Draft — needs legal review before you rely on it. The factual parts (what data this platform collects, where it comes from, how long it is kept) are accurate to how the software actually works. The legal framing, governing law, and your company details still need to be checked and completed by someone qualified.

Privacy Policy

Last updated: 20 September 2026. This policy explains what personal data Tremolo Media processes in Tremolo Engine, our creator-marketing platform, why we process it, and what rights you have over it.

Controller: Tremolo Media. Privacy enquiries: privacy@tremolomedia.com.

1. People this policy covers

We process data about three groups, and what we hold differs for each:

  • Account holders — staff, agency users, brand clients, and creators who have signed up.
  • Discovered creators — people with public social media accounts whose profiles we have collected in order to assess whether they may be a fit for a campaign. These people have not signed up and may not know we hold data about them. Section 4 explains this in detail.
  • Contacts — people we email as part of campaign outreach.

2. Account data

When you hold an account we store:

  • Your email address, name, and optionally a phone number and avatar.
  • A one-way cryptographic hash of your password (scrypt with a random per-user salt). We never store, log, or have any means to recover your actual password.
  • Your role, whether your email has been confirmed, and your account and sign-in timestamps.
  • Session records, so you stay signed in, and short-lived one-time tokens for password reset, email confirmation, and invitations. Those tokens are stored only as hashes.
  • An audit log of significant actions taken in the platform (who changed a role, connected an integration, or approved a creator, and when).

Creator account holders additionally store the profile they choose to publish: display name, handle, biography, location, niche tags, rate card, portfolio links, and connected social accounts with their follower and engagement figures.

3. Campaign data

  • Messages exchanged between brands, agents, and creators through the platform.
  • Collaboration records: briefs, agreed fees, deliverables, submitted content and its performance, and payment status.
  • Outreach emails we have drafted, approved, or sent.

4. Data about discovered creators

To find creators who may suit a client campaign, we collect information that social platforms make publicly available through their official APIs. We do not scrape private accounts, bypass access controls, or use unofficial endpoints.

For a discovered creator we may hold:

  • Public profile information: username, display name, profile URL, biography, profile picture, stated country, linked website, follower and following counts, and post count.
  • Public post metadata: post URLs, captions, media type, and view, like and comment counts.
  • Figures we derive from the above — a share of video posts, a typical view count, an engagement rate, inferred niche tags, and an internal fit score estimating suitability for a campaign.

Our lawful basis is legitimate interest: identifying potential commercial partners from information they have chosen to publish. We balance this against your interests by collecting only public professional information, never special-category data, and by honouring objections and deletion requests as described in section 9.

Sources are Instagram (Meta), YouTube (Google) and, where access allows, TikTok. If a discovered creator later signs up, their records are linked and the account they control takes precedence.

5. Connected accounts

An administrator may connect Tremolo Media's own Meta account to the platform. We then store an access token together with the list of Facebook Pages, Instagram Business accounts, and advertising accounts it grants access to, plus advertising performance figures for accounts explicitly linked to a client. Tokens are held server-side only and are never sent to a browser.

6. Cookies

We set no advertising or analytics cookies. We use two strictly necessary cookies:

  • tremolo_session — keeps you signed in. HTTP-only, expires after 30 days or when you sign out.
  • meta_oauth_state — a ten-minute, HTTP-only security token that protects the Meta connection flow against cross-site request forgery.

7. Who we share data with

We do not sell personal data. We share it only with providers who process it on our behalf:

  • Meta Platforms — when we query the Instagram Graph API, Marketing API, or Ad Library.
  • Google — the YouTube Data API for creator discovery, and Google Workspace for delivering transactional email such as password resets and invitations.

Brand clients see the creator profiles and campaign data relevant to their own campaigns. Discovered-creator research is internal to Tremolo Media and its agents, and is not exposed to clients.

8. Where data is stored, and for how long

Platform data is held in a self-hosted database on infrastructure we control, rather than a third-party database service.

  • Account data: kept while the account is open, then deleted on request.
  • Discovered-creator data: kept while the creator remains a plausible campaign fit, and deleted on request or when no longer relevant.
  • Sessions expire after 30 days; password reset and confirmation tokens expire within hours and are single-use.
  • Audit logs are retained for security and accountability purposes.

9. Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, object to or restrict our processing, receive it in a portable format, and complain to a data protection authority.

This includes people we have discovered but who never signed up. If that is you, you can ask us to remove your profile with no obligation and no account required — see our data deletion page. We will action it and will not re-collect your profile.

10. Security

  • Passwords are hashed with scrypt and are never recoverable.
  • Reset, confirmation, and invitation links are stored only as hashes, expire quickly, and can each be used once.
  • Changing a password signs out every other device, and we email you whenever your password or sign-in address changes.
  • API credentials and access tokens are held server-side and never exposed to a browser.

11. Children

Tremolo Engine is a business tool and is not directed at children. We do not knowingly hold data about anyone under 16. If you believe we do, contact us and we will remove it.

12. Changes

If we change this policy materially we will update the date above and, where the change affects you significantly, notify account holders by email.