Privacy Policy

1. Controller and contact

GameInfluencer GmbH, Richard-Strauss-Str. 75, 81679 Munich, Germany, is the controller for personal data processed to operate Creator Pass at pass.gameinfluencer.com.

For privacy questions or requests, email [email protected], using “Creator Pass” in the subject. Company details are available in the GI Legal Notice. This service-specific policy describes Creator Pass; GI’s corporate website policy describes its separate company website.

2. Information we process

Information comes from you, accounts you choose to authorize, people submitting enabled enquiries, and technical requests to our hosting infrastructure. Optional platform permissions and API rules determine which fields are available.

Google sign-in

Your Google account identifier, verified email address and name, used to identify the owner of a private workspace. Signing in does not itself connect YouTube analytics.

YouTube connection

Authorized channel identity, name, description, avatar and available channel/video statistics; public upload metadata and links; available aggregate audience reports such as age/gender, countries and devices; and available watch-time and retention reports for selected owned videos. The public portfolio includes public videos only. Upload metadata can be processed to identify and exclude private or unlisted portfolio items.

Twitch connection

Account identifier, login/display name, bio and channel link; aggregate follower count, current category and language when returned. We retain the aggregate follower count, not a list of individual followers.

TikTok connection

An app-specific account identifier, display name, avatar and, where permitted, bio, username/profile link, aggregate follower/like/public-video counts and up to three recent public videos with IDs, titles, links, timestamps and view, like, comment and share counts. The current connection does not provide audience demographics or retention.

Creator input and controls

Optional profile edits, portfolio links, collaboration formats, Gaming DNA preferences, sponsorship labels and timestamps; onboarding progress; sharing selections, public-link settings and named GI grants; relevant change history and timestamps.

Partnership enquiries

Sender name, business email, company/brand, campaign/game, format, brief and any optional budget or target date. The creator can save private notes and enquiry status. Sender email is self-reported and not verified by Creator Pass.

Technical information

IP address and request/device information that can be processed by hosting services, request times, error/security information and essential authentication data. We do not ask for your social-account passwords or SMS verification codes.

Platform data may be missing, delayed or suppressed. Imported metrics are snapshots with source/date information, not an audit of audience authenticity. Custom profile information and Gaming DNA are self-reported. Aggregate audience reports do not provide a list of identifiable viewers.

3. Purposes and legal bases

We process personal data for the following purposes under the EU General Data Protection Regulation (GDPR):

Providing the creator service

Account identification, authorized imports, private reports, media-kit preparation and requested account controls: performance of our service agreement with you, Article 6(1)(b). Where you act for an organization rather than contract personally, Article 6(1)(f) supports our legitimate interest in administering that requested business service.

Optional disclosures selected by a creator

Publishing selected personal data in a link-based media kit or sharing it through a supported named GI grant: your consent to the selected disclosure, Article 6(1)(a). You can stop future disclosure by disabling the page, changing its selections or revoking the relevant grant. Platform authorization is separate from these sharing choices.

Handling enquiries and requests

Steps you request before entering a contract, Article 6(1)(b), or our legitimate interest in handling relevant business communications with an organization’s representative, Article 6(1)(f). An enquiry sender separately chooses to disclose the contact details and brief to the creator, Article 6(1)(a).

Security and service administration

Preventing abuse, enforcing access controls, diagnosing faults and keeping the service reliable: Article 6(1)(f), based on our legitimate interests in secure and properly functioning services, while considering the rights of the people concerned.

Legal obligations and claims

Responding to applicable legal duties under Article 6(1)(c), and retaining necessary, limited evidence to establish, exercise or defend legal claims under Article 6(1)(f), where applicable.

Connecting your account authorizes the platform API access shown in its consent screen. It does not give GI blanket permission for unrelated data uses. The current pilot does not automatically enroll you in newsletters, use connected-account data for advertising targeting, sell it to data brokers or train general-purpose AI models on it. A future new purpose requiring information or permission must be presented before it is used.

Sign-in details are needed to provide a private account. Social connections, public sharing, Gaming DNA and enquiry fields marked optional are voluntary; declining them limits the corresponding feature rather than publishing an estimate.

4. Sharing and recipients

Private workspace: connecting a profile does not automatically publish its data or make it visible to every GI teammate. The account owner can review the imported information privately. Authorized service operators and infrastructure providers may process information where needed to operate, support or secure the service, or comply with law.

Named GI access: a creator can grant a specific GI email address access to the supported categories for a chosen period and revoke it separately. General GI workspace membership does not by itself make every creator report visible.

Public media kits: a creator selects the supported sections to publish. Anyone with an active link can view the selected content without signing in or being verified as a brand. Links may be forwarded. Expiry, replacement or disabling prevents future access through the relevant link but cannot recall copies already obtained. Public links are not a confidential delivery channel.

Enquiries: if enabled, a sender’s selected contact details and brief go to that creator’s private inbox, not the public media kit. Enquiry records and the creator’s notes are not included in GI report grants. Once a creator receives and uses enquiry data for their own business discussions, they are responsible for that independent use.

Other recipients: relevant service providers, professional advisers and authorities may receive information where necessary for their services, a legal duty or the protection of legal rights. Sharing to assess a partnership does not authorize unrelated onward resale or advertising use of connected-account data.

5. Providers and international processing

Creator Pass is hosted by Vercel and stores saved workspaces in private Vercel Blob storage. Vercel, Inc. and its infrastructure subprocessors process service data under the applicable hosting arrangements. Vercel’s Data Processing Addendum describes processor obligations and international-transfer safeguards, including EU Standard Contractual Clauses where applicable. A copy or relevant information about applicable safeguards can be requested from GI.

