Privacy Policy
Effective date: 29 July 2026. Last updated: 17 October 2026.
This policy explains what personal data CreatorCount collects, why we collect it, how long we keep it, and the rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
CreatorCount is operated by Jack Wilson, a sole trader established in the United Kingdom (“CreatorCount”, “we”, “us”). We are the data controller for the personal data described in this policy.
Postal address: 20 Wenlock Road, London, England, N1 7GU, United Kingdom
Email: hello@creatorcount.com
We are not required to appoint a Data Protection Officer. Privacy questions go to the email address above.
2. What CreatorCount does
CreatorCount gives brands and agencies (each a “workspace”) a dashboard showing how the public TikTok videos and Instagram Reels of the UGC creators they work with are performing. A creator appears in a workspace only after they have personally connected their own account, through TikTok’s official Login Kit or Instagram’s own login, and granted consent on that platform’s consent screen.
We access TikTok data through TikTok’s official Display API, read-only. We cannot post, edit, delete, or interact with anything on a creator’s TikTok account.
We access Instagram data through Meta’s official Instagram API with Instagram Login, read-only. We cannot post, edit, delete, comment, send messages, or interact with anything on a creator’s Instagram account. Only Instagram professional accounts (creator or business accounts) can be connected, because Instagram provides these statistics to apps only for those accounts. Connecting Instagram is optional and separate from TikTok: a creator connects one TikTok account, and can also connect one or more Instagram accounts, each of which is connected, removed and deleted on its own.
Creators who have connected TikTok can also create an optional CreatorCount account. It lets them sign in to a creator dashboard showing their own TikTok statistics, the workspace’s monthly bonuses, and how they rank against the other creators on the same workspace’s roster. The creator dashboard, bonuses and rankings use TikTok data only.
3. Personal data we collect
3.1 Creator data received from TikTok
When a creator authorises CreatorCount, we request exactly three TikTok scopes and nothing more:
- user.info.basic — TikTok Open ID and Union ID, display name, and avatar image URL
- user.info.stats — follower count, following count, total likes count, and total video count
- video.list— the creator’s public videos: the TikTok video ID, post date, title, description, duration, cover image URL, share URL, and the view, like, comment, and share counts for each
We also store the OAuth access and refresh tokens that TikTok issues, the scopes granted, and their expiry times, so that we can keep statistics up to date without asking the creator to reconnect daily.
3.2 Creator data received from Instagram
When a creator connects an Instagram professional account, we use Meta’s Instagram API with Instagram Login and request exactly two Instagram permissions and nothing more:
- instagram_business_basic— the account’s Instagram IDs (its account ID and the IDs Instagram assigns to it for CreatorCount), username, name, account type, profile picture URL, and follower, following and post counts; and, for each Reel, its ID, caption, link, thumbnail image URL, post time, and like and comment counts
- instagram_business_manage_insights — statistics for each Reel: views, reach, likes, comments, shares, saves, average watch time, total watch time, and skip rate (the share of views skipped within the first three seconds); and, where a Reel is also shared to Facebook, its views across Instagram and Facebook combined and its views on Facebook
We collect Reels only. To find them we read the account’s list of posts, which includes each post’s type; posts that are not Reels, such as photos and carousels, are discarded and not stored.
Instagram counts views, likes and comments from organic activity only, so they leave out paid promotion and can be lower than the figures Instagram shows in its app for a boosted Reel. Meta can take up to 48 hours to update these statistics, so the most recent figures may lag behind.
We also store the access token that Instagram issues for each account (valid for about 60 days, which we renew before it expires), the permissions granted, and its expiry time. Instagram does not issue a separate refresh token.
3.3 Data we generate ourselves
- A label chosen by the workspace to identify the creator internally (for example “Sarah – skincare account”)
- An invitation link token used to tie a creator’s TikTok or Instagram authorisation to the right workspace. The same link lets the creator reconnect later or create their CreatorCount account
- Connection status and timestamps for each connected account: when it was connected, when it was last refreshed, and any error returned by TikTok or Instagram on the last refresh
- A time-series history of the statistics above. We refresh TikTok about every six hours. We refresh Instagram on the same six-hour cycle, checking recent Reels each time and older Reels daily or weekly. Whenever a video or Reel has changed we store a dated snapshot so the dashboard can show performance over time
- For each Instagram account, a record of the creator’s consent: when it was given, which version of our consent wording they saw, the permissions they granted, and the workspace they agreed to share with
3.4 Workspace account data
For the person administering a workspace, we hold the email address used to sign in and a session cookie that keeps them logged in. The sign-in cookie is strictly necessary for the service to function.
