Privacy Policy
1. About this Policy
This Privacy Policy explains how Brief72 (“we”, “us”, “our”; clause 2 says who we are) collects, uses, shares and protects personal data when you visit brief72.com, use our web apps for creators (creators.brief72.com) and for brands and agencies (brands.brief72.com), including from your phone’s home screen, take part in a campaign or our referral programme, get our emails, or otherwise deal with us (together, the “Services”). Our iOS and Android apps are paused. If they come back, we’ll update this Policy first.
It applies to creators (“Creators”); to brands, agencies and betting and gaming operators, and the people who use Brief72 for them (“Advertisers”); to visitors to our website; and to other people whose personal data we handle, such as business contacts we email, colleagues added to a brand’s team and people who appear in creators’ videos (clause 3.4).
Please read it with our Creator Terms, Advertiser Terms, Referral Programme Terms and Cookie Notice. This Policy explains what we do with personal data. It isn’t part of our contract with you: when you sign up, you confirm that you’ve read it.
It’s written to meet the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, both as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
Your right to object
You can object at any time to our use of your personal data where we rely on our legitimate interests, including profiling (clause 12), and you can always stop our marketing. Email [email protected], or use the unsubscribe link in any marketing email. Clause 10 explains your other rights.
2. Who We Are
Brief72 (“Brief72”, “we”, “us”, “our”) is the controller of your personal data: we decide why and how it’s used. Our details are below.
Privacy contact: [email protected]
General contact: [email protected]
You can contact us about your personal data by email at [email protected], through the help button in our web apps, or by post to our registered office.
We haven’t appointed a Data Protection Officer, because the law doesn’t require one for a business of our size and type. We’ll review this as Brief72 grows. Our privacy contact deals with every data protection question, request and complaint.
Brands, agencies and operators that receive creators’ data for their campaigns are separate controllers of what they receive (clause 6).
3. Personal Data We Collect
“Personal data” means information that identifies you, or that could be combined with other information to identify you. What we collect depends on how you use the Services.
3.1 If you’re a creator
- Account and profile: your name, email address, password (stored scrambled, never in readable form), profile photo, bio, gender (you can choose “prefer not to say”), date of birth and city, and your settings and choices, such as the newsletter, new campaign emails, whether to hide betting, gaming and lottery campaigns, and whether we can use you in case studies.
- Social media accounts: the handles and links of the accounts you add, the content categories you choose, and our team’s checks, decisions and notes on each account. Clause 3.3 explains what we collect from the platforms.
- Campaign activity: your applications, the fee and expected views shown to you when you apply, the videos, images and captions you upload, comments from our team and the brand, your post links, your deadlines and reminders, and, for betting, gaming and lottery campaigns, your posting checklists and their screenshots.
- Age, ID and audience checks (age-restricted campaigns): see clause 4A. The betting and gaming declaration: see clause 4.
- Tax details: see clause 15.
- Bank and payment details: the name on your bank account, your bank’s name, sort code and account number, your withdrawal requests, and the reference of each payment we make to you.
- Messages: what you send us through the help button in our web apps (with any file, rating or feedback you add) or by email, and notes our team makes about your account.
- Records: the terms you accepted and the versions of this Policy you confirmed you’d read (when, which versions, and your IP address and browser), the reason you give if you ask us to delete your account, and any suspension or ban and why.
- Referrals: if you join with someone’s invite, or invite others, the invite code and how each referral is going (clause 6 and the Referral Programme Terms).
3.1A If you use Brief72 for a brand, agency or operator
- Your account: your name, work email address, password (stored scrambled), job title and phone number, and your settings and choices, such as the newsletter.
- Your organisation: its name, website, logo, billing address, purchase order numbers and invoice details; its campaigns and briefs, including any images or videos you upload for them; and your comments on creators’ content and decisions on their applications.
- Payments: requests to top up your Balance, with any proof of payment you send, your Balance history and refunds, and, if you’re owed a referral reward, the bank details you send us to pay it.
- Betting and gaming operators: the operator’s legal name, company number, registered office, Gambling Commission licence details and licensed websites; the name and email address of its compliance contact; the name and job title of the person who signs its letters of authorisation; its account IDs with Meta, TikTok and Google; and screenshots of its platform approvals.
- Messages and records: as for creators (clause 3.1).
3.2 Information we collect automatically
- Sign-in records: your IP address and the country it’s in, your browser and operating system, and your device’s time zone, each time you sign in or your sign-in is renewed. We use them to keep accounts secure: for example, a device set to UK time that connects from another country may be using a VPN or proxy, which our team can see.
- Activity records: what you change in your account and anything that goes wrong (the action, the result, when, and your IP address, never what you typed), the pages you open in our web apps, and errors your browser reports to us. We use them to help you and to keep accounts secure.
- When you were last active: we list a creator account as inactive after 30 days without signing in.
- On brief72.com: your cookie choice and, only if you click Accept, Google Analytics data (clause 13).
- Our emails: our email provider records that it delivered each email, or that it bounced. Our marketing emails don’t track whether you open them or click their links (clause 11).
3.3 Information from other sources
- Social media platforms (TikTok, Instagram and YouTube): public information about the accounts you add and the posts on them. To work out the views your posts usually get (clause 12), we collect the views, publish dates and titles or captions of up to 30 of your most recent posts on each account, and your follower or subscriber count. To check campaign posts (clause 12), we collect each post’s views, likes, comments, shares and saves, its caption and hashtags, the account it was posted from, the video’s length and your follower count, several times over 5 days. We get this from the platforms’ public pages through a data-collection service, and for YouTube through YouTube API Services. You don’t sign in to your social media accounts through Brief72, and we never see your passwords, private messages or account settings.
- Your own analytics: numbers you send us from your platforms’ insights, such as accounts reached, impressions, watch time, profile visits, link clicks, new followers and your audience’s age groups, gender and country, which our team types in.
- Brands and agencies: their comments on your content, and their decisions on your applications.
- Banks: confirmation from our bank of the payments we make to you; and, when we use a bank details checking service, whether your sort code and account number are valid, and your bank’s name.
- Public sources: such as the Gambling Commission’s public register and Companies House (for brands and operators), a business’s website and social media accounts when we check it before opening an account it registered on our website, and creators’ public profiles when we check an account or look into suspected fraud or a breach of our terms.
