Kitscore is operated by GHG Consulting LLC (“Kitscore”, “we”, “us”), a New York State registered limited liability company. This policy explains what data we collect through kitscore.co and our app, why, and what choices you have. You can contact us about privacy at hello@kitscore.co.
GHG Consulting LLC is the controller of the personal data described in this policy, except where an agency, manager, or team account uploads information about other people (for example roster members, contract counterparties, or notes about creators). In that case the account holder decides why and how that information is used, and we process it on their behalf to provide the Service.
If you're in the EEA or UK, see Sections 10, 13 and 18 for how international transfers, your rights, and our contact and representative details work.
| Category | Examples | Who it applies to |
|---|---|---|
| Account data | Name/company name, email, password (hashed), account role (creator, sponsor, manager, or agency/team member) | Everyone with an account |
| Profile data | Niche, location, business email, supported platforms | Creators |
| Evidence you submit | Screenshots, analytics exports, campaign documentation, brand safety questionnaire answers | Creators |
| Influencer permit records | If you tell us you do paid promotion in the UAE or Saudi Arabia, you can add details of your advertiser permit or licence: the permit type and number, the holder’s name, issue and expiry dates, the accounts it covers, any sponsoring agency, a trade licence number and expiry where relevant, and optionally a copy of the permit and a dated screenshot of your profile. We use your base country and the markets you work in only to decide whether to ask you for these details. | Creators who work in the UAE or Saudi Arabia |
| Platform connection data | When you connect a YouTube, TikTok, Instagram, Twitch, or Discord account, we receive your channel/account ID, display name or handle, and public statistics (follower/subscriber count, view count, video/post count, or server member count, as available from that platform). For YouTube, this is read via the youtube.readonly scope, limited to the channel belonging to the Google account you sign in with, and includes your channel’s recent upload history (for each video: title, description, publish date, and whether it is marked as containing paid promotion). For Instagram, this is read via Meta's Instagram Graph API using read-only scopes tied to the Instagram professional account you authorize. For Twitch, this is read via the Twitch API using read-only scopes tied to the Twitch account you authorize. For Discord, this is read via Discord OAuth2's identify and guilds scopes, and is limited to confirming a server you own and its approximate member count. If you also add the Kitscore Discord app to your server, it counts recent messages as described in Section 8. In every case we never request access to post, upload, edit, or delete anything on your connected account. | Creators who connect a platform account |
| Contract & deal data | Contracts you upload or create, contract terms, deliverables, milestones, payment terms, deal values, rate cards, and related notes, including the names and business contact details of counterparties named in them | Creators, sponsors, managers & agencies |
| Team, roster & invitation data | Names and email addresses of teammates, roster creators, or contacts you invite (or refer), and their responses to the invitation | Anyone who invites or is invited |
| Manager & agency workspace data | Notes, pipeline stages, decision memos, issue logs, and message templates that managers and agency staff keep about creators and deals | Managers & agencies |
| Automated check results | Results of AI-assisted and rule-based checks (disclosure, brand-safety, contract-clause, and exclusivity scans), and the text or metadata that was checked | Creators, managers & agencies |
| Campaign & evaluation data | Campaign briefs, mutual confirmations, sponsor ratings/endorsements, evaluation requests and outputs | Creators & sponsors |
| Billing data | Payment processed by Stripe — we receive confirmation of payment and a Stripe customer reference, not your full card number. For subscriptions and invoices we also collect your billing address and, where applicable, a VAT or other tax ID, so that tax can be calculated and shown on invoices (using Stripe Tax). For escrow and payouts, Stripe (including Stripe Connect) also collects the identity and bank details it requires; we receive account status and transaction references. | Anyone making a paid purchase |
| Demo requests & bookings | Name, work email, company, team size, message, and any preferred call time you give us when you request a demo or book a call, through our forms or through Cal.com. We also keep a one-way hash of your IP address for a short time to limit spam; we never store the raw address. | Visitors who request a demo or book a call |
| Checklist downloads | Your work email address, the time you asked for the checklist, and whether you later unsubscribed, when you request our creator vetting checklist from our sponsor page. We send you the checklist and one follow-up email. We also keep a one-way hash of your IP address for a short time to limit spam; we never store the raw address. | Visitors who request the checklist |
| Free-trial eligibility records | A normalized form of your email address and, once a free trial starts, a Stripe-generated fingerprint of the card used (not the card number), kept so that a free trial is not granted repeatedly to the same person | Sponsors, managers and agencies who start a free trial |