3.5 Creator account data
If a creator chooses to create a CreatorCount account, we hold the email address they sign in with and their password. The password is stored only as a one-way scrypt hash, so we cannot read it. While they are signed in we keep a session record (a hash of the session token and its expiry) and set a session cookie.
3.6 What we never receive
We do not receive or store TikTok passwords, private or draft videos, direct messages, comment content, audience demographics, or the email addresses and phone numbers attached to a creator’s TikTok account. TikTok never shares credentials with us; the authorisation happens entirely on TikTok’s own systems.
Likewise, we do not receive or store Instagram passwords, direct messages, Stories, the text of comments, audience demographics, the identities of followers, or the email addresses and phone numbers attached to an Instagram account, and we receive nothing from private Instagram accounts or from accounts that have not connected to CreatorCount themselves. Instagram never shares credentials with us; the authorisation happens on Instagram’s own systems.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Showing a creator’s public profile and video statistics to the one workspace they authorised | Consent (Art. 6(1)(a)), given by the creator on TikTok’s consent screen |
| Storing dated snapshots so the workspace can see performance trends over time | Consent (Art. 6(1)(a)) |
| Refreshing OAuth tokens and running the sync, about every six hours, that keeps figures current | Consent (Art. 6(1)(a)) |
| Showing a creator’s Instagram profile and Reel statistics to the one workspace they authorised, storing dated snapshots of them, and renewing the Instagram access token and running the sync that keeps them current | Consent (Art. 6(1)(a)), given by the creator on our connect page and on Instagram’s authorisation screen. We keep a record of when it was given and what it covered |
| Where we are only told that access to an Instagram account was removed (not asked to delete), keeping its data hidden for up to 30 days so it can be restored if the creator reconnects, and then deleting it | Legitimate interests (Art. 6(1)(f)) — letting a creator who reconnects carry on without losing their history. Nobody can see the data while it is hidden, and the creator can ask us to erase it sooner |
| Operating, securing, debugging, and maintaining the service; keeping records of consent and deletion requests | Legitimate interests (Art. 6(1)(f)) — running a secure, reliable service and being able to demonstrate compliance |
| Showing a creator’s TikTok statistics, videos and bonus standings to the other creators on the same workspace’s roster | Consent (Art. 6(1)(a)), given on the connect page, which says so before the creator connects |
| Providing a creator’s CreatorCount account and signing them in | Contract (Art. 6(1)(b)) — providing the account they asked for |
| Authenticating the workspace administrator | Contract (Art. 6(1)(b)) — providing the service they signed up for |
Where we rely on consent, a creator can withdraw it at any time (see section 8). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
We do not sell personal data, we do not use it for advertising or profiling, we do not use it to train machine learning models, and we do not make automated decisions that produce legal or similarly significant effects. Bonus standings are calculated automatically from the statistics, but whether and what to pay any creator is decided by the workspace, not by CreatorCount.
5. Who we share data with
A creator’s data is visible to the single workspace they authorised. Their TikTok data is also visible to the other creators on that same workspace’s roster who sign in to a CreatorCount account: they can see the creator’s name and avatar, the titles, cover images and links of their public videos, the counts and monthly gains for those videos, and their ranking and bonus standings. The connect page tells creators this before they connect. A creator’s data is never shown to other workspaces or to creators on other workspaces’ rosters.
Instagram data is shown only to the single workspace the creator authorised. It is not shown to other creators, including those on the same roster, and it is not part of the creator dashboard, roster rankings or bonus standings described above, which use TikTok statistics only.
A workspace can also read its own creators’ statistics through a private, read-only data connection, for example from an AI assistant the workspace chooses to use. Data the workspace retrieves that way is under the workspace’s control. This connection covers TikTok statistics only; Instagram data is not available through it.
We use the following processors to run the service:
- Vercel Inc. (United States) — application hosting and the scheduled jobs that refresh statistics
- Neon Inc. (United States) — the PostgreSQL database where the data described above is stored
Each is bound by a data processing agreement permitting them to process data only on our instructions. We also exchange data with TikTok (TikTok Information Technologies UK Limited and its affiliates), which is the source of the creator data and an independent controller of it under its own privacy policy.
We also receive data from Meta (Meta Platforms, Inc. and its affiliates), which operates Instagram. Meta is the source of the Instagram data described above and an independent controller of it, not our processor, under its own privacy policy. Meta may notify us when a creator removes CreatorCount from an Instagram account or asks for that account’s data to be deleted, and we act on those notifications as described in section 8.
We may also disclose data where we are legally required to, or to establish or defend legal claims. If the business is ever sold or transferred, data may pass to the acquirer, who would remain bound by this policy.
6. International transfers
Our hosting and database providers store and process data in the United States. This means personal data is transferred outside the United Kingdom.
