Privacy Policy

PRIVACY POLICY

LAST UPDATE: [Will be dated during publication]

This PRIVACY POLICY is the entire personal data protection policy (hereinafter "Privacy Policy") for the OpenWild platform operated by [COMPANY_LEGAL_NAME].

We appreciate that you are trusting us with your personal information. We take your privacy very seriously. In this Privacy Policy, we seek to explain to you in the clearest way possible what information we collect, how we use it and what rights you have in relation to it.

Before accessing or using the application, please ensure that you have read and understood our Privacy Policy. If there are any terms in this Privacy Policy that you do not agree with, please discontinue use of our Services immediately.

If you have any queries about this Privacy Policy or data protection in general, please contact: [email protected]

1. GENERAL INFORMATION

   1. This Privacy Policy was drawn up by [COMPANY_LEGAL_NAME], a company registered at [REGISTERED_ADDRESS] (hereinafter "OpenWild", "we", "us" or "our") which is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share and protect data that identifies or is associated with you ("personal data") in relation to our web platform OpenWild, accessible at https://openwild.ai (as well as any related sub-domain, media form, web application, media channel, mobile website, linked or otherwise connected thereto), including the services offered on such website (hereinafter collectively the "Platform" or "Site"), and your choices about the collection and use of your information.

   1. This Privacy Policy will enter into force on the date stated above. If this document is updated, we will notify you of the revised versions through our regular channels. For more information regarding updates please see the section titled “Updates to the Privacy Policy” below.

   2. OpenWild is operated by [COMPANY_LEGAL_NAME], a company established in [COUNTRY_OF_ESTABLISHMENT], and is subject to the data protection legislation applicable to it in that jurisdiction. Please note that this Privacy Policy has been prepared primarily in line with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). Recognizing the global nature of the Internet, reference has also been made throughout this Privacy Policy to other jurisdictions and regulations which may be applicable to some Members and Users. However, we hereby expressly state that any such reference was made for ease of understanding and those persons who choose to access the Site from other locations do so on their own initiative; this does not mean or imply that OpenWild is subject to the laws and regulations of any such jurisdiction.

   3. Hereinafter, any natural person who registers to the Platform in order to produce and submit content shall be referred to as a "Creator". Any legal entity, or natural person acting for business purposes, which registers to the Platform in order to create and fund campaigns shall be referred to as a "Brand". Creators and Brands are together referred to as "Members". Any person who visits the Platform without registration shall be referred to as a "User". OpenWild hereby acknowledges its Data Controller status in respect of the personal data of Members and Users described in this Privacy Policy. Where a Brand processes personal data which it obtains through the Platform for its own purposes, that Brand acts as an independent data controller in respect of such processing and this Privacy Policy does not apply to it.

   4. OpenWild is a web-based user-generated content ("UGC") and influencer campaign marketplace. Brands create reward-based content campaigns and fund the corresponding reward pool; Creators produce content and publish it on their own social media accounts (Instagram, TikTok, YouTube and X); the Platform automatically monitors the performance metrics of the published content through the official application programming interfaces of those social networks, verifies submissions and allocates the reward to Creators who reach the campaign target. The Platform also offers artificial-intelligence assisted image and video generation tools for use in content production. This Privacy Policy applies to all products and services provided on the Platform to Members and Users by OpenWild as the Data Controller. However, this Policy is not applicable to any information collected offline or via channels other than the Platform, nor to the processing of your personal data by the social media platforms on which you publish your content.

   5. Please note that this Privacy Policy has been prepared in line with the OpenWild Creator Terms of Use and Brand Terms of Use, and OpenWild does not intend for the Platform to be used by persons who are prohibited from using the Platform as per those terms. The Platform is intended solely for persons who are at least eighteen (18) years of age. We do not knowingly collect personal data from persons under the age of 18. If we learn that personal data of a person under 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from a person under the age of 18, please contact us at [email protected].

2. WHAT IS PERSONAL DATA?

   1. “Personal Data” used throughout this Privacy Policy means in short personally identifiable information of Users and Members of the Platform that is collected through the Platform by OpenWild from User/Member and maintained by OpenWild in an accessible form, and by definition may include personal identifiers such as a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number, or any other identifier that permits the physical or online contacting of the User/Member, and any other information concerning the User/Member collected by OpenWild from User/Member and maintained in personally identifiable form in combination with any identifier described in this paragraph.

   2. This section is intended to provide you with a definition of personal data. Please see Section 4.2. titled “What Data Do We Use?” and Section 12 titled “Notice for California Residents; Categories of Personal Data Processed” for details regarding the data actually processed by OpenWild as a Data Controller.

3. ON WHAT BASIS DO WE COLLECT OR USE PERSONAL DATA?

   1. Data protection laws require that we meet certain conditions before we are allowed to use your personal data in the manner described in this Privacy Policy. To use your personal data, we will rely on one of the following conditions, depending on the activities we are carrying out:

      1. You have given us consent;

      2. Processing is necessary for our legitimate business interests or those of a third party: provided this does not override any interests or rights that you have as an individual.

      3. Processing is necessary in order to enter into or perform a contract with you.

      4. Processing is necessary for compliance with our legal obligations.

      5. Processing is necessary for legal claims.

      6. Processing is necessary for substantial public interest.

   2. Below you will find detailed information on the basis that we collect and use your personal data. If we look to use your personal data for any other purpose not covered in this Privacy Policy, we will let you know about any proposed new purposes before using your personal data in this way.