- Other people: the person who invited you to Brief72 (through their invite code), and the people described in clause 3.4.
YouTube. Brief72 uses YouTube API Services to read public information about the YouTube channels creators add and their videos: the channel’s ID and subscriber count, and each video’s title, publish date, length, views, likes and comments. We share these numbers with the brands whose campaigns you apply to or take part in (clause 6). We don’t ask for access to your Google account. Google’s Privacy Policy explains how Google handles data: www.google.com/policies/privacy. To see or delete the YouTube data we hold about you, remove the account in your settings or email [email protected].
3.4 People who aren’t Brief72 users
- Colleagues and operator staff: if your organisation asks our team to add you to its brand or agency team, or an operator names you as its compliance contact or as the person who signs its letters of authorisation, we get your name, work email address and job title from them. We use them to run the account and the campaign paperwork. The signatory’s name appears on the letters, which go to the social media platforms (clause 6).
- Business contacts: we may email people at companies about Brief72. We get their name, work email address and company from public business sources (such as company websites and business directories), from business events and introductions, or because they’ve agreed to hear from us. We record where each list came from. Each email says who we are, why you’re getting it and how to stop. If you ask us to stop, we keep only your email address, on our “do not email” list.
- Our brand quiz: if you fill in the quiz on brief72.com, we get your name, work email address, your brand’s name and your answers, your phone number and website if you give them, and whether you ticked the newsletter box (it starts unticked). With them, we record the page you came from and any campaign tags in the link you followed (UTM tags), but no cookies. We keep them in a spreadsheet (Google Sheets), separate from the accounts on our platform, and use them to reply to you and to see whether Brief72 could work for your brand.
- Our e-book for creators: to download it from brief72.com, you give us your full name and email address, and you can tick a box to get our emails (it starts unticked). With them, we record the page you came from and any campaign tags in the link you followed (UTM tags), but no cookies. We keep them in the same spreadsheet (Google Sheets), separate from the accounts on our platform, to give you the e-book and keep a record of who downloads it. We email you the link to the e-book once, from our Google account. Apart from that, we only send you our emails if you tick the box.
- People in creators’ videos: if you appear in a video a creator sends us, we hold it for the campaign, the brand receives it, and we may use approved videos in our own marketing (clause 5). Creators must have your permission before they include you (Creator Terms). To ask about a video you appear in, email [email protected].
3.5 What you have to give us
To join as a creator, you need to give us your name, email address and a password. To apply to campaigns, you also need to give us your date of birth, your gender (or “prefer not to say”) and your city, and add at least one social media account. You need tax details and bank details before you can withdraw money, and photo ID, audience screenshots and the betting and gaming declaration only for betting, gaming and lottery campaigns. For brands and agencies, we need your name, work email address and your organisation’s name, and billing details before we can invoice you. Everything else is up to you. If you don’t give us something we need, you won’t be able to use that part of the Services.
4. Special Category Data and Information about Offences
Some information gets extra protection under UK GDPR: special category data, such as information about your health, ethnic origin, religion or sex life (Article 9), and information about criminal offences, including allegations (Article 10). We don’t use face recognition or any other biometric technology. This is what we may hold:
- Information about suspected offences: if we suspect fraud (for example fake views, a false ID or someone else’s bank account), we keep a record of what we found and what we did, and of any suspension or ban. We do this to prevent and detect unlawful acts (Data Protection Act 2018, Schedule 1, paragraph 10, with paragraph 36).
- The betting and gaming declaration: before your first betting, gaming or lottery campaign, you confirm that you’re 25 or over, that you’re not self-excluded from gambling (for example with GAMSTOP), that under-18s make up less than a quarter of your audience and your content isn’t aimed at them, and that your posts will follow the rules. We keep only the fact that you confirmed it, which version and when, and we show the operator the date you confirmed it. We don’t ask for, or keep, anything else about your gambling.
The age and ID checks (clause 4A) don’t involve biometric data either: a member of our team compares the photos by eye, without face recognition or any other automated matching.
We don’t deliberately collect any other special category data. Please don’t include it in your messages to us or in content you submit. If a campaign ever needs it, we’ll ask for your explicit consent first. Once you publish a post yourself, what’s in it is public.
4A. Age, ID and Audience Checks for Age-Restricted Campaigns
Some campaigns are only open to creators of a certain age. Under the UK advertising rules (the CAP Code), nobody who is, or seems to be, under 25 can play a significant role in an ad for betting, casino and gaming, or for alcohol. On Brief72, lottery campaigns follow the same rule, so all these campaigns are for creators aged 25 or over. For betting, gaming and lottery campaigns we also apply the rules on audiences: the ads mustn’t appeal strongly to under-18s, or appear where more than a quarter of the audience is under 18. That’s why, before your first betting, gaming or lottery campaign, we check your age with your photo ID, and your audience with screenshots of your audience ages. For alcohol campaigns we use the date of birth you’ve given us, and we may ask you to verify it with your ID.
- What we ask for: a photo of your photo ID (passport, driving licence or national ID card, including the back where it has one) and a selfie of you holding it; a screenshot of each linked account’s audience ages from that platform’s own analytics; and the betting and gaming declaration (clause 4).
- When: when you first apply to (or register interest in) a betting, gaming or lottery campaign. You have until the end of the second day after you apply (or after we ask), UK time, to send them. If they don’t arrive in time, your application closes automatically or, if you’d already been accepted, your place goes to another creator. You can apply again, while the campaign is open, once your checks are done. An audience check counts for 90 days. We may also ask you to check your ID again at any time, for example as a random check, if your ID has expired, or if you look younger than your age.
- Who sees it: only the Brief72 team sees your ID, its details, your date of birth and your screenshots. Advertisers see an “ID verified” mark (and, if we’ve asked you for a new check, that it’s due and by when); whether you fit the campaign’s ages (yes or no) and your age group, never your date of birth; your audience’s age groups and share under 18, with the date we checked them; and, for betting, gaming and lottery campaigns, the date you confirmed the declaration. Operators get these in a compliance report for each campaign (clause 6). Once you’ve done an audience check, Advertisers see your audience’s age groups on your profile when you apply to any of their campaigns, not only age-restricted ones.
