Gorilyft← Back to site

Legal

Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how Gorilyft (“Gorilyft”, “we”, “us”) processes personal data in connection with the website gorilyft.com, the Gorilyft application and the related services (the “Service”), a marketplace that connects brands with Instagram content creators. It applies to:

  • people who have a Gorilyft account, as a creator or on behalf of a brand;
  • creators whose public Instagram account a brand found through Gorilyft or invited, even if they have no Gorilyft account (see section 4);
  • visitors of our website.

We process personal data in line with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act. Our Terms of Service describe how the Service works.

1. Who we are

Gorilyft operates the Service and is the data controller for the processing described in this policy. For any privacy question or to exercise your rights, contact us at contact@gorilyft.com.

Brands decide which creators they invite and what they write to them. A brand is responsible for the messages it sends outside Gorilyft, for example in its own Instagram direct messages.

2. Data we collect from account holders

  • Account data. Your name, e-mail address, role (creator or brand), language and the sign-in method you use: a password (stored only as a secure hash), a one-time code or link sent by e-mail, or Google.
  • Google sign-in data. If you choose “Continue with Google”, Google shares your name, e-mail address and profile picture with us so we can create and authenticate your account. We do not receive your Google password and do not access your Gmail, contacts, Drive or any other Google data.
  • Creator profile. Your name, profile photo, country, languages, niches, prices and the other information you add to your creator card.
  • Instagram data (creators). The Instagram username you add and the public data of that account that we retrieve through our data providers: account ID, display name, bio, profile picture, follower, following and post counts, account type, and your public reels with their captions and their view, like and comment counts. When you prove that the account is yours, we record the method and the date of the proof and the link between the Instagram account ID and your Gorilyft account, plus, depending on the method: for a like on our Instagram post, whether your account had liked that post and the post’s like count at each check of the verification (never the list of the other accounts that liked it); for the automatic check of a professional account, a one-way digest (SHA-256) of the account’s public contact e-mail address(es), compared with your verified Gorilyft login e-mail — never the address itself. If a brand confirmed your identity instead, we record that confirmation for the invitation concerned. We never receive your Instagram password. Signing in with Instagram is not offered at the moment; if you connected Instagram that way in the past, we keep the access token until you disconnect Instagram or delete your account.
  • Brand data. Your company’s name, website, logo, Instagram account, description, campaigns and briefs, and, where applicable, the members of your team. To pre-fill your profile, we analyse the public pages of the website you give us.
  • Collaboration data. Invitations, booking offers, briefs, drafts, published posts and their statistics, ratings, and the messages and files exchanged between brands and creators.
  • Payment and billing data. For brands: the amount, date and status of your top-ups. Card details are entered on Stripe’s payment page and never reach us. For creators: your billing identity (legal name, address, business identifiers, VAT status), your bank details or Stripe account, your earnings, payouts, self-billing mandate and invoices.
  • Technical and security data. IP address, browser and device information, logs, and the security and anti-abuse events needed to protect the Service.

3. Why we use your data and on what legal basis

  • To create and secure your account and sign you in — performance of our contract with you.
  • To run the marketplace: profiles, invitations, bookings, messages, held funds, payouts, invoices and rewards — performance of the contract.
  • To check that a creator owns the Instagram account they add (a like from that account on a Gorilyft post, or the account’s public contact e-mail matching the creator’s verified login e-mail — compared as a one-way hash, the address is not stored) and prevent impersonation — performance of the contract and our legitimate interest in protecting creators and brands from fraud.
  • To help brands find creators who fit their campaign, including with AI (sections 4 and 5) — our and the brands’ legitimate interest.
  • To check messages automatically for contact details, external links or attempts to move payment off the platform, and block them — our legitimate interest in keeping users safe and protecting the marketplace.
  • To answer your requests and complaints, keep the Service secure, prevent abuse and improve the Service — our legitimate interest.
  • To issue invoices, keep accounting records, meet tax obligations and answer lawful requests from authorities — legal obligation.
  • Where the law requires it, we ask for your consent, which you can withdraw at any time.

4. Creators found or invited by a brand

This section gives the information required by Article 14 of the GDPR. It is for you if a brand found your Instagram account through Gorilyft or sent you an invitation link, whether or not you have a Gorilyft account.

