Draft for legal review. This policy was written from what the Vively website and its code actually do as of the version date above. Items marked TODO need information or decisions from the business owner, and the whole document should be reviewed by a qualified professional for the laws that apply to Vively (including Korea's Personal Information Protection Act) before it is treated as final.
한국어 번역본은 준비 중입니다. TODO: provide an official Korean version
1. Who we are
Vively ("Vively", "we", "us") operates the website vivelyglobal.com, a marketplace where content creators living in or connected to Korea can apply to brand campaigns, and where brands can submit campaigns and find creators.
| Business name (상호) | Vively TODO: confirm registered legal entity name |
|---|---|
| Representative (대표자) | TODO: representative name |
| Business registration no. (사업자등록번호) | 486-56-00588 |
| Mail-order business report no. (통신판매업 신고번호) | TODO: add if applicable |
| Address (주소) | Seongsu-dong, Seoul, Republic of Korea TODO: full registered address |
| Phone (전화) | TODO: phone number |
| vivelyglobal@gmail.com | |
| Privacy officer (개인정보 보호책임자) | TODO: name, title and contact details |
2. What we collect
We only collect what the corresponding feature needs. The tables below list every field the website stores, grouped by where it comes from.
2.1 Creator accounts
Collected when you sign up as a creator (email/password or Google Sign-In) and when you edit your profile on My Page.
| Field | Required? | Why we need it |
|---|---|---|
| Email address | Required | Account login, verification codes, service emails |
| Password | Required (email sign-up) | Login. Stored only as a bcrypt hash — we cannot read it |
| Google account ID and profile picture | Only with Google Sign-In | Linking your Google login to your account; showing your picture |
| Username, full name | Required | Identifying you to brands and Vively staff |
| Gender | Required | Campaign targeting and creator search by brands TODO: consider making optional |
| Nationality, second nationality, country of residence | Nationality & residence required | Campaign targeting (e.g. campaigns for creators from a specific country) |
| Date of birth | Required | Confirming you meet the age requirement; age-range targeting by brands (only your age in years is shown to brands) |
| Phone number and country code | Required | Shared with a brand when you apply so they can coordinate the campaign TODO: consider collecting only at application time |
| Instagram handle | Required | Core of your creator profile; shown to brands |
| TikTok, YouTube handles; follower/subscriber counts | Optional | Profile completeness and matching. Counts are self-reported |
| Content categories, bio, portfolio URL | Categories required; others optional | Matching you to campaigns; shown to brands |
| Referral code you used / your own referral code / who joined with your code | Optional | Referral programme |
| Marketing preference and consent records (what you agreed to, when, which policy version) | Recorded automatically | Honouring your choices; proof of consent |
2.2 Campaign applications
When you apply to a campaign we store a snapshot of your name, email, phone, Instagram/TikTok handles, an optional message, the campaign, the date and the review status. The snapshot is what the brand sees.
2.3 Brand partner accounts
Collected when a company applies for a brand account.
| Field | Required? | Why we need it |
|---|---|---|
| Company name, business email, password (hashed), phone, industry, business address, website | Website optional | Account creation, review and contact |
| Business registration number (사업자등록번호) | Required | Verifying that the applicant is a registered business |
| Business registration certificate (PDF or image) | Optional | Same verification. Stored as a private (non-public) file; only Vively staff can generate a signed link to view it |
| Representative's name, job title, contact email | Contact email optional | Knowing who is responsible for the account |
| Campaign needs: influencer tiers, target regions, content categories, budget range, notes | Optional | Preparing proposals and matching |
| Consent records | Recorded automatically | Proof of agreement to these terms |
2.4 Contact form
The contact form on the Contact page does not send anything to our servers. It opens a pre-filled email in your own email app (company name, contact name, work email, target market, services of interest, project details); we receive it as an ordinary email and keep it in our mailbox.
2.5 Automatically collected technical data
- Server and hosting logs (IP address, time, requested URL, browser type) kept by the hosting providers listed in section 4 for security and troubleshooting.
- Rate-limiting records: short-lived counters keyed by IP address and/or email to block brute-force login and code-guessing attempts. They expire automatically within twice the limit window (at most a few hours).
- Browser storage: see the Cookie & Storage Policy. We do not use analytics or advertising trackers.
3. How we use it
| Purpose | Data involved | Basis TODO: legal to confirm per jurisdiction |
|---|---|---|
| Creating and running your account, logging you in, verifying your email | Account data, verification codes | Performing the service you asked for |
| Showing your creator profile to approved brands so they can invite you to campaigns ("Find Creators") | Profile fields listed in section 4.1 | Your consent at sign-up (required to use the platform) |
| Processing your campaign application and sharing it with the brand | Application snapshot | Performing the service; your acknowledgement when applying |
| Reviewing and approving brand accounts and campaigns | Brand account data, KYC document | Performing the service; legal obligations |
| Service emails: verification codes, password resets, application status, campaign invitations, referral notifications | Email address, name, campaign | Performing the service |
| Marketing emails about new campaigns and opportunities | Email address, name | Only if you opted in. No marketing email is currently sent. You can opt out any time (section 7) |
| Security: preventing abuse, brute-force attempts and duplicate accounts | IP address, email, timestamps | Our legitimate interest in keeping the service secure |
| Complying with law and resolving disputes | Whatever is required | Legal obligation |
We do not sell personal information and we do not use it for automated decisions with legal effects. Creator matching produces a ranked suggestion list for brands; a human at the brand or at Vively decides who is invited or selected.
