Privacy Policy
Klymb Studio (“Klymb”, “we”, “us”), a service of KLYMB SAS, operates klymbstudio.com, a platform where brands and agencies run UGC (user-generated content) campaigns with independent creators. This policy explains what personal data we collect, why, and the rights you have over it. It applies to brands, agencies and creators using the platform, and to visitors of this site.
The data controller for the processing described here is KLYMB SAS, publisher of Klymb Studio, registered office 15 rue François Bardot, 90000 Belfort, France (SIREN 104 161 187 — see the legal notice). You can reach us at [email protected].
1. Data we collect
Account & profile
- Name, email address and password (stored as a salted hash — we never see or store your plain-text password).
- Workspace and organization details you provide (company name, industry, team members you invite).
- For creators: handle, profile details, portfolio information, date of birth, the social accounts they declare or verify, and the tax details needed for contracts and invoices (country, status, address, registration and VAT numbers).
- If you sign up or log in with Google, Google shares your name, email address and profile picture with us. We use them only to create and secure your account. We don't ask for access to any other Google data, we don't sell it, and it isn't used for advertising.
Campaign content
- Briefs, scripts, messages and comments exchanged on the platform.
- Videos submitted by creators for review, hosted on Cloudflare Stream.
Payments
- Payments are processed by Stripe. We never see or store card numbers or full bank details. We store references Stripe gives us (customer, subscription and payout identifiers, amounts, statuses) to operate subscriptions, card payments and creator payouts. Creators are onboarded through Stripe Connect, which collects identity-verification (KYC) data directly under Stripe's privacy policy.
Social platform data
- From the public link of each published campaign video, we read its performance figures (views, likes, comments counts) and its author. From the public profile of an account a creator declares, we read its follower count and, when the creator verifies the account, its bio. We use this to show campaign performance to the creator and to the brand or agency the creator works with, to calculate payments that depend on views, and to check that a video or an account belongs to the creator.
- If a creator connects a social account (TikTok, Instagram, YouTube), we read the same data through the platform's official API, with the creator's authorization.
- We do not post on anyone's behalf, and we do not access private messages, contact lists or followers' personal data.
Technical data
- Standard server logs (IP address, browser type, timestamps) kept for security and debugging.
- In the mobile app, a device identifier used to detect referral abuse.
2. Why we process it (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the platform: accounts, campaigns, review flows, messaging | Performance of a contract (art. 6(1)(b)) |
| Subscriptions, saved payment cards and creator payouts | Performance of a contract; legal obligations (accounting, anti-fraud) |
| Reading the public figures of campaign videos and declared accounts, and calculating the payments that depend on them | Performance of a contract; legitimate interest |
| Reading a social account through its official API | Consent of the creator who connects the account (art. 6(1)(a)) — revocable at any time |
| Reviewing unusual view counts and detecting fraud | Legitimate interest (art. 6(1)(f)) |
| Transactional email (password resets, invitations, payout confirmations, trial reminders) | Performance of a contract; legitimate interest |
| Security, abuse prevention, service integrity | Legitimate interest (art. 6(1)(f)) |
We do not sell personal data, we do not run third-party advertising, and we do not use your data to train AI models.
3. Where your data lives
Our database is hosted by Supabase in the European Union (AWS eu-west-3, Paris). Videos and the website are served by Cloudflare. Emails are sent by Resend from EU infrastructure. Where a processor transfers data outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
4. Who we share data with
Only the processors needed to run the service:
| Processor | Role |
|---|---|
| Supabase | Database, authentication (EU — Paris) |
| Cloudflare | Hosting, CDN, video storage & streaming (Stream) |
| Stripe | Subscriptions, saved payment cards, creator payments and payouts (Connect) |
| Resend | Transactional email |
| Annuaire des entreprises (api.gouv.fr) | Checks a French SIRET a creator enters against the public business register |
| ScrapeCreators | Reads public view counts, public profiles and the author of a post |
| Supadata | Reads public view counts when ScrapeCreators can't, and the transcript of public videos saved as inspiration |
| Google (Gemini API) | Reads the text shown on public videos saved as inspiration |
| Pennylane | Receives a workspace's accounting entries, only when that workspace connects it |
Within the platform, data is shared on a need-to-know basis: a brand sees the creators working on its campaigns and their campaign-video metrics; an agency sees the workspaces it manages; a creator sees their own campaigns, briefs and earnings. Tenant isolation is enforced at the database level (row-level security).
5. Social platforms (TikTok, Instagram, YouTube)
When a creator connects an account, Klymb uses the official developer APIs of TikTok, Meta (Instagram Graph API) and Google (YouTube Data API) to read the performance of the campaign videos they publish.
- Klymb's use of YouTube API Services is subject to the Google Privacy Policy. You can revoke Klymb's access at any time via Google security settings.
- You can revoke TikTok access in your TikTok app settings, and Instagram access in your Facebook/Instagram account settings — or simply disconnect the integration inside Klymb.
- When access is revoked, we stop collecting new data immediately; previously collected campaign metrics may be retained as part of the campaign's historical record.
6. Retention
While your account is open, we keep what it shows you. When an account closes, we erase or replace straight away what identifies you in it: name, email address, password, profile, handle, picture, social accounts, date of birth, bank references, devices and sign-in. A closed brand's workspace is paused and renamed.
The records below stay after that, for the time stated, because the law requires it or because someone else's rights depend on it:
| Records | How long | Why |
|---|---|---|
| Invoices, statements of services, payment and accounting records, with the legal identity printed on them | 10 years from the end of the financial year | Accounting and tax law (French Commercial Code, art. L123-22) |
| Signed contracts and their proof of signature | 10 years after the end of the collaboration | Supporting documents for those records |
| Messages, briefs, reviews, videos and metrics of a campaign | Up to 5 years after the end of the collaboration | Shared record of the brand and the creator, and evidence in a dispute (limitation period, French Civil Code, art. 2224) |
| The record that an account was closed (workspace name, date) | 5 years | Proof of the closure |
| Server logs | Up to 12 months | Security |
A technical identifier stays attached to these records, so they are pseudonymized, not anonymous. Messages keep what their authors wrote. We use these records only for the purposes above.
Stripe keeps its own records (customers, saved cards, identity verification) under its own policy. Closing your account removes our link to them, not those records.
7. Your rights
Under the GDPR you can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Where processing relies on consent (social integrations), you can withdraw it at any time without affecting past processing.
Erasure does not reach the records listed in section 6 for as long as they must be kept. Write to [email protected] — we answer within 30 days. You can also lodge a complaint with your supervisory authority (in France, the CNIL).
8. Cookies & local storage
Klymb itself sets no advertising, analytics or cross-site tracking cookies. We use the browser's local storage strictly for the session that keeps you signed in and for interface preferences. The only cookie Klymb sets is a strictly necessary sign-in cookie for Klymb's own staff console, kept for 8 hours.
Stripe sets its own cookies on its checkout pages, under its own policy. In Script Studio, a TikTok or YouTube player loads only when you press play; those services may then set their own cookies, under their own policies.
9. Security
All traffic is encrypted in transit (TLS). Data access is scoped per tenant with database row-level security. Payments and identity verification are handled by Stripe, a PCI-DSS Level 1 provider. Passwords are hashed with bcrypt.
10. Age
Klymb is a professional tool intended for users aged 18 or over. We do not knowingly collect data from minors.
11. Changes
If we change this policy in a meaningful way, we will notify account holders by email or in-app before the change takes effect. The “last updated” date above always reflects the current version.
Contact
KLYMB SAS (Klymb Studio), 15 rue François Bardot, 90000 Belfort, France — [email protected]