Privacy with clear operational boundaries.

AcidSpain LLC operates AcidSpain Creators and is responsible for the personal information described in this policy. This policy covers our public website, creator submission and claim forms, client workspaces, operator tools, discovery catalog, reveal system, agency CRM, campaign workflows, support, and related services.

AcidSpain LLC is located at 6303 Waterford District Dr STE 400, Miami, Florida 33126, United States. Privacy questions and requests may be sent to hello@acidspain.com or made by telephone at +1 (786) 505-5398.

Account and company information may include names, work email addresses, password hashes, profile images, workspace names, company logos, legal company names, addresses, tax identifiers, billing and support contacts, telephone numbers, teammate roles, invitation status, and account status. We do not receive or store full payment-card numbers handled by Stripe.

Product and commercial activity may include searches, filters, saved lists, creator matches, contact and pricing reveals, reveal-token balances and ledgers, client records, campaign briefs, budgets, placements, deliverables, outreach drafts, notes, brand-safety reviews, links, attachments, receivables, payables, reports, exports, and audit activity attributed to a workspace user or operator.

Creator information may include names, channel names, handles, profile URLs, public business contact details, countries, languages, categories, niches, audiences, commercial rates, avatars, and platform metrics. Public channel descriptions may be processed to enrich a record or identify a publicly listed business email even when the description itself is not displayed in marketplace discovery.

Technical information may include IP address, browser and device information, request metadata, security events, rate-limit records, session activity, referral information, and error or performance information needed to protect and operate the service.

We receive information directly from customers, invited teammates, creators, public-site visitors, and people who submit a claim, pricing request, or support request. Workspace owners and administrators may provide information about teammates, clients, campaigns, and creators.

Creator records may also come from publicly available creator and platform pages, the YouTube Data API and other configured platform APIs, creator or agency submissions, customer or operator imports, and source files supplied to AcidSpain. We may combine those sources to identify duplicates, validate a channel, update metrics, or maintain a usable commercial record.

Billing status and identifiers come from Stripe or from an authorized manual paid-account workflow. Infrastructure and security providers may provide request, delivery, or system information associated with their services.

We use information to create and authenticate accounts; maintain workspaces, company profiles, roles, and invitations; provide discovery, lists, intelligence, contact and pricing reveals, CRM, budgets, campaign execution, files, reporting, and exports; process subscriptions; send transactional messages; respond to support; and provide requested AcidSpain operator or managed services.

We also use information to enforce plan, seat, and reveal-token limits; preserve prior reveal access; improve data quality and creator matching; synchronize public channel metrics; prevent fraud, scraping, credential abuse, and unauthorized access; investigate incidents; maintain audit trails; comply with law; and establish, exercise, or defend legal claims.

For people in the EEA or United Kingdom, our legal bases are performance of a contract or steps requested before a contract, our legitimate interests in operating and securing a business platform, compliance with legal obligations, and consent where required for optional cookies or marketing communications. We balance legitimate interests against the rights and expectations of the people affected.

We use necessary first-party cookies for secure client and operator sessions and to remember cookie preferences. If Remember me is not selected, the signed authentication session and cookie expire after 48 hours. If selected, they may remain for up to 30 days, subject to account status, password changes, role changes, revocation, and security controls.

Optional analytics and marketing categories are off until a user makes a choice. AcidSpain Creators does not currently load analytics, advertising, or cross-site tracking cookies. Our consent panel offers equally accessible reject and accept actions, granular settings, and a permanent Cookie settings control in the site footer.

See the Cookie Policy for cookie names, purposes, lifetimes, third-party checkout information, and instructions for changing a choice.

We disclose information to service providers only as needed for them to perform services for us. Current categories include Supabase for database and file infrastructure, Vercel for application hosting and delivery, Stripe for subscription billing and its hosted billing pages, Resend for transactional email, and Google or YouTube for configured public channel enrichment. Other configured platform APIs may process the channel identifiers requested through those integrations.

Authorized workspace users may access workspace content according to their role and plan. Paid users may access creator email or exact pricing after an authorized reveal. AcidSpain operators may access records when needed for catalog administration, customer support, security, billing administration, or requested campaign execution.

