Privacy Policy

This Privacy Policy explains how Gorilyft (“Gorilyft”, “we”, “us”) collects, uses, and protects your personal data when you use our website and application (the “Service”), a B2B marketplace connecting Instagram creators with brands. We are committed to protecting your privacy and handling your data transparently and in line with the EU General Data Protection Regulation (GDPR).

1. Who we are

Gorilyft operates the Service and acts as the data controller for the personal data described in this policy. For any privacy question or to exercise your rights, contact us at contact@gorilyft.com.

2. Data we collect

• Account data. When you create an account, we collect your name, email address, and the password you set (stored only as a secure hash), or, if you sign in with Google, the identifiers described below. We also store the workspace you use (creator or brand).
• Google sign-in data. If you choose “Continue with Google”, Google shares with us your basic profile information — your name, email address, and profile picture — so we can create and authenticate your account. We do not receive your Google password and we do not access your Gmail, contacts, Drive, or any other Google data.
• Creator profile & Instagram data. For creators, we collect the Instagram handle you provide and associated public metrics. If you connect a professional Instagram account (Creator or Business) through Instagram authorization, we also receive account identifiers, profile information, media, and the insights you authorize, such as views, reach, saves, and shares, when available. We store an access token to retrieve and refresh this information for your creator profile, matching, campaign performance, and rewards. We do not receive your Instagram password. See our data deletion instructions to disconnect Instagram, delete your Gorilyft account, or request removal of specific data.
• Campaign & messaging data. Content you submit through the Service, including campaigns, briefs, offers, and messages exchanged between brands and creators.
• Usage & technical data. Basic technical information needed to operate and secure the Service, such as log data and device or browser information.

3. How we use your data

• To create, authenticate, and secure your account.
• To operate the marketplace — matching creators and brands, running campaigns, enabling messaging, and calculating creator rewards.
• To provide customer support and respond to your requests.
• To maintain, improve, and protect the Service, and to prevent fraud and abuse.
• To comply with our legal obligations.

4. Legal bases

We process your data to perform our contract with you (providing the Service), on the basis of our legitimate interests (operating, securing, and improving the Service), to comply with legal obligations, and, where required, with your consent (which you may withdraw at any time).

5. How we share data

We do not sell your personal data. We share it only with service providers who process it on our behalf and under contract, including:

• Supabase — authentication and database hosting.
• Vercel — application hosting and delivery.
• Google — sign-in (OAuth), when you choose that option.

We may also disclose data where required by law, or to protect the rights, safety, and security of Gorilyft and its users.

6. International transfers

Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Service, then for any additional period required to comply with our legal obligations or resolve disputes. You can ask us to delete your account and associated data at any time.

8. Security

We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to address any incident promptly.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, and port your personal data, to object to certain processing, and to withdraw consent. To exercise any of these rights, contact us at contact@gorilyft.com. You also have the right to lodge a complaint with your local data protection authority (in France, the CNIL).

10. Cookies

We use strictly necessary cookies to keep you signed in and to secure the Service. These are essential to the Service’s operation and do not require consent. We do not use them for advertising.

11. Children

The Service is not directed to children under the age required to hold an Instagram account or to enter into a contract in their country, and we do not knowingly collect their data.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you through the Service.

13. Contact

For any question about this policy or your personal data, contact us at contact@gorilyft.com.