- How we check it: a member of our team compares your selfie with your ID by eye, and reads your date of birth and the ID’s expiry date. From your screenshots, our team reads the share of each account’s audience in each age group, including under 18. If more than a quarter of an account’s audience is under 18, you can’t take part in betting, gaming and lottery campaigns on that platform. If 100,000 or more of your followers are likely to be under 18, your audience counts as appealing strongly to under-18s and you can’t take part, unless our team decides otherwise.
- How we keep it safe: the photos and screenshots are encrypted, kept apart from everything else in private storage, and never published.
- How long we keep it: we delete ID photos 24 hours after our decision, and audience screenshots 90 days after we approve them. Clause 8.4 has the details.
- What happens next: the date of birth on your ID replaces the one on your profile. If your ID shows that you don’t meet a campaign’s age requirement, or your audience is too young for it, your application or place on that campaign ends. You can ask a person on our team to look at it again (clause 12).
Our lawful basis is legitimate interests (Art. 6(1)(f)): making sure the creators in age-restricted campaigns meet the advertising rules that Advertisers and we must follow, and preventing people from misstating their age or audience. If you’d rather not share your ID, you can still take part in campaigns that aren’t age-restricted, and you can hide betting, gaming and lottery campaigns in your account.
5. How and Why We Use Your Data (Lawful Bases)
We only use personal data where the law allows. The table shows what we do, with which data, and the lawful basis we rely on under Article 6(1) UK GDPR: (a) consent; (b) contract; (c) legal obligation; (f) legitimate interests.
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and running your account, and checking and approving creators’ social media accounts | Account and profile, social media accounts, sign-in records | Contract (b): to set up and run your account under the Creator Terms or, for brands and agencies that are sole traders or partnerships, the Advertiser Terms. If you use Brief72 for a company or other organisation: legitimate interests (f) in providing the Services to your organisation under its contract with us. |
| Working out the views your posts usually get, and the fee shown to you for a campaign (clause 12) | Social media data (your recent posts’ views), account | Contract (b), to offer you a fee; legitimate interests (f) in pricing campaigns fairly and giving brands an estimate of the views they can expect. |
| Showing you the campaigns you can take part in, and telling you in the app when a new one opens (clause 12) | Platforms and content categories, gender, date of birth, your choice to hide betting, gaming and lottery campaigns | Contract (b); legitimate interests (f) in matching creators to brands’ requirements and to the advertising rules. |
| Running campaigns: applications, choosing creators, reviewing videos (by our team and the brand), deadlines, reminders and notices | Account, campaign activity, content, messages | Contract (b); legitimate interests (f) for people who use Brief72 for an organisation, and for people who appear in creators’ videos, in running the campaign the brand has paid for. |
| The 5-day views check on campaign posts, and paying or holding your fee (clause 12) | Post links and numbers, captions, your verified accounts, expected views, audience data | Contract (b), to pay the fee you’ve earned; legitimate interests (f) in preventing fraud and making sure ads are labelled and follow the advertising rules. |
| Checking your age, ID and audience for age-restricted campaigns, including occasional random checks (clause 4A) | Identity, age, ID and audience check data, the betting and gaming declaration | Legitimate interests (f): making sure creators in age-restricted campaigns meet the UK advertising rules (the CAP Code), and preventing people from misstating their age or audience. |
| Betting and gaming paperwork: posting checklists and screenshots, letters of authorisation, evidence packs and compliance reports for operators (clause 6) | Your name (your legal name from your tax details, if you’ve given them), social media accounts, checklists and screenshots, check results; operator staff’s names and contact details | Legitimate interests (f) in helping operators and creators get the platform approvals and evidence that betting and gaming ads need, and in showing that campaigns followed the rules. |
| Paying creators: withdrawals and bank transfers | Identity, bank details, balance history | Contract (b); legal obligation (c) to keep accounting and tax records. |
| Collecting and checking creators’ tax details, and reporting their earnings to HM Revenue & Customs (clause 15) | Identity, contact, tax details, bank, earnings | Legal obligation (c) under the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023. |
| Brands’ Balance, top-ups, invoices, refunds and the views guarantee | Organisation and billing details, payments, proof of payment, campaign results | Contract (b); legitimate interests (f) for people acting for an organisation; legal obligation (c) to keep accounting and tax records. |
| Running the referral programme: linking a new member to the person who invited them, checking that the new member is genuinely new to Brief72 and isn’t the referrer under another name, and paying rewards | Identity, contact, account, bank details, sign-in IP addresses, company email domain, brand names and websites, coded records of closed accounts (clause 8.7) | Contract (b) for paying rewards; legitimate interests (f) in preventing fraud and misuse of the programme. A person on our team looks at every match before deciding anything. |
| Preventing fraud, fake views, abuse and security problems, and investigating breaches of our terms | Account, technical, usage, content, social media, messages | Legitimate interests (f) in protecting Brief72, Advertisers, Creators and the platform. For records of suspected offences, see clause 4. |
| Keeping records of the terms you accepted, what happens in your account and what our team does | Account, technical, usage | Legitimate interests (f) in keeping accounts secure, helping you, and being able to show what was agreed and done. |
| Service messages about your account, campaigns, payments, security and changes to our terms or this Policy | Identity, contact, account | Contract (b); legitimate interests (f). |
| Marketing emails (clause 11) | Name, email address, organisation, your email choices (the newsletter and, for creators, new campaign emails) | Creators: consent (a). People at companies: legitimate interests (f). Sole traders and partnerships who use Brief72 for their business: legitimate interests (f), with the “soft opt-in” under PECR regulation 22(3), only if you didn’t untick the newsletter box. We never send marketing to anyone who has said no. |
| Emailing business contacts about Brief72 (clause 3.4) | Name, work email address, company, where we got the details | Legitimate interests (f) in promoting Brief72 to businesses: people at companies only, unless they’ve agreed to hear from us, when it’s consent (a). |
| Website analytics on brief72.com (clause 13) | Cookie data, how the site is used | Consent (a), given through our cookie banner. |
| Using approved campaign videos in our own marketing: our website, presentations, social media accounts, case studies and awards entries | Approved videos, and the creator’s name or handle where shown | Legitimate interests (f) in promoting Brief72. We don’t do this if the brand has asked us not to, and you can object (clause 10). |
