Privacy notice

TTT Property Sdn. Bhd. (1234532-V), 8, Jalan Bahagia 12A, Taman Sri Bahagia, 56000 Kuala Lumpur, Malaysia, decides how your data is handled here and is the data user under the PDPA. Reach us at support@kreadors.com.

Your account: your name, email address, and the password or Google sign-in you use. The sign-in itself is handled by Clerk, and we never see your password. If your login has a picture, we keep a copy of its address; it is shown on Kreadors only for a creator who has not yet uploaded a photo of their own, and never for a business.

Creators: your display name, handle, headline and bio, your photo and cover picture, the town you work from, languages, niches, your rate card and add-ons with the reach figures you give for each item, the social accounts you list and the figures they carry (including the age, gender and location mix of their audience, as percentages, never as individual followers; how often and how recently you post; how long viewers stay on your videos; a daily record of your follower count so growth can be shown; and your most-viewed recent posts, with a copy of each one's cover picture and the accounts it tagged), what you write about yourself and what you make, your past work, how far you travel, whether you take product, the date you are busy until, how quickly you answer requests, and the number of paid bookings you have backed out of.

Businesses: your brand name and logo, where you are, your own social media accounts if you name them (shown on your page and on each order, and what a delivered post's caption is checked against), the campaigns you post and their pictures, the creators you have saved, and, if you give them, a billing email and address, your SSM registration number and your tax number, which go on your invoices. A creator who hires another creator is a business on that booking, and we hold the same for them: it starts as their own name, picture and login email, made the first time they book, message, save someone or post a campaign as the one hiring.

Bookings and orders: what was requested, quoted, offered or proposed, what was agreed, delivered and approved, the messages between the two sides both before and on an order, the files attached to them, delivered drafts, published post links and the views, reach and other figures recorded against them, with a copy of each post's cover picture and caption where the platform gives them, reviews, disputes and how they were settled, and a record of each payment and refund with the reference the payment gateway gave it.

Payouts: the bank, the name on the account and the account number a creator gives us so we can pay them, plus their full legal name and IC or passport number, and their tax number where they give it. The money needs the account; the law needs the person, because a payment to an individual is reported under their identity and the invoice we issue carries it. We ask for nothing beyond that: no photograph of the card, no bank statement, no selfie.

Invitations, before you have an account: we sometimes build a starting page for a creator from their public profile — display name, handle, follower count, niche and town, as shown publicly on the day, or for a videographer, editor or photographer what they are hired for and the link to their showreel in place of a follower count — and send them a private link to claim it. That page is reachable only by the link, appears nowhere on Kreadors, and nothing on it is ever marked as verified. If it is not for you, one button deletes it, and we keep only a scrambled form of the handle so we never add you again.

Visits and searches on Kreadors: when a creator's page is viewed we record the day, whether the viewer was a business (and which), a creator or signed out, and whether they came from a search, a campaign, another page of ours or another site. A signed-out visitor is counted by a scrambled code that changes every day, so no one can be followed from one day to the next, and we keep no internet address. When a business searches for creators we record the filters and any words it used, and how many creators were found. We use these to tell creators how their page is doing and to see which creators businesses are looking for. Our host, Vercel, also counts page visits for us without cookies.

We do not collect your browsing habits across other sites, and Kreadors carries no advertising trackers.

To run the marketplace: show a creator's page to businesses searching, take a booking, hold the money, deliver the work, settle a dispute, pay a creator, and email both sides when something needs their attention.

To keep it honest: figures read from a connected account, an operator checking a creator's reach claim against the post it came from, the record of what an order actually delivered, the response rate and back-out count on a creator's page, and the sign-off record on a business's page. And to keep bookings where both sides are protected: messages that contain a phone number, an email address or a WhatsApp or Telegram link are listed for our operators to see. Nothing is blocked and nobody is told; if it keeps happening before a deal, an operator may get in touch.

To meet the law: invoices and credit notes, the tax record of who was paid what, and anything a regulator can require us to keep. This is why we hold a creator's legal name and IC — not to verify them, but because a payment has to be reported against a person.

A creator's published page is public: their name, handle, town, pictures, rate card, portfolio, reach figures, reviews, response rate, busy date, and the number of paid bookings they have backed out of after they started. That is the point of it. It is public only once they publish it — an unpublished page is reachable by its link and appears in no search, and search engines are told not to list it.

A business's page is public too: its name and logo, its state, its open campaigns, the reviews creators have written about it, and how it behaves on orders — how long it takes to sign off a draft, how many drafts it left to the deadline, how many campaigns it has completed, how many creators it has booked and how much it has paid them in total. Its billing details, SSM number and tax number are on no public page.