   3. Consent

      1. We ask that you provide affirmative and informed consent to the use of your personal data as described in this Privacy Policy when you access the Platform and participate in the Services. Please discontinue using the Services if you do not have such consent.

      2. As at the entry into force of this Privacy Policy we do not send marketing communications. We send only transactional messages that are necessary for the operation of your account and the Platform (such as e-mail address verification, password reset, e-mail change confirmation, campaign approval, claim result, submission status and payment notifications), together with in-app notifications. If we introduce newsletters, campaign announcements or any other commercial electronic communication in the future, we will obtain your separate and explicit consent in advance where required by applicable law, and you will be able to withdraw that consent at any time from your account settings or by using the unsubscribe link.

      3. We will also provide you with access to, or transfer your personal data at your written request, provided that we aren’t legally restricted from doing so or otherwise prevented from doing it due to circumstances beyond our reasonable control. Please relate your request for access to or transfer of personal data to [email protected]

      4. If we are relying solely on your consent to process your personal data, you may withdraw your consent to our processing of your personal data at any time; however, withdrawing consent may result in your inability to continue using some or all of the services in the Platform. Please note that the withdrawal of your previous consent will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent.

   4. Legitimate Interest

      1. Sometimes our collection and use of your personal data may not depend on your informed consent but our legitimate interests. It is in our legitimate interests to collect your personal data as it provides us with information that we need to provide our Services to you and to make our Platform available.

      2. This requires us to carry out a balancing test of our interests in using your personal data (for example, in order to provide you with access to the Platform, against the interests you have as a person and the rights you have under applicable data protection law (for example, to not have your personal data sold to third party marketing companies without your knowledge).

      3. The outcome of this balancing test will determine whether we may use your personal data in the ways described in this Privacy Policy. We will always act reasonably and give full and proper consideration to your interests in carrying out this balancing test.

      4. Our legitimate interests are: managing our business and relationship with you or your company/organization; understanding and responding to inquiries and Member and User feedback; understanding how our Members and Users use the Platform; identifying what our Members and Users want and developing our relationship with you, your company or organization; improving our Platform and offerings; managing our supply chain; developing relationships with business partners; sharing data in connection with acquisitions and transfers of our business.

   5. Contractual Performance

      1. Please note that when you become a Brand or a Creator of the Platform you enter into a contractual relationship with OpenWild via the relevant Terms of Use which you accept by use of our Platform. This contractual relationship necessitates the processing, use and storage of your personal data for the purpose of fulfilling our contractual obligations and/or facilitating our contractual rights. Therefore, at this stage the contractual relationship itself becomes the legal basis of our processing of your personal data.

      2. In short, we are permitted to hold and process some of your personal data because it is necessary to do so in order to provide you access to, and to enable you to make use of, the Platform. Without this personal data, we could not provide you with access to the Platform.

   6. Legal Obligations and Legal Claims

      1. We are permitted to process your personal data where it is necessary for compliance with our legal obligations. We are also permitted to process your personal data where it is necessary to establish, pursue or defend a legal claim.

      2. We may disclose your personal data to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users of the Services, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose personal data when we believe in good faith that such disclosure is required by and in accordance with the law.

   7. Substantial Public Interest

      1. We are permitted to process your personal data where it is necessary for reasons of substantial public interest, on the basis of data protection laws.

4. USE OF COLLECTED DATA

   1. We use your personal data to help us provide and support (the Services on) our Platform. This section provides you with details of what personal data we use and why we use it.

   2. What Data Do We Use?

      1. We collect information directly from you and in some instances from third party service providers whom you authorize to share your information with OpenWild.

      2. Depending on whether you are a User, a Creator or a Brand, the personal data collected from you will differ. As explained above, if you only visit https://openwild.ai without registering you are categorized as a User; the only personal data collected from Users is explained in the Section titled "Cookie Policy" below.

      3. Naturally, we collect more personal data from you when you sign up to the Platform as a Member. As a Member you provide more personal data including:

         1. account information, namely your first and last name, your e-mail address, the password you choose (which is stored only in irreversibly hashed form and is never stored in plain text) and the account type you select (Creator or Brand);

         2. user picture or “avatar” (in case it contains your personally identifiable information);

         3. details of your correspondence with us;

         4. technical information which we collect when you access the Platform, such as your Internet Protocol (IP) address, browser type and version (user agent), session records and session history, and server access logs;

         5. profile information which you provide when completing your profile: if you are a Creator, your username (handle), profile picture, short biography, country and social media links; if you are a Brand, your company name, website, description, logo and billing and tax details (legal name, tax number, country, address, city and postal code);

         6. we do not collect geolocation data. We only store the country which you declare yourself in your profile;

         7. in-app activity data, namely the campaigns you create or join, your submissions, claims, wallet and ledger movements and notifications;

         8. where you are a Creator and choose to connect a social media account, the access and refresh tokens issued by that social network (stored encrypted with AES-256-GCM) together with the publicly available profile information of the connected account (channel/account identifier, username, profile picture and follower count) and the performance statistics of the content you submit (view, like, comment and share counts);

         9. payment-related data, namely your Stripe customer identifier, Stripe connected account identifier, onboarding status flags, payment transaction references and the amounts and ledger records of your wallet movements. We never collect or store your card details or bank account details (please see the Section titled "Payment Data" below);

         10. security data, namely your two-factor authentication (TOTP) secret and backup codes, audit log records (the action taken, the acting person, IP address and user agent), and strike, ban and ban-appeal records; and

         11. the prompts and any reference images you enter into the artificial-intelligence tools offered on the Platform, together with the images and videos generated from them.