| Case studies showing what creators achieve on Brief72 (Creator Terms clause 20.7A) | Creator name and handles, profile photo, public profile information (bio, follower numbers, platforms, kind of content), town or city, content categories, campaign results and the audience figures for those campaigns (as totals or percentages), and quotes you’ve agreed. Never your legal name (unless it’s your creator name), contact details, date of birth, bank or tax details, ID or age check data, or earnings | Legitimate interests (f) in showing brands real results. You can turn this off in Settings or object at any time (clause 10): we stop new uses straight away and remove you from our website and our own social media accounts within 30 days. |
| Checking a business before we open an account it registered on our website, and getting in touch to welcome it | Your name, work email address, phone number and job title; your organisation’s name and website; public information about it (clause 3.3) | Legitimate interests (f) in making sure only genuine businesses use Brief72, and in welcoming new customers; contract (b) for sole traders and partnerships. |
| Our brand quiz: replying to you, seeing whether Brief72 could work for your brand, and following up (clause 3.4) | Your name, work email address, brand, phone number and website if you give them, your answers, the page you came from and campaign tags | Legitimate interests (f) in answering your enquiry and talking to you about Brief72. The newsletter only if you tick the box: consent (a). |
| Our e-book for creators: giving you the download and keeping a record of who downloads it (clause 3.4) | Your full name and email address, the date, the page you came from and campaign tags | Legitimate interests (f) in providing the e-book (including the email with its link) and seeing who it helps. Our emails only if you tick the box: consent (a). |
| Help requests, complaints and disputes | Identity, contact, account, messages | Contract (b); legitimate interests (f); legal obligation (c) for data protection complaints. |
| Defending or bringing legal claims, and complying with the law, court orders and regulators | Any relevant data | Legal obligation (c); legitimate interests (f) in establishing, exercising or defending legal claims. |
| Moving Brief72’s business, or part of it, to a new owner (for example in a sale or merger) | Any relevant data | Legitimate interests (f) in carrying out and completing the transaction. |
Where we rely on legitimate interests, we only do so where our interests aren’t outweighed by your rights and interests, and you can object at any time (clause 10).
Where we rely on consent, you can withdraw it at any time. That doesn’t affect anything we did before. Use the unsubscribe link in any marketing email, the newsletter setting in your account, “Cookie Settings” at the bottom of our pages on brief72.com, or email [email protected].
6. Sharing Your Data
We only share personal data where we have a lawful reason. We share it with:
- Advertisers (brands, agencies and operators): when you apply to a campaign, the Advertiser running it sees your name, profile photo, city, social media handles and links, follower counts, content categories, age group (never your date of birth), whether you fit the campaign’s ages, your “ID verified” mark and audience age groups (clause 4A), and the views you’re expected to get (never your fee). If you take part, they also see the videos you submit and the comments on them, how many attempts you have left, your post links, and the numbers from the views check, including those from your insights. If your place on their campaign closes or your fee is withheld, they also see the reason we give. If you agree to let the brand run your post as a paid ad, we give the brand what it needs to do that through the platform’s own tools. We don’t give Advertisers your email address or phone number. Each Advertiser decides how to use this data for its campaigns, so it’s a separate controller, responsible for its own use. Our Advertiser Terms only let Advertisers contact you through Brief72 and use your content as our terms allow.
- Betting and gaming operators, and the social media platforms: for betting, gaming and lottery campaigns, the operator also gets a compliance report for each campaign. For each creator it shows their name, platform, account and post link; whether their ID is verified, with the date (and any new check that’s due); whether they fit the campaign’s ages; the date they confirmed the betting and gaming declaration; whether each caption has the ad label, “18+” and a responsible play message; and each account’s audience under 18, with the date we checked it. The operator sees which items of your posting checklist you’ve ticked and whether we’ve checked them, but not your screenshots, and we may give it an evidence pack for the campaign with the same details. The platforms (Meta, TikTok and Google/YouTube) may need a letter of authorisation from the operator. It names you, using your legal name from your tax details if you’ve given them (otherwise your profile name), and lists your accounts on the campaign. The operator or you send it to the platform, and the platform’s own privacy policy then applies. Operators are separate controllers of what they receive.
- Service providers acting for us (processors): hosting for our web apps, database and files; the security network that all traffic to our sites passes through; the server that hosts brief72.com; email delivery for our account emails and newsletters; our team’s email accounts; a data-collection service that reads public social media profiles and posts; website analytics on brief72.com (only with your consent); Google’s spreadsheet and email services, where we keep brand quiz answers and e-book downloads and which send the e-book email; a bank details checking service (when we switch it on); and accounting and IT tools. They may use your data only on our instructions, under contracts that meet Article 28 UK GDPR.
- Google: when we use YouTube API Services (clause 3.3), under Google’s own privacy policy.
- Our bank: when we pay you, the name on your bank account, your sort code and account number, the amount and the reference. Our bank is a separate controller.
- HM Revenue & Customs (HMRC): once a year, as clause 15 explains. HMRC may pass the information to the tax authority where you live.
- Regulators, law enforcement and courts: where the law requires it, or where we reasonably think it’s needed to comply with the law, respond to a valid request, protect our rights, or prevent or investigate fraud or other crime (including reporting to the National Crime Agency). This includes the advertising and gambling regulators (such as the ASA and the Gambling Commission) and the Information Commission.
- Professional advisers and insurers: lawyers, accountants, auditors and insurers, in confidence.
- Social media platforms: when we check your accounts and posts, the platforms (or our data-collection service) receive requests for your public profile and posts. We don’t post for you, and we don’t send the platforms anything else about you, except when we report suspected fraud (below).
- Preventing fraud: if we suspect fraud, such as fake views, we may tell the social media platform involved, our bank and the Advertiser concerned what they need to know to deal with it, the Advertiser only as far as it needs it for its campaign (Creator Terms clause 23).
- The person who invited you, or whom you invited (referrals): if you join with someone’s invite, they see your first name and the initial of your surname, when you joined, your deadline and how far you’ve got (only the stages, never your earnings, the brands you work with or the reasons for any decision). If you invite someone, they see your first name and initial. Anyone who has your invite code or link can also see your first name and initial, so they know who invited them. We don’t email the people you invite: you share your link yourself. See our Referral Programme Terms.
