Privacy Policy

What we collect

When you sign in with Google we receive your name, email, profile photo and Google account ID. We do not store your Google password. When you connect Instagram, TikTok, Gmail, or other channels, we receive the OAuth scopes you approve at the time of consent.

When you run campaigns we hold the campaign brief, the creators on it, the messages sent and received, contract drafts and signed contracts, deliverables, and the record of money received from you and paid to creators.

Creator payment details

A creator who signs a deal submits, on our offer page, their legal name, contact email, country, and the account we should pay: bank account identifiers, a PayPal address, or a wallet address, depending on the method.

These details are encrypted at rest. Operators see only the last four characters of the account. Full details can be revealed only by a WaveSurge administrator, only with a stated reason, and every reveal is recorded in an audit log. They are shared with the payment provider handling that payment, and with no one else — a brand never sees a creator's bank details through WaveSurge.

Who we share it with

We do not sell personal data. We share data only with the sub-processors below, each for the purpose stated.

Payments

These are the processors that touch money. A creator's payment details go only to the provider actually handling that payment.

• Airwallex — bank transfers and card payments in from brands, and bank payouts out to creators. For a payout it receives the creator's legal name, entity type, full postal address, country, bank account identifiers (account number, IBAN, SWIFT/BIC, or the local clearing code for that corridor), the amount and currency, and a remittance-purpose code. For a card payment in, the payer's name and email; card details are entered on Airwallex's own page and never reach WaveSurge.
• Wise — bank transfers in from brands, and bank payouts out to creators. For a payout it receives the creator's legal name, whether they are an individual or a business, country, their address on the corridors that require it, and the local bank identifiers for that corridor (account number with routing number, sort code, IFSC, or institution and transit number, or IBAN with SWIFT/BIC), plus the amount and currency.
• PayPal — invoices to brands, and payouts to creators who elect PayPal. For a payout it receives the creator's PayPal email address or phone number, the amount, and a short payment reference. It receives no bank details from us. PayPal payouts are switched off at present: PayPal has not enabled payout sending on our account.
• Coinbase and OKX — stablecoin (USDC) payouts to a wallet. They receive the wallet address, the chain, the asset, and the amount. They do not receive the creator's name, address, or bank details from us. Stablecoin payouts are switched off at present.
• Stripe — credit purchases only. When you buy credits, Stripe receives your name, your email, and the credit pack and amount. Your card details are entered on Stripe's own hosted checkout and are never seen or stored by WaveSurge. Stripe is not a payout rail: it never receives creator payment details, and no creator is ever paid through it.

A processor listed as switched off receives no data while it is off. We list it because turning it on is a configuration change, and we would rather you knew now than found out afterwards.

Everything else

• DigitalOcean — hosting, the database, and file storage (uploaded creative and reports).
• Google — sign-in, and the Gmail API when you connect your mailbox so we can send and read campaign email on your behalf.
• Resend — transactional email: recipient address and message content.
• OpenRouter — the LLM gateway behind drafting, classification, and analysis. It receives the text we ask a model to work on, which can include message content and campaign briefs.
• Exa and xAI (Grok) — creator and company discovery search. They receive search queries built from your brief, not your customer data.
• Apollo — company and contact data for the Sales workflow.
• Slack — internal operational alerts to WaveSurge staff. An alert can include a campaign name, a creator handle, an amount, and a short excerpt of an inbound message.

Data-processing agreements

We rely on each provider's own published data-processing terms, which we accept when we open the account. WaveSurge does not yet have its own customer-facing data-processing agreement to offer, and we would rather say that than imply a document exists. If your procurement process requires one, email [email protected] and we will tell you honestly where we have got to.

How we use it

We use your data to operate the service: route inbound replies to the right campaign, attribute results, generate reports, surface metrics in your dashboard, and make and reconcile payments. We use it to send transactional email (login confirmations, receipts, milestone notifications, digests). With your separate consent we may send product updates.

Creator data

We aggregate publicly-available creator data (post counts, follower counts, engagement rate) to power discovery. We honor opt-out requests from creators within 30 days. Creator handles you privately add to your account are scoped to your workspace only.

Retention

Campaign and message data is retained for the life of your account plus 90 days after closure, so an account can be recovered. You can request earlier deletion of specific records via [email protected].

Records of money — what we received, from whom, and what we paid to which creator — are kept longer, and for a different reason. They are WaveSurge's own accounting records, and we have to be able to evidence a payment years later if a bank, a payment provider, a creator, or a brand asks about it. We keep them for at least five years from the date of the transaction. They are append-only by design: an error is corrected by a further entry, never by deleting one, so a deletion request cannot remove them.

We do not keep them for tax reporting, because we do not do any. WaveSurge does not collect tax identity documents (no W-9, no W-8BEN, no tax identification number), does not withhold tax from a creator's fee, and does not file information returns about creator earnings. A creator's payment details are stored per deal rather than per person, so we cannot produce a total of what one creator earned across deals in a year. Tax on a creator's fee is the creator's to report and pay, as their contract states.

A creator's stored payment details are retained while the deal is live, and afterwards as part of the payment record described above.

Your rights

Depending on your jurisdiction you may have rights to access, correct, port, or delete personal data we hold about you. Email us at [email protected] to exercise them. We respond within 30 days. Requests are handled by hand — we do not yet have a self-service export or deletion tool.

Children

WaveSurge is not directed at users under 18. If you believe we have collected data from a minor, contact us and we will delete it.

Changes

We will notify you by email before material changes take effect. Adding a payment sub-processor is always material.