      4. For more detail on the personal data we process, please see Article 12 titled “Notice for California Residents; Categories of Personal Data Processed” below.

      5. Registration and login to the Platform are possible only with an e-mail address and password; we do not offer third-party login (such as Google, Apple or Facebook). However, after registration, a Creator may connect their YouTube (Google), Instagram (Meta) and TikTok accounts to the Platform through OAuth in order to enable submission verification and performance tracking; connection of an X (Twitter) account is under development. These connections are not a login method. When you connect an account we receive the profile information and content statistics described above from the relevant social network. We use the information we receive only for the purposes described in this Privacy Policy. You may disconnect a connected account at any time from your account settings. Please note that we do not control, and are not responsible for, the processing of your personal data by the relevant social network, and we recommend that you review its privacy policy.

      6. For registering as a Member, the provision of your first and last name, e-mail address, a password and your account type is mandatory, together with the verification code we send to your e-mail address: if this data is not provided you will not be able to create an account. In order to join a campaign as a Creator you must additionally complete your profile and connect at least one social media account, and in order to receive rewards you must complete Stripe Connect onboarding. In order to publish a campaign as a Brand you must additionally provide your company and billing details and fund your wallet.

      7. When you participate in a campaign as a Creator, we process your submission (the link to the content you have published on the relevant social network and any free-text note you add), the performance statistics of that content and the resulting claim and payment records, in order to verify that the campaign target has been met and to allocate the reward. This processing is necessary for the performance of our contract with you.

   3. You are able to view and update much of the information collected about you through your account settings. You may request a copy of all of your personal data stored on the Platform via the relevant sections of the Platform or by e-mail to us at [email protected].

      1. We automatically collect certain information when you visit, use or navigate the website www.openwild.ai. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Platform and other technical information which may lead to your identification. This information is primarily needed to maintain the security and operation of our Platform, and for our internal analytics and reporting purposes. Please refer to the section titled “Cookie Policy” and the sub-section titled “Service Providers Processing Data on Our Behalf” for more information on automatically collected personal data.

      2. As a Member, please remember that if you use the Platform to share personal data of persons who are not Members themselves (e.g. photographs, documents containing personal data such as receipts, video, etc.), you represent that you have read and understood the Terms of Use and agree to be bound by the conditions thereto. In these instances, you further represent that the individuals to whom this data relates have been informed of and have consented to such use and disclosure.

      3. When this product/service was designed, the possibility that it would be used to process special categories of personal data or data regarding criminal convictions and offenses was not taken into account. In fact, our Terms of Use specifically state that Members shall not use the Platform for any purpose or in any manner involving transmitting protected health information using OpenWild unless you have received prior written consent to such use from OpenWild

      4. Our Platform is intended for the use of persons above the age of eighteen (18) only. We do not knowingly collect personal data from children or minors. If OpenWild is made aware that a person under the age of 18 has provided us with personal data, we will deactivate the account and endeavour to delete that information from our databases. If you have questions about personal data that may have been submitted by a minor, please email us at [email protected].

      5. Card and bank account details are never collected or stored by OpenWild. Wallet top-ups made by Brands are transmitted directly to Stripe through Stripe Elements; the Platform stores only the Stripe customer identifier, the payment transaction references (PaymentIntent ID) and the amount and ledger records of the transaction. Rewards are paid out to Creators through Stripe Connect Express; identity verification documents, bank account and tax information are collected and stored directly by Stripe, and the Platform holds only the connected account identifier and onboarding status flags. Stripe processes this data as an independent controller under its own privacy policy, which is available at https://stripe.com/privacy.

   4. Why Do We Use Your Data?

      1. Service provision: we use the information to operate and administer the Platform, to create and manage your account, to publish campaigns, to enable Creators to join campaigns and make submissions, and to display campaign and profile pages;

      2. Communication: we process your e-mail address and account data in order to send you transactional e-mails and in-app notifications relating to your account and your campaigns (such as verification, password reset, campaign approval, claim result, dispute and payment notifications), and in order to deal with your enquiries and complaints. These messages are not marketing communications and are necessary for the provision of the service; you may not opt out of them while your account remains open;

      3. Platform monitoring: to check the Platform and our other technology services are being used appropriately and to optimize their functionality for the purpose of administering and improving our Services.