- People who see our marketing: if we use an approved video or a case study in our own marketing (clause 5), anyone who sees it can see the creator, anyone else in the video, and the details clause 5 lists for case studies.
- A new owner of our business: if we sell, merge or restructure all or part of Brief72, your data may pass to the new owner, who must use it as this Policy says. We’ll tell you before that happens.
We don’t sell your personal data, and we don’t share it with others for their own marketing.
7. International Transfers
Our web apps, our database and the files you upload are hosted in the Netherlands, in the European Economic Area (“EEA”), by a hosting company based in the United States. brief72.com is hosted on a server in London. Traffic to all our sites passes through our security network, which has servers around the world. An encrypted backup copy of our database and files (never the photos of ID documents) is kept in the EEA, in storage provided by our security network, so we can restore our systems if our hosting fails.
Some of our providers are based in, or use staff or sub-processors in, countries outside the UK, mainly the United States. For example, our hosting company, our security network, the company that runs the brief72.com server and Google are US companies.
When personal data goes outside the UK, we rely on:
- UK regulations that approve transfers to that country (Article 45A UK GDPR), for example to the EEA, and to US organisations certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”); or
- where there are none, the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, or another safeguard allowed by Article 46 UK GDPR, after checking that your data will still be protected to a standard that isn’t materially lower than in the UK.
Email [email protected] for a copy of the safeguards for a particular transfer.
8. How Long We Keep Your Data
We keep personal data only for as long as we need it for the purposes in this Policy. The tables below give the period for each kind of data. When a period ends, we delete the data, or remove everything that identifies you and keep only anonymous figures. Our systems do most of this automatically every day.
8.1 Your account
| Data | How long we keep it |
|---|---|
| Your profile, settings and choices, and the social media accounts you’ve added (with their statistics and our team’s checks and notes) | While your account is open. A social media account you remove is deleted straight away, with its statistics. When your account is erased (clause 10), these are deleted, except the records in 8.8. |
| Accounts nobody uses | If nobody has signed in to an account for 24 months, and it has no money in it and no campaign running, we may close it after emailing at least 30 days before (Creator Terms clause 32; Advertiser Terms clause 29.1), and then erase it as clause 10 explains. |
| Sign-in records (IP address and its country, browser, operating system and time zone) | 12 months after the sign-in was last used. |
| Activity records (what you change and what goes wrong, with your IP address, and errors your browser reports) | 12 months; the pages you open, 90 days. Deleted when your account is erased. |
| Notifications in our web apps | 12 months. Our requests for your tax details are kept with your tax records (8.2). |
| Help messages, and our team’s notes about you | While your account is open. When it’s erased, we delete them, unless they’re about a dispute or a payment query: then we keep them with the records in 8.8. Copies in our team’s mailboxes, including any files you attached, are deleted 2 years after the last message. |
| Suspensions and bans, and why | While your account is open; after it’s erased, with the records in 8.8. |
| The terms you accepted, and the versions of this Policy you confirmed you’d read (when, which versions, your IP address and browser) | While your account is open; after it’s erased, with the records in 8.8, to show what was agreed. If we delete your account outright because there’s nothing to keep, we delete these too. |
8.2 Money and tax (creators)
| Data | How long we keep it |
|---|---|
| Your balance history, fees, withdrawals and our payments to you (amounts, dates and references) | While your account is open; after it’s erased, until 6 years after the end of our financial year in which your account closed or your last payment was made, whichever is later (tax and company law, and the time limit for legal claims). |
| Your bank details | While your account is open. When it’s erased, we delete the full account number, and keep the name on the account, the bank’s name, the sort code and the last 4 digits with your payments, for the period above. |
| Money still owed to you | If your account is closed while we still owe you money, we keep what we need to pay you (your name, email address and balance history) until we’ve paid you, even after the periods in this clause (Creator Terms clause 32). |
| Your tax details (legal name, date of birth, address, and National Insurance or other tax number), our checks on them, and our requests and reminders | While your account is open, and then until 31 December five years after the last calendar year in which we added a fee to your balance, even if you ask us to delete your account (Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023, regulation 3). |
| Our reports to HMRC, and your copy | Until 31 December five years after the year they cover. For example, the report for 2026 is deleted after 31 December 2031. |
8.3 Campaigns
| Data | How long we keep it |
|---|---|
| Your applications, the fee and expected views, and the decisions on them (with reasons) | Until 6 years after the end of our financial year in which the campaign ended. Then we delete the reasons and notes. The figures stay with your account, and become anonymous when your account is erased. |
| Videos and images you upload, their captions, and the comments on them | Ones that aren’t approved: deleted 90 days after the campaign ends, or when your account is erased, if sooner (except a video the brand paid for without it being posted, which we keep like an approved one). Approved ones: until 6 years after the end of our financial year in which the campaign ended, to show what was approved and posted, and for longer only while we’re using one in our own marketing (clause 5). The brand keeps its own copy as the owner. |
| Your post links and the views-check readings (the numbers, caption, hashtags, account, warning signs and our decision) | Until 6 years after the end of our financial year in which the campaign ended, as the record of what we paid you and what the brand bought. Then we delete the links, account names, captions and hashtags. The numbers stay with your account, and become anonymous when your account is erased. |
| Readings of your recent posts (for your expected views) | While the account is linked to Brief72, and no more than 12 months after each reading, except the latest figure for your expected views, which we keep while the account is linked. Readings from YouTube API Services, and the figures worked out from them (the latest included), are refreshed or deleted within 30 days, as YouTube’s rules require. All of them are deleted when you remove the account or your account is erased. |
| Betting and gaming posting checklists and their screenshots | Screenshots: 12 months after the campaign ends. What you ticked, when, and our check: with your campaign records, as above. |
8.4 Age, ID and audience checks
| Data | How long we keep it |
|---|---|
| Photos of your ID and selfie | Deleted 24 hours after our decision, or after 14 days if we haven’t checked them by then. |
| Screenshots of your audience ages | Deleted 90 days after we approve them (when the check stops counting), 24 hours after we ask you for new ones, or after 14 days if we haven’t checked them by then. |
| Your date of birth and the ID’s expiry date, as read from your ID | While your account is open. Deleted when your account is erased. |
