1. Scope
This Privacy Policy applies to Creator Twin, including the public site, authenticated dashboard, support workflows, and connected Fanvue and Instagram features.
2. Data we process
Depending on the features a creator uses, we may process:
- Fanvue account identifiers such as UUID, handle, display name, and avatar.
- Instagram Business account identifiers (IG user ID, username, profile picture), access tokens, and post metadata for content you schedule through Creator Twin.
- OAuth session data, access tokens, refresh tokens, and scope information.
- Vault media metadata, scheduling data, captions, campaign settings, and posting preferences.
- AI configuration, automation logs, moderation settings, and support conversations.
- Operational data such as billing state, plan entitlements, timestamps, and audit events.
3. How we use data
- Provide the product features a creator explicitly enables.
- Authenticate sessions and maintain secure Fanvue API access.
- Schedule posts, generate captions, process analytics, and support creator workflows.
- Prevent abuse, investigate security incidents, and keep the service reliable.
- Respond to support requests, deletion requests, and legal obligations.
4. Legal bases for GDPR processing
Where GDPR applies, Creator Twin relies on one or more of these bases:
- Performance of a contract when delivering requested product features.
- Legitimate interests in securing, maintaining, and improving the service.
- Compliance with legal obligations, including tax, fraud, and security requirements.
- Consent where a feature or workflow clearly asks for it.
5. Sharing and subprocessors
Creator Twin shares data only where needed to operate the service. This can include hosting providers, secure storage providers, AI vendors, analytics processors, billing systems, and Fanvue itself when the creator has authorized access through OAuth.
When you connect Instagram, we exchange data with Meta only to authenticate your account and publish content you have explicitly scheduled. We do not use Instagram data for advertising or share it with third parties beyond what is needed to deliver the features you have enabled.
We do not sell creator personal data or request Fanvue or Instagram passwords.
6. Retention
We keep data only as long as needed for the active service, support, fraud prevention, financial reconciliation, and legal compliance. OAuth tokens and session data are treated as sensitive and retained only for the minimum period needed to maintain authorized access.
7. Deletion and creator rights
Creators can request deletion from account settings or through Creator Twin Discord. We also support requests to access, correct, export, restrict, or object to processing where applicable.
You can disconnect Instagram at any time from Settings, which revokes our access token and deletes stored Instagram credentials. You can also revoke access directly from Instagram under Settings → Apps and Websites.
Some records may be retained where necessary for security, fraud prevention, billing reconciliation, or legal compliance. If that applies, we will limit the retained data to what is strictly necessary.
8. Security
We use HTTPS, scoped OAuth access, server-side secret storage, access controls, and operational monitoring to protect creator data. No security program is perfect, but we design the service to minimize exposure and isolate sensitive credentials from client-side code.
9. Contact
Privacy questions, GDPR requests, and deletion requests can be raised through Creator Twin Discord.