      4. Platform optimization: improve, test, and monitor the effectiveness of our Platform and diagnose or fix technology problems;

      5. Managing suppliers: we use information to manage third-party suppliers who deliver services to us;

      6. Campaign verification and performance measurement: we retrieve, at regular intervals, the view, like and comment counts of the content you publish through the official interfaces of the connected social networks, in order to determine automatically whether the campaign target has been reached and to trigger the claim process;

      7. Development: develop and test new products and features.

      8. Rewards, escrow and payouts: when a Brand creates a campaign, the total reward amount is deducted from the Brand's wallet and held in the reward pool. We process your account, submission, claim and wallet records in order to hold the reward, to allocate it upon approval and to execute the payout through Stripe. This processing is carried out on the basis of contractual performance. Wallet and ledger records are retained for the periods set out in the Section titled "Retention of Your Personal Data" in order to comply with tax legislation and to resolve any dispute regarding reward allocation;

      9. Artificial-intelligence assisted tools: the Platform offers artificial-intelligence assisted tools which enable Brands to prepare campaign briefs and Creators to generate images and videos. The prompts and reference materials you enter into these tools are transmitted to our service providers Anthropic, PBC and Features and Labels, Inc. (fal.ai) solely in order to generate the requested output; we do not send your account identity information to those providers, and the data is not used for the training or fine-tuning of artificial-intelligence models. Automated decision-making producing legal effects concerning you or similarly significantly affecting you is not carried out on the Platform. The automatic verification of campaign metrics is a purely technical measurement based on objective figures published by the social networks; where a claim is rejected you may object through the dispute process set out in the Terms of Use and obtain human review.

      10. Fraud prevention and platform security: we process IP addresses, user agent data, session and audit records, strike and ban records and connected account statistics in order to detect and prevent artificial engagement, fake accounts, multiple accounts, bot traffic and other misuse, to apply rate limiting and to secure the Platform;

      11. Legal and tax compliance: we process your account, transaction and ledger records in order to comply with our obligations under tax, accounting, anti-money-laundering and other applicable legislation, and to establish, exercise or defend legal claims.

   5. If we plan to use your personal data in the future for any other purposes not identified above, we will only do so after informing you by updating this Privacy Policy. See further the section of this Privacy Policy entitled “Updates to the Privacy Policy”.

5. COOKIE POLICY FOR OUR PLATFORM

   1. We use cookies on our website to distinguish you from other users of our Site. This helps us to provide you with a good experience when you browse our Site and also allows us to improve the Site.

   2. A cookie is a commonly used automated data collection tool. Cookies are small text files that are placed on your computer or device by websites that you visit or HTML-formatted emails you open, in order to make websites work, or work more efficiently, as well as to provide information to the owners of the Site.

   3. The Platform provides a login feature and therefore we use both session cookies and persistent cookies. Strictly necessary cookies are used for authentication, session management, two-factor authentication, protection against cross-site request forgery during social account connection, and bot protection; functional cookies are used to remember your interface preferences and trusted devices. We do not use any third-party analytics or advertising cookies (such as Google Analytics or Meta Pixel). Third-party cookies are set only on pages where external content is embedded, namely the Stripe payment element on wallet top-up pages and the social media post embeds displayed on submission review pages. Details of the cookies used on the Platform are set out in our Cookie Notice available at here. Please be advised that our Cookie Notice is an integral part of this Privacy Policy.

   4. You can set up your browser options, to stop your computer accepting cookies which require consent (such as social plug-in tracking cookies like those used for behavioral advertising, analytics or market research; third party cookies used for behavioral advertising) or to prompt you before accepting a cookie from the websites you visit. If you do not accept cookies, however, you may be unable to access certain parts of our Site or to receive certain Services. Please note that some cookies are necessary for the Site to perform its functions and may not be stopped (such as cookies that allow the processing of web server requests over a pool of machines instead of just one, authentication cookies, etc.) if the Site is to be used; these are noted as “necessary cookies” in our cookie policy.

   5. Your browser may feature a preference which alerts websites you visit that you do not want them to collect certain information about you. This is referred to as a Do-Not-Track (“DNT”) signal. Please note that our Site may not recognize or take action in response to DNT signals from your browser.

6. WHERE WE STORE YOUR DATA

   1. The Platform application, its PostgreSQL database and its Redis cache are hosted on infrastructure located in TÜRKİYE and operated by RNG Bilişim Teknolojileri San. ve Tic. Ltd. Şti. Files uploaded by Members (profile pictures, logos, brand assets and campaign covers) and artificial-intelligence outputs are stored in Cloudflare, Inc. R2 object storage, and all traffic to the Platform passes through the Cloudflare content delivery and security network. Processing of the information collected about you is only undertaken for the purposes described in this Privacy Policy.

   2. Although our servers and database are located in Türkiye, your personal data is transferred abroad through the service providers listed in the Section titled "Service Providers Processing Data on Our Behalf" below, namely to the United States (Stripe, Cloudflare, Google, Meta, fal.ai and Anthropic) and to Singapore (TikTok). Such transfers are carried out on the basis of the safeguards required by applicable law, including standard contractual clauses and, where the KVKK applies, the standard contract to be notified to the Turkish Personal Data Protection Authority, or your explicit consent where no other transfer mechanism is available.

   3. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. In particular, this means that your personal data will only be transferred where the recipient is bound by contractual clauses requiring the confidentiality and protection of personal data.

   4. Our Platform is accessible via the internet and may potentially be accessed by anyone around the world. Other users may access the Platform from outside the USA, EEA or the UK. This means that where you chose to post your data on our Platform, it could be accessed from anywhere around the world and therefore a transfer of your data outside of the EEA or the UK may be deemed to have occurred. You consent to such transfer of your data for and by way of this purpose.