We may disclose information in a business transaction, with a professional adviser under confidentiality, when required by law or valid legal process, or when reasonably necessary to protect the rights, safety, property, or security of AcidSpain, our customers, creators, service providers, or the public.

Public visitors receive masked creator previews. Raw creator emails, exact prices, private campaign records, and platform sync metadata are not intended for anonymous access. Authorized workspace users receive gated data according to plan, role, and token rules and may use it only for legitimate creator-marketing activity.

Creators may ask us to correct, claim, or remove a profile, subject to verification and legal or operational retention needs. A public business email or public platform metric can still be personal information, and we evaluate requests in light of the source, purpose, applicable law, customer commitments, and the rights of the creator.

We retain information only for as long as reasonably necessary for the purposes described here. The period depends on account and subscription status, campaign and client workflows, contractual obligations, creator data quality, security and fraud prevention, dispute resolution, and financial or legal recordkeeping requirements.

Session cookies expire as described in the Cookie Policy, and the cookie-preference record lasts up to 180 days unless replaced or cleared sooner. Campaign attachments remain private and are made available through authenticated, short-lived access links; profile images and company logos are workspace assets. Customers should delete content they no longer need, and they may request account deletion where applicable.

We may retain limited records after a request when necessary to document the request, prevent abuse, preserve billing or tax records, enforce agreements, protect other users, or comply with law. When retention is no longer justified, information is deleted, deidentified, or securely disposed of.

We use administrative, technical, and organizational safeguards designed for the nature of the platform. These include hashed passwords, signed and expiring sessions, HttpOnly and Secure cookie controls in production, role and workspace authorization, database access controls, rate limits, request-origin checks, private campaign-file storage, short-lived file links, audit records, and session revocation after sensitive account changes.

No internet service can guarantee absolute security. Customers must use unique passwords, protect reset and invitation links, assign the least access needed, remove former teammates promptly, and avoid selecting Remember me on shared or public devices. Contact us promptly if you believe an account or creator record has been compromised.

AcidSpain is based in the United States, and our providers may process information in the United States and other countries. Those locations may have privacy laws different from the country where information originated.

Where applicable law requires a transfer mechanism, we rely on appropriate contractual or other legally recognized safeguards made available by us or our providers. You may contact us for more information about the safeguards relevant to your information.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection to certain processing. Where processing depends on consent, you may withdraw consent at any time without affecting earlier lawful processing. You may also object to direct marketing at any time.

You may lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred. We encourage you to contact us first so we can address the concern. Contractual, legal, security, and identity-verification limitations may apply to a request.

Residents of California and other states with applicable privacy laws may have rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive personal information, appeal a denied request, and receive equal service without unlawful discrimination for exercising a right.

AcidSpain does not currently sell personal information or share it for cross-context behavioral advertising, and did not knowingly do so during the 12 months preceding this policy's effective date. We do not currently use personal information for targeted advertising. Where a browser sends a recognized Global Privacy Control signal, our consent system keeps marketing cookies off.

To exercise a right, email hello@acidspain.com, call +1 (786) 505-5398, or write to the address in Section 1. We may need information to verify identity and authority. An authorized agent may submit a request where permitted, but we may request proof of authorization and direct verification from the person concerned.

AcidSpain Creators is a business service and is not directed to children under 13. We do not knowingly collect personal information from a child under 13 through the service. If you believe a child provided personal information, contact us so we can investigate and take appropriate action.

Creator intelligence, matching, category, audience, safety, and campaign indicators are decision-support tools. They may use profile, platform, commercial, and campaign inputs, but they are not intended to make decisions that produce legal or similarly significant effects about an individual without human review.

Send privacy, creator-profile, correction, deletion, or rights requests to hello@acidspain.com. You may also call +1 (786) 505-5398 or write to AcidSpain LLC, 6303 Waterford District Dr STE 400, Miami, Florida 33126, United States.

We may update this policy when the product, providers, data practices, or law changes. We will post the revised date and provide additional notice when required. Material changes to optional cookie purposes will require a renewed choice where applicable.