Privacy Notice

The controller for the processing described here is Gustav Bode, 58, Triq Patri Indri Vella, PBK 1314 Pembroke, Malta. See our Impressum. Contact for data-protection matters: mgmt.nakama@gmail.com.

• Account: email address, member number (the number on your card, which our team can find your account by), role, rank and XP.
• Profile: display name, optional bio, optional pronouns (only if you pick them; only you and our team see them), avatar, and TikTok / YouTube handles typed into an earlier version of the profile form, which we no longer use and are deleting.
• Discord handle (optional): if you enter it, we use it to recognise you in our Discord server. Only our team can see it, and you can remove it in your profile at any time.
• Sign-in with Google (optional): if you choose “Continue with Google”, Google confirms your email address to us. Our login provider stores your Google account ID and the name and profile picture on your Google account. We use them to sign you in. When your account is created this way, your Google name becomes your starting display name, which you can change. To protect accounts, we block a Google sign-in that would be attached to an existing account without being asked for. We then remove it (if that fails, we strip its profile data and alert our team) and keep only its ID on record, so it can’t be attached again.
• Connected accounts (optional): if you link your TikTok or YouTube account via their login (up to 3 per platform), we store the platform's account/channel ID, your public handle and avatar, encrypted read-only access tokens, and a cached copy of the account's public stats (follower or subscriber, like and video counts; no subscriber count if your channel hides it) and recent public videos with their view counts (for YouTube we refresh these by your channel ID, also after the access you gave us has expired). For TikTok and YouTube we keep copies of those videos’ cover images and, for accounts you show, of the account’s profile picture (your TikTok picture or your YouTube channel picture) in our own file storage, so they keep showing. Like the videos themselves, these images can be opened by anyone who has their exact link. If you haven't uploaded a profile photo of your own, we show your TikTok profile picture as your profile photo (from your Main account if it is a TikTok account, else your oldest visible one; never a hidden account). Our team, campaign owners and the other creators on your campaigns see it next to your name. Uploading your own photo replaces it, and you can switch it off under Edit profile at any time. Hiding an account deletes our copy of its picture. We use this data to verify the account is yours, to show campaign owners your public track record on your platform profile, and to show the view counts of your approved posts to the other creators on the same campaign. For each approved post made with an account you show, we also pull its public numbers (views, likes, comments, and shares on TikTok) from that account once a day for 30 days after approval: our team sees them in the campaign's results and its CSV export, on a promoter's campaign that promoter and the other promoters on their team see them, with any view count our team records by hand, once the post is approved, and you see your own under your posts. You can hide any account's stats in your profile at any time; hidden accounts remain pure ownership proof. We never post on your behalf. Disconnecting or deleting your account removes these records and the stored covers and picture. A connection is removed automatically once neither it nor your account has been used for 180 days.
• Discord link (optional): if you link your Discord account to get the Clicked Creator role on our server, we store your Discord account ID and name, when you linked it, and the access Discord gives us for this one purpose (encrypted). We tell Discord only that you are a creator on Clicked and the follower size class of the biggest TikTok account you show on your profile (under 10K, 10K to 50K, 50K to 250K, 250K to 1M, or 1M and more; never the exact number), and we check that follower count once a day while Discord is linked. Nothing else about you goes to Discord; Discord then gives you the matching roles, which members of our server can see, and shows Clicked as a connection on your Discord profile. Unlinking or deleting your account removes these records, and we tell Discord to take the roles back (you can also remove Clicked under Authorized Apps in your Discord settings).
• Date of birth: collected at onboarding. We need it to (a) confirm you meet the minimum age of 13, (b) determine whether payout details may be held in your own name, and (c) check whether you are old enough for paid campaigns, if the team has set a higher minimum age for them. Under 18, payout details may not be in your name: a parent or guardian represents you in the contract and receives any payout (see section 7). We store the date, not a copy of any ID document.
• Payout & tax (creators, 18+ only): legal name, address, country, payment method and payment details (IBAN / PayPal or Wise email), tax ID and tax status. Provided by you during onboarding so we can pay you. We do not collect these from anyone under 18. For creators under 18, a parent or guardian provides what is needed (see section 7).
