Privacy Policy

Effective date: 12 October 2026. Last updated: 12 October 2026.

1. Who is responsible

The data controller for delvora.io and app.delvora.io is Delvora P.S.A., Aleja Jana Pawła II 27, 00-867 Warszawa, Poland, KRS 0001266798, NIP 5273236974, REGON 545745040 ("Delvora", "we", "us"). For privacy matters contact casper@delvora.io.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Polish data protection law.

2. Who this policy covers

This policy describes how we handle personal data of three groups:

• Customers and users: people who create an account or belong to an organisation workspace in Delvora.
• Creators: social media creators whose public profile and content information appears in Delvora, and creators who apply to a campaign through a Delvora signup page.
• Website visitors: anyone who visits delvora.io.

Where a customer uploads or collects personal data in Delvora (for example creator contact details or notes), the customer is the controller of that data and we act as their processor under the Data Processing Addendum.

3. Data about customers and users

4. Data about creators

Delvora's core function is to help brands find and work with social media creators. To do this we collect and analyse information that creators have chosen to make public on Instagram, TikTok and YouTube, obtained through platform APIs, licensed data providers and automated collection of public pages. This includes:

• public profile information: username, display name, biography, profile picture, follower and following counts, verification status, public contact details shown in the bio and links;
• public content: posts, reels, stories, videos, captions, hashtags, mentions, and public engagement metrics such as likes, comments and views;
• derived information: content categories, estimated audience demographics and location, engagement rates, credibility and brand-fit scores produced by our analysis, including AI models;
• campaign information added by customers: outreach status, notes, agreed deliverables, posted content tracked for a campaign.

If you apply to a campaign through a Delvora signup page, we also collect the details you enter into that form (for example name, email, phone, address, social handles, shipping details). The brand running the campaign is the controller of that form data and decides how it is used; we process it on their behalf.

Legal basis. We process public creator data on the basis of our legitimate interests and those of our customers (Art. 6(1)(f) GDPR) in identifying and evaluating creators for commercial collaborations and in measuring sponsored content. We only use publicly available information, we do not process special category data, and we limit use to influencer marketing purposes. We have assessed that this processing does not override creators' interests, given that the information is published for professional self-promotion.

Creators' rights. If you are a creator and want to know what we hold about you, correct it, object to processing, or have your profile excluded from Delvora, email casper@delvora.io. We will respond within one month and, where you object, remove your profile from search results unless we have compelling grounds to continue.

5. Website visitors and cookies

delvora.io uses only strictly necessary cookies and does not run advertising trackers. The application at app.delvora.io uses:

• Necessary cookies for authentication and security (set by our identity provider and by us). These cannot be switched off.
• Analytics (Hotjar) to understand how the application is used, including anonymised session recordings and heatmaps. Hotjar masks keystrokes and form inputs by default. This runs only with your consent, which you can give or withdraw in the cookie settings in the application.

Our servers also record standard access logs (IP address, user agent, requested URL, timestamp) for security and troubleshooting.

6. Purposes and legal bases

7. Who we share data with

We do not sell personal data. We share it with service providers who process it on our instructions, and with your organisation's administrators and members within your workspace. Our main providers:

We may also disclose data where required by law, to protect our rights, or in connection with a merger or acquisition, in which case we will notify you.

8. International transfers

Some providers are located outside the European Economic Area, mainly in the United States. Where that is the case we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for certified providers, and otherwise on Standard Contractual Clauses together with additional safeguards. You can request a copy of the relevant safeguards at casper@delvora.io.

9. How long we keep data

• Account and workspace data: for the life of the account and 30 days after closure to allow export, then deleted.
• Billing records: 5 years after the end of the tax year, as required by Polish accounting and tax law.
• Creator profile data: refreshed regularly and removed when it is no longer available on the source platform, on a valid objection, or after 24 months without being accessed.
• Tracked campaign content: for the life of the customer's account, so campaign reports remain accurate.
• Server logs: up to 90 days.
• Support communications: 3 years.

10. Security

We protect data with encryption in transit (TLS) and at rest, role-based access within workspaces, least-privilege access for staff, audit logging, and regular dependency and security updates. Payment details are handled entirely by Stripe, which is PCI DSS Level 1 certified. No method of transmission or storage is completely secure, and we will notify you and the supervisory authority of a personal data breach where the GDPR requires it.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• restrict processing in certain circumstances;
• receive your data in a portable format;
• object to processing based on legitimate interests, including profiling, and to direct marketing at any time;
• withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal;
• lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise these rights email casper@delvora.io. We may ask you to verify your identity. We respond within one month, extendable by two months for complex requests. If you are a creator and the data was entered by one of our customers, we may forward your request to that customer and help them respond.

We do not make automated decisions with legal or similarly significant effects. Scores and categories produced by our models are used by customers as one input among others when choosing who to contact.

12. Children

The Service is for business users aged 18 and over. We do not knowingly collect data from children. Creator profiles that are clearly operated by minors are excluded from search where we can identify them, and we remove them on request.

13. Data Processing Addendum

Where we process personal data on behalf of a customer (Customer Data as defined in the Terms of Service), the following terms apply and form our data processing agreement under Art. 28 GDPR:

1. Roles. The customer is the controller; Delvora is the processor. Subject matter: provision of the Service. Duration: the subscription term. Nature and purpose: hosting, storing, analysing and displaying Customer Data to provide the Service. Data subjects: creators, customer staff and contacts. Data types: contact details, social media identifiers, campaign and communication records.
2. Instructions. We process Customer Data only on the customer's documented instructions, which include the Terms of Service and use of the Service's features, unless required otherwise by EU or Member State law.
3. Confidentiality. Our personnel with access to Customer Data are bound by confidentiality obligations.
4. Security. We implement the measures described in section 10.
5. Sub-processors. The customer authorises the sub-processors listed in section 7. We will give at least 14 days' notice of changes by email or in the application; the customer may object on reasonable data protection grounds, and if we cannot resolve the objection the customer may terminate the affected service.
6. Assistance. We will assist the customer, taking into account the nature of processing, in responding to data subject requests, in meeting security and breach notification obligations, and in data protection impact assessments.
7. Breach notification. We will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data.
8. Deletion. At the end of the subscription we will make Customer Data available for export for 30 days and then delete it, unless EU or Member State law requires storage.
9. Audit. We will make available information necessary to demonstrate compliance with Art. 28 GDPR and allow audits by the customer or an auditor mandated by the customer, at most once a year unless required by a supervisory authority, on reasonable notice and subject to confidentiality.
10. Transfers. Transfers outside the EEA take place only under the safeguards described in section 8.

Enterprise customers who need a separately signed DPA can request one at casper@delvora.io.

14. Changes

We may update this policy from time to time. Material changes will be announced by email or in the application at least 14 days before they take effect. The effective date at the top shows when the current version applies.

15. Contact

Delvora P.S.A.
Aleja Jana Pawła II 27, 00-867 Warszawa, Poland
Privacy: casper@delvora.io
General: casper@delvora.io