The two sides of a booking see what is on it: the request, the quote, the messages, the drafts, the money, and each other's name and picture. Creators proposing on a campaign see the campaign and the business; the business sees each proposing creator's page. A review is hidden from the other side until both have written one or 14 days pass.

Bank details, your IC or passport number and your tax number are seen by nobody but you and the person making the payment. They appear on no page a business can reach, and on no public page at all.

Kreadors operators — a named list of people — can open any order, its messages and its drafts. They do so to settle a dispute or a problem reported after approval, to sort out a payment, refund or held payout, to check a reach claim, or to look at a message the contact-details check pointed to, and the record of what they did stays on the order. When someone reports a conversation or a page, operators read it; the report, who sent it and what we noted are kept. The account reported is not told who reported it. A block is recorded on the conversation until the side that blocked lifts it.

Operators also see which accounts joined recently, to check they are real. An account that breaks the terms can be suspended: it can no longer sign in, and its page and campaigns are taken off Kreadors. The orders it is part of stay, so they can be settled, and we keep the record of the suspension and why.

A creator can give someone else access to their page, such as a manager or an assistant, each signing in with their own login. We keep who was invited, by which email address, what they may do and when, and we record beside each message which helper wrote it. A helper never sees the creator's bank or ID details or payouts. Removing someone ends their access; what they did stays on the creator's page.

We email you about your bookings, payments, disputes and payouts; those are the service and cannot be switched off while the account is open. We also email you when someone writes to you, once per conversation until you have read it. That one you can switch off on your account page or from the link at the foot of the email. We send no marketing.

We use a small number of suppliers to run the service, and they only get what they need to do their part: Clerk for sign-in, Neon for the database, Vercel for hosting and file storage, and Resend for the emails we send you. A creator's Instagram, Facebook, YouTube or TikTok is connected to Kreadors directly, through Meta's, Google's and TikTok's own logins: the permission is held by us, sealed in our database so a copy of it alone cannot use it, used only to read your profile and post figures (never to post), and forgotten the moment you disconnect. Some of these suppliers process data outside Malaysia, which the PDPA allows where the data is properly protected.

A business pays on a secure payment page run by our Malaysian payment gateway, which handles the card, bank or e-wallet details itself. We receive only that the payment succeeded, the amount, the method used and the gateway's reference, and we never see a card number. Refunds go back through the same gateway.

Creators are paid by bank transfer from our own account, so your bank sees a transfer from us and nothing more.

We do not sell your data, and we do not hand it to anyone for their own marketing.

This section covers the data Kreadors receives from Google when a creator connects a YouTube channel through Google's login. Kreadors asks Google for two read-only permissions, youtube.readonly and yt-analytics.readonly, and nothing else. Connecting is optional: a creator can use Kreadors without it.

What we access. Through YouTube API Services: the channel's name, handle and subscriber count; each upload's title, description, thumbnail, publish date, length and its public view, like and comment counts; and, from YouTube Analytics, each video's average watch time and shares, and the countries, age groups and genders of the channel's viewers over the last 90 days, as percentages only. We never receive who the viewers or subscribers are, the channel's email, messages, comments' contents, private videos or anything about your Google account beyond the channel. We read these again once a day while the channel stays connected.

How we use it. Only to show the creator's real YouTube figures on Kreadors, in place of numbers typed in by hand: on the creator's public page and media kit (including its PDF), in the audience-size filter businesses search with, and on the results report of a paid booking, where the business sees the figures of the video it paid for. We can only read: we never upload, edit, delete, comment, like or subscribe on the channel. We do not use Google user data for advertising, to build profiles of viewers, for credit or lending decisions, or to develop, improve or train AI or machine-learning models, and we do not send it to any AI service.

Who we share it with. The figures a creator connects are shown, as above, to people who visit their Kreadors page or kit and to the business on a booking — showing them is the reason a creator connects. Beyond that, Google user data goes only to the suppliers that run Kreadors for us and store it on our behalf, under contract and for no purpose of their own: Neon (our database) and Vercel (hosting and file storage, where our copies of video thumbnails are kept). It may also be disclosed where Malaysian law requires it. We never sell Google user data, and never pass it to advertisers, data brokers, information resellers or anyone for their own use.

How we protect it. Everything travels over encrypted connections (HTTPS). The permission Google gives us is kept sealed with AES-256-GCM encryption, under a key held apart from the database, so a copy of the database alone cannot use it. Only the server that reads your figures opens it. The operator screens that can see data are limited to a named list of people, and no person reads Google user data except to fix a fault you report, for security, or where the law requires.

How long we keep it, and deleting it. We keep it while the channel stays connected, refreshing it daily. Press Disconnect beside YouTube on My profile and we delete the permission and everything we read from YouTube at once: the channel's figures, its daily history, its best videos, our copies of their thumbnails and its audience figures. If you instead remove Kreadors on Google's third-party connections page, or Google stops the permission for any other reason, we delete the same at our next daily read. The only thing that stays is the link to a video you delivered on a paid order, because it is the work the business paid for; the figures we read about it are removed. You can also ask for deletion at support@kreadors.com.