• Activity: campaign ideas, votes, predictions, claimed slots, pre-save applications, booking invites and your answers to them (including any decline reason and note you give), uploaded video links, the account each submitted video was posted from (as TikTok or YouTube report it, to check it is one of your connected accounts), a copy of each submitted video’s preview image, the note you add for the reviewer (and the caption or hook text of older posts), the note the team writes when it rejects a post, the appeal you file against a rejection (the checklist point you name and your explanation), performance metrics, and favorite picks of your posts. The preview images can be opened by anyone who has their exact link. Deleting your account removes them.
• Messages with our team: what you write to us in Messages, and what the team writes to you. The team can also start a conversation with you. Everyone on the Clicked team can read these messages, and we keep them on record while your account exists. They are included in your data export. If your account is deleted, the text of every message in your conversations is erased.
• Other messages and notifications: questions you ask on a campaign (other creators in that campaign and our team see them with your display name), your in-app notifications, and your push-notification subscription if you turn push on.
• Your price: the price per post and the bundles you set in your profile, and your price changes from the last 90 days (used for the limit on raising your price). Our team sees them when booking you; if a promoter invited you, that promoter and their team see your price per post to book you on their campaigns, and so do promoters outside your team if you switch on “Open to other promoters” (below). They’re deleted with your account.
• Open to other promoters: if you switch this on in your profile, promoters outside your team can find you and book you on their campaigns. To find you, they see your display name, your price per post, which platforms you linked, your on-time streak and how many of your posts were approved; once they book you, they see what the promoter of a campaign sees (below). We store when you switched it on. Switching it off hides you again; invites and bookings you already have stay. If you are under 18, you can switch it on only after your parent or guardian agreed to promoter campaigns. It’s in your data export and is deleted with your account.
• Applications: if you apply on our apply page, we store your answers (name or handle, email, date of birth, profile and post links, Discord handle, niche, price, bundles and your sentence) and check your profile link with TikTok or YouTube (for YouTube we also store the follower count it reports). Only our owners see the application. If you join through the link we send you, we copy your date of birth, price, bundles and Discord handle into your account. We delete applications 30 days after we decide, or after 60 days if we haven’t decided.
• Invite links: a personal invite link stores the email it is bound to and, when our team or a promoter makes a link for someone they found, that person’s handle and a short label. Links nobody used are deleted after 30 days; the email and handle on used links are removed after 90 days. We keep a note of who made the link you joined with. If that was a promoter (someone our team allowed to invite their own creators), that promoter and the other promoters on their team (a team has at most 10) can see your display name, the day you joined, whether your profile is set up, your own price per post and which platforms you linked (so they can book you on their campaigns), your on-time streak, how many of your posts were approved and the thumbs their team gave you after its campaigns, and nothing else about you. Our team can see who invited you.
• Booking terms: if the team sets a per-post rate for you, we store it (visible only to campaign owners) and use it as the default for offers you receive. It’s deleted with your account.
• Team shortlists: our team can keep private favourites and lists of creators while they decide whom to book. Only team members see the lists themselves. Your data export shows only how many of them you are on, and they are deleted with your account.
• Gamification & payments: XP events, rank transitions, badges, and credit notes (Gutschriften) with the amounts paid.
• Thumbs: after a campaign ends, the side that ran it (our team, or the promoter of a promoter’s campaign) may give you a thumb up or down for it. Thumbs are private: other creators and the public never see them; our team sees them, a promoter only the thumbs their own team gave. They never change your pay or your rank. We use them to book reliable creators (our legitimate interest, Art. 6(1)(f)); they are in your data export and are deleted with your account.
• Paid status on promoter campaigns: on a promoter’s campaign the promoter pays you directly. When they mark a payment to you as paid, we store the amount and the number of posts it covered, when they marked it, and your answer (it arrived, or it did not). The promoter’s team sees your answer; our team sees the marks and answers so we can help if a payment goes missing. It never changes what you are owed. We use it to run the campaign you joined (Art. 6(1)(b)); it’s in your data export and is deleted with your account.
• Security logs: an audit trail of privileged actions (identifiers and categories only, no sensitive payout details).
• Fraud-prevention signals: when you submit a video, we record your IP address and browser identifier (user-agent), and we store a one-way cryptographic hash of your payout details. These let us detect duplicate accounts and coordinated abuse. We do not build advertising or behavioural profiles from them. Access requests made before Clicked became invite-only carry the same signals until their scheduled deletion (see section 5).
• Promoter enquiries: the public enquiry form is closed. Enquiries sent before that are kept until their retention period ends (section 5), and then their personal data is deleted.