| Usage data | Pages visited, session activity, IP address, and basic device/browser info, via essential cookies and standard server logs; on our public sponsor, creator and manager pages, aggregated visit statistics (pages viewed, referring site, approximate country, and device and browser type) collected by Vercel Web Analytics, which does not use cookies; account activity and audit logs of actions taken in your account | All visitors |
If you are in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:
| What we do | Legal basis |
|---|---|
| Create and run your account; generate Trust Scores, Reliability Scores, and evaluation reports; verify platform ownership and evidence; facilitate mutual campaign confirmation; process payments and manage subscriptions | Performing our contract with you |
| Connect a YouTube, TikTok, Instagram, Twitch, or Discord account and pull public statistics into your scores | Your consent (you can withdraw it at any time by disconnecting the account), and performing our contract with you |
| Run a brand-safety check on your recent YouTube video titles and descriptions, and show the result to sponsors evaluating you | Performing our contract with you, and the legitimate interests of sponsors and Kitscore in reliable, safe sponsorship decisions |
| Show creator scores and profiles to sponsors, and sponsor feedback on creator profiles (Section 4) | Performing our contract with the creator or sponsor, and the legitimate interests of sponsors in evaluating creators |
| AI-assisted features you choose to use (drafting pitches and briefs, scanning contracts, captions, and video titles) | Performing our contract with you, and our legitimate interests in providing useful, safe features |
| Record your UAE or Saudi advertiser permit, email you reminders 30, 14 and 7 days before it expires, and show its status to sponsors and managers as described in Section 4 | Your consent (you choose to add these details and can remove them at any time), and performing our contract with you |
| Process information about people who are not Kitscore users but are named by our customers (for example contract counterparties, or people invited to join) | Legitimate interests of our customers and of Kitscore in running the Service; you can object at any time (Section 13) |
| Detect fraud, fake evidence, or abuse of the scoring system; prevent repeated free trials; keep the Service secure; keep audit logs | Legitimate interests in protecting the Service and its users |
| Communicate with you about your account, evaluations, or billing | Performing our contract with you |
| Send product announcements and optional activity digests (each has an opt-out in your profile or team settings) | Our legitimate interests in keeping users informed; you can opt out at any time |
| Respond to demo requests and book calls | Taking steps at your request before a contract, and our legitimate interests in responding to people who contact us |
| Improve the product and understand usage patterns, including aggregated website visit statistics | Legitimate interests in improving the Service |
| Keep tax and accounting records; respond to lawful requests | Legal obligation |
Providing account and billing data is necessary to use the Service. Connecting platform accounts, submitting evidence, and using AI-assisted features are optional, but without them some features (such as verified scores) cannot work.
We do not sell your data, and we do not share it with advertisers.
If you're a creator, parts of your profile are designed to be visible to sponsors by nature of the product — this includes your Trust Score, Reliability Score, badge tier, niche, location, and (for verified campaigns) the fact that a campaign was mutually confirmed. Evidence files themselves are not made public; they back the score but aren't displayed raw. Self-reported, evidence-submitted, and live-verified data are labeled separately so sponsors can see the source.
If you're a sponsor, submitting endorsement feedback on a completed campaign (ratings, would-hire-again status, and any notes you write) may appear publicly on that creator's profile, visible to anyone browsing Kitscore — not only to the creator. By default this feedback is attributed to "Verified sponsor," not your company name. Your company name is shown alongside your feedback only if you explicitly opt in at the time you submit it.
Automated scoring. Trust Scores and Reliability Scores are calculated automatically from the data described in Section 2 (for example verified platform statistics, evidence you submit, campaign confirmations, and sponsor feedback), using the approach described on our Methodology page. Sponsors may consider these scores when deciding whether to work with a creator. Kitscore does not make hiring decisions, and sponsors are not required to act on a score. If you believe a score, evaluation, or piece of evidence is wrong, email hello@kitscore.co and ask for a person to review it. If you are in the EEA or UK, you also have the rights described in Section 13 in relation to automated decision-making, including the right to obtain human review, express your point of view, and contest a decision.
AI-assisted features. Some features use a large language model provided by Groq to draft pitches and briefs, and to scan contracts, captions, and public video titles for possible issues. The content you submit to those features is sent to Groq only to produce the result you asked for. Their outputs are automated suggestions and checks; they are not legal advice and are not guaranteed to be complete or correct.
