Privacy Policy
Effective date: January 1, 2026
This Privacy Policy sets out how Ali Media ("Creatornet", "we", "us" or "our") handles personal data when you use Creatornet and related services (the "Services") or our website.
1. Personal Data We Collect
What we collect depends on the features you use and on whether you are a brand, a creator, a visitor to our website or a person who interacts with a brand that uses Creatornet:
| Category | Examples |
|---|---|
| Account and contact | Name, email address, login credentials |
| Brand | Organization name, team members and roles |
| Creator profile | Profile image, social handles, date of birth, gender, country |
| Payout details | The payout method you choose and the account or address you enter so a brand can pay you |
| Content and messages | Files you upload and messages you send |
| Billing | Billing details for paid plans. Card numbers are handled by our payment processor. We do not store them. |
| Store attribution | A visitor identifier, a session identifier, campaign and click parameters, landing page and referrer, pages and products viewed on the store, IP address and approximate location, browser and device information, order and conversion data linked to attribution |
| Direct conversions | Purchases and other actions a brand sends us from its own site, the campaign details behind them, any customer identifier the brand attaches and an email address or phone number (optional, hashed and never stored in plain text). |
| Integrations | Shopify store, product and order data. Meta ad performance and account information when you connect that integration. |
| Device and usage | IP address, browser type, pages visited, features used, cookies and similar technologies |
| Website | Email signup, contact-form contents and Google Analytics after you opt in |
We collect this directly from you and from the integrations you connect. We also collect it automatically when you use the Services or visit a participating brand's site or store. A brand may also send us conversions from its own systems.
2. How We Use Personal Data
We may use personal data for the following purposes:
- provide and maintain the Services, including integrations you turn on
- create and authenticate accounts and send service messages
- connect brands and creators through profiles, submissions and messages
- process billing and charges for paid plans and keep invoices and billing records
- attribute store activity, calculate commission and report store and ad performance to the brand the data came from, on its instructions
- monitor and analyze how the Services are used, fix problems and improve them
- create aggregated and de-identified data to maintain and improve the Services
- measure use of the website and send marketing email, in each case after you opt in
- respond to contact and support requests
- detect, prevent and address abuse, fraud and security incidents so the Services stay available
- enforce our terms and meet legal, tax and accounting duties
3. Legal Bases
These are our bases for processing personal data as controller where you are located in the European Economic Area (the "EEA"), the United Kingdom or Switzerland:
| Purpose | Basis |
|---|---|
| Providing the Services: accounts, profiles, submissions, messages and the earnings we calculate and show | Contract |
| Billing and billing records | Contract; legal obligation for the records |
| Improving the Services, including aggregated and de-identified data | Legitimate interests: developing our product |
| Website measurement | Consent |
| Marketing email | Consent |
| Naming a brand in our marketing and case studies | Legitimate interests: showing what the product does; you may opt out |
| Answering contact and support requests | Legitimate interests: serving our users and prospective users |
| Preventing abuse, fraud and security incidents | Legitimate interests: keeping the Services secure and available |
| Enforcing our terms and meeting legal, tax and accounting duties | Legitimate interests: establishing and defending legal claims; legal obligation for the duties |
Our legitimate interests do not override your rights. You can object to that processing. You can withdraw consent at any time. Where we are the processor, as described in Section 8, notice and basis are the brand's responsibility as controller.
4. How We Share Personal Data
We do not sell or share personal data. We disclose it only in the cases described below. A brand, social network or payment processor acting for its own purposes follows its own policy.
Other users. Brands see creator profiles, submissions and the payout method and details a creator enters so the brand can pay them. Creators see brand information, the attribution context relevant to them and the approved videos other creators made for the same brand together with how those videos performed. A brand also receives attribution and conversion data for its own store. This covers the Store attribution categories in Section 1, including traffic sources, order values and the visitor and session identifiers our pixel generates. The order identifiers a brand receives resolve only in its own store admin.
Our own marketing. We may name a brand or show its logo in case studies, customer lists and sales materials unless it opts out. We name a creator or use their image only where they have given permission. A brand can opt out and a creator can withdraw permission at any time by emailing legal@creatornet.io. Any performance and earnings figures we use are anonymized or aggregated, unless a brand agrees in writing to be identified with its figures.
Service providers. We share personal data with vendors that provide hosting, email, billing and similar services for us. They receive only what the service requires and use it for nothing else. The Sub-processor List names each of them.
Legal. We disclose personal data only when the law or a valid legal process requires it or when disclosure protects rights, safety or the integrity of the Services.
Business transfer. We may transfer personal data as part of a proposed or completed merger, acquisition, sale of assets, reorganization or insolvency proceeding. A buyer may use it only under this Privacy Policy.