7. DISCLOSURE OF YOUR PERSONAL DATA

   1. We do not sell, lease, rent or otherwise give away the personal data collected about you, and we do not have any feature enabling the sale of your personal data. Where we disclose your personal data to the service providers described below, we require them to comply with adequate privacy, confidentiality and security standards.

   2. Disclosure to Affiliates: where OpenWild has affiliated companies, your personal data may be shared with them for the purposes of providing the Platform, delivering our services, managing your account, IT, support, billing and communications.

   3. Disclosure to Brands: where you join a campaign as a Creator, the Brand which owns that campaign is shown your username (handle), profile picture, country, connected social media account and the link to and embedded view of the content you have published, together with the performance statistics of that content and any free-text note you add to your submission. The Brand is not shown your e-mail address, your billing or tax details or your Stripe account details. Where the Brand uses this information for its own purposes it acts as an independent data controller.

   4. We may disclose your personal data to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users of the Services, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose personal data when we believe in good faith that such disclosure is required by and in accordance with the law. In certain instances, it may be necessary for OpenWild to disclose the information that we’ve collected about you to government officials or otherwise as required by applicable law. No personal data will be disclosed to any law enforcement agency or governmental agency except in response to:

      1. A subpoena, warrant or other process issued by a court of competent jurisdiction;

      2. A legal process having the same consequence as a court-issued request for information, in that if OpenWild were to refuse to provide such information, it would be in breach of local law, and it or its officers, executives or employees would be subject to liability for failing to honor such legal process; or

      3. Where such disclosure is necessary for OpenWild to enforce its legal rights pursuant to the laws of the jurisdiction from which such information was gathered.

      4. For the avoidance of doubt, we would like to explicitly and unequivocally state that OpenWild has the right to fully cooperate with any law enforcement authorities or court order requesting or directing us to disclose the identity, or other information, of anyone posting or distributing any Material (as defined in our Terms of Use) on or through the Platform. We also reserve the right to access, review, monitor, display, read, preserve, store, and disclose any information and any Material as we reasonably believe is necessary. Please note that we may, upon request by another User or at our discretion, report Material as well as any information we have on such User to law enforcement officials in any relevant jurisdiction for criminal prosecution if we believe that Materials are in violation of applicable laws, this Privacy Policy, the Terms of Use or the best interest of any other User.

   5. We may also disclose your personal data, subject to appropriate confidentiality protections, in connection with a corporate re-organization, a merger or amalgamation with another entity, a sale of all or a substantial portion of our assets or stock, including any due diligence exercise carried out in relation to the same, provided that the information disclosed continues to be used for the purposes permitted by this Privacy Policy by the entity acquiring the information.

   6. The Platform may contain links to third party websites. When you click on a link to any other website or location, you will go to another site, and another entity may collect personal or anonymous data from you. We have no control over, do not review, and cannot be responsible for these outside websites or their content. Please be aware that this Privacy Policy does not apply to these outside websites or content, or to any collection of your personal data after you click on links to such outside websites. We encourage you to read the privacy policies of every website you visit. The links to third party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.

   7. Service Providers Processing Data on Our Behalf

      1. We may use contractors and service providers to process the information collected about you on our behalf for the purposes described in this Privacy Policy. We contractually require service providers to keep information secure and confidential and we do not allow our data processors to disclose your information to others without our authorization, or to use it for their own purposes. However, if you have an independent relationship with these service providers their privacy statements will apply. Please also see Article 6 above for information on where we store your data as it may contain information on service providers.

      2. Stripe, Inc. and Stripe Payments Europe, Limited (United States / Ireland): payment, escrow and payout services. Your e-mail address, transaction amounts and transaction references are transmitted from the Platform to Stripe; card details and billing address on the Brand side, and identity verification documents, bank account and tax information on the Creator side, are collected directly by Stripe and are not visible to the Platform. Privacy policy: https://stripe.com/privacy

      3. Cloudflare, Inc. (United States / global network): content delivery network, security proxy and R2 object storage. All Platform traffic (including IP address and request metadata) passes through Cloudflare, and Member uploads and artificial-intelligence outputs are stored in R2. Privacy policy: https://www.cloudflare.com/privacypolicy/

      4. Google LLC (United States): YouTube Data API and Gmail SMTP. Where a Creator connects a YouTube account, OAuth access and refresh tokens are stored by us and the channel identifier, channel name and video statistics are transferred from Google to the Platform; no personal data is sent from the Platform to Google for this purpose. Transactional e-mails sent by the Platform (recipient address and message content) pass through Google's infrastructure. Privacy policy: https://policies.google.com/privacy

      5. Meta Platforms, Inc. (United States): Instagram API with Instagram Login. Where a Creator connects an Instagram account, OAuth tokens are stored by us and the account identifier, username, profile picture, follower count and media statistics are transferred from Meta to the Platform. Privacy policy: https://privacycenter.instagram.com/policy

      6. TikTok Pte. Ltd. (Singapore): TikTok API. Where a Creator connects a TikTok account, OAuth tokens are stored by us and profile information (username, avatar) and video statistics are transferred from TikTok to the Platform. Privacy policy: https://www.tiktok.com/legal/privacy-policy

      7. Features and Labels, Inc. (fal.ai) (United States): artificial-intelligence image and video generation. The prompts entered by the Member and the URLs of any reference images are transmitted to fal.ai and the generated output is returned to the Platform.

