Privacy policy

Most of it comes from you.

Your account

• Your email address. If you sign in with Google, Google also shares your name and profile picture. There are no passwords.
• Your name, your company if you add one, what you use Enaloop for, your feed filters, your email settings and when you accepted the terms.
• Two-step verification, if you turn it on: the secret your authenticator app shares with us, stored encrypted, and your backup codes, stored only in a form that can't be turned back into the codes.

Your creator profile, if you make one

You create it yourself, or start from a private draft our team prepared for you (see Drafts we prepare for creators). Nothing is listed until you publish it and our team reviews it.

• Profile: display name, handle, photo, headline, bio, country and city, languages, what you offer, creator types, formats, niches, availability, starting rate, whether you're open to barter, and social links with any follower counts you type in and their dates.
• Showcase: links to up to 12 public TikTok or YouTube posts (Instagram posts later), the details the platform provides (such as title, author and thumbnail), and your confirmation that you made any post on someone else's account.
• Contact details: phone, WhatsApp and business email, if you add them, and your choices about showing and exporting each one.
• Link-in-bio page: up to 10 links you add, each a title and an address, and which ones you hide.
• Media kit: which sections you leave out of your media kit.
• Records of your listing consent and 18+ confirmation, when you joined and when you were last active.
• Our review of your profile: whether we approved it, asked for changes or declined it, when, and the note we sent you.

Connected TikTok or Instagram accounts

Connecting an account isn't available yet. Once it is, and with your permission, the platform sends us your username, profile picture and account stats (such as follower, like and video counts), and your 12 latest public posts with their views and likes. We store its access keys encrypted. Enaloop can't post or send messages for you.

Using Enaloop

• Messages you send and receive, and when you last read each conversation.
• Lists: saved creators, list names, client labels, statuses and private notes.
• Teams and campaigns: the team you create or join and your role in it, the email addresses of people you invite, and your campaigns: names, clients, dates, budgets, the creators on them with their stage, deal, deliverables, due dates, links to finished posts and notes.
• Blocks and reports you make.
• Usage events: profile views, saves, contact reveals, clicks on social links and link-in-bio links, and new conversations, linked to your account when you're signed in.
• Technical data: your IP address and browser and device details, collected by our hosting and sign-in providers, and by our error-monitoring provider when it's switched on.

From other people

Members may message you, report you or save you to a private list with notes, and admins record moderation decisions, such as a ban.

To invite a creator we'd like to list, our team may prepare a private draft profile for them, by hand, from what they show publicly. It can include their name, handles, links to a few of their public posts with the details the platform's official preview gives (such as title and thumbnail), their niches, where they're based, and a business email only if they publish one for business enquiries, with where we found it. We don't sign in to anyone's accounts, scrape sites or collect anything automatically, and we never prepare a draft for someone who has asked us not to contact them.

• Who can see it: only our admins and whoever opens the private link we send the creator. It isn't in search, the feed or anywhere else on Enaloop, and search engines can't index it.
• Why (legitimate interests): to offer creators a free listing with less typing. We send one personal message with the link; Enaloop itself doesn't email or message anyone about it.
• Publish: the creator signs in, checks and changes everything, chooses which posts to pin, and sends it for our usual review. The draft's details become their own profile, which they control like any other, and the draft is deleted.
• Delete: the link's page deletes the draft straight away, without signing in. We then keep the handles on a do-not-contact list, so we don't prepare another draft. The email goes on it only as a one-way hash, which can't be turned back into the address.
• Do nothing: the draft and its link are deleted 30 days after the draft was made. We keep only counts, such as how many drafts were published, with nothing that identifies anyone.

You can also object, or ask what a draft about you contains, by emailing privacy@enaloop.com.

• Everyone, including search engines: approved creator profiles (the profile and showcase above, the join date, and connected-account stats and recent videos), each number with its source and date, and each listed creator's link-in-bio page with the links they show. Profiles waiting for review and paused profiles are hidden.
• Signed-in members: the contact details each creator chooses to show, with every reveal logged and capped at 50 a day per member. They also see your name, company and photo, so people know who they're talking to.
• People you message: your messages, name and company.
• Your team: your name, email address and role, and the lists and campaigns you share with the team, including notes on them. Lists and campaigns you keep private aren't shared.
• Members who export a list: the public details of the creators on it, plus phone, WhatsApp and business email only where the creator allows exports. Exported files sit on that member's device, outside Enaloop.
• Only you: your contact settings and Enaloop stats, and the lists and campaigns you don't share with a team. Notes go into an export only if the person exporting ticks "Include notes"; on a shared list, that includes your teammates' notes. Creators see totals, never who viewed or saved them.
• Our admins: what they need to review new creator profiles and handle reports. They read messages only when a conversation is reported.

• To provide Enaloop (contract): your account and profile, contact details shown the way you choose, messages and email alerts, lists and exports, connected accounts, and data downloads and deletion.
• To keep Enaloop safe and working (legitimate interests): two-step verification, reviewing creator profiles before they're listed, limits on reveals and requests, logs, reports and moderation, and the bot check at sign-in and error monitoring when they're switched on. It's also why messages you sent stay with their recipients after you delete your account: the conversation is theirs too.
• To show creators their stats and improve Enaloop (legitimate interests): usage events become creators' "On Enaloop" totals and our own overall counts.
• With your consent: Tips and Enaloop news by email (off unless you turn it on, at most once a month, with an unsubscribe link in each), and video players from TikTok and YouTube (and Instagram, once it's available).
• To meet legal obligations: answering valid requests from authorities, handling your privacy requests and keeping records the law requires.

