Draft · not yet in force

Privacy notice

Version 0.1 (draft) · Prepared 3 November 2026 · Philippine English (en-PH). This draft is pending review by a Philippine lawyer and our Data Protection Officer before launch.

Creator Network Philippines (“we”, “us”) runs a marketplace where Filipino content creators and brands work together on paid, disclosed campaigns. This notice explains how we handle personal data under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1. Who we are

For the personal data described here we act as a personal information controller. We are an intermediary platform: we connect creators and brands, hold campaign funds, check publication and pay creators. We are not the creator’s employer and we do not publish content on anyone’s behalf.

Controller: [Legal entity name and SEC/DTI registration — to be confirmed]
Address: [Registered address in the Philippines — to be confirmed]
Data Protection Officer: [Name and privacy contact email — to be confirmed]
NPC registration: [Registration number, if required — to be confirmed]

2. What we collect

Creators

Account details: name, email address, the sign-in provider you used (Google, Facebook or TikTok) and its account identifier.
Profile: region (province or city), content categories, languages, your rate in Philippine pesos, availability and confirmation that you are 18 or over.
Campaign work: offers, drafts and captions you submit, review comments, the link to your published post and its performance.
Payouts: payout method and account details you provide, payout history and the records Philippine tax rules require.

Brands

Business details: legal name, website, category and the people who manage the brand account (name, work email, role).
Campaigns: briefs, budgets, quotes, payments and invoices, and the conversions you choose to report to us.

Everyone

Technical data needed to run the service securely: session cookies, IP address, browser type, and security and audit logs.
Messages you send us, including privacy and data-deletion requests.

We do not use advertising cookies and we do not sell personal data.

When you connect a channel, you sign in on the platform itself and choose what to allow. We never see your social media password. Each platform shares only what its permissions allow:

TikTok: Display name, avatar and account identifier; with your permission, follower count and the list of your public videos and their view counts.
Instagram: For professional (Creator or Business) accounts: username, account type, follower count, number of posts and, with permission, insights for posts made for a campaign.
Facebook: For Pages you manage: Page name and identifier, follower count and, with permission, insights for campaign posts. Personal profiles are not connected.
YouTube: Channel name and identifier, subscriber, view and video counts, through a separate Google permission that you grant after signing in.

We store the access tokens the platforms issue in encrypted form and use them only to refresh these figures and to verify campaign posts. You can disconnect a channel at any time; we then stop collecting new data and revoke the token where the platform allows it. Network totals shown on our public pages include only accounts whose owners agreed to be counted. See How we count.

4. Why we use it

To provide the service you signed up for: matching, offers, campaign review, publication checks and payouts (contract).
To keep accounts, money and the platform safe: fraud prevention, security logs, verifying that a creator controls a connected channel (legitimate interest).
To meet legal duties: accounting, tax, and responding to lawful requests of Philippine authorities (legal obligation).
To publish anonymised network statistics and, if you opt in, a public creator card without your name (consent, which you can withdraw).

Brands see the creator details needed to choose and work with you: region, categories, connected channels and their figures, rate, and the content you submit. They do not see your payout details.
Creators see the brand name, brief and offer amount.
Service providers that act on our instructions under a data-sharing or outsourcing agreement: hosting, payment and payout providers, email delivery. We will list them here before launch.
Authorities, when Philippine law requires it.

Some providers may process data outside the Philippines. When they do, we remain responsible for it and require protection comparable to the Data Privacy Act.

6. How long we keep it

Account and profile data: while your account is open, then deleted or anonymised within 30 days after you close it.
Social platform data and tokens: until you disconnect the channel or close your account; the token is deleted at once and figures within 30 days.
Campaign, payment and payout records: for as long as Philippine tax and accounting rules require, then deleted.
Security logs: up to 12 months.

7. Your rights

Under the Data Privacy Act you have the right to be informed, to access your data, to object, to have inaccurate data corrected, to have data erased or blocked, to data portability, and to claim damages. You can also file a complaint with the National Privacy Commission (privacy.gov.ph).

Signed-in users can make a request from their account. We confirm receipt and reply within 30 days. For deletion, follow the steps on the data deletion page.

Make a privacy request

8. Security and breaches

We use encryption for stored tokens and connections, role-based access for staff and an audit log of sensitive actions. If a personal data breach is likely to cause you serious harm, we will notify the NPC and affected people within 72 hours of knowing about it, as NPC rules require.

9. Age limit

The service is for people aged 18 and over. We do not knowingly accept creators under 18. If you believe a minor has signed up, contact us and we will close the account.

10. Changes and contact

We will post any change here with a new version number and, for significant changes, tell signed-in users before it takes effect. Questions: [privacy contact email — to be confirmed].