Privacy policy

1. Introduction

We are Creator Technologies Ltd (company number 15624338), registered in England and Wales with our registered office at 124 City Road, London EC1V 2NX, operating the Trudy platform at trudy.app. This policy explains how we handle personal data, and it is organised in two parts.

If you are a creator whose public content Trudy analyses, section 2 is written for you. It is our creator privacy notice: it explains what the product collects from public profiles, why, and your right to object at any time.

The remaining sections cover everyone else we deal with: website visitors, prospective and current customers, influencers we contract with, event attendees, job applicants and people who receive our updates. Sections 5 onwards apply to all personal data we hold, including creator profiles.

For any question about this policy, or to exercise your legal rights, contact privacy@trudy.app or write to us at the address above. Our representative in the European Union under Article 27 of the EU GDPR is Prighter GmbH, Schellinggasse 3, 1010 Vienna, Austria. You can contact our representative, and exercise your rights through them, via our Trust Center: app.prighter.com/portal/12745286821.

2. Creator privacy notice: how Trudy analyses public profiles

2.1 Does this section apply to you?

This section is the privacy notice for creators: people with public social media profiles whose published content Trudy analyses. If you have a public profile with more than 1,000 followers, Trudy may hold a profile about you. Because we collect this information from public sources rather than from you directly, Article 14 of the UK and EU GDPR requires us to explain what we collect, why we collect it, and the rights you have. This section is that explanation; the sections on storage and transfers (5), security (7) and your rights (9) apply to creator profiles too.

2.2 What Trudy is

Trudy is a decision-support tool for creator marketing. It analyses publicly available creator content and produces a fit assessment: a 0–100 score across content fit, audience fit and psychometric fit, which brands, agencies and creator networks use to decide which creators to shortlist for commercial collaborations. The psychometric component measures communication style and audience-trust characteristics of your published content; it does not assess your personality or emotional state.

Trudy does not contact you, does not negotiate for you or about you, and does not make selection decisions. Our customers make their own decisions, weighing Trudy's assessment alongside pricing, prior collaborations and their own judgement. Trudy does not access private content or direct messages, does not use content from profiles with 1,000 followers or fewer, and does not generate synthetic media.

2.3 What we collect, and where from

Everything we collect comes from what you have published on public social media platforms. The categories are: profile information (your name or handle, profile description, country where apparent from your public profile, and follower count); published content (captions, video and audio transcripts, and technical signal characteristics of published audio and video); engagement statistics (likes, views, comment counts and engagement rates); and aggregate audience statistics provided by the platforms (country, age and gender distributions of your audience as a whole). We hold no records about individual followers and we do not scan the text of comments on your posts.

What we never collect: private or restricted content; direct messages; special category data (our ingestion filters detect and discard signals revealing religion, health, ethnicity, political opinions, sexual orientation or similar characteristics before anything is modelled or stored, and they form no part of any profile or score); biometric identification data; and anything from profiles at or below the 1,000-follower threshold.

2.4 What we produce

From this material we derive a creator profile: the topics and style characteristics of your content, aggregate audience composition, and the three fit scores. Scores are relative to a specific brand or campaign brief, so the same creator scores differently for different briefs. The principal factors are the topical and stylistic match between your published content and the brand's brief, the overlap between your audience's aggregate characteristics and the brand's target audience, and communication-style characteristics of your published content associated with audience trust.

2.5 Our legal basis

We rely on legitimate interests (Article 6(1)(f) of the UK and EU GDPR): enabling evidence-based matching between brands and professional creators who publicly seek commercial collaborations, and training and improving the models that produce Trudy's fit assessments. A documented legitimate interests assessment supports this. In short: the source data is professional and public by your choice; creators above the follower threshold operate in a market where analytics tools are standard and brand collaborations are actively sought; the processing involves no special category data, no private content and no solely automated decisions with legal or similarly significant effects; and you can object at any time and we will stop. You can request a summary of the assessment via privacy@trudy.app.