You can object to uses based on legitimate interests. People, not algorithms, make moderation decisions, and we make no automated decisions with legal or similar effects on you.

We don't sell personal data or use it for advertising, and there are no ads on Enaloop today. If ads come later, we'll update this policy first and ask for your consent where the law requires it.

Enaloop sets only essential cookies: one keeps you signed in, and short-lived ones protect signing in (and, once it's available, connecting a TikTok or Instagram account) while you do it. If you open a link to a draft we prepared for you, one more cookie, used only on that draft's page, remembers the link for up to 30 days. Because they're strictly necessary, they don't need your consent. There are no advertising or cross-site tracking cookies, and our analytics (Vercel Web Analytics), when it's switched on, counts visits without cookies.

Your browser's local storage remembers whether you've allowed videos and, when you're signed out, your feed filters. For the rest of your visit, your browser also remembers that you closed the feed's "What are you looking for?" card. To reset them, clear Enaloop's site data in your browser settings.

Creators' posts stay on TikTok and YouTube and play in each platform's own player, and Instagram posts will too, once it's available. Until you choose Allow videos, nothing loads from those platforms, not even a post's thumbnail: you see Enaloop's own artwork with the post's title instead.

After that, thumbnails load from the platforms and a player loads when a post is on your screen or you open it. The platform receives details such as your IP address and browser, and may set or read its own cookies or similar storage, under its own privacy policy. YouTube videos play in YouTube's privacy-enhanced mode (youtube-nocookie.com). Your choice is saved in your browser; to undo it, choose Turn off at the bottom of any page, and we'll ask again.

Enaloop uses YouTube API Services to show YouTube videos. Google's use of the data a YouTube player collects is covered by Google's Privacy Policy.

We share personal data only as described here, and we never sell it.

Service providers

These companies run parts of Enaloop for us and may use the data only for that:

• Supabase: database, sign-in, file storage and real-time messaging.
• Vercel: hosting, and cookieless analytics when it's switched on.
• Resend: sending our emails.
• Sentry: error monitoring, when it's switched on.
• Cloudflare Turnstile: the bot check on the sign-in form, when it's switched on.

Platforms you choose

Google when you sign in with Google, TikTok or Meta when you connect an account, and TikTok and YouTube (and Instagram, once it's available) when their players load. Each is responsible for what it collects, under its own privacy policy.

Legal reasons and safety

We share data when the law requires it, such as for a valid court order, or when it's needed to protect someone's safety, prevent fraud or abuse, or enforce our Terms of use.

Our providers may process data outside your country, including in the United States, where data protection laws may differ. Where the law requires it, we use safeguards such as standard contractual clauses. Ask privacy@enaloop.com for details.

• Account, profile, contact details, lists and settings: until you delete them or your account. A paused profile stays hidden until you publish or delete it.
• Messages: while either person in the conversation has an account. After you delete yours, messages you sent stay with their recipients, from "Deleted user".
• Connected account data: deleted straight away when you disconnect, delete your account, or the platform tells us you removed Enaloop.
• Drafts we prepare for creators: until the creator publishes or deletes the draft, and never more than 30 days. The do-not-contact list keeps handles and hashed emails for as long as we prepare drafts.
• Usage events and contact reveal logs: up to 12 months.
• Reports and moderation records: as long as needed to keep Enaloop safe. After you delete your account, reports are kept only in anonymised form.
• Technical logs and error reports: up to 90 days.
• Backups: deleted data can stay in backups for up to 30 days, until they're overwritten.

If the law requires us to keep something longer, we keep only that, and only for as long as required.

• Get a copy: Download my data in Settings gives you a JSON file of your account, profile, contact settings, link-in-bio links, lists and notes, conversations, blocks and the reports you sent.
• Correct it in Settings and in your dashboard.
• Delete it: remove posts or lists, disconnect accounts, or delete your whole account. See Data deletion.
• Object to uses based on legitimate interests, or ask us to restrict a use while we look into a concern.
• Withdraw consent any time: turn off Tips and Enaloop news in Settings, or clear Enaloop's site data to reset your choice about videos.
• Turn off new-message alerts in Settings. Security emails, like sign-in links, always arrive.
• Complain to the data protection authority where you live or work, though we'd like the chance to help first.

For anything else, or if you can't sign in, email privacy@enaloop.com from your account's email address. We may ask you to confirm it's you, and we reply within 30 days. These rights apply to everyone, wherever you live.

Enaloop is only for people 18 or older, and we don't knowingly collect data from anyone younger. If we learn that someone under 18 has an account, we delete it. To tell us about one, email safety@enaloop.com.

• There are no Enaloop passwords to steal: you sign in with Google or with a one-time link we email you, whichever we offer, and you can add a code from an authenticator app as a second step.
• Database rules let each person read only what they're allowed to. Contact details and connected-account keys sit in tables browsers can never read, and the keys are encrypted.
• Contact reveals and message requests are limited and logged, and sign-in has a bot check when it's switched on.
• Our account emails don't track whether you open them or click their links.

No system is perfectly secure, and messages aren't end-to-end encrypted. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

We'll update this policy as Enaloop changes. The date at the top shows the latest version, and we'll tell you about important changes by email or on Enaloop before they take effect.

Privacy: privacy@enaloop.com. Safety: safety@enaloop.com. Anything else: hello@enaloop.com, or see our contact page. For post, use the address under Who we are.