| The record of each check: the type of ID, the result, who checked it and when, the reason for any rejection or new check, and your accounts’ audience age groups and follower counts | 6 years after the check, to show that campaigns met the advertising rules, except the ID check your verification still relies on, which we keep while your account is open. If we delete your account outright, we delete these too. |
| The betting and gaming declaration (which version, and when you confirmed it) | While your account is open; after it’s erased, with the records in 8.8. |
8.5 Brands, agencies and operators
| Data | How long we keep it |
|---|---|
| Your account, if you use Brief72 for a brand or agency (name, work email address, job title and phone number) | While your account is open. When it’s erased, we delete it, except your name and email address, which stay with the records of the campaigns and payments you dealt with (8.8). |
| Your organisation’s records: its name, website, logo, billing address and contacts; its campaigns and briefs, and the media you upload for them; its Balance history, top-up requests, invoices and refunds; and, for operators, the licence details, compliance contact, signatory, platform approvals and account IDs | While the organisation’s account is open, and then until 6 years after the end of our financial year in which its last campaign ended or its last payment was made. Then we delete the names, email addresses and phone numbers in them, and keep only anonymous figures. |
| Proof of payment you send with a top-up request | 12 months after the top-up is added to your Balance or the request is cancelled. |
| Screenshots of an operator’s platform approvals | Until 12 months after the later of the operator’s last betting or gaming campaign ending and the screenshot being added. A replaced screenshot is deleted straight away. The approval itself (its status, dates and who checked it) stays with the organisation’s records. |
8.6 Emails and marketing
| Data | How long we keep it |
|---|---|
| Your email choices: the newsletter and new campaign emails (when you said yes or no, and how) | While your account is open; after it’s erased, with the records in 8.8. |
| Our “do not email” list (email address, reason and date) | For as long as we send marketing emails, so that we never send you marketing again. |
| Our record of the marketing emails we’ve sent you (who, when, whether it was delivered, and the first name and company we addressed it to) | 2 years after each email. |
| Lists of business contacts we upload (email address, first name, company and where we got them) | Deleted once the email has gone out, or 90 days after we upload the list if it’s never sent. Our record of the email: 2 years, as above. |
| Your details on our email provider’s mailing lists (email address, name and organisation) | While you’re subscribed. Deleted when you unsubscribe or your account is erased. |
| Our email provider’s delivery records, and its copies of the emails it sends for us | Delivery records: 12 months. Copies of emails: 30 days. |
| Brand quiz answers (name, work email address, brand, phone number, website, answers and the newsletter choice) | 24 months after you send them or after our last conversation with you, whichever is later. If your brand joins Brief72, the details you need for your account move into it (8.5). If you tick the newsletter box, your email choice is kept as above. |
| E-book downloads (full name, email address and whether you ticked the box) | 12 months after you download it. If you tick the box, we keep your email address on our mailing list until you unsubscribe. |
| Case studies and other marketing material that shows a creator | While we use them. If you turn case studies off, object or close your account, we stop new uses straight away and remove them from our website and our own social media accounts within 30 days (material already printed or shared by others may stay). Approved videos the brand or we hold rights in are covered by 8.3. |
8.7 Referrals
| Data | How long we keep it |
|---|---|
| Referral records (who invited whom, the code, the checks and their results, decisions and reasons, deadlines, rewards and payment references) | While the referral is open. Then, if a reward was paid, until 6 years after the end of our financial year in which it was paid (or taken back, if later), and while a reward is still owed; if not, 12 months after the referral ended. If we delete an account outright, its referral record goes with it. |
| Coded records of closed accounts: keyed hashes (not the details themselves) of the email address, social media accounts, bank account, and name with date of birth | 3 years after the account is deleted or erased, only to check that new members of the referral programme are genuinely new. |
8.8 What we keep after your account is erased
When we erase an account (clause 10), we delete your personal details except:
- your name, the email address you used, and the records of payments and campaigns linked to them, with the bank details in 8.2;
- the terms you accepted (with the IP address and browser), any suspension or ban, your email choices and the betting and gaming declaration;
- help messages and our team’s notes about a dispute or a payment query;
- the record of your deletion request and what we did; and
- your email address on our “do not email” list, and the coded records in 8.7.
We keep these until 6 years after the end of our financial year in which your account closed or your last payment was made, whichever is later (tax and company law, and the time limit for legal claims), unless a row above gives a different period. Then we delete the names, email addresses, IP addresses, bank details, messages and notes, and keep only anonymous amounts. If your account had no payments, no place on a campaign and no ban, we delete it outright: only your email address stays, on our “do not email” list, with the coded records in 8.7.
8.9 Technical records and other data
| Data | How long we keep it |
|---|---|
| Your cookie choice on brief72.com | 12 months, in your browser. |
| Google Analytics cookies (only if you accept) | Up to 13 months after your last visit, in your browser. Google keeps the analytics data for up to 14 months. |
| Sign-in storage in our web apps | Until you sign out. Your sign-in ends after 30 days without use. |
| Server logs kept by our hosting providers and security network (IP address, the address requested, browser and time) | Up to 30 days. |
| Our audit log: records of what our team does, and of what happens in accounts | 6 years after each entry, except the record of your email choices (clause 8.6) and an erased account’s records (clause 8.8). |
| Copies in our database backups | Deleted within 3 months. We only use backups to restore our systems. |
| Records of legal claims, complaints and disputes | Until they’re resolved, and then 6 years. |
We keep data for longer only where the law requires it, or while we’re dealing with a complaint, a legal claim or an investigation that needs it.
9. Security
We protect personal data with measures suited to the risks, including:
- encrypted connections (HTTPS) to all our sites;
- passwords stored only in scrambled (hashed) form;
- photos of IDs, audience screenshots, posting checklist and platform approval screenshots, and proof-of-payment files encrypted and kept in private storage that’s never public;
- National Insurance numbers and other tax numbers, our reports to HMRC, and bank account numbers encrypted in our database, with a key that’s kept separately;
- campaign videos you upload reachable only through short-lived, signed links, given to signed-in people who are allowed to see them;
- access for our team limited by role: the most sensitive details, such as full National Insurance numbers, are shown only to senior staff, and every look is recorded;
- a record of what our team does in our admin tools;
- a firewall that only lets our security network reach the server for brief72.com;
- limits on repeated sign-in attempts; and
- deleting data at the end of its retention period (clause 8).