• To run campaigns and pay you: performance of our contract with you (Art. 6(1)(b) GDPR).
• To review your application: steps you asked us to take before a possible contract (Art. 6(1)(b)).
• To keep credit notes / tax records: compliance with a legal obligation (Art. 6(1)(c); German §147 AO / §14b UStG retention).
• To rank submissions, prevent fraud, and secure the service: our legitimate interests in a working, abuse-free platform (Art. 6(1)(f)). This is the basis for the fraud-prevention signals above (IP address, browser identifier, hashed payout details), which are used only to detect duplicate accounts and coordinated abuse.
• To recognise you in our Discord, if you enter your handle: our legitimate interest in running a safe community (Art. 6(1)(f)).
• To give you the Clicked Creator and follower roles on Discord, if you link your Discord account: providing the feature you ask for (Art. 6(1)(b)).
• To show your pronouns on your profile card and help our team address you the way you want, if you pick them: our legitimate interest in respectful communication with you (Art. 6(1)(f)). You can remove them at any time by choosing “Not shown”.
• To show you to promoters outside your team, if you switch on “Open to other promoters”: your consent (Art. 6(1)(a)). You can take it back at any time by switching it off.
• To handle older promoter enquiries until they are deleted: the sender asked us about a possible contract (Art. 6(1)(b)).
• For creators under 18 and their parents or guardians: see section 7.

These providers process data for us:

• Database, login and file storage: Supabase, in the EU region (Frankfurt, eu-central-1). Payout documents (credit-note PDFs and payout exports) are kept in private storage and only ever served through short-lived, signed links.
• Web server: Hetzner, in Germany. It runs the app and handles your IP address to deliver pages, but stores no database.
• Background jobs: Inngest (USA). It runs scheduled tasks such as campaign timing and data clean-up. It sees internal record IDs, not your profile or payout details.
• Email: Resend (USA). It delivers account emails such as invitations (when the person inviting you chose to send it by email) and password resets.
• Bot check: Cloudflare Turnstile, if enabled, checks that a sign-up, an application or a parent’s confirmation comes from a person. It receives your IP address and browser data.

Promoters: on a campaign run by a promoter (marked “paid by the promoter”), the promoter pays you directly, to perform your agreement with them (Art. 6(1)(b)). Once they approve a post of yours, they can open your payout details (payment method, IBAN or PayPal address, and for a bank transfer your legal name) to pay you, and may use them for nothing else. If you are under 18, they see your parent’s or guardian’s payout account instead, only if that parent agreed to it. We keep a record each time a promoter opens these details.

These services work under their own terms and privacy policies:

• Push notifications: if you turn them on, notifications travel through your browser maker’s push service (Google, Apple, Mozilla or Microsoft). The content is encrypted, so the push service cannot read it.
• Google sign-in: only if you choose “Continue with Google”.
• TikTok and YouTube (Google): when you connect an account or submit a video link, we fetch public account and video data from their services.
• Discord: our community server runs on Discord. If you link your Discord account, we send Discord that you are a creator on Clicked and your follower size class (see Discord link above); otherwise we send no personal data to Discord. Campaign announcements we post there contain no personal data.

Supabase, Hetzner, Inngest, Resend and Cloudflare work for us under a data-processing contract. Some of them are based in the USA. When data goes there, it is protected by the EU-US Data Privacy Framework if the provider is certified, and otherwise by the EU standard contract clauses.

Credit notes and the tax data they contain are kept for 10 years from the end of the year in which they were issued, to meet statutory tax-retention duties. Other personal data is kept while your account is active and then anonymised; pseudonymous business records (e.g. votes, XP) may be retained in anonymised form for platform integrity.

Messages with our team are kept while your account exists. When your account is deleted, their text is erased.

Fraud-prevention signals (IP address and browser identifier) are deleted automatically after at most 24 months, and earlier if your account is erased. Sign-up requests that are rejected or abandoned, and promoter enquiries once handled or abandoned, are anonymised after 90/180 days, including these signals.

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data (Art. 15-21 GDPR), and to lodge a complaint with a supervisory authority.

• Access & portability: export all of your data as JSON from your profile (“Privacy & your data”).
• Rectification: edit your profile and payout details at any time.
• Erasure: request deletion at mgmt.nakama@gmail.com; we anonymise your account (tax records are retained as required by law).