      8. Anthropic, PBC (United States): campaign assistant and content studio prompt functionality (Claude API). The brief and prompt texts entered by the Member are transmitted; account identity information is not transmitted.

      9. RNG Bilişim Teknolojileri San. ve Tic. Ltd. Şti. (Türkiye): server hosting. The application, the PostgreSQL database and Redis are hosted on this infrastructure, and therefore all Platform data is physically located on this infrastructure.

      10. As at the entry into force of this Privacy Policy, no third-party analytics or marketing tool (such as Google Analytics or Meta Pixel) is integrated into the Platform.

8. RETENTION OF YOUR PERSONAL DATA

   1. We will retain your personal data for as long as needed to fulfill the purpose for which we collected it and for a reasonable period thereafter in order to comply with audit, contractual, or legal requirements, or where we have a legitimate interest in doing so. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

   2. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

   3. We may retain aggregated or de-identified data indefinitely or to the extent allowed by applicable law. We may retain personal data preserved in automatically generated computer backup or archival copies generated in the ordinary course of our information technology systems procedures.

   4. All retained personal data will remain subject to the terms of this Privacy Policy. Please note that if you request that your personal data be removed from our databases, it may not be possible to completely delete all of your personal data due to technological or legal constraints, though we will use reasonable efforts to do so.

   5. Without prejudice to the foregoing, we apply the following retention periods: account data is retained for as long as your account remains active and for six (6) months following closure of the account; wallet and ledger records are retained for ten (10) years in accordance with tax legislation; server access logs are retained for thirty (30) days; audit log records are retained for ninety (90) days; and records relating to strikes, bans and ban appeals are retained for ninety (90) days. Upon expiry of these periods, or where the purpose of processing ceases to exist, the personal data is deleted, destroyed or anonymised.

   6. Upon deletion or consent withdrawal, we will delete or anonymise your personal data in accordance with this Privacy Policy and applicable law. Aggregated statistical outputs already generated from your answers cannot be retroactively removed, as they do not identify you individually and are therefore unaffected by account deletion.

9. SECURITY POLICY

   1. The security of your personal data is important to us. We use commercially reasonable efforts to store and maintain your personal data in a secure environment. We also take technical, contractual, administrative, and physical security steps designed to protect any and all personal data you provide. We have implemented procedures designed to limit the dissemination of your personal data to only such designated staff as are reasonably necessary to carry out the stated purposes we have communicated to you in this Privacy Policy.

   2. Please note that you are also responsible for helping to protect the security of your personal data. For instance, never give out the credentials you use in connection with accessing the Platform, so that other people will not have access to your personal data. Furthermore, you are responsible for maintaining the security of any personal computing device on which you utilize the Services. We provide e-mail verification upon membership sign up and enable sign in only through the use of your password.

   3. We are not liable for disclosure of data due to errors in transmission, unauthorized access or acts by third parties, or omissions or acts beyond our reasonable control. Although we employ commercially reasonable measures of security, we also cannot guarantee that your personal data may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards by persons or systems with malicious intent.

   4. In the event we become aware of a security breach that could result in your personal data being disclosed in a manner that is not authorized under this Privacy Policy, we will notify you via e-mail (or other communication channel you have provided to us) if we can and use other means (such as posting a notice on our Platform) to try to alert you as appropriate.

   5. We have implemented the following security measures to protect its product or service:

      1. All traffic between you and the Platform is encrypted with TLS (Cloudflare and Let's Encrypt).

      2. Passwords are stored only in irreversibly hashed form (scrypt); plain-text passwords are never stored. Procedures are in place to ensure that only authorised personnel have access to personal data, and a non-disclosure and confidentiality agreement ensures that this continues to apply when a member of staff leaves.

      3. Optional two-factor authentication (TOTP) and backup codes are offered.

      4. OAuth tokens for connected social accounts are stored encrypted in the database using AES-256-GCM.

      5. IP-based rate limiting is applied to authentication endpoints in order to protect against brute-force attacks.

      6. Role-based access control (Creator / Brand / Admin) and server-side authorisation checks are applied, and administrative privileges are further differentiated among authorised personnel.

      7. An audit log (action, actor, IP address and user agent) is kept for all critical operations.

      8. We require e-mail verification on registration.

      9. Session cookies are set with the HttpOnly, Secure and SameSite attributes and sessions expire after seven (7) days.

      10. Schema validation is applied to every input (Zod) and webhook signatures are verified (Stripe).

      11. The database and Redis are accessible only from within the private network and Redis is password-protected.

      12. File uploads are performed through time-limited presigned URLs, and files are stored in Cloudflare R2 object storage which is not publicly listable.

      13. Card data never reaches the Platform servers; the PCI DSS scope remains with Stripe.

      14. We intend to work together with external security service providers to perform periodic penetration tests in order to ensure our protection against unauthorised access.

   6. We regularly revise the security measures outlined in this Privacy Policy to ensure that we are always fully prepared and up to date with regard to data protection.

10. MANAGING YOUR OPENWILD MEMBER STATUS AND ACCOUNT

    1. Username: Creators are required to choose a username (handle) which uniquely identifies them on the Platform. Your username may contain personal data such as your real name or another identifier. Please be aware that your username, profile picture and country are visible to the Brands whose campaigns you join and on the campaign pages on which your submission is displayed.

