Privacy policy

1. Who we are

Flendy is a creator marketing platform run by [Flendy legal entity name] (“Flendy”, “we”, “us”). We decide how and why the personal data described here is used, so we’re its data controller under the Nigeria Data Protection Act 2023 (NDPA), and, for people in the European Union or the United Kingdom, under the GDPR and UK GDPR.

Company

[Flendy legal entity name]

RC number

[RC number]

Registered address

[registered address]

Data protection officer

[DPO name], privacy@flendy.co

NDPC registration

[NDPC registration number]

This policy covers flendy.co (the website, the brand app, the creator app at flendy.co/creator, spotter links, share and approval links) and the Flendy app for iPhone and Android. When a brand uploads its own list of creators or customers, we use it on that brand’s instructions as described below.

2. What we collect

What we hold depends on how you meet Flendy.

Brands, agencies and their teams

• Account: name, work email, phone (if you add it), photo from Google if you sign in with Google, your role, and the brands you can reach.
• Company: brand name, website, logo, industry, CAC number for verification, and what we read from your public website and Instagram to set up your brand.
• Billing: legal name, address, tax ID, VAT status, billing contacts, purchase order details, top-ups, invoices and wallet history. For a bank withdrawal from your wallet, the receiving account number (stored encrypted).
• Campaigns: briefs, products, budgets, approvals, offers, messages with creators, feedback on deliveries, reviews and private notes about creators.
• We never see full card numbers: card payments happen on Paystack’s page.

Creators and clippers

• Account and profile: name, email, phone (if you add it), photo, handle, bio, city, languages, niches, your rates, referral code, and your Flendy score and tier.
• Connected social accounts (TikTok, Instagram, YouTube, only if you connect them): your account id, handle, display name, photo and follower count, and for each of your posts the link, caption, thumbnail, length and the view, like, comment and share counts the platform gives us. We store the access tokens encrypted. We ask only for read access: TikTok user.info.basic, user.info.stats, video.list; Instagram instagram_business_basic, instagram_business_manage_insights; YouTube youtube.readonly. We never post for you, and we don’t collect your followers’ personal data.
• Work: campaigns you join, applications, offers, deals, deliveries (files, links and captions you send), messages, disputes and reviews.
• Shipping: for product deals, the name, phone and delivery address you give us. The brand sending the product sees them.
• Money: earnings, holds, withdrawals and their bank references; your bank name, account name and account number (the number is stored encrypted and only our finance team can reveal it).
• Identity check: before your total withdrawals pass ₦50,000 we check your identity, either by matching the name on your bank account or with your BVN through Paystack. We keep the result and the last 4 digits only, never your full BVN. We don’t take selfies or biometric data.
• Fraud signals: view patterns over time, engagement rates, a fingerprint of the video file to spot the same clip posted from other accounts, account age, and public view counts read for comparison.

Spotters

• Name, phone, email, city, your bank details for payment (account number stored encrypted), the creators you add and what you earn.

Creators who aren’t on Flendy yet

• From public pages: name, handle, bio, profile photo, link in bio, follower and following counts, post counts, whether the account is a business or verified, its category and country, and your recent public posts (captions, tags, mentions, hashtags, like, comment and view counts and paid-partnership labels). We keep a history of these numbers to see what changed.
• What we work out from them: likely niches, content style, languages, city, how likely you are to be based in Nigeria, brand safety and past brand deals.
• Contact details: a business email or phone shown publicly in your bio, or details a spotter added with your agreement, or that a brand already holds and shared with us. Each one records where it came from and whether you agreed to be contacted. These are visible to Flendy staff only, never to brands.
• Outreach: the messages we send you and whether you opened, replied, or asked us to stop.

Visitors and people who open a link

• Everyone: the cookies in our cookie policy, and standard server logs (IP address, browser, pages, time) kept by our host for security.
• Affiliate links: when you click a creator’s link we record a scrambled (hashed) version of your IP address, your browser type and the page you came from, so a sale can be credited to them.
• Recruitment ads: if you sign up from one of our ads, the campaign tags, the ad click id and your browser type.
• Share and approval links: the name or email you enter, when you viewed or approved, and a scrambled version of your IP address.
• Waitlist and emails: your email, and whether our emails were delivered, opened or clicked.

