Privacy Policy
Operator: Open Creators Pty Ltd. Registered address: [NEED: registered address]. ABN: [NEED: ABN].
This Privacy Policy explains how Open Creators Pty Ltd ("Surge", "we") handles personal data when you use https://surgecampaign.com and our related services (the "Service"). If you have questions, contact [privacy email].
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, date of birth (age check), country, role (Creator or Studio), studio name | You |
| Connected platform data | See section 2 | TikTok, YouTube, Instagram, with your authorization |
| Campaign data | Campaigns joined, submitted video links, review decisions, flags, appeals, messages | You, Studios, the Service |
| Payout and billing data | Payout method, tax forms, invoices. Card and bank details are handled by our payment processor | You, payment processor |
| Game data | Store page details for games Studios add (e.g. from the Steam store) | Studios, public store APIs |
| Usage and device data | Log data, IP address, browser type, pages viewed, essential cookies | Your device |
2. Data from connected platforms
When you connect a social media account, the platform shows you exactly what you're allowing. We request only read access:
| Platform | Permissions requested | What we read |
|---|---|---|
| TikTok | user.info.basic, user.info.profile, user.info.stats, video.list | Open ID, display name, avatar, profile link, follower and video counts; your public videos' IDs, titles, links, cover images, create time and view, like, comment and share counts |
| YouTube (Google) | youtube.readonly | Channel ID, title, avatar, subscriber count; your uploaded videos' IDs, titles, publish dates and view, like and comment counts |
| Instagram (Meta) | instagram_business_basic, instagram_business_manage_insights | Account ID, username, profile picture, follower and media counts; your media's IDs, captions, links, timestamps and insights (views, reach, likes, comments, shares, saves). Requires a Professional (Creator or Business) account |
We use this data only to: (a) verify that you control the account and to show your audience size to Studios; (b) let you pick which of your videos to submit to a campaign; (c) measure verified views on the videos you submit, during their tracking window; (d) detect fraud such as purchased or bot views; and (e) calculate and audit your payouts. Studios see the profile and metrics of the videos you submit to their campaigns, not your other videos.
We do not use platform data to serve ads, to build profiles for advertising, or to train general-purpose AI models, and we never sell or rent it.
Google / YouTube
Surge uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's Privacy Policy applies to Google's handling of your data. You can revoke Surge's access at any time from the Google security settings page. Surge's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We refresh or delete YouTube API data we store at least every 30 days, as YouTube's policies require.
TikTok
You can revoke access in the TikTok app under Settings and privacy → Security and permissions → Apps and services permissions. Our use of TikTok data follows the TikTok Developer Terms of Service.
Instagram / Meta
You can remove Surge in Instagram under Settings → Website permissions → Apps and websites. To delete data we hold, see Data deletion.
3. How we use data and our legal bases
- Providing the Service (accounts, campaigns, tracking, payouts): performance of our contract with you.
- Fraud prevention and security: our legitimate interest in a fair marketplace, and protecting Studios and Creators.
- Payments, tax and legal obligations: legal obligation.
- Service emails (campaign updates, payout notices): contract. Marketing emails: consent, which you can withdraw at any time.
- Improving the Service using aggregated or de-identified analytics: legitimate interest.
4. Who we share data with
- Studios: your public handle, profile picture, audience size and the videos and metrics you submit to their campaigns.
- Service providers under contract, acting on our instructions: cloud hosting (Cloudflare), database and storage, payment processing and payouts, email delivery, and customer support tooling.
- Legal and safety: where required by law, or to protect rights, safety and the integrity of the Service.
- Business transfers: in a merger or acquisition, subject to this Policy.
We do not sell personal data, and we do not "share" it for cross-context behavioral advertising.
5. Retention
- OAuth access and refresh tokens are kept while the account stays connected, and deleted within 24 hours of disconnection.
- Video metrics are kept for the tracking window plus the payout audit period (up to 24 months) as payout records. YouTube API data is refreshed or deleted within 30 days unless kept as part of a payout record in aggregated form.
- Account data is kept while your account is open, and deleted or anonymized within 30 days after closure, except for records we must keep for tax, accounting or legal reasons (typically 7 years).
6. Your rights and choices
Depending on where you live (including the EEA, UK and California), you can request access to, correction of, deletion of, or a copy of your personal data, object to or restrict certain processing, and withdraw consent. Email [privacy email] or use the settings in your account. We respond within 30 days. You can also complain to your local data protection authority. We won't discriminate against you for exercising your rights.
7. Security
We use encryption in transit (TLS), encryption at rest for tokens and secrets, least-privilege access and audit logging. No system is perfectly secure. If a breach affects you, we'll notify you as required by law.
8. International transfers
We and our providers may process data outside your country. Where required, we use safeguards such as the European Commission's Standard Contractual Clauses.
9. Children
The Service is not for anyone under 18. We don't knowingly collect data from children. If you believe a child has given us data, contact us and we'll delete it.
10. Cookies
We use only essential cookies, for sign-in, security and the OAuth "state" check during account connection. We don't use advertising cookies.
11. Changes
We'll post updates here and change the "Last updated" date. For material changes we'll notify you by email or in the app.
12. Contact
Open Creators Pty Ltd, [NEED: registered address]. Privacy questions: [privacy email].