Influencer permit status (UAE and Saudi Arabia). If you add a UAE advertiser permit or a Saudi Mawthooq licence, sponsors and managers who receive a Kitscore decision memo for a campaign in that market see a “Permit & market compliance” section. It shows the permit type, the last four digits of the permit number, the valid-to date, a status (valid, expiring soon, expired, missing, mismatch, or unverified), an evidence label (self reported, evidence submitted, or live verified), when Kitscore last checked it, and any sponsoring agency. The memo may show an adjusted confidence figure that reflects the permit status; your Trust Score is not affected. If you choose to, your public Verified Media Kit and its PDF show only the permit type, the valid-to date, and the evidence label, never the number. That line disappears when the permit expires or if you switch it off, and a self-reported permit with no document is never shown publicly. We email you reminders at 30, 14 and 7 days before a recorded permit (or, for UAE residents, the trade licence recorded with it) expires; these are based on what you entered. Permit status is recorded from what you submit. It is not legal advice and it is not verification by a regulator.
Permit documents and profile screenshots are stored in your evidence folder, which a manager linked to your account can read. Please cover national ID, Emirates ID, passport, and similar numbers on anything you upload; you can black out images before they are saved.
If you connect your YouTube account, Kitscore's use of the resulting Google user data is limited as follows:
youtube.readonly OAuth scope. We do not request write, upload, or delete access to your YouTube channel.Kitscore's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect your Instagram account, Kitscore's use of the resulting Meta/Instagram data is limited as follows:
Kitscore's use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.
If you connect your Twitch account, Kitscore's use of the resulting Twitch data is limited as follows:
Kitscore's use of information received from the Twitch API adheres to the Twitch Developer Agreement and Twitch Developer Services Agreement.
TikTok. If you connect your TikTok account, Kitscore's use of the resulting TikTok data is limited as follows:
user.info.basic and user.info.stats scopes — your TikTok open ID, display name, profile picture URL, and public statistics (follower count, video count, and total likes). We do not request permission to post, upload, message, or edit anything on your behalf. We store your open ID, display name, follower, video and like counts, and the access and refresh tokens needed to refresh these statistics.Kitscore's use of information received from the TikTok API adheres to TikTok's developer terms and policies.
If you connect your Discord account, Kitscore's use of the resulting Discord data is limited as follows:
identify and guilds only — your Discord user ID and username, and the list of servers you belong to solely to identify a server you own and read its approximate member and online-presence count. The OAuth connection itself gives us no access to messages or to any server management action.Kitscore's use of information received from the Discord API adheres to Discord's Developer Terms of Service and Developer Policy.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage for accounts, evidence, and evaluation data (primary database hosted in Ireland, AWS eu-west-1) |
| Vercel | Website hosting and content delivery (CDN) for kitscore.co and the app, and cookieless aggregated visit statistics (Vercel Web Analytics) for our public sponsor, creator and manager pages |
| Stripe | Payment processing and automatic tax calculation (Stripe Tax) for evaluations and subscriptions, and escrow funding, releases, and payouts (including Stripe Connect onboarding for managers who receive funds) |
| Cal.com | Scheduling calls, only if you choose to book a meeting with us. Cal.com receives what you enter when you book (such as your name, email address, and any message) and sends us the booking details. |
| Resend | Sending email (sign-in and account messages, invitations, notifications, receipts, and the checklist emails) |
| Slack | Only if you or your agency add a Slack webhook in settings: Kitscore then sends the notifications you chose to that Slack workspace, where Slack’s terms apply |
| Groq | AI inference for AI-assisted features (for example, drafting pitches and campaign briefs, and scanning contract terms, exclusivity language, and public video titles for red flags). Only the content needed for the feature you use is sent. |
| YouTube Data API (Google) | Source of channel statistics when you connect a YouTube account — see Section 5. This is a data source we read from, not a party we share your Kitscore data with. |
| TikTok API | Source of account statistics when you connect a TikTok account — see Section 7. This is a data source we read from, not a party we share your Kitscore data with. |
| Instagram Graph API (Meta) | Source of account statistics when you connect an Instagram account — see Section 6. This is a data source we read from, not a party we share your Kitscore data with. |
| Twitch API | Source of account statistics when you connect a Twitch account — see Section 7. This is a data source we read from, not a party we share your Kitscore data with. |
| Discord API | Source of server ownership and member-count statistics when you connect a Discord account — see Section 8. This is a data source we read from, not a party we share your Kitscore data with. |
Each of our service providers processes data on our behalf under its own data processing terms. Other Kitscore users see the information described in Section 4. Beyond that, we don't share your information with any other third party except where required by law, to investigate fraud, or to protect the rights and safety of our users, or as part of a merger, acquisition, or sale of assets (in which case we will tell you and the recipient must honor this policy).