2.6 Automated decision-making

Trudy scores; people decide. No creator is automatically selected or excluded by the system. Selection decisions are taken by our customers, who weigh the assessment alongside pricing, availability, past collaborations and their own review of your work, so Trudy does not make decisions of the kind restricted by Article 22 of the UK and EU GDPR. You can contest any element of your profile and have it corrected (section 2.8).

2.7 Who sees your information

Our customers (brands, agencies and creator networks) see your profile and scores within the Trudy platform, and our contracts require them to tell you about Trudy's role no later than the point you are approached for a campaign. Our service providers process data on our instructions: cloud hosting providers, and a large language model provider that receives text excerpts of published content for content-fit analysis (text only; never audio, video or images). Beyond that, we disclose personal data only to our professional advisers, to authorities where the law requires it, and to a prospective buyer of the business under confidentiality.

2.8 Your rights and choices

You can object at any time, and we will stop. Email privacy@trudy.app. We will remove your profile, add you to our suppression list so your profile is not collected again, and confirm within one month. This is free, and you do not need to give a reason.

You also have the right to: access what we hold about you; correct or contest anything, including the scores and the material behind them; have your data erased; restrict processing while a request is resolved; and complain to a supervisory authority, either the Information Commissioner's Office in the UK (ico.org.uk) or your local data protection authority if you are in the EU or EEA (listed at edpb.europa.eu). We respond to all requests within one month.

2.9 How long we keep your information

Raw collected material is kept for 12 months. Derived profiles and scores are kept for 24 months from the last refresh; profiles in active coverage are refreshed on a rolling cycle, and anything not refreshed within these periods is deleted. If you object, your profile is deleted within one month and the suppression entry (the minimum needed to honour your objection) is all that remains. Where profiles are stored, and how transfers outside the UK and EEA are protected, is set out in section 5.

3. How we use your personal data (customers, influencers, visitors, applicants)

When you contact us, by phone, email, our 'Let's Talk' page or social media, we collect your name, social media handle and contact details, because it is in our legitimate interest to respond properly to your query.

When we on-board you as a customer, we collect your name, email address, phone number, address, company name and address (if applicable) and payment details, in order to take steps to enter into a contract with you and then to perform it.

When we on-board you as an influencer, contracting with you directly or through your agency, we collect your name, email address, phone number, address and public social media profile information and, where we contract with you directly, your company name and address and payment details. We collect this to enter into and perform the contract with you or your agent.

When you sign up to receive our updates, we collect your name and email address and rely on your consent. You can unsubscribe at any time by replying to any email from us or emailing privacy@trudy.app.

When you use our website and consent to non-essential cookies, we collect information about how you use it, including IP address, approximate location, browser and operating system, referral source, length of visit, pages viewed and navigation paths, to improve the website. Detail is in section 8.

When you attend one of our events or a third-party event we also attend, including virtual events, we usually collect your name, address, email address and phone number, because it is in our legitimate interest to promote our business and know who is attending.

When you apply for a job with us, we collect your name, contact details, recruitment information such as right-to-work documentation and references, test results, qualifications and accreditations, and any additional information from you or our recruitment partners. We use this to assess your suitability, to take steps at your request before entering a contract, and, for right-to-work documentation, to comply with our legal obligations.

If our business is sold, we process personal information under our legitimate interest in ensuring the business can be continued by the buyer, under confidentiality.

4. Who sees your data

Service providers who process data on our instructions under contract: hosting, analytics, payment and communications providers. If you are an influencer working with us: the brands and agencies considering or running a collaboration with you. If you are a customer: influencers and their agents, to the extent needed to arrange a collaboration with you. Our insurers and professional advisers, for insurance, risk management, professional advice and the establishment, exercise or defence of legal claims. Regulators, authorities and enforcement agencies, where we are under a duty to disclose, to enforce our terms, or to protect the rights, property or safety of our clients or others, including fraud protection. Prospective buyers of our business, under our legitimate interest in ensuring the business can be continued, under confidentiality.

