Privacy policy

Here we explain, with no small print, what data we process when you visit this website or send your assessment request, what we use it for, how long we keep it and what rights you have. If anything isn't clear, write to us and we'll explain it in plain language.

Last updated: 22 September 2026. This policy applies together with the Legal notice, the Cookie policy and the Process terms.

1. Who the data controller is

Controller: Creator House
Privacy contact email: hello@creatorhouse.agency

We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. What data we process

We only ask for the minimum needed to assess your request and reply to you. At this stage we never ask you for identity documents, passwords, intimate photos or information about the type of content you make or would like to make.

Your situation as a creator The option you choose in the form (for example, whether you're starting from scratch, already run your own account or are with another agency).
Approximate follower range A rough range, not exact figures or access to your accounts.
Name or stage name It can be your stage name; we don't require your legal name at this stage.
Date of birth Used only to verify that you are over 18 and not stored: once verified, we keep only your age in years with the application. If the date shows you are under 18, the request is rejected automatically and no data is kept (see section 4).
Chosen contact channel and its identifier Only the detail for the channel you choose: your WhatsApp number, your Telegram username, your Instagram username or your email. We don't ask for all of them.
Your Instagram username (optional) If you want to give it to us, even if your contact channel is a different one. It lets us see your public profile; we never ask for your password or access to the account.
1 to 3 photos of yourself Normal photos, of your face and, if you can, full-length, in everyday clothes, to assess your profile. Before they are sent, your browser shrinks them and strips their metadata (including your phone's GPS location). They are kept in private storage that only the selection team can access. We don't accept nudes or lingerie: if a photo like that comes in, it is deleted without being reviewed and the application is discarded.
What's holding you back (optional) An optional question you can skip; it's used only to prepare the first conversation better.
Approximate country derived from your IP At country level, to organise schedules and the contact team. We don't store your precise location.
Which campaign or link you came from (only if you accept cookies) The campaign parameters in the web address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the Meta click identifier (fbclid), the domain you came from and the landing page. It tells us which ads work. The fbclid is an online identifier, which is why we only process it with your consent: if you reject in the banner, none of this is stored and your request is sent exactly the same.
Which page of this website you opened the form from Only the address of our own page (for example, the FAQ page), with nothing that identifies you. It travels with your request even if you reject cookies, because it isn't stored in your browser. It tells us which pages help people decide.
Essential technical data The minimum needed for the website to work and be secure, including your IP address, which our providers process to deliver the service and protect it against abuse. We only keep the country deduced from it, not the full IP. Marketing cookies (Meta) are only activated if you accept them in the banner; you can see the details in the Cookie policy.

3. What we use your data for and on what legal basis

The legal basis for handling your application is Article 6(1)(b) GDPR: taking pre-contractual steps at your request. That is why we do not make you tick consent boxes to send the form: forced consent would be neither free nor valid.

Purpose	Data	Legal basis	Retention
Managing your application, assessing it and contacting you on the channel you choose	Situation, follower range, name or nickname, age in years, contact channel and identifier, Instagram username (optional), 1 to 3 photos, optional answer, approximate country	Art. 6(1)(b) GDPR — pre-contractual steps at the data subject's request	12 months from the last contact; then erasure. Photos are deleted as soon as the application is discarded
Verifying that you are over 18	Date of birth (not stored; only the age in years is kept)	Art. 6(1)(b) GDPR — a requirement for handling the request	The date isn't stored; the age in years is kept with the application. If you are under 18: automatic rejection and no data is kept
Knowing which campaign or link you came from, to measure which ads work	`utm_*` parameters, Meta click identifier (`fbclid`), referring domain and landing page	Art. 6(1)(a) GDPR — your consent, the same one you give in the cookie banner. You can withdraw it whenever you like	If you don't accept, it isn't collected. If you accept and send the request, it is kept with your application and erased with it
Measuring our advertising campaigns (Meta Pixel)	Marketing cookies (see Cookie policy)	Art. 6(1)(a) GDPR — your consent in the banner, which you can withdraw at any time	Until you withdraw consent or the cookie expires
Basic operation and security of the website	Minimum essential technical data	Art. 6(1)(f) GDPR — legitimate interest in keeping the website running and secure	Minimum technical periods

4. Minors

This process is aimed exclusively at people over 18. The form asks for the date of birth only to verify this: if it shows the person is under 18, the request is rejected automatically —both in the browser and on our server— and no data is kept about that person.