    2. Profile Picture and Brand Assets: Creators may upload a profile picture and Brands may upload a logo, brand images and videos and campaign cover images, or generate them using the artificial-intelligence tools. Depending on the material uploaded, this content may contain personal data and, where applicable, special categories of personal data. You must not upload material containing the personal data of third parties unless you have obtained the necessary consent or have another lawful basis for doing so.

    3. Notes on Submissions: any free-text note you add to a submission is visible only to the Brand which owns the relevant campaign and to authorised OpenWild personnel. There is no in-app messaging feature between Members.

    4. Email address: Members are required to provide an e-mail address. OpenWild sends e-mail verification requests to this address in order to secure your personal data. You can change your e-mail address only after you have verified the address you last provided.

    5. Deleting Your Account: Deleting your account will stop all services you receive on the Platform and will delete the data you have uploaded to the Platform, subject to the retention periods set out above. Please be aware that certain information cannot be deleted immediately: wallet and ledger records must be retained under tax legislation, and submissions relating to campaigns which have been completed or are subject to an ongoing dispute are retained until the dispute is resolved and for a reasonable period thereafter. Content which you have published on your own social media accounts is not affected by deletion of your OpenWild account and must be removed by you. Any reward which has accrued but has not yet been paid out at the date of deletion will be dealt with in accordance with the Terms of Use.

11. DATA LEAK PROTOCOL

    1. In the unfortunate event that something does go wrong, OpenWild will follow the following data breach protocol to ensure that data subjects are notified of incidents.

    2. A relevant internal data breach procedure is in place. OpenWild will set up a team in order to analyse the cause, the impact and the affected Members and Users. Depending on the outcome of this analysis, Members will be notified as soon as possible and in any event within seventy-two (72) hours of OpenWild becoming aware of the breach. Where the KVKK applies, the Personal Data Protection Authority will be notified within seventy-two (72) hours of OpenWild becoming aware of the breach and the affected data subjects will be notified within the shortest time reasonably possible; where the GDPR applies, the competent supervisory authority will be notified within seventy-two (72) hours.

    3. OpenWild will provide highly detailed information about:

       1. The nature of the breach, including a description of the incident, the nature of the personal data or categories of affected data subjects, an estimate of the number of affected data subjects and databases that may be affected, as well as an indication of when the incident occurred;

       2. Any measures already taken by OpenWild in order to stop the breach;

       3. Any measures to be taken by the affected data subjects (what can the affected data subjects themselves do, such as “keep an eye on your e-mails, change your passwords”, etc.);

       4. Any measures to be taken by OpenWild in order to prevent a future breach.

12. NOTICE FOR CALIFORNIA RESIDENTS; CATEGORIES OF PERSONAL DATA PROCESSED

    1. Please note that this notice for residents of the State of California is provided for the ease of said persons; however, the other provisions of this Privacy Policy are equally valid and in force for residents of the State of California. Also, Members and Users accessing this Privacy Policy from other locations may find this section useful.

    2. Please refer to Article 14 below for more information regarding your rights related to the personal information processed and how to pose questions or requests to us regarding your personal information.

    3. The chart below includes details on personal data or “personal information” collected for customers. Within the last twelve (12) months, we may have collected the following categories of personal information from the sources identified below for the business and commercial purposes indicated, and disclosed, shared, or sold (as indicated) such categories of personal information with the specified categories of third parties:

13. NOTICE FOR EU RESIDENTS; GDPR LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER GDPR 

    1. If you are a resident of one of the countries in the European Economic Area, the following provisions apply to you.

    2. We may process Personal Data under the following conditions: 

       1. Consent: You have given Your consent for processing Personal Data for one or more specific purposes. If we are relying solely on your consent to process your personal data, you may withdraw your consent to our processing of your personal data at any time; however, withdrawing consent may result in your inability to continue using some or all of the services in the Site. Please note that the withdrawal of your previous consent will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent.

       2. Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof. 

       3. Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.

       4. Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another natural person. 

       5. Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company. 

       6. Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company. Our legitimate interests are: managing our business and relationship with you or your company or organization; understanding and responding to inquiries and Member and User feedback; understanding how our Members and Users use the Platform; identifying what our Members and Users want and developing our relationship with you, your company or organization; improving our Platform and offerings; managing our supply chain; developing relationships with business partners; sharing data in connection with acquisitions and transfers of our business.

    3. In any case, the Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract. 

14. Your Rights under the GDPR 

    1. The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights. 

    2. You have the right under this Privacy Policy, and by law if You are within the EU, to: 

       1. Right to access: You have the right to access, update or delete the information We have on You. Whenever made possible, you can access, update or request deletion of Your Personal Data directly within Your account settings section. If you are unable to perform these actions yourself, please contact Us to assist You. This also enables You to receive a copy of the Personal Data We hold about You. 

       2. Right to request correction of the Personal Data: You have the right to have any incomplete or inaccurate information We hold about You corrected. 

       3. Right to object: This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground. You also have the right to object to where We are processing Your Personal Data for direct marketing purposes. 

       4. Right to erasure: You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it. 

       5. Right to data portability: You have the right to transfer your information to a third party in a structured, commonly used and machine-readable format, in circumstances where the information is processed with your consent or by automated means. You have the right to receive your Personal Data from us in a structured format and you have the right to (let) transmit such Personal Data to another controller. In that case we will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format.