4. Who we share it with
4.1 Brand partners
Before you apply: approved brand partners can search Vively creators from their dashboard. For each matching creator they see: username, full name, profile picture, bio (first 160 characters), content categories, nationality, country of residence, gender, age in years, Instagram/TikTok/YouTube handles, self-reported follower counts, and a match score with short reasons. Your email address and phone number are not shown at this stage.
When you apply to a campaign, the brand that owns it also receives your email address, phone number and any message you wrote. Brands agree in our Terms of Service to use this information only for that campaign.
4.2 Vively staff
Vively administrators can view creator and brand accounts, applications and uploaded documents to operate and review the service.
4.3 Service providers
These companies process data on our behalf under their own terms and security measures. They do not receive more than the feature needs.
| Provider | What it does for us | What it may receive |
|---|---|---|
| MongoDB Atlas | Database hosting | All stored account, application, campaign and consent data |
| Render | Hosts the API server | All requests to the API, including IP addresses in server logs |
| Cloudflare Pages | Hosts the website and forwards API requests to Render | Every page and API request, including IP address |
| Netlify | Alternative hosting used in development/preview | Same as above when in use |
| Brevo | Sends our emails | Recipient email address, name, and the email content (codes, links, campaign names). TODO: confirm whether open/click tracking is enabled in the Brevo account and disable it, or keep the disclosure in the sign-up consent |
| Cloudinary | Stores uploaded images and business registration documents | Campaign images and profile pictures (public); business registration certificates (private, signed-URL access only) |
| Google (Google Identity Services) | "Continue with Google" login | Only if you choose it: Google tells us your email, name, picture and Google account ID. The Google script loads only when you open the login dialog |
| Anthropic (Claude API) | Interprets a brand's free-text creator search and writes the short "why this creator fits" reasons | The brand's search text and, for candidate creators: an internal record ID, categories, nationality, residence, gender, age, follower count and the first 200 characters of the bio. No names, usernames, emails or handles are sent. Used only when an API key is configured; otherwise rule-based matching runs locally |
| jsDelivr | Delivers the Pretendard web font | Your IP address and browser details when the font file is requested |
4.4 Other disclosures
We may disclose information if required by law, to protect the rights and safety of users or Vively, or as part of a business transfer, in which case this policy continues to apply.
5. International transfers
Some providers above store or process data outside the Republic of Korea (for example in the United States). TODO: list the actual hosting regions for MongoDB Atlas, Render, Cloudinary and Brevo, and the safeguards relied on for overseas transfer under PIPA (e.g. consent wording or contractual protections).
6. How long we keep it
| Data | Kept for |
|---|---|
| Email verification codes (sign-up) | 10 minutes, then deleted automatically; also deleted once the account is created |
| Account-change / deletion confirmation codes | 10 minutes, then deleted automatically |
| Password reset links | 30 minutes or first use, whichever is sooner |
| Rate-limiting counters | At most twice the limit window (minutes to a few hours) |
| Creator account and profile | Until you delete the account (My Page → Delete account) or ask us to |
| Campaign applications | While your account exists. When you delete your account the application records are kept only in anonymised form (campaign, status, dates) with all personal fields removed TODO: confirm this retention and set a maximum period |
| Notifications, invitations, referral records | Deleted with your account (referral records of people you invited show "deleted-user" instead of your name) |
| Brand accounts and business registration documents | TODO: define retention for approved, rejected and closed brand accounts and for KYC documents (Korean commercial/tax law may require keeping some records for a fixed period) |
| Emails received through the contact form | TODO: define mailbox retention |
| Hosting provider logs | Per each provider's log retention TODO: confirm |
| Account-deletion audit rows | Indefinitely — they contain no personal data (only account type, who initiated the deletion and the timestamp) |
7. Your choices & rights
Depending on where you live you may also have rights to restrict or object to processing, to data portability, and to complain to a supervisory authority (in Korea, the Personal Information Protection Commission). To exercise any right, or to request deletion of a brand account or of data that is not covered by the self-service tools, email vivelyglobal@gmail.com with the subject "Privacy request". We will verify that the request comes from the account holder before acting on it. TODO: state the response deadline you commit to (e.g. within 10 days under PIPA guidance / 30 days under GDPR).
Brand visibility: showing your profile to approved brands is a core part of the creator service and cannot be switched off while your account is active. If you no longer want brands to see your profile, delete your account or contact us.
8. Security
- Passwords are stored only as bcrypt hashes. Login sessions use signed tokens that expire after 7 days.
- Sensitive account changes (profile edits, account deletion) require a one-time code sent to your email.
- Login, code and password-reset endpoints are rate-limited to slow down guessing attacks.
- Business registration certificates are stored as private assets that are not reachable at a public URL.
- All traffic uses HTTPS.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately.
9. Age requirement
You must be at least 17 years old to create a Vively creator account; sign-up asks for your date of birth and a confirmation, and accounts that do not meet the requirement are rejected. We do not knowingly collect personal information from anyone under 17. If you believe a younger person has created an account, email us and we will delete it. TODO (legal): confirm the minimum age and whether guardian consent is required for any age band under Korean law (e.g. under 14) or in other countries where creators live.
10. Cookies & storage
The website itself sets no cookies and uses no analytics or advertising trackers. It keeps your login session and a few preferences in your browser's local storage. Details, including third-party scripts, are in the Cookie & Storage Policy.
11. Changes to this policy
When we change this policy in a meaningful way we will update the version date at the top and, for changes that affect how we use data you already gave us, notify account holders by email or a notice on the site before the change takes effect.
12. Contact
Questions or requests about personal information: vivelyglobal@gmail.com · Privacy officer: TODO: name and contact