No online service can be completely secure. Please use a strong password that you don’t use anywhere else, and tell us straight away at [email protected] if you think someone else has used your account.
10. Your Rights
Under UK GDPR you have these rights, subject to some conditions and exceptions:
- To be informed about how we use your data, which is what this Policy is for.
- Access: to get a copy of the personal data we hold about you, and information about how we use it. We’ll search for it in a reasonable and proportionate way.
- Rectification: to ask us to correct inaccurate data or complete incomplete data.
- Erasure: to ask us to delete your data. This isn’t absolute: we may need to keep some data, for example to meet our tax and record-keeping duties or to deal with legal claims (clause 8).
- Restriction: to ask us to limit how we use your data in some situations.
- Portability: to get the data you gave us in a structured, commonly used and machine-readable format, and to ask us to send it to another organisation where that’s technically possible.
- Objection: see below.
- Rights about automated decisions and profiling: see clause 12.
- To withdraw consent at any time, where we rely on it.
- To complain to us and to the Information Commission: see clause 17.
Your right to object
You can object at any time to our use of your personal data based on legitimate interests, including profiling. We’ll stop unless we have compelling reasons that override your interests, or we need the data for legal claims. You can always stop our marketing, and if you object to it, we stop straight away. If you’d rather we didn’t use a video of you in our own marketing, tell us, and we’ll stop new uses within a reasonable time.
How to use your rights
Email [email protected] from your account’s email address, use the help button in our web apps, or write to us at our registered office (clause 2). We may need to check it’s you before we act, for example by asking you to sign in or to reply from your account’s email address, so that we don’t give your data to the wrong person.
We’ll reply within one month of getting your request, or of when we’ve confirmed it’s you or received anything else we asked you for. If your request is complex, or you’ve made several, we may take up to two more months, and we’ll tell you within the first month. We don’t normally charge. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, and we’ll tell you why.
Closing and deleting your account
You can ask us to delete your account in your settings (Delete account), where we ask you to tell us why you’re leaving, or by emailing [email protected] from your account’s email address, where you don’t have to give a reason.
If you’re a creator and we still owe you money (money in your balance, a withdrawal on its way, or a fee still to come from a campaign you’re on), you can’t close your account yet. Withdraw your money first, and you can close your account once it’s been paid to you (see the Creator Terms). Until then, you can ask us to stop all marketing, and to stop using your data for anything we don’t need to pay you.
Otherwise, we close your account straight away: you’re signed out and can’t sign in, and we stop sending you marketing. We email you to confirm. If you change your mind, reply to that email before your account is erased, and we’ll open it again.
Within 28 days, our team erases your account. We delete your personal data, except the records in clause 8.8, which we keep for the reasons given there, and we email you to confirm what we deleted, what we kept and why. If there are no payments, campaign places or bans to keep, we delete your account outright. If you asked by email and we need to check it’s you, the 28 days start once you’ve confirmed. Copies in our backups are deleted within 3 months.
If you use Brief72 for a brand or agency, your organisation’s campaigns and payment records stay with the organisation (clause 8.5). If you’re the only person on its team, we’ll contact you about what happens to the organisation’s account.
11. Marketing & Communications
We only send marketing emails where the law allows:
- Creators: only if you say yes (your consent). For our weekly email, tick the box when you sign up or turn it on in your settings. For an email when a new campaign you can take part in opens, say yes when you sign up or later in the app. We send creators no other marketing, including reminders to finish signing up, unless you’ve said yes.
- Brands and agencies: when you sign up, the box for The Brief, our weekly newsletter, starts ticked. If you leave it ticked, we may send you The Brief and other emails about our services, for example about starting your first campaign. If you untick it, we record that you said no, and we don’t send you marketing. For people at companies we rely on our legitimate interests. For sole traders and partnerships we rely on the “soft opt-in”, because you gave us your details when you signed up for our services, and you could say no then and can in every email.
- Business contacts who aren’t users: we may email people at companies (not sole traders or partnerships, unless they’ve agreed to hear from us) about Brief72. Before we send to a list, our team records where it came from and confirms that we’re allowed to email it. Each email says who we are, why you’re getting it and how to stop.
Every marketing email has an unsubscribe link, which works straight away, without signing in. You can also turn marketing off in your settings, or email [email protected]. If you unsubscribe from any of our marketing emails, we stop all of them, and keep your email address on our “do not email” list so it stays that way.
Our marketing emails don’t contain tracking pixels or tracked links, so we don’t know whether you open them or which links you click.
We also post new campaigns and news on our WhatsApp and Telegram channels. Joining them is up to you, in those apps. WhatsApp doesn’t show your phone number to other followers, or to us unless we already have it saved as a contact. On Telegram, other subscribers can’t see who has joined; as the channel’s admins, we can see the name Telegram shows for each subscriber, but not your phone number unless your Telegram settings allow it. WhatsApp’s and Telegram’s own privacy policies apply there.
We’ll still send you service messages about your account, campaigns, payments, security and changes to our terms or this Policy, even if you’ve turned marketing off.
We don’t use your data to show you adverts on other websites or apps.
12. Automated Decisions & Profiling
Some things on Brief72 are worked out automatically, by rules we’ve set. This is profiling: using your data to assess things about you. We don’t use artificial intelligence for it.
- (a) Your expected views and fee. When you look at a brief, we use the views on your recent posts on the campaign’s platform to work out a cautious estimate of the views a new post is likely to get. Your fee is that number of views at the campaign’s creator rate. The brief shows you the fee before you apply, and applying confirms it. If the brand accepts you, the fee is locked: the views your post actually gets don’t change it. Brands see your expected views, never your fee. If we can’t show a fee when you apply (for example, because your views are still being worked out), our team tells you the fee when you’re accepted, and you can withdraw without penalty.
- (b) Warning signs in the 5-day views check. After you add your post link, we check the post several times over 5 days. If there are no warning signs at the end, your fee goes into your balance automatically. Warning signs include: the post isn’t on one of your verified accounts, can’t be found, or is linked to another campaign; views fall between checks, or jump with hardly any new likes or comments; far more views than your account usually gets; very few likes, comments and shares for the views; no ad label, or one that isn’t at the start of the caption; a post made before the video was approved; for betting, gaming and lottery posts, no “18+” or responsible play message, an audience that’s too young, or an ID check that’s due; or not enough readings. A warning sign never refuses your fee by itself: it holds the fee for our team, and a person decides whether to pay it in full or not at all.