Creators aged 13 to 17 can take part before a parent or guardian confirms. Nothing is paid out until a parent or guardian has confirmed on Clicked. Until then, the child’s earnings are held.

This confirmation is a parent’s permission for the contract. It is not the legal basis for processing data (see below).

The child creates a confirmation link on the Payments page and sends it to their parent or guardian. The link works once and for 7 days. It shows the child’s display name and TikTok handle to whoever opens it, so the child should only send it to their parent or guardian.

What we collect

• About the parent or guardian: full name, whether they are a parent or legal guardian, whether they have sole custody or share custody and act with the other parent’s consent, a declaration that they are 18 or older and hold parental responsibility, and optionally an email address or phone number so our team can reach them.
• About the child: legal name, address and country, entered by the parent or guardian.
• Payout details: an IBAN and the exact name of the account holder, or the parent’s or guardian’s own PayPal email address. The account must be the parent’s or guardian’s. We don’t accept an account holder name that matches the child’s name, or a PayPal address that matches the child’s login email. We store the IBAN or PayPal address encrypted. We also store a one-way hash of it to spot the same account being used for several creators. If that happens, our team checks it before any payout.
• Proof of confirmation: the version of the text, a fingerprint (hash) of the exact text shown, including its language and the options chosen, the time of confirmation, and a hashed (unreadable) copy of the IP address and browser identifier (user agent) used.

You don’t have to give these details, but without them we can’t pay.

Why, and on what legal basis

• To make and carry out the contract with the child, whom the parent or guardian represents, and to pay for approved posts: Art. 6(1)(b) GDPR.
• To keep payment and tax records: compliance with a legal obligation (Art. 6(1)(c)).
• To prove that the parent or guardian confirmed, and to prevent fraud: our legitimate interests (Art. 6(1)(f)).

Who sees it

• The child sees the parent’s or guardian’s name, their relationship and the masked payout account (for example IBAN ending 1234) on the Payments page. The child’s data export also shows the account holder’s name, the custody choice, the child’s legal name, address and country as entered, and the text version and dates of the confirmation. The child never sees the full account or the parent’s contact details.
• Only the owners of Clicked see the parent’s or guardian’s details in our tools, with the payout account masked.
• The bank or PayPal that carries out the payment, our tax advisor, and tax or other authorities where the law requires it.
• Other creators never see these details.

The parent’s personal link

After confirming, the parent or guardian gets a personal link. It is shown only once, so they should bookmark or save it. With it they can see the main details (the child, their relationship, the masked payout account and the account holder) and withdraw the permission at any time.

“Not your parent?”

If someone other than the child’s parent or guardian confirmed, the child can report it on the Payments page. Our team then checks it, and no payout is made until the check is done.

Withdrawal

When a parent or guardian withdraws the permission, we stop paying to their account and delete the account number or PayPal address and their contact details right away. The account holder’s name is kept with the other details (see below). The child’s earnings are not lost: they are held until a parent or guardian confirms again. The child can then send a new link. To change the payout account, the parent or guardian withdraws and the child sends a new link.

How long we keep it

• Links: a link expires after 7 days. Records that were never confirmed are deleted after 30 days.
• When the child turns 18: the permission ends and we delete the parent’s or guardian’s account number or PayPal address and their contact details, once no payout for the child is still in progress. From then on the child is paid to their own account.
• After a withdrawal, or once the child is 18: the remaining details (names, the child’s legal name and address, the account holder and the hashed IP address and browser identifier) are deleted after 3 years. We keep only the status, the text version and its fingerprint, the options chosen and the dates, as proof of what was agreed.
• If the child’s account is deleted: we delete the parent’s or guardian’s personal data right away, and their personal link stops working. We keep only the same pseudonymous proof (status, text version and fingerprint, options chosen, dates).
• Payment records and payout documents: for the statutory tax and bookkeeping periods (see section 5).

Rights

The parent or guardian can use the rights in section 6, for their own data and for the child’s data. Parents and guardians have no Clicked account, so they use their personal link to withdraw, and send any other request by email to mgmt.nakama@gmail.com.

We use only cookies that are needed for the service: to keep you signed in, to secure account connections, and to remember the look you chose. When a parent or guardian opens their personal link, we set one more cookie for one hour so the page can show their permission. There is no advertising or analytics tracking, so no cookie-consent banner is required.

Questions or requests: mgmt.nakama@gmail.com. Last updated: 18 October 2026.