Who we are

OneMediaKit ("we", "us") operates onemediakit.com — a service that turns a content creator's platform statistics into a live media kit. For anything in this policy, write to support@onemediakit.com. We are the data controller for the personal data described here.

The data we collect

We only collect what the service needs to work:

• Account data — your name or brand name, e-mail address and password hash (we never see or store your actual password).
• Billing data — handled by Stripe, our payment processor. Card numbers never touch our servers; we store only your Stripe customer reference, plan and subscription status.
• Platform statistics — when you connect Instagram, Facebook, TikTok, YouTube, Pinterest or your newsletter tool, the platform hands us a read-only key. With it we fetch statistics: follower counts, views, engagement, aggregated audience demographics, top posts. We never receive your platform passwords, private messages or the ability to act on your account.
• Content you add — your bio, profile details, portfolio entries, rates, images you upload.
• Technical data — server logs (IP address, browser, pages requested) kept for security and debugging, and the cookies described below.

Why we process it

• To provide the service — build and refresh your media kit, produce your PDF and QR code (performance of our contract with you).
• To bill you — subscriptions, invoices, taxes (contract and legal obligations).
• To help you — answering messages you send through support or the in-app feedback bubble (legitimate interest).
• To improve the product — aggregated, de-identified statistics across members (for example average engagement per niche) that never expose an individual creator without consent (legitimate interest).
• To keep the platform safe — abuse prevention, security logging (legitimate interest and legal obligations).

We do not sell personal data. We do not run third-party advertising or advertising trackers.

Who processes data for us

A short, deliberate list of processors, each bound by their own data-processing agreement:

• Stripe — payments and subscription management.
• Our hosting provider — the servers this site runs on.
• Our e-mail provider — transactional e-mail (welcome, alerts, password resets).
• The social platforms' official APIs (Meta, TikTok, Google/YouTube, Pinterest, Mailchimp) — they send us your statistics at your request; their own privacy policies govern what happens on their side.

Your public kit — you decide who sees it

Your media-kit page shows exactly the sections and numbers you chose to publish, nothing more. New kits are password-protected by default: visitors need the password you hand out. You can make your kit public, change the password or re-protect it at any time from your dashboard.

Brand accounts and the Creator Network

If you are a creator who joined the Creator Network, a signed-in brand on a brand plan can see: your kit as it shows on the web (your visibility settings apply, and the password no longer stops them), a relative score computed by us from the numbers your kit already shows, and the count of brands following you. A brand never sees your e-mail address, the numbers you hid or content that only lives on your PDF. A brief a brand sends you arrives by e-mail from us, with the brand's address as the reply address; your own address reaches the brand only if you answer. Leaving the Creator Network removes your kit from every brand's search, dashboard, list and follow within the day.

If you hold a brand account, we store your company profile (name, website, industry, country, logo), your plan, its period and status, the creators you follow and your private notes on them, your lists and saved searches, and the briefs you sent (recipient, subject, text, date). Billing runs through Stripe as described above. This data is deleted 30 days after your account closes, except what invoicing law obliges us to keep.

Cookies

We use cookies strictly for signing you in (session cookies), for the kit-password check, and for basic security. No advertising cookies, no cross-site tracking.

Retention

Messages sent through the contact form are stored with your name, email, subject and text so a person can reply, and emailed to our support address. A message refused by the anti-spam check is kept for fifteen minutes only, so you can correct and resend it, then deleted.

Your data lives as long as your account does. If you cancel, your space stays intact (suspended) so you can come back; you may request full deletion at any time and we remove your space, statistics and account within 30 days — except what invoicing law obliges us to keep, for as long as it obliges us to keep it. Read-only platform keys are deleted with your space, and you can revoke them at any time from the platform itself (Facebook, TikTok, Google or Pinterest settings).

Your rights

Under the GDPR and Swiss data-protection law you can ask for access, correction, deletion, portability or restriction of your personal data, and object to processing based on legitimate interest. One e-mail to support@onemediakit.com is enough — we answer within 30 days. You may also complain to your local supervisory authority.

Changes

When this policy changes in a way that matters, we tell members by e-mail before the change applies. The date at the top always reflects the current version.