- (c) Which campaigns you see. We only show you campaigns you can take part in, based on your platforms and content categories, the brand’s choice of creator age range and gender, and whether you’ve hidden betting, gaming and lottery campaigns. If a brand chooses creators of one gender, you’ll only see its campaign if your profile shows that gender.
- (d) Betting, gaming and lottery applications. If your ID and audience checks aren’t done by the deadline, your application closes automatically, or your place goes to another creator (clause 4A). You can apply again, while the campaign is open, once your checks are done.
- (e) Tax details. If the name on your bank account or your date of birth doesn’t match your tax details, or you live outside the UK, our team checks them, and withdrawals wait until they have (clause 15).
- (f) Referrals. Possible matches with other accounts are flagged for our team, who decide. A referral that doesn’t qualify by its deadline ends automatically, and we tell you (Referral Programme Terms).
- (g) Time limits on a campaign. If the 72 hours to upload your video pass and you haven’t uploaded anything (Creator Terms clause 12.1), your place closes automatically, and we tell you. If something outside your control stopped you, ask us to look again: our team can give you more time or reopen your place.
The deadlines in (d), (f) and (g) close things automatically, because they’re time limits set out in our terms. You can apply again (d), or ask for a person on our team to look again (f and g), and they can reopen it. Otherwise, a person on our team makes or reviews every decision that goes against you, such as holding or refusing a fee, refusing an application, closing your place on a campaign for any other reason, or refusing a referral reward. Apart from those deadlines, we don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
Your rights: for anything in this clause, you can ask us to explain it, tell us your side, ask for a person on our team to look at it again, and challenge the result. Email [email protected] or use the help button in our web apps. We’ll reply within one month.
13. Cookies & Similar Technologies
On brief72.com we use one cookie to remember your cookie choice and, only if you click Accept, Google Analytics cookies, which help us see how people use the site. Our fonts are stored on our own servers. Our security network doesn’t normally set cookies, but if it has to check that a visitor isn’t a bot, it sets a short-lived security cookie.
Our web apps for creators and brands store only what they need in your browser: to keep you signed in and, in the creator app, to remember that you’ve closed the “add to home screen” tip. They don’t use analytics or advertising technologies.
We don’t use advertising cookies or pixels, and our marketing emails don’t contain tracking pixels. You can change your choice at any time with “Cookie Settings” at the bottom of our pages on brief72.com. Our Cookie Notice lists every cookie and how long it lasts.
14. Our Mobile Apps
Our iOS and Android apps are paused. You use Brief72 through our web apps, which you can add to your phone’s home screen. If the apps come back, we’ll update this Policy first, to explain the phone permissions they ask for.
15. Tax Details and Reporting to HMRC
UK law requires Brief72, as a digital platform, to collect and check creators’ tax details and to report their earnings to HMRC every year (the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023). Our lawful basis is legal obligation (Art. 6(1)(c)).
- When we ask: when we first add a fee to your balance, and then from time to time (no more than once every 30 days) until you’ve given them. You need them before your first withdrawal.
- What we collect: your legal name, date of birth, home address and National Insurance number (or, if you live outside the UK, your tax number and the country that issued it, or why you don’t have one); or, if you work through a company, its name, company number and address. We also use your bank details and, from your balance history, the fees we added to your balance each quarter and how many paid videos they were for.
- How we check them: our system checks that your National Insurance number is in the right format, and whether your date of birth and the name on your bank account match what we already hold. If something doesn’t match, or you live outside the UK or have no tax number, our team checks it, and withdrawals wait until they have. We may ask you to send us a document to show it.
- Who sees them: your National Insurance number is encrypted, and our team sees only its last 3 characters. Only senior staff can see the full number, and every look is recorded.
- Who receives them: HMRC, by 31 January after each calendar year in which we added money to your balance: your tax details, the bank account we paid you into, and the fees and referral rewards we added. HMRC may pass the information to the tax authority where you live. We give you a copy of what we report by the same date, in the creator app (Balance, then Tax details). If you close your account, we email you a summary of what we’ll report for that year.
- Letters for betting and gaming campaigns: if you take part in one, the operator’s letter of authorisation uses the legal name from your tax details (clause 6).
- If you don’t give them to us: your earnings stay in your balance, but you can’t withdraw them until you do.
- How long we keep them: see clause 8.2.
16. Children
Brief72 is only for people aged 18 or over, and brand and agency accounts are only for people acting for a business. We ask creators for their date of birth before they can apply to campaigns, and check it with photo ID for betting, gaming and lottery campaigns. If we learn that someone under 18 has an account, we close it and delete their data. If you’re a parent or guardian and think your child has given us personal data, please contact [email protected].
17. Data Breaches & Complaints
17.1 Data breaches
If we have a personal data breach that’s likely to put your rights at risk, we’ll report it to the Information Commission within 72 hours of becoming aware of it. If it’s likely to put you at high risk, we’ll also tell you without undue delay.
17.2 How to complain
If you’re unhappy with how we’ve handled your personal data, please tell us first: email [email protected], use the help button in our web apps, or write to us at our registered office (clause 2). We’ll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
You can also complain at any time to the UK’s data protection regulator, the Information Commission, which took over from the Information Commissioner’s Office (ICO) on 30 September 2026:
Information Commission
4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL
Helpline: 0303 123 1113
Website: ico.org.uk
If you live or work in another country, you can also complain to the data protection authority there.
18. Changes to This Policy
We may update this Policy, for example when the Services, our practices or the law change. We’ll publish each new version here, with its version number and date. Before an important change takes effect, we’ll tell you by email or in your account, unless the change only describes something we already do or is needed to follow the law. You don’t have to agree to this Policy: it explains how we use personal data. You can ask us for an earlier version at [email protected].
19. How to Contact Us
If you have any questions about this Policy or how we handle your personal data, please contact:
Brief72
Privacy queries: [email protected]
General queries: [email protected]
Legal queries: [email protected]
You can also write to us at our registered office, shown above.
© Brief72. All rights reserved.