5. Cookies and Similar Technologies
We rely on cookies and similar technologies to run the Services and our website:
- Session cookies to keep you signed in
- A cookie or local browser storage on our website to remember your consent choice
- Google Analytics cookies to measure use of the website, set only after you opt in
- First-party attribution cookies set by our pixel on a participating brand's site or store
- Session storage and session recording in the product app, used to diagnose errors. Text is masked and media is blocked
Our marketing website sets no analytics or marketing cookies until you answer the cookie banner. You can manage cookies in your browser settings or through the cookie controls on our website. Disabling cookies can limit how some features work.
6. Security
The security of your personal data matters to us. We protect it with measures appropriate to the risk, including access controls, authentication and encryption in transit and at rest. Security disclosures go to security@creatornet.io. Still, no method of internet transmission or electronic storage is 100% secure and we cannot guarantee absolute security.
7. Retention
We keep personal data only as long as needed to provide and secure the Services, resolve disputes, enforce our terms and meet legal, tax and accounting duties.
| Information | How long |
|---|---|
| Account and profile | Until you delete your account or ask us to delete it. Commission and payout records stay after that, with your personal details removed |
| Payout details | Until you change them or delete your account, which removes them from Creatornet |
| Billing and tax records | For as long as the legal duty lasts |
| Store events as received from Shopify | At most 30 days |
| Store data processed for a brand | Until the brand deletes it or we no longer need it to provide the Services |
| Meta ad data | Until you disconnect the integration, which deletes the imported ad data, or until Meta's data-deletion process removes it |
| Commission and payout records | Kept after you delete your account, with your name, email and form responses removed |
| Content you submitted to a campaign | Kept while the brand you sent it to still has it, including after you delete your account |
| Messages | Until your account or the conversation they belong to is deleted |
When we no longer need personal data we delete or anonymize it. Aggregated and de-identified data may be kept indefinitely.
8. Our Role
We are the controller for most personal data covered by this Privacy Policy, including account, billing and website data. We decide how and why it is processed. Where we process personal data only to provide a brand's features on that brand's instructions, that brand is the controller and we are the processor. Store and order data from a connected store, such as attribution and conversion data, is the main example. Our Data Processing Agreement sets out what we process in that role. The same data also serves purposes of our own. There we are the controller: our commission and payout records, the earnings we show creators and our fraud prevention.
9. Your Rights
Depending on where you live, you have some or all of these rights:
Access. Request a copy of the personal data we hold about you.
Correction. Ask us to correct inaccurate personal data.
Deletion. Ask us to delete your personal data. We keep what the law requires us to keep. We also keep the commission and payout records described in Section 7 so we can establish or defend legal claims. Disconnecting an integration stops new data from it but is not a deletion request. If you remove Creatornet in your Facebook settings and send a data deletion request through Meta, we delete the Meta ad data imported through your connection and show the result on a status page with a confirmation code.
Restriction. Ask us to restrict processing while a dispute about it is resolved.
Portability. Request a copy of your data in a portable format.
Objection. Object to processing based on legitimate interests and to direct marketing. Marketing email includes an unsubscribe link in every message.
Withdraw consent. Withdraw at any time where we rely on consent. Earlier processing stays lawful.
Automated decisions. We do not make solely automated decisions that have legal or similarly significant effects on you.
Complain. Lodge a complaint with your data protection authority. In Norway that is Datatilsynet.
You can update your details and delete your account in your settings. To make any other privacy request, email privacy@creatornet.io. We may verify your identity first and we respond within the timeframes the law requires.
10. International Data Transfers
We are based in Norway and personal data may be processed in the United States, where our service providers operate under laws that can differ from yours. For transfers from the EEA, the UK or Switzerland we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses or a vendor's certification under the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards we rely on.
11. Children
You must be 18 or older to use Creatornet. We do not knowingly collect data from anyone younger. Tell us if you think a child has sent us personal data and we will delete it.
12. California Privacy Rights
If you live in California, the California Consumer Privacy Act gives you rights over your personal information, including:
- knowing what categories of personal information we collect and how we use and disclose them;
- asking us to delete personal information;
- opting out of any sale or sharing of personal information; and
- freedom from discrimination for exercising these rights.
To exercise these rights, contact us at privacy@creatornet.io.
13. Changes
From time to time we may revise this Privacy Policy. For a material change we will notify you by email or through a prominent notice in the Services. The date at the top shows the latest version.
14. Shopify Merchants
If you install our Shopify app:
- We access store data only to provide the Services
- We do not ask Shopify to send buyer names, emails, phone numbers or addresses
- We do not sell merchant data
- Uninstalling the app starts Shopify's redaction process for that store's data. It does not delete your Creatornet account, organization or billing records
- The Data Processing Agreement and its list of sub-processors apply
15. Contact Us
For questions, concerns or privacy requests, contact:
Ali Media
VAT number NO 835 517 632 MVA
Moraveien 29
1542 Vestby
Norway
Email: privacy@creatornet.io