       6. Right to withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, we may not be able to provide You with access to certain specific functionalities of the Service. 

15. Exercising of Your GDPR Data Protection Rights 

    1. You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, we will try our best to respond to You as soon as possible. 

    2. You have the right to complain to a Data Protection Authority about Our collection and use of Your Personal Data. For more information, if You are in the European Economic Area (EEA), please contact Your local data protection authority in the EEA. 

16. NOTICE FOR TURKIYE RESIDENTS; KVKK LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER KVKK

If you are a resident of Türkiye or if your personal data is processed within the scope of activities carried out in Türkiye, the following provisions will also apply to you in addition to the rest of this Privacy Policy.

1. What Kind of Personal Information Do We Collect?

The only personal data collected from User’s are explained in the Section titled “Cookies” above.

2. Naturally, we collect more personal data from you when you sign up to the Platform as a Member. As a Member you more personal data including:

   1. account and profile information such as your e-mail address, first and last name, username, profile picture, country, and (for Brands) company and billing/tax details;

   2. user picture or “avatar” (in case it contains your personally identifiable information);

   3. details of your correspondence with us;

   4. technical information, such as your Internet Protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, screen resolution, flash version, time zone setting, browser plug-in types and versions, operating system, platform and traffic data, cookies data, web logs and other communication data, and details of the resources that you access, as well as your sessions records, which we collect from you when you access the Platform; and

   5. campaign, submission, claim, wallet and payment records; connected social media account information and content statistics; security records (two-factor authentication, audit logs, strike and ban records); and prompts entered into the artificial-intelligence tools.

3. What Lawful Reasons Do We Have to Process Personal Data?

We collect and process your Personal Data one or more of the below-listed reasons:

1. Contract - We may process personal data to fulfill our contractual obligations.

2. Consent - We may rely on your freely given consent at the time you provide your personal data to us.

3. Legitimate interests - We may rely on legitimate interests based on our assessment that the processing is fair, reasonable and balanced.

4. Legal obligations and public interest - We may process personal data to fulfill legal obligations.

4. Transfer of Personal Data Abroad

   1. Your personal data is stored on servers located in Türkiye. However, it is transferred abroad through the service providers listed above, namely to the United States (Stripe, Cloudflare, Google, Meta, fal.ai and Anthropic) and to Singapore (TikTok). Such transfers are carried out on the basis of the safeguards recognised under the KVKK, in particular the standard contract notified to the Personal Data Protection Board ("KVKK Board") within five business days of its execution, an undertaking approved by the KVKK Board, or your explicit consent where no other transfer mechanism is available. OpenWild has taken or will take the necessary steps to ensure compliance with the KVKK Board's decisions on international transfers.

5. Data Subject Rights

   1. Under KVKK, you have the right to:

1. learn whether your personal data is being processed;

2. request information about the processing;

3. learn the purpose of processing and whether data is being used consistently with that purpose;

4. learn the categories of third parties to whom data has been transferred domestically or abroad;

5. request rectification of incomplete or inaccurate data;

6. request erasure or destruction of personal data where the grounds for processing no longer exist;

7. request notification of rectification or erasure to third parties to whom data has been disclosed;

8. object to processing carried out solely by automated means that produces a result to your detriment; and

9. claim compensation for any damage arising from unlawful processing.

You may exercise these rights by submitting a request to [email protected] with "KVKK" in the subject line, or by any other method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We will respond as soon as possible and in any event within thirty (30) days of receipt.

17. UPDATES TO THE PRIVACY POLICY

    1. We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Entry Into Force" date and the updated version will be effective as soon as it is accessible. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes on the Platform or by directly sending you a notification through the Platform. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your personal data.

18. QUESTIONS AND REQUESTS ABOUT YOUR PERSONAL DATA ("CONSUMER REQUEST”)

    1. As a Member or User of OpenWild you may request the following from OpenWild as Data Controller;

       1. Access to your personal data.

       2. Rectification or deletion of your personal data.

       3. A restriction on the processing of your personal data.

       4. Object to the processing of your personal data.

       5. A transfer of your personal data (data portability) in a structured, machine readable and commonly used format.

       6. Withdraw your consent to us processing your personal data, at any time.

    2. Please note that withdrawing your consent is only effective provided that consent is the only basis for the processing of relevant personal data. Similarly, even if you request the deletion of any personal data, we will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

    3. You can make a request in relation to any of the above rights by writing to us at the contact address given at the end of this Privacy Policy. Only you, or someone legally authorized to act on your behalf, may make a consumer request related to your personal data. You may also make a consumer request on behalf of your minor child.

    4. We will respond to such queries as soon as reasonably possible and deal with requests we receive from you, in accordance with the provisions of any applicable data protection law. Please note that you also have the right to appeal our responses to your consumer requests regarding this privacy policy. You can make your appeals to us using the same contact information below.

19. CONTACT US

    1. You can contact us via post or email.

       1. Via post:

[COMPANY_LEGAL_NAME]

Attn: Privacy

[REGISTERED_ADDRESS]

2. Via email:

[email protected] with “Privacy” in the subject line

2. If your letter or email involves one of the requests listed above in the section titled “Questions and Requests About Your Personal Data”, we may ask you to verify your identity before fulfilling your request depending on the method of your request.