Privacy Policy

Effective date: 31 July 2026  ·  Last updated: 31 July 2026

This Privacy Policy explains how BookInfluencers ("we", "us", "our") processes personal data when you use our iOS app, our website at bookinfluencers.app and related services (together, the "Services").

We are based in Germany. Processing is governed by the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Digital Services Data Protection Act (TDDDG). This policy also satisfies the disclosure requirements of Meta, Google/YouTube, TikTok and the Apple App Store.

1. Controller and Contact

The controller responsible for the processing described here (Art. 4(7) GDPR) is:

[Legal name and legal form]
[Street and number]
[Postal code and city], Germany
Represented by: [Managing director / owner]
Email: info@bookinfluencers.app

Data protection officer: [We have not appointed a data protection officer because the statutory thresholds of Art. 37 GDPR / § 38 BDSG are not met. / Our data protection officer can be reached at …]

For any request concerning your data — access, rectification, erasure, restriction, portability, objection or withdrawal of consent — write to info@bookinfluencers.app. We respond within one month (Art. 12(3) GDPR); where a request is complex we may extend this by two further months and will tell you.

2. Who Is Responsible for What

BookInfluencers is a marketplace. That has a consequence for data protection that is easy to miss:

• We are the controller for operating the platform — accounts, profiles, bookings, messages, payment processing, security and fraud prevention.
• Each user is its own controller for what it does with data it receives through the platform. When a brand books a creator, the brand receives the creator's profile and campaign data and decides itself how to use it (e.g. in its own CRM). We have no control over that, and the brand must comply with the GDPR in its own right.
• The social networks are separate controllers for the processing that takes place on their own platforms.

We are not joint controllers with brands or creators, and we do not act as their processor.

3. What We Process, Why, and on What Legal Basis

The table below lists every category of personal data we process, why we process it, and the legal basis under Art. 6(1) GDPR.

Where we rely on legitimate interests (Art. 6(1)(f)), we have weighed those interests against your rights. You may object at any time under Art. 21 GDPR (see Section 16).

Providing data. Account, profile and booking data are necessary to use the Services; without them a contract cannot be performed. Tax data is required by law before a payout can be reported. Connecting a social account is voluntary — without it, verified reach metrics and Reach Packages are unavailable.

4. What We Deliberately Do Not Do

Because this is unusual for an app in this category, we state it explicitly. We verified the following against the app's source code and its Apple privacy manifest:

• No advertising and no ad networks. We do not use your data for advertising purposes, neither our own nor Apple's or anyone else's.
• No tracking. The app does not access the advertising identifier (IDFA), does not ask for App Tracking Transparency permission, and does not link your data with data from other companies' apps or websites. The app's privacy manifest declares NSPrivacyTracking = false.
• No analytics SDK. The app contains no Firebase Analytics, no Google Analytics and no comparable product. We do not record which screens you view, how long you use the app or which buttons you tap.
• No third-party crash-reporting SDK. Crash data reaches us only if you choose to share it with developers through Apple's own system, in which case Apple provides it in aggregated form.
• No analytics or advertising cookies on our website. See Section 18.
• No sale of data and no transfer to data brokers or advertisers.
• No profiling for advertising purposes. The automated processing we do carry out is described transparently in Section 11.

5. Data from Linked Social Accounts

Connecting a social account is voluntary and always requires your explicit consent through the provider's own OAuth screen. We store the access and refresh tokens issued to us — they are readable only by our backend service role, never by other users — and we use them solely to retrieve the metrics listed in Section 3.

Withdrawing consent. You can disconnect a social account in the app at any time, and you can additionally revoke our access in the provider's own settings (links in Sections 6–8). Upon disconnection we delete the stored tokens and the metrics retrieved from that account, unless we are required to keep specific figures as evidence for a booking that has already been paid (see Section 15).

Where we obtain data about you from a social network rather than from you directly, we do so on the basis of your consent, and Art. 14 GDPR applies — the categories and sources are those set out in Sections 6 to 8.

6. Meta Platform API (Facebook & Instagram)

Our Services integrate Meta's APIs, which may include the Instagram Graph API, Instagram Basic Display API and Facebook Login. By connecting your Instagram or Facebook account you also agree to Meta's Platform Terms and Meta's Privacy Policy.

Data we receive from Meta

• Facebook or Instagram user ID and public profile name
• Profile picture URL
• Email address (only if you grant the email permission)
• Instagram media count, biography and account type
• Follower and following counts (where permitted by your account settings)
• Audience insights and post-level metrics (for business and creator accounts that grant access)

How we use Meta data

• To populate and verify your BookInfluencers creator profile
• To display reach and engagement data to brands during discovery and matching
• To verify delivered views in Reach Packages and to detect manipulated reach

You can revoke our access at any time in your Facebook App Settings or Instagram Account Access.