  • Data concerned. Your Instagram username and account ID, display name, bio, profile picture, follower, following and post counts, account type, whether the account is private or has a verified badge and, when available, your public posts and reels (captions, hashtags, view counts), public comments you posted on other accounts and the topics identified by an AI analysis of your public videos. From these we derive niches and a relevance score, with its reasons, for the brand’s campaign. If a brand invites you, we also keep the invitation (brand, campaign, offer) and an “identity card” of the invited account, fixed when the invitation is prepared: display name, username, follower and post counts, account type, private status, niches and a copy of your profile picture stored by us. If your account is a professional one that shows a public contact e-mail, we keep only a one-way digest (SHA-256) of that address, linked to the account ID and replaced at each new reading, so that you are recognised automatically if you sign up with that e-mail — never the address itself.
  • Source. Publicly accessible Instagram data, obtained through HikerAPI (a provider of public Instagram data), our own collection service and web search engines, and the username a brand may enter itself.
  • Purposes. To let brands find creators relevant to their campaigns and invite them to paid collaborations, and to show on the invitation page which account was invited, so that the wrong person cannot accept it.
  • Legal basis. Our legitimate interest and that of the brands in finding and contacting professional content creators for paid collaborations. We only use data that your Instagram account makes public, only for this professional purpose, and you can object at any time.
  • Who sees it. The brand that found or invited you sees your profile data, score and reasons. Anyone who has the invitation link can see the invitation page: the brand, the offer, a preview of the brief and your identity card (display name, username, profile picture, follower count and private status). The link is personal, sent by the brand in an Instagram direct message, not indexed by search engines, and stops working after 30 days unless the brand renews it. Our service providers process the data for us (section 6).
  • Retention. We keep public profile data only as long as it may be useful for brands’ creator searches, and we delete it when you object. An invitation and its identity card are kept with the brand’s campaign, unless you object or ask us to delete them.
  • Your choices. You do not have to do anything, and you never have to accept an invitation. You can object at any time, or ask for access, correction or deletion, by writing to contact@gorilyft.com with your Instagram username — see our data deletion page. If you choose “This isn’t my Instagram account” on an invitation page, we tell the brand. You can also complain to the CNIL.
  • No automated decision. The relevance score only helps the brand decide whom to contact; it has no legal or similarly significant effect on you.

5. AI-powered features

We use AI models — mainly Google’s Gemini models, and Anthropic’s Claude as a fallback to analyse brand websites — to analyse brand websites and briefs, draft campaign briefs, and assess how relevant public creator profiles and public content are to a campaign. The AI receives the content brands provide and the public creator data described above. Our instructions to the AI forbid inferring personal characteristics such as age, gender or place of residence. AI results can be wrong: they suggest, and a person — the brand — decides.

6. Who we share data with

We do not sell personal data and we do not use it for advertising. We share it only as follows.

  • Other users, as the marketplace requires: brands see creators’ public profiles, creator cards, prices and statistics; creators see brand profiles and campaigns; each party sees its own conversations and bookings.
  • Service providers that process data on our instructions and under contract:
    • Supabase — database, authentication and file storage.
    • Vercel — hosting and delivery of the Service.
    • Google — sign-in with Google, when you choose it, and the Gemini AI models.
    • Anthropic — AI model used as a fallback to analyse brand websites.
    • Stripe — card payments for brand top-ups and, when a creator chooses it, payouts to a Stripe account (Stripe may then verify the creator’s identity).
    • HikerAPI — retrieval of public Instagram data: profile lookups, the likes of a Gorilyft post and the public contact e-mail of professional accounts that prove account ownership, public reels and their statistics, and creator search.
    • Resend — sending of sign-in e-mails (one-time codes, sign-in and confirmation links).
    • A web search provider (Serper or Brave Search) — web searches to find public creator profiles for a campaign; it receives search keywords, not your account data.
    • The hosting provider of our own public-data collection service.
    • Our bank — bank transfers of creator payouts.
  • Authorities, when the law requires it, and where necessary to protect the rights, safety and security of Gorilyft and its users.

7. International transfers

Some of these providers may process data outside the European Economic Area, for example in the United States. In that case the transfer relies on a European Commission adequacy decision (such as the EU–US Data Privacy Framework, for certified providers) or on the Commission’s Standard Contractual Clauses.

8. How long we keep data

  • Account and profile data: as long as your account exists. When you delete your account, we delete it (see our data deletion page), except as below.
  • Messages you sent in a conversation that continues after you leave stay visible to the other participant, without your name.
  • Invoices, accounting and payment records: as long as the law requires (10 years for accounting documents in France).
  • Instagram ownership checks: a log of the checks made for each Instagram account ID, kept to prevent account takeover and no longer linked to your Gorilyft account once it is deleted.
  • Security logs: for a limited period.
  • Creators found or invited by a brand: see section 4.

9. Security

We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to address any incident promptly.

10. Your rights

Subject to applicable law, you have the right to access, correct and erase your personal data, to restrict its processing, to receive it in a portable format, to withdraw your consent, and to give instructions about your data after your death. You can object at any time to processing based on our legitimate interests, including creator search. To exercise these rights, write to contact@gorilyft.com; we answer within one month. We may ask you to confirm your identity, for example with a message from the Instagram account concerned. You also have the right to lodge a complaint with your data protection authority — in France, the CNIL (www.cnil.fr).

11. Cookies and local storage

We use only what the Service needs: cookies that keep you signed in and secure the Service, a cookie that remembers your language, and your light or dark theme preference stored in your browser. We do not use advertising or analytics cookies. Stripe’s payment page sets its own cookies when a brand pays by card.

12. Children

The Service is for adults. We do not knowingly collect data about people under 18. If you are under 18 and a brand found or invited your Instagram account, write to contact@gorilyft.com and we will delete your data.

13. Changes to this policy

We may update this Privacy Policy. We will publish the new version on this page with a new date and, for material changes, notify account holders through the Service.

14. Contact

For any question about this policy or your personal data, contact us at contact@gorilyft.com.