Kitscore is operated from the United States, so personal data of people in the EEA and UK is processed in the United States. Our primary database is located in the European Union (Ireland, AWS eu-west-1). Our application code runs on Vercel in the United States (Washington, D.C. region), and content is delivered through Vercel’s global Content Delivery Network, which may process requests in multiple regions, including the United Kingdom, the United States, and other locations.
We also transfer certain personal data to the following providers, which are located outside the EEA and UK or may process data outside them:
Where these transfers occur, we rely on appropriate safeguards under applicable data-protection law. Depending on the recipient, these are the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum to those clauses, the EU-US Data Privacy Framework and UK Extension (where the recipient is certified), adequacy decisions, or other lawful transfer mechanisms. You can request a copy of the relevant safeguards, or further information, by emailing hello@kitscore.co.
We use essential cookies and local storage required to keep you signed in and to operate the Service securely, plus local storage for interface preferences (such as sidebar state). We do not use advertising or tracking cookies. On our public sponsor, creator and manager pages we use Vercel Web Analytics to count visits; according to Vercel, it does not use cookies, stores only anonymized data, and does not track you across other sites. We serve our fonts, scripts, and icons from our own domain, and we generate QR codes in your browser, so loading our pages does not send your IP address to font, CDN, or QR-code providers. Details are in our Cookie Policy. If we add non-essential cookies in the future, we will update this policy and ask for your consent first where the law requires it.
You can ask us to access, correct, delete, or export the data we hold about you by emailing hello@kitscore.co, or use Data Deletion Instructions for deletion. We may need to confirm your identity (for example, by asking you to write from the email address on your account). We respond within one month (45 days for California residents), and we may extend this where the law allows. We don’t charge a fee unless a request is clearly excessive.
If you are in the EEA or UK, you have the right to: access your personal data; have it corrected; have it erased; restrict its processing; receive it in a portable format; object to processing based on legitimate interests; withdraw consent at any time (without affecting earlier processing); and not be subject to a decision based solely on automated processing that significantly affects you, including the right to human review (Section 4). You may complain to your local data-protection authority. In the UK this is the Information Commissioner’s Office; for the EEA, you can find your authority on the EDPB website. We would appreciate the chance to address your concern first.
Deleting evidence tied to a mutually confirmed campaign may affect the accuracy of historical score records, and we may need to keep certain billing records despite a deletion request (Section 12).
Self-serve account deletion: creators, sponsors, and managers can delete their account directly from their profile page, without emailing us. This gives you 14 days to change your mind before your personal data is permanently erased. Records that another party's contract or an existing dispute depends on, and billing records we're required to keep, are retained with your name and contact details removed (Section 12). We can't process a self-serve deletion while a contract you're party to has funds held in escrow or an unresolved dispute; the page will tell you what to resolve first.
This section applies to California residents to the extent the California Consumer Privacy Act, as amended (CCPA), applies to us.
Residents of other US states that have their own privacy laws can email us to exercise similar rights.
Kitscore is intended for creators and sponsors who are 18 or older, and is not directed at children. We don't knowingly collect data from anyone under 18. If you believe a child has given us personal data, email hello@kitscore.co and we will delete it.
We use reasonable technical and organizational measures to protect your data, including access controls on our database (row-level security), hashed passwords, and encrypted payment processing via Stripe. No system is 100% secure, and we can't guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
If we materially change how we collect or use your data, we'll update the date at the top of this page and, where appropriate, notify you directly.
Who we are: GHG Consulting LLC, a New York State limited liability company, United States. For any privacy question or request, including from people in the EEA or UK, email hello@kitscore.co. Our postal address is available on request at the same email address.
Representatives: Where the law requires us to appoint a representative in the EEA or the UK, their contact details will be published here. Until then, you can reach us at the email address above.
General & privacy requests: hello@kitscore.co
Billing-related data: billing@kitscore.co
Platform data deletion requests: see our Data Deletion Instructions