This check is a first barrier. Before any collaboration, a documentary verification of identity and age is also carried out, which we'll explain to you when the time comes.

5. Who can access your data

We don't sell your data or pass it on to third parties for advertising purposes. To run the website and contact you, we use providers that act as data processors, under contracts in accordance with Article 28 GDPR.

Infrastructure and database provider Cloudflare, Inc. (hosting and content delivery network) and Supabase (database) — hosts the website and securely stores the form data.
Messaging provider The service for the channel you choose for us to contact you (for example WhatsApp, Instagram or the email provider). Only the channel you indicate is used.
Meta Platforms Only if you accept marketing cookies in the banner, to measure our campaigns. If you reject them, no data is sent to Meta.
Legal obligations We may disclose data to the competent authorities when required by law.

6. International transfers

Some of our providers may process data outside the European Economic Area. When that happens, the transfer is covered by appropriate safeguards under the GDPR, mainly the standard contractual clauses approved by the European Commission, together with any additional measures that apply in each case. You can ask us for more details about these safeguards by writing to the email in section 1.

7. How long we keep your data

Complete applications 12 months from our last contact with you; then they are erased.
Your photos If your application doesn't move forward, they are deleted as soon as it is discarded. If it does, they are kept with it and for the same periods. You can ask us to delete them earlier whenever you like.
Minors No data is kept: the request is rejected without being stored.
Cookies According to the periods set out in the Cookie policy; marketing cookies, only while you maintain your consent.

8. Your rights

You can exercise the rights the GDPR gives you at any time. Exercising them is free of charge.

What rights you have

Access Knowing what data of yours we hold.
Rectification Correcting inaccurate data.
Erasure Asking us to delete your data.
Objection Objecting to a specific processing.
Restriction Restricting the use of your data.
Portability Receiving your data in a reusable format.

How to exercise them

Write to us at hello@creatorhouse.agency saying which right you want to exercise. To protect you, we may ask for reasonable verification that it's you, without ever asking for more data than necessary. We will reply within one month at most.

You can also withdraw your consent to marketing cookies whenever you like from the Cookie policy, without this affecting your application or the lawfulness of the earlier processing.

You can complain to the supervisory authority whenever you like. You don't need to write to us first or to disagree with our reply: you can go directly to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), www.aepd.es. If you live in the United Kingdom, you can also complain to the Information Commissioner's Office (ICO), ico.org.uk. If you'd rather try with us first, write to us and we'll reply within the maximum of one month set by the GDPR.

We have not appointed a Data Protection Officer (DPO) because our activity doesn't require one; for any privacy matter, the contact is the email given above. Providing your data in the form is voluntary, but without it we can't assess your application or contact you.

About automated decisions: the only automatic check we carry out is the age check. If the date you enter shows you are under 18, the request is rejected at that moment and no data is kept. We apply no other automatic filter: your application is read and assessed by a person.

9. How we protect your data

Encryption Communications with the website and with our systems are encrypted in transit.
Role-based access Only the staff who need your data to handle your request can access it, with permissions differentiated by role.
Minimum necessary At each step we collect and share internally only the minimum essential data; internal new-request alerts don't include your personal data.
Confidentiality The team works under a contract and a confidentiality commitment.

This policy may be updated if the processing or the regulations change. We will publish the version in force here, with its update date. If a change is relevant to an application in progress, we will let you know through your contact channel.