Privacy Policy

1. Introduction

Vantora Creative Sdn Bhd (202501019613 (1621026-X)) ("we", "us", "our") operates Creamatch (crea-match.com). This Privacy Policy explains how we collect, use, and protect your personal information.

2. Information we collect

From clients/brands

Name, company name, email address
Phone number, industry
Campaign briefs and requirements
Payment information (processed securely via Stripe or other supported payment providers — we do not store card details)

From creators

Full name, email, phone number
Home address
Social media accounts and portfolio
Bank account details (for payment processing)
Content niche and specialties
Date of birth
Google account profile information (name, email, profile photo) if you sign in with Google
Push notification token, and access to your device’s camera, photo library and microphone when you submit content via the Creator mobile app

3. How we use your information

To provide and improve our services
To match brands with suitable creators
To process payments
To send service-related communications
To send push notifications about campaigns and payments (Creator app)
To comply with legal obligations

4. Data sharing

We do not sell your personal data. We share data only with the service providers needed to operate Creamatch:

Payment processing — Stripe or other supported payment providers.
Infrastructure, authentication & storage — Supabase (database, auth, file storage).
Transactional email — Resend, to send service-related emails.
Analytics — PostHog (EU region), only where you have consented to analytics cookies.
Marketing measurement — Meta and TikTok advertising pixels, only where you have consented to marketing cookies.
AI features — Anthropic processes prompts to power AI tools; it does not retain your personal data for training.
Internal operations — Telegram, used by our team for operational alerts only.
Our internal team, for service delivery.

Public creator profiles

Approved creators have a public profile at crea-match.com/creators/<username> showing their name, username, photo, bio, niches, city and state, verified stats, portfolio and (only if they publish them) rates. Profiles are public and searchable by default: once complete, a profile can appear in Google and other search engines. Phone numbers, email, home address, bank details and social account links are never shown publicly. Creators can switch off “Show my profile on Google” (or hide their profile from the directory) at any time in Settings → Privacy & visibility; search engines are then told not to list the profile, and it is removed from our sitemap.

5. Data security

We implement appropriate security measures including:

Encrypted data transmission (SSL/TLS)
Sensitive identifiers — bank account numbers and IC numbers — are stored encrypted at rest using AES-256-GCM and are never transmitted or stored in plaintext
Secure authentication systems
Limited access to personal data

6. Data retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations.

7. Your rights

Under PDPA (Personal Data Protection Act 2010), you have the right to:

Access your personal data
Correct inaccurate data
Withdraw consent for data processing
Request deletion of your data

8. Cookies

We use cookies and similar technologies across four categories — Essential, Analytics, Marketing, and Functional. Non-essential categories are off by default until you opt in. You can accept or reject categories any time via our cookie banner or the "Manage cookie preferences" control. See our Cookie Policy for the full list.

9. Third-party links

Our website may contain links to third-party sites. We are not responsible for their privacy practices.

10. Contact us

For privacy concerns or data requests:

Email: privacy@crea-match.com

Address: Vantora Creative Sdn Bhd (202501019613 (1621026-X)), Malaysia

11. Referral data

We collect referral codes and track referral relationships to process rewards. This data is used solely for referral program administration and is not shared with third parties. Referral data is retained for 24 months after the referral relationship ends.

12. Public tools & lead capture

CreatorScore (/score) ingests publicly available social profile data for the handle you enter, plus an optional email you provide, to generate and share a score.
Campaign estimator (/estimator) captures the contact details you submit as a lead so we can follow up about your campaign.

13. Connected AI assistants

If you connect an external AI assistant (such as Claude or ChatGPT) to Creamatch, it acts only after you sign in and approve access, and only for your own workspace. The assistant may read the campaign and agency-client information exposed by the listed tools and the public creator directory cards a signed-in brand already sees (never creator contact, address or banking details), may prepare a private campaign draft for your review, and may approve or request changes on drafts waiting for you only when you explicitly tell it to. It cannot publish campaigns, book or select creators, or make or confirm payments through the connector.

Creamatch records the signed-in account, tool name, outcome, duration and relevant record identifiers for security and support. This connector audit log does not store the campaign brief or tool response body. Information you send to an external AI provider is also governed by that provider's privacy terms.

Creators and brands can choose to connect their own Threads, Instagram (professional account), Facebook Page or TikTok account to Creamatch through each platform's official sign-in. You approve the permissions on the platform's own screen, and you can disconnect at any time. We never see or store your social media password.

What we read: your account id, username, display name and profile picture; follower and post counts; and the numbers (views, likes, comments, shares, saves, reach) for posts you published through Creamatch, for up to 30 days after posting. We do not read your messages, other people's content, or posts you did not publish through Creamatch.
What we post: only the video or photo you choose, with the caption you wrote and the settings you picked (for TikTok: who can view it, comments / Duet / Stitch, and the branded content disclosure), at the time you chose. Creators can post their own approved campaign videos and portfolio uploads; brands can post the UGC videos delivered to them. Nothing is posted without your action.
Campaign records: when a creator posts a campaign video through Creamatch, the public post link is added to that campaign (the same as submitting it by hand), so the brand and our team can verify it and see its results.
Storage and security: access tokens are encrypted (AES-256) on our servers, are never shown in the app or shared, and are used only for the actions above.
Retention: tokens are deleted as soon as you disconnect. Scheduled post records and their numbers are kept with your Creamatch account and deleted when you ask us, send a platform data deletion request, or delete your account.
Disconnect and delete: disconnect in Creator Settings → Connected accounts or Brand portal → Social scheduler. You can also remove Creamatch in the platform's own settings (Facebook / Instagram / Threads: Settings → Apps and websites; TikTok: Settings and privacy → Security → Apps and services). Removing Creamatch on Facebook, Instagram or Threads, or sending a data deletion request there, deletes the connected account data we hold. You can also email us (section 10) to delete it.

Use of information received from these platforms follows their developer policies, including the Meta Platform Terms and the TikTok Developer Terms of Service.

15. Updates

We may update this policy periodically. Changes will be posted on this page with an updated date.