Sub-processors

Primary application database and serverless functions runtime.

• Account profile
• Campaign and offer records
• Messaging content
• Payment metadata

Web application hosting and global edge / CDN delivery for the Next.js application, plus product analytics (page views and custom events) and Core Web Vitals real-user monitoring.

• Request metadata
• IP address (transient)
• Page and route visited
• Device, browser and connection metrics
• Visitor-level Core Web Vitals measurements

User authentication, session management and account security.

• Email address
• Name
• Authentication factors
• Session metadata

Payment processing, Stripe Connect payouts and invoice billing.

• Name
• Email address
• Payment instrument metadata
• Transaction history
• Tax identifiers

Self-employed payouts, tax withholding and Skatteverket KU10/AGI reporting for Swedish influencers.

• Name
• Personnummer
• Bank account details
• Payout amount

Qualified electronic signature for contracts and identity verification of Swedish residents.

• Personnummer
• Name
• Signature evidence

Error monitoring and application performance telemetry.

PII fields are redacted at the application boundary before transmission.

• Stack traces
• Request metadata
• User identifier (pseudonymised)

Transactional email delivery (notification, campaign and account emails sent from the platform).

Engaged only when email sending is configured for the deployment (`EMAIL_PROVIDER_API_KEY`); no marketing email is sent without opt-in consent.

• Recipient email address
• Email subject and body
• Delivery, bounce and complaint events

Push-notification relay for the Collabify mobile app — forwards notifications to Apple APNs and Google FCM.

Only engaged when a user enables push notifications on a device.

• Device push token
• Notification title and body
• Delivery receipts

AI-assisted post-description and scheduling-prompt generation.

Engaged under zero-retention API terms; prompts are not used for model training.

• Campaign briefs
• Influencer-supplied draft content

AI model routing for campaign-brief drafting and the advisory AI review of a submitted campaign video against its brief.

Prompts and media are routed to the model provider under no-training terms; the review is advisory — the business reviewer decides.

• Campaign briefs
• Business-supplied draft text
• Submitted campaign video (for the advisory review only)

OAuth-based access to a user's TikTok account for content publishing and analytics.

Only engaged when a user explicitly connects their TikTok account.

• OAuth access and refresh tokens
• Public profile data (display name, username, avatar, bio, follower/likes counts)
• Statistics of videos published through Collabify
• The approved video, caption and post settings sent for publishing

OAuth-based merchant integration for product sync and discount-code provisioning.

Only engaged when a business connects a Shopify store.

• Shop domain
• Product catalogue
• Discount codes
• Order references

Authenticated REST API access to a merchant's WooCommerce store for product sync.

Only engaged when a business connects a WooCommerce store.

• Store URL
• Product catalogue
• Order references