Infrastructure and connected-platform processing may take place outside Germany and the European Economic Area, including in the United States. Where required, transfers are made using an applicable adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses. We do not represent that all Creator Pass data stays in the EEA.

Google/YouTube, Twitch and TikTok operate their own authorization and API services and process information under their applicable policies. Displaying an avatar or opening a platform link may send a request, including your IP address, to that platform or its image-delivery provider. See Google’s Privacy Policy, Twitch’s Privacy Notice and TikTok’s Privacy Policy.

6. Google and YouTube data

Creator Pass uses Google sign-in and YouTube API Services. Google/YouTube information is used for the user-facing account, reports and media-kit features you request, with supported disclosures controlled by your selections.

Creator Pass’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data to advertising platforms, data brokers or information resellers, or use it to target advertising. Human access is limited to your selected sharing, necessary support/security or legal handling, and other access permitted by the applicable Google policy.

You can revoke Google authorization through Google account connections and request deletion from GI using the contact below. Revoking authorization and deleting stored Creator Pass data are distinct controls. Deleting Creator Pass data does not delete your YouTube videos or account.

7. Sessions, essential cookies and browser storage

The live app uses essential Secure/HttpOnly cookies for sign-in, short-lived platform access and protection of authorization callbacks. Sign-in and platform-access sessions last at most one hour, or the shorter applicable session/token lifetime. Temporary authorization-state cookies last up to ten minutes. Signing out clears the service’s current session cookies. Closing a tab does not necessarily revoke a platform’s remaining authorization.

Access credentials are encrypted in these session cookies and are not included in saved workspace documents or public media kits. Refresh tokens are not retained, and background syncing is not enabled. Saved reports are separate from the access session and can remain after it expires.

The separate interactive demo uses browser local storage for its example profile and access-request changes. That demo data stays in that browser until you clear the relevant storage and is not a real platform authorization. Do not enter confidential creator information in the demo.

The current Creator Pass app does not include an advertising tracker or a visitor-marketing analytics integration. Necessary hosting requests and security processing still occur. Essential storage supports functions you request; any future optional tracking requiring consent will be introduced with the corresponding choice.

8. Retention, disconnecting and deletion

We retain workspace identity, profile information, selections and relevant records while they are needed to provide the account and sharing you request. The criteria are whether the workspace is being used, the feature or enquiry remains relevant, you have requested deletion, or limited retention is required for a legal obligation, security investigation or legal claim. We remove records when those purposes no longer require them. An expired login session is not an instruction to delete the workspace.

Imported platform data: saved snapshots are separate from your live access session. Platform-specific retention and refresh requirements apply. YouTube data must be refreshed, deleted or have continuing authorization verified, as applicable to its type, within the platform’s 30-day review cycle; a lack of background syncing does not permit indefinite retention without the required review. During the pilot, GI handles these reviews operationally and removes data when continuing authorization cannot be established; there is no automatic background authorization check. For other platforms, retain only the data needed for the current authorized purpose and remove it when that purpose or authorization ends.

Public TikTok/Twitch sections hide snapshots older than 30 days. Hiding an old snapshot is not deletion of the private record. Public-link and named-grant expiry choices are 7, 30 or 90 days; expired/revoked access records and limited change history may remain where needed to record access decisions, resolve disputes or protect the service.

TikTok and Twitch: Disconnect & remove snapshot removes the saved connection snapshot and turns off public inclusion. The service requests token revocation if an active access session is available. If that session has already expired, also remove the app permission in the platform’s own settings to revoke any remaining provider authorization.

YouTube: disconnect revokes the active connection but leaves saved reports and GI grants for separate management. To remove remaining YouTube data, use the request process below. Revoking Google access through your Google account also signals that continued use of the authorized data must stop; contact us if you want prompt confirmation of deletion.

Deletion requests: email [email protected] from the sign-in email where possible, identifying whether you want to remove one platform’s data or the whole workspace. We verify requests proportionately. YouTube user-data deletion requests are handled as soon as possible and within seven calendar days, subject to verifying the requester. Other rights requests are handled without undue delay and within the applicable legal time limit, normally one month; any permitted extension and its reason will be communicated.

Limited information may be retained where a lawful exception applies, such as an applicable legal obligation or necessary legal-claim evidence. Operational logs and provider-managed recovery copies follow the necessary security/recovery lifecycle and applicable hosting retention arrangements; they are not used to republish a deleted profile. For case-specific information, contact GI. We cannot erase copies already lawfully obtained and independently held by other recipients, or platform content held by its platform.

9. Your rights

Depending on the circumstances and applicable law, you may request access to your personal data, correction, erasure, restriction of processing and portability. You may withdraw consent for future processing based on consent; withdrawal does not affect the lawfulness of processing before withdrawal. You may object to processing based on legitimate interests, including on grounds relating to your particular situation.

Use [email protected] for requests. We may ask for proportionate verification to protect an account from an unauthorized deletion or disclosure; never send us passwords or verification codes. If you submitted an enquiry without an account, identify the sender email and approximate submission date.

You may complain to a competent data-protection supervisory authority, including in the EU country where you live or work or where an alleged infringement occurred. The Bavarian authority for private-sector organizations is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

10. Children and automated decisions

Creator Pass is a creator/business tool and is not directed at children. Do not submit children’s personal information or connect an account you are not legally entitled to manage. Contact us if such information has been provided inappropriately.

The current pilot does not make solely automated decisions producing legal or similarly significant effects about creators. Imported metrics, optional Gaming DNA and a media kit can inform a person’s assessment of partnership fit; they do not automatically award or reject a paid campaign.

11. Changes to this policy

We will update this page and its date when practices change and provide appropriate notice of material changes. Where a new purpose or disclosure needs consent or platform authorization, it will be presented before that use starts. Publishing an updated policy alone does not authorize an unrelated use of existing connected-account data.