Google handles your data under the Google Privacy Policy, and by connecting you also agree to the YouTube Terms of Service. Kreadors' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your account and page for as long as you have an account. Orders, invoices, payment and payout records for seven years after the order closes, because tax and accounting rules require it — a deleted account does not erase an invoice we are obliged to keep.

Messages, attachments and drafts stay with the order they belong to, because they are what a dispute is decided on, and so does any problem reported on it and the operator's answer. A conversation that never became a booking is kept while both accounts exist.

Close your account and we remove your page from Kreadors and delete what we are not required to keep. An invitation page you did not claim is deleted the moment you ask. We also keep a record of each time you agreed to these terms and this notice, and which version, as proof of what you agreed to.

You can have a copy of what we hold about you, have anything wrong corrected, limit how we use it, or withdraw consent where we relied on it. Most of it you can do yourself: a creator changes their page and rate card, a business its details under My business, and anyone can download everything we hold about their account, as one file, from My account → Your data.

Write to support@kreadors.com and we will answer within 21 days, as the PDPA requires. If you are not satisfied, you can complain to the Personal Data Protection Commissioner of Malaysia.

What we read from a connected account. When you connect Instagram, Kreadors reads your username, follower count, your posts with their figures (views, reach, likes, comments, shares, saves, watch time) and where your followers are and how old they are, in totals only. We can only read; we never post, comment or message as you.

To stop us reading it: on Kreadors, open My profile and press Disconnect beside the account. We forget the permission at once. For Instagram you can do the same from Instagram: Settings → Apps and websites → Kreadors → Remove. The figures already on your page stay as last read, no longer marked as read from the platform, until you connect again or remove the account from your page.

To delete everything we read from Instagram: in Instagram, go to Settings → Apps and websites, open Kreadors, remove it and choose to send a request to delete your data. Instagram passes the request to us and we delete it straight away: the account's figures, its daily history, your best posts and our copies of their pictures. Instagram then shows you a confirmation code. On orders you delivered, the link to the post stays, because it is the work the business paid for, but everything we read about it from Instagram is removed.

YouTube. Press Disconnect on My profile, or remove Kreadors on Google's third-party connections page, and we delete everything we read from YouTube: at once when you disconnect here, and at our next daily read when you remove us at Google. Posts you delivered on orders keep their link, as with Instagram. What we read from YouTube, how we use it, who sees it and how it is protected are set out in full under Google user data (YouTube) above.

TikTok. When you connect TikTok, Kreadors reads your username, display name, follower, following and like counts, and your videos with their figures (views, likes, comments, shares), title, caption and cover picture. TikTok gives us nothing about who your followers are. We read it again every day and can only read; we never post as you. Press Disconnect on My profile, or remove Kreadors in TikTok under Settings and privacy → Security and permissions → Apps and services permissions, and we delete everything we read from TikTok: at once when you disconnect here, and at our next daily read when you remove us in TikTok. Posts you delivered on orders keep their link, as with Instagram and YouTube.

Facebook. Facebook lets us read only a Page you manage, never a personal profile. When you connect a Page, Kreadors reads its name, username and follower count, and its posts and reels with their figures (views, reach, reactions, comments, shares and, for reels, watch time), caption and picture. Facebook gives us nothing about who your followers are. We read it again every day and can only read; we never post as your Page. Press Disconnect on My profile, or remove Kreadors in Facebook under Settings and privacy → Settings → Business integrations, and we stop reading; the figures stay as last read, as with Instagram. To delete everything we read from your Page, remove Kreadors there and choose to send a request to delete your data: Facebook passes it to us, we delete it straight away and Facebook shows you a confirmation code. Posts you delivered on orders keep their link.

To delete your whole account, use Close my account under My account → Your data. It happens at once: your login, page, pictures, prices, connected accounts and bank details go, and what the law makes us keep is under “How long we keep it” above. An account with an order still in progress, or money still owed to it, can be closed once that is finished. You can also write to support@kreadors.com from the email you sign in with and we will do it within 21 days.

Traffic is encrypted. Uploaded files — pictures, attachments and drafts — are stored privately and served only to people entitled to see them, through links that expire. Operator screens are limited to a named list of email addresses. No system is perfect: if data of yours is ever exposed, we will tell you and the Commissioner rather than hope you do not notice.

Kreadors sets only the cookies it needs to keep you signed in. Your search filters live in the page address, not in a cookie. There are no advertising or cross-site tracking cookies, which is why there is no banner asking you to accept them.

Kreadors is for people 18 and over. If we learn an account belongs to someone younger, we close it and delete what we hold.