider, which only receives the useful context (the content, its category, indicators computed by the site): never your email address, password, payment data or login tokens. Private messages are never analysed, except messages attached to a report. The assistant takes no decision: it summarizes and flags, and a team member decides. If the team turns it on, content rated high risk may be hidden temporarily until that check; its author is told in their space. Activity indicators (pace of comments, likes, follows) are also computed to spot automated behavior.
• Advanced creator statistics (offer for creators): post impressions (once per person and per day), profile visits, contact opens, clicks from search. A visit, follow or contact is only linked to a post when the same person opened it in the previous 30 minutes. When you visit a profile while logged in, that creator may see, for 30 days, this visit and its approximate date, according to your choice in your settings (“Visibility when I visit profiles”): identity visible, limited information (“Platform user”, the default) or private browsing (“Anonymous visitor”). They never see your other pages or actions. Creators who have access can also get briefs, reports and analyses of their own activity, and chat with the assistant, which only uses their own data and anonymized averages.

3. Purposes and legal bases

• Providing the service (account, identities and organizations, profile, publishing, follows, private messaging): performance of the contract (terms of use).
• Security, abuse prevention and moderation: legitimate interest and legal obligations of hosting providers.
• Statistics provided to creators and personalized suggestions on the platform: legitimate interest (you can object by clearing your history or writing to us).
• Community reputation (Wanted Stars) and abuse detection (spam, fake accounts, artificial interactions): legitimate interest.
• Moderation help by the assistant (automated analysis, human decision): legitimate interest and legal obligations of hosting providers.
• Advanced statistics, briefs and analyses of the creator offer: performance of the contract for the creator who has it; for visitors, legitimate interest, with the choice of how their visits are shown.
• Advertising campaigns, payment and invoices: performance of the contract; keeping accounting records: legal obligation.
• Measuring campaign delivery (impressions, clicks, repetition limit): legitimate interest.
• Confirming your email address and verifying a creator profile, at your request: performance of the contract.
• Answering your requests and the authorities: legal obligations.

4. Cookies

WantedCreator only uses strictly necessary cookies: fc_session (keeps you logged in) and NEXT_LOCALE (your language). They do not require prior consent. No advertising or analytics cookies are used. The payment page is hosted by Stripe (checkout.stripe.com), which applies its own cookie policy there.

5. Recipients

Data is never sold or rented. It is accessible to the WantedCreator team as needed and to our technical processors: hosting [provider name and country], image storage [provider name and country], email sending (address confirmation, verification decisions) [email provider name and country], automated analysis by the assistant [artificial-intelligence provider name and country, and safeguards for transfers outside the EU], payments and invoices: Stripe (Stripe privacy policy), which also acts as a controller for some purposes such as fraud prevention and its regulatory obligations. Public content is visible to all visitors. Private messages are only visible to the two participants (and, for messages attached to a report, to the moderation team). For an organization, its managers have access according to their permissions (messages, statistics, invoices, log); an organization's official e-mail is only visible to its managers.

6. Retention

• Account and content, including the history of campaigns, notifications, reputation history, Wanted Stars and badges: as long as the account exists. Deleting the account immediately erases the account, profile, content, interactions, campaigns, reputation and images.
• Orders and invoicing references (paid campaigns): kept after the account is deleted, for accounting obligations, for [legal retention period of accounting records to be confirmed]. The invoices themselves are kept by Stripe.
• Campaign delivery data (impressions and clicks per visitor): 180 days, like viewing events.
• Verification requests and their history: as long as the creator profile exists; they are erased with it (or with the account).
• Private messages: as long as the account exists. Deleting your account erases your messages; the other participant keeps their own and sees “Deleted account”. A conversation whose two participants have deleted their accounts is erased. Messages attached to a report are kept with the report (see below).
• Organizations: as long as the organization exists. An account that owns organizations can only be deleted after transferring or deleting them. When a manager deletes their account, what they published on behalf of the organization stays with it and the log shows “Deleted account”. Accepted contribution credits stay visible as long as the post exists, even after the creator leaves the team.
• Assistant analyses and the log of its calls: 180 days, except those of an item still awaiting a decision; briefs, reports and conversations with the assistant: as long as the account exists (a conversation can be deleted at any time); a visitor's identity in the recent visitors list: 30 days.
• Sessions: expire after 30 days of inactivity.
• Rate-limiting data: a few minutes to 48 hours.
• Viewing events (statistics, recommendations): 180 days, then deleted; only aggregate counters (number of views, clicks) remain, which cannot identify anyone.
• Reports and moderation log: [period to be set, e.g. 12 months], to handle appeals and answer the authorities.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. From your account settings you can edit your information, download your data as JSON and delete your account. For anything else: [email protected]. You may also lodge a complaint with your data protection authority (in France, the CNIL).

8. Minimum age

You must be at least 15 years old to create an account.

9. External links

Links added by creators lead to third-party websites with their own policies. A warning screen is shown before you leave WantedCreator.