5. Where your data is stored, and international transfers

We store personal data, including the creator profiles described in section 2, on Google Cloud infrastructure in the UK and EU. One dedicated customer deployment runs on AWS in the United States and holds only the profiles served to that customer. Where personal data leaves the UK or the EEA, for example to a provider in the United States or through text-only calls to our language model provider, we protect it with the EU–US Data Privacy Framework (including its UK Extension) where the recipient is certified, or with the 2021 EU Standard Contractual Clauses together with the ICO's UK Addendum, or the ICO's International Data Transfer Agreement, in each case supported by a transfer impact assessment. Transfers between the UK and the EEA rely on the applicable adequacy decisions. You can obtain a copy of the safeguard relevant to your data via privacy@trudy.app.

6. How long we keep your data

We keep personal data no longer than we need it for the purpose it was collected for. In practice: customer and influencer account records for the life of the relationship and then for as long as legal, accounting or limitation-period requirements demand; marketing data until you unsubscribe; recruitment data for the duration of the recruitment process, and longer only with your consent; website analytics for the cookie durations set out in section 8; and creator profiles for the periods set out in section 2.9 (12 months for raw collected material, 24 months for derived profiles and scores). In some circumstances we irreversibly anonymise data, so it can no longer be associated with anyone, and use that anonymised information to improve our services.

7. Security

Personal data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access is role-based on a need-to-know basis and logged, two-factor authentication is enforced, our people are bound by confidentiality undertakings and trained in security, and we review our security controls at least annually.

8. Cookies

Essential cookies. We use essential cookies to distinguish you from other users and make the website work. These are trudy_consent_v1, which records your cookie choice so that we do not ask again, and _cfuvid, set by Cloudflare to tell real visitors from automated traffic. We can place these without consent, but you can block all cookies in your browser settings; if you block essential cookies, parts of the website may not work.

Cookies you control. A cookie banner appears on your first visit and nothing in the table below is set until you choose. Until then we instruct Google to treat every storage category as denied, so no analytics or advertising cookies are placed. Your choice lasts 12 months, after which we ask again, and you can change it at any time through the Cookie settings link in the footer of any page.

Cookie	Purpose	Duration
Google Analytics	Helps us understand how you use the website, including how long you spend and which pages you visit. Set only if you allow the Statistics category. More detail: policies.google.com/technologies/cookies	1 minute to 2 years, by cookie type

Marketing. We run no advertising or remarketing tags on this website. The Marketing option in the banner is there so that any we add in future stay blocked until you allow them.

Product analytics outside the banner. Our home page also loads PostHog, a product analytics tool that records the pages you view, the elements you interact with and a replay of your session, so that we can see how that page is used. It sets a cookie that lasts one year. PostHog is not controlled by the cookie banner. To stop it, block cookies for this site in your browser, or write to privacy@trudy.app and we will exclude you.

You can withdraw or change your consent at any time through the Cookie settings link in the footer of any page, or by blocking cookies for this site in your browser settings.

9. Your rights

You have the right to: access your personal data (a subject access request); have incomplete or inaccurate data corrected; have your data erased; restrict our handling of your data; receive data you provided to us, where processing rests on contract or consent and is automated, in a portable format; object to processing based on legitimate interests, and object absolutely to direct marketing; and withdraw consent at any time, without affecting processing that happened before you withdrew it. We respond within one month. Some rights depend on the legal basis of the processing concerned; if a right does not apply, we will tell you why. Creators also have the dedicated objection and correction route in section 2.8.

Where we rely on legitimate interests, we have assessed that the processing is necessary for a specific, articulated interest and that your interests and fundamental rights and freedoms do not override it. You can request a summary of the balancing assessment for any processing described in this policy via privacy@trudy.app.

You can complain to us at privacy@trudy.app, to the Information Commissioner's Office, the supervisory authority for the United Kingdom (ico.org.uk), or, if you are in the EU or EEA, to your local supervisory authority (listed at edpb.europa.eu). Our representative in the European Union is named in section 1, and if you are in the EU or EEA you can exercise your rights through them via our Trust Center: app.prighter.com/portal/12745286821.

10. Updates to this policy

We may update this policy by publishing a new version on our website, dated at the top. We will flag significant changes with a notice on the site.

11. Contact

privacy@trudy.app, or Creator Technologies Ltd, 124 City Road, London EC1V 2NX.