The Flendy app

• Everything in the creator section above, plus your device’s push notification token, the platform, app version and device model, so we can send notifications.
• If you sign in with Apple, a token from Apple, stored encrypted, used only to cancel Flendy’s access to your Apple ID when you delete your account.
• Photos and videos only when you pick them to send to a brand. The app doesn’t read your location, contacts or other files, and has no advertising or analytics trackers.

We don’t ask for sensitive personal data such as health, religion, ethnicity, political views or biometrics. Content niches such as “faith” or “fitness” describe what someone posts about, not who they are, and are never used to infer sensitive characteristics.

3. Where it comes from

• You, when you sign up, fill in your profile, run or join campaigns, message, or contact us.
• Sign-in providers (Google, Apple): your name, email and photo, if you choose to sign in with them.
• Social platforms (TikTok, Instagram, YouTube), when you connect an account.
• Public profiles, read by our crawler (through Apify), the YouTube Data API, Instagram’s Business Discovery and, where available, TikTok and data-provider search tools.
• Spotters, who suggest creators and may add contact details the creator agreed to share.
• Brands, who may import a list of creators they already work with.
• Paystack, for payment confirmations, bank account names and identity check results.
• Our email and WhatsApp providers, for delivery, bounce and reply events.

4. Why we use it and our lawful basis

We only use personal data where the law gives us a basis (NDPA section 25; GDPR article 6).

Where we rely on consent, you can withdraw it at any time; that doesn’t affect what we did before.

5. Indexing public creator profiles

Flendy keeps an index of Nigerian creators so brands can find people to pay, and so creators can be offered paid work. Some of these creators haven’t signed up yet. We think this is a fair, legitimate interest, for these reasons:

• Only public, professional information. We read pages the creator has chosen to make public, for the purpose they made them public: being discovered and doing brand work. We don’t read private accounts or private messages.
• Limited and labelled. Brands see public stats labelled as public, not verified. A creator’s phone, WhatsApp and email are never shown to brands until the creator has joined Flendy and is in a deal with them.
• Benefit to the creator. The point is paid work. Creators can claim their profile, correct it, or have it removed.
• Careful contact. WhatsApp messages only go to numbers the creator agreed to share. Email only goes to public business emails or addresses shared with agreement. Every message says who we are and why we’re in touch, and has a remove-me link. Instagram and TikTok messages are sent by a person, never by software.
• Kept accurate. We refresh profiles on a schedule, so numbers stay current and pages that go private or disappear are marked that way.

To object or be removed: use the remove-me link in any message from us, email privacy@flendy.co, or reply “STOP” to a WhatsApp message. Removal deletes your contact details and the stats history we hold, takes you out of search and brand lists, and keeps only your handle on a do-not-add list so you aren’t added again.

6. AI and automated decisions

We use software, including AI models, to help with:

• drafting campaign briefs from what a brand types, and setting up a brand from its website;
• classifying public creator profiles (niche, language, city, brand safety);
• ranking creators in search and applicants for a brand, by expected cost per 1,000 verified views, reliability and fit;
• checking whether a creator meets a campaign’s qualifications, and whether a spotter’s suggestion is valid;
• scoring posts for signs of fake views.

None of these makes a decision with legal or similarly significant effect on you by itself. A brand decides whom to work with; a brand’s auto-accept rules can only accept, never reject; a post flagged for fraud stops earning until a person reviews it; spotter decisions can be overridden by a person. You can ask a person to look again at any of them by emailing privacy@flendy.co.

The text we send to AI providers (OpenAI, Google and Anthropic) is the minimum needed for the task, such as a brief or a public bio and captions. We use their business APIs, whose terms don’t allow them to train their models on it.

7. Who we share it with

People on Flendy

• Brands see a creator’s public profile, handle, stats, rates, campaign posts and their numbers, and, once in a deal, messages and (for product deals) the shipping details.
• Creators see the brand’s name, brief, offers and messages from its team.
• Report links show campaign results, including creators’ handles and posts, to the people the brand shares them with.

Service providers

These companies process data for us, under contracts that limit them to our instructions:

If we turn on another provider (for example a creator data provider), we’ll add it here first.