7. Google API Services (YouTube)

BookInfluencers uses the YouTube Data API v3 so that users can connect their YouTube channel and display performance data within the platform.

Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Data we receive from YouTube / Google

• YouTube channel ID, channel name and profile picture
• Subscriber count and total view count
• Video titles and public performance metrics (views, likes, comments)
• Channel analytics, average watch time and subscriber growth (if you grant the yt-analytics.readonly scope)

We store YouTube data only for as long as your account is connected and your account is active, and we do not use it for advertising or share it with unauthorised third parties.

8. TikTok API

We integrate the TikTok API (TikTok Login Kit and/or Display API) so that users can link their TikTok account and show their creator metrics. Your use of TikTok features is subject to TikTok's Privacy Policy and TikTok's Terms of Service.

Data we receive from TikTok

• TikTok username and display name
• Profile picture and biography
• Follower and following counts
• Video count and total likes
• Post-level performance metrics (views, likes, shares, comments) where authorised

You can revoke our access at any time in TikTok's privacy settings under "Manage app permissions".

9. Payments and Stripe

All payments and payouts are processed by Stripe Payments Europe, Ltd. (Ireland) and its affiliates. Payments from brands are routed directly to the creator's Stripe Connect account; we do not hold funds.

To receive payouts, creators must complete Stripe's identity verification (KYC). Stripe collects the identity documents and personal data required for this as its own controller under anti-money-laundering law; we receive only the verification status, not the documents. Stripe's processing is described in Stripe's Privacy Policy.

Legal basis: Art. 6(1)(b) for processing your bookings, Art. 6(1)(c) for accounting and anti-money-laundering obligations, and Art. 6(1)(f) for preventing payment fraud and chargeback abuse.

10. AI-Supported Matching

When a brand uses the optional "AI match" feature, we send the brand's campaign brief together with a shortlist of candidate creator profiles to the Claude API operated by Anthropic PBC (United States), which returns a suitability score and a short justification for each candidate.

What is transmitted

• The brand's brief, budget and preferred niches
• For each shortlisted creator: internal ID, display name, bio, niches, base price, average rating, number of reviews, engagement rate and verification status

No email addresses, contact details, payment data, tax data, messages or social media tokens are transmitted. The data sent is limited to what is already visible to brands on the public creator profile.

Legal basis: Art. 6(1)(f) — our legitimate interest, and that of both sides of the marketplace, in relevant matches. You can object to this processing under Art. 21 GDPR at info@bookinfluencers.app; we will then exclude your profile from AI matching. Your profile remains findable through the ordinary search and filter functions.

Anthropic acts as our processor under Art. 28 GDPR on the basis of a data processing agreement; the transfer to the United States is covered by the European Commission's Standard Contractual Clauses (see Section 14). The AI result is a ranking suggestion for the brand — it does not decide anything about you; the brand decides who to contact (see Section 11).

11. Automated Decisions, Profiling and Fraud Detection

We are transparent about the three places where the platform evaluates data automatically. Under Art. 22 GDPR you have the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you.

11.1 Fraud detection in Reach Packages

To ensure that only genuinely delivered reach is paid for, we automatically compare the view figures retrieved from the social networks against your own historical averages and against the plausibility of the growth curve. Concretely, a participation is marked as conspicuous if the views are implausibly high compared with your average, if the growth within a short period is unnaturally steep, or if the engagement rate is implausibly low relative to the views.

Consequence: the participation receives the status fraud_flagged and the payment is withheld pending review. This automatic marking is not a final decision. No payment is permanently refused without a human review. If your participation is flagged, you can contact us at info@bookinfluencers.app at any time and are entitled to human intervention, to state your position and to contest the decision (Art. 22(3) GDPR). Legal basis: Art. 6(1)(b) and Art. 6(1)(f) — our legitimate interest and that of the paying brands in preventing fraud.

11.2 Contact-detail scanning in messages

Before a message is sent, the app checks the text against fixed patterns for email addresses, phone numbers and messenger handles, and warns you or redacts the details. This is a pattern check on your device — no AI is used, and messages are not analysed for content beyond these patterns. Purpose: preventing circumvention of the platform and protecting users from being moved into unprotected side channels. Legal basis: Art. 6(1)(f) and Art. 6(1)(b).

11.3 Matching scores

The scores described in Section 10 and the sorting in search results rank profiles. They are decision aids for brands and produce no automated legal effect for you — a brand always decides for itself whom to book.

11.4 Restrictions and account closures

Warnings, restrictions and account closures are always decided by a person, not automatically. You will be given the essential reasons and can object (Section 11 of our Terms of Service).

12. Apple, App Store and Push Notifications

Our app is distributed through the Apple App Store. Downloading it involves a relationship between you and Apple; Apple processes your Apple Account data as its own controller. We receive no personal data from Apple in connection with the download, only aggregated, non-personal statistics.