For these transfers we rely on the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, incorporated into our agreements with Vercel and Neon, and where applicable on those providers’ certification under the UK Extension to the EU–US Data Privacy Framework. You can request a copy of the relevant safeguards by emailing us.
7. Security
- TikTok access and refresh tokens and Instagram access tokens are encrypted at rest with AES-256-GCM using a key held separately from the database. They are never sent to a browser, never shown to a workspace, and never shared with a third party.
- Creator account passwords are stored only as one-way scrypt hashes, and creator session tokens only as SHA-256 hashes, so a copy of the database would not reveal either.
- All traffic to and from the service is encrypted over HTTPS.
- The dashboard is behind authentication, and each workspace can query only its own creators.
- The invitation link that starts the connect flow is a single-purpose random token, and the authorisation flow is protected against cross-site request forgery.
- Removal and deletion notifications from Meta are acted on only after their cryptographic signature has been verified.
No system is perfectly secure, but if a breach occurs that risks people’s rights and freedoms we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell affected people directly where the risk to them is high.
To report a security vulnerability, email hello@creatorcount.com. Our security contact details are also published at /.well-known/security.txt.
8. Retention and deletion
We keep a creator’s data for as long as their connection to a workspace is active, because the product’s purpose is to show performance over time. It ends in any of the following ways:
- The creator revokes access in TikTok. In the TikTok app, go to Settings and privacy → Security and permissions → Manage app permissions, and remove CreatorCount. All future syncing stops immediately. Ask us to erase the history we already hold and we will.
- The creator removes CreatorCount in Instagram. In the Instagram app, go to Profile → Menu → Website permissions → Apps and websites → Active, and tap Remove next to CreatorCount. On the web: More → Settings → Website permissions → Apps and websites → Active → Remove. Do this for each Instagram account you connected. When a creator removes CreatorCount in their Instagram settings, Meta tells us and asks us to delete their data. We stop syncing and permanently delete that Instagram account’s data straight away: its profile details, its Reels and their snapshots. If we are only told that access was removed, we hide the data immediately and delete it within 30 days unless the creator reconnects the same account, in which case the hidden data is restored. The creator’s TikTok data and any other Instagram account they have connected are not affected.
- The creator asks Meta to delete their data. If Meta sends us a data deletion request for an Instagram account, we permanently delete that account’s Instagram data (profile details, Reels, snapshots and access token) and return a confirmation code. Meta gives the creator that code and a link to creatorcount.com/data-deletion, where they can check that the deletion is complete. Afterwards we keep only the code, a one-way hash of the Instagram account ID, the request’s status and its dates, so we can show the request was handled.
- The workspace removes the creator. This revokes our TikTok token, deletes our Instagram tokens, and permanently deletes the creator record together with every video, Reel and snapshot belonging to it, and the creator’s CreatorCount account and sessions. Instagram gives apps no way to withdraw their own access, so the creator can also remove CreatorCount in Instagram as described above.
- Either party asks us directly. Email hello@creatorcount.com and we will erase the data within 30 days and confirm when it is done. These instructions are also at creatorcount.com/data-deletion.
Deletion is a hard delete, not a flag. Backups held by our database provider are overwritten on a rolling cycle and are fully cycled out within 30 days. If a workspace closes its account, we delete its creators and their data within 30 days.
9. Your rights
Under UK data protection law you have the right to: be informed about how your data is used; access a copy of it; have inaccurate data corrected; have your data erased; restrict or object to our processing of it; receive it in a portable, machine-readable format; and withdraw consent at any time.
To exercise any of these, email hello@creatorcount.com. We respond within one month, and we do not charge for it. We may ask you to confirm your identity — normally by demonstrating control of the TikTok or Instagram account concerned — so that we do not disclose data to the wrong person.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113). We would appreciate the chance to put things right first.
10. Cookies
We use a small number of strictly necessary cookies: a session cookie that keeps a workspace administrator signed in (30 days); a session cookie, cc_creator, that keeps a creator signed in to their CreatorCount account (30 days); and two short-lived cookies, tt_oauth_nonce and ig_oauth_nonce, used during the TikTok and Instagram authorisation flows to protect against cross-site request forgery (10 minutes each). We do not use advertising, analytics, or tracking cookies, which is why you are not asked for cookie consent.
11. Children
CreatorCount is a business tool and is not directed at children. In keeping with TikTok’s and Instagram’s own minimum age, creators must be at least 13 years old (and old enough under local law to consent to this processing) to connect an account. If we learn that we hold data about a child below that age, we will delete it.
12. Changes to this policy
We will post any changes on this page and update the effective date above. Where a change materially affects how we use personal data, we will contact affected workspaces and, where we rely on consent, ask for it again.