Flendy’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is used only to show and verify your channel and video stats; the YouTube Terms of Service and Google Privacy Policy also apply, and you can remove Flendy’s access at myaccount.google.com/permissions.

Others

• Authorities, such as the NDPC, courts, police or tax authority, when the law requires it.
• Professional advisers (lawyers, auditors, accountants) under confidentiality.
• A buyer or investor if Flendy is sold or merged, under this policy.

We don’t sell personal data, and we don’t share it with advertisers or data brokers.

8. International transfers

Some providers above store or process data outside Nigeria, mainly in the United States and the European Union. When data leaves Nigeria we rely on the safeguards the NDPA and the NDPC’s General Application and Implementation Directive (GAID) 2025 allow: transfers to countries with adequate protection, contractual clauses that bind the recipient to equivalent protection, and, where those aren’t available, your consent or the transfer being needed for our contract with you. For people in the EU and UK we use the European Commission’s standard contractual clauses and the UK addendum. Ask privacy@flendy.co for a copy of the safeguards.

9. How long we keep it

We may keep data longer if the law requires it, or to deal with a dispute, fraud or legal claim.

10. How we protect it

• Everything is sent over HTTPS. Social account tokens and bank account numbers are encrypted (AES-256-GCM) before they’re stored.
• Access is checked on every request: brands only see their own brands, creators only their own data. Only named staff with the right role can see contact details or reveal bank numbers, and every reveal is logged.
• Sign-in attempts, searches and links are rate-limited. Webhooks from payment and messaging providers are signature-checked.
• We never store full BVNs, card numbers or your social media passwords.
• If a personal data breach is likely to put you at risk, we’ll tell the NDPC within 72 hours and tell you without undue delay.

11. Your rights

Under the NDPA (and the GDPR and UK GDPR where they apply) you can:

• Access: get a copy of the data we hold about you.
• Correct anything that’s wrong. Most of it you can edit yourself in your profile or settings.
• Delete your data, subject to what we must keep by law.
• Portability: get your data in a machine-readable format (JSON, with a spreadsheet (CSV) copy of each section).
• Object to processing based on legitimate interests, including indexing and outreach, and to direct marketing at any time.
• Restrict processing while a complaint is checked.
• Withdraw consent where we rely on it, for example for WhatsApp messages.
• Ask a person to review an automated decision.

How to use them

• In the app or on the web: creators use Settings › Privacy in the app, or Profile on flendy.co/creator; brands use Settings › Account on flendy.co. Choose “Download my data” or “Delete my account”. See deleting your account.
• By email: privacy@flendy.co, from the address on your account if you have one.
• Not on Flendy? Use the remove-me link in any message from us, or email privacy@flendy.co with your handle.

We’ll reply within 30 days (and tell you if we need longer for a complex request). We may ask you to confirm your identity first. It’s free unless a request is clearly excessive.

12. Emails, WhatsApp and notifications

• Account and payment messages (offers, approvals, money on its way, security) are part of the service. You can choose how you get most of them in notification settings.
• Every marketing or outreach email has an unsubscribe link. Reply STOP to any WhatsApp message to stop all WhatsApp from us.
• Push notifications can be turned off in the app or your phone’s settings.

13. Children

Flendy is for people aged 18 and over. We don’t knowingly accept creators, spotters or users under 18, and if we learn that a creator in our index is under 18, we remove them. If you think we hold data about a child, email privacy@flendy.co and we’ll delete it.

14. Cookies

We use a small number of first-party cookies to keep you signed in, remember your choices and credit referrals. No advertising or analytics cookies. The full list is in our cookie policy.

15. If you're in California or elsewhere in the US

The categories of personal information we collect, the sources and the purposes are described above. We don’t sell or “share” personal information for cross-context behavioural advertising, and we don’t use sensitive personal information to infer characteristics. You have the right to know, access, correct and delete your personal information, and we won’t treat you differently for using these rights. Use the routes in “Your rights” above.

16. Changes to this policy

We’ll update this page when what we do changes, and change the date at the top. For important changes we’ll tell you by email or in the app before they apply.

17. Contact and complaints

Our data protection officer is [DPO name]: privacy@flendy.co, or write to [Flendy legal entity name], [registered address]. For anything else, hello@flendy.co.

If you’re not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng). In the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the data protection authority where you live.