Sign in with Apple

If you register with Sign in with Apple, we receive a pseudonymous Apple user ID and, depending on your choice, either your email address or an anonymised Apple relay address. Apple provides your name only once, at first sign-in, which is why we store it at that moment. Legal basis: Art. 6(1)(b).

Push notifications

Notifications are delivered via the Apple Push Notification service (APNs). We transmit your device token and the notification text (e.g. "New message about your campaign") to Apple. Notifications are limited to events relating to your bookings, messages and payouts — we do not send advertising push messages. You can revoke the permission at any time in the iOS settings.

App Store privacy label

The data categories declared for the App Store correspond to the app's privacy manifest: contact info (name, email), identifiers (user ID), user content (photos, campaign content, messages), payment information and other financial information — all linked to your account, all used solely for app functionality, and none of it used for tracking.

In-app purchases

If paid features are offered, they are processed exclusively through Apple's payment system. We receive no Apple Account credentials and no payment card details, only the status of your purchase.

13. Recipients and Processors

We use carefully selected service providers, each bound by a data processing agreement under Art. 28 GDPR where they act on our behalf:

In addition, other users receive the data that the platform inherently makes visible: brands see creator profiles and metrics, creators see brand profiles and briefs, and both sides see the messages and booking data of their shared campaign. Reviews you write are visible to other users.

14. International Transfers

We aim to keep processing within the EU. Where data is transferred to a third country — in particular to the United States (Anthropic, and the US parent companies of Stripe, Apple, Google, Meta and TikTok) — we ensure an adequate level of protection through:

• the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures; and/or
• an adequacy decision of the European Commission, where the recipient is certified under the EU–US Data Privacy Framework.

You can request a copy of the safeguards in place at info@bookinfluencers.app.

15. Retention, Deletion and Anonymisation

Please note: content you have published (e.g. campaign posts on your own channels) and data that other users have received are not affected by our deletion — those users are their own controllers (Section 2).

16. Your Rights

You have the following rights in relation to your personal data:

• Access (Art. 15) — confirmation of whether we process your data and a copy of it
• Rectification (Art. 16) — correction of inaccurate or incomplete data
• Erasure (Art. 17) — deletion, subject to the statutory retention obligations in Section 15
• Restriction (Art. 18) — restriction of processing in certain circumstances
• Portability (Art. 20) — the data you provided, in a structured, commonly used, machine-readable format
• Withdrawal of consent (Art. 7(3)) — at any time, with effect for the future; the lawfulness of processing carried out before withdrawal is unaffected. This concerns in particular your connected social accounts.

To exercise your rights, write to info@bookinfluencers.app. So that we do not disclose data to the wrong person, we may need to verify your identity.

Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or of the alleged infringement (Art. 77 GDPR). The authority competent for us is: [Competent supervisory authority of the federal state in which the company has its seat].

17. Security

We take technical and organisational measures appropriate to the risk, in particular:

• Encryption in transit (TLS) for all connections between app, website, backend and service providers
• Row-level security in the database, so that each user can technically access only their own records and the records of shared bookings
• Passwords are stored only as salted hashes, never in plain text
• Social media tokens and payout data are accessible only to privileged backend functions, never to other users
• Card data never reaches our systems (Section 9)
• Access on a need-to-know basis, separation of test and production environments, logging of administrative actions

No transmission over the internet can be made completely secure. If a personal data breach is likely to result in a high risk to your rights, we will notify you without undue delay (Art. 34 GDPR) and report it to the supervisory authority within 72 hours (Art. 33 GDPR).

18. Cookies, Local Storage and § 25 TDDDG

Website. Our website is a static presentation page. It sets no analytics or advertising cookies, and there is no tracking pixel and no consent banner because none is needed. Fonts are loaded from Google Fonts, which means your IP address is transmitted to Google in the process; legal basis Art. 6(1)(f), our legitimate interest in a consistent presentation. Access to our web server is logged as described in Section 3.

App. The app stores your login session and your settings (e.g. language) locally on your device. This is strictly necessary to provide the service you expressly requested, so it does not require consent under § 25(2)(2) TDDDG. Deleting the app removes this local data.

19. Minors

The Services are intended exclusively for persons aged 18 and over; you confirm your age at registration. We do not knowingly process data of minors. If we become aware that an account belongs to a minor, we will block it and delete the data, subject to Section 15. If you believe a minor has provided us with data, contact us at info@bookinfluencers.app.

20. Changes and Contact

We will update this Privacy Policy when the processing described here changes — for example if we add a new service provider or a new feature. We will publish the updated version on this page with a new date and, if the change is material, notify you in the app or by email.

BookInfluencers
[Legal name and address — see Section 1]
info@bookinfluencers.app
bookinfluencers.app

See also: Terms of Service  ·  Datenschutzerklärung (deutsche Fassung)