Privacy Policy

Who we are

OneMediaKit ("we", "us") operates onemediakit.com — a service that turns a content creator's platform statistics into a live media kit. For anything in this policy, write to support@onemediakit.com. We are the data controller for the personal data described here.

The operator, as entered in the commercial register: OneMediaKit Arton Ismaili · c/o Arton Ismaili, Spiserstrasse 10, 8047 Zürich, Switzerland · UID CHE-188.289.136 · +41 76 400 51 31.

The data we collect

We only collect what the service needs to work:

• Account data — your name or brand name, e-mail address and password hash (we never see or store your actual password).
• Billing data — handled by Stripe, our payment processor. Card numbers never touch our servers; we store only your Stripe customer reference, plan and subscription status.
• Platform statistics — when you connect Instagram, Facebook, TikTok, YouTube, Pinterest or your newsletter tool, the platform hands us a read-only key. With it we fetch statistics: follower counts, views, engagement, aggregated audience demographics, top posts. We never receive your platform passwords, private messages or the ability to act on your account.
• Content you add — your bio, profile details, portfolio entries, rates, images you upload.
• Waiting-list data — if you leave your details before you have an account: your e-mail address, whether you are a creator, a brand or an agency, and the handle you asked us to hold. We use it to write to you when your place opens, and we remove it on request.
• Technical data — server logs (IP address, browser, pages requested) kept for security and debugging, and the cookies described below.

Why we process it

• To provide the service — build and refresh your media kit, produce your PDF and QR code (performance of our contract with you).
• To bill you — subscriptions, invoices, taxes (contract and legal obligations).
• To help you — answering messages you send through support or the in-app feedback bubble (legitimate interest).
• To improve the product — aggregated, de-identified statistics across members (for example average engagement per niche) that never expose an individual creator without consent (legitimate interest).
• To keep the platform safe — abuse prevention, security logging (legitimate interest and legal obligations).

We do not sell personal data. We do not run third-party advertising or advertising trackers.

Who processes data for us

A short, deliberate list of processors, each bound by their own data-processing agreement:

• Stripe — payments, subscription management and, where it is offered, the Stripe accounts of users paid through OneMediaKit.
• Hostinger — the servers this site and your space run on.
• Infomaniak (Switzerland) — our mailboxes and the e-mails the service sends you: password resets, welcome, alerts, invoices.
• An AI model provider — it receives only what is needed to answer: the question you type into the in-app help assistant; the deal details you enter when you ask for a contract draft; and, when a brand describes a campaign in the brief search, that brief together with the public network card of creators who joined the Creator Network (name, handle, niche, country, city, languages, follower totals per platform, engagement rate, monthly views, rates, availability, a short bio). Never your access keys, your e-mail, your age range, your audience breakdown or anything you did not publish on your network card. Nothing is used to train models.
• PostHog (hosted in the European Union), when analytics are switched on — product analytics on our own pages: which page was opened and which step of sign-up was reached. No advertising identifiers.
• The social platforms' official APIs (Meta, TikTok, Google/YouTube, Pinterest, Mailchimp) — they send us your statistics at your request; their own privacy policies govern what happens on their side.

Data we receive from Instagram, Facebook, TikTok and YouTube

You connect a platform by signing in on that platform's own page and approving a read-only permission. We never see your platform password. What we ask for, and the only thing we do with it, is listed here.

• Instagram and Facebook (Meta) — permissions instagram_basic, instagram_manage_insights, pages_show_list and pages_read_engagement. We read the username, follower count and post count of the Instagram professional account you pick, its insights (views, reach, profile visits, link clicks, likes, comments, saves, shares, and the aggregated age, gender and country of its audience), and the like and comment counts of its recent posts. The two Page permissions exist only to find the Instagram account linked to your Facebook Page. We never post, comment, message or change anything.
• Instagram login (Meta), when you connect with your Instagram credentials instead of Facebook — permissions instagram_business_basic and instagram_business_manage_insights. Same data, read the same way: the username, follower count and post count of the professional account that logs in, its insights and audience profile, and the like and comment counts of its recent posts. No Facebook Page is involved and no Facebook data is read.
• TikTok — scopes user.info.basic, user.info.stats and video.list. We read your account identifier, your follower, like and video counts, and your public videos: title, date, cover image, link, and their view, like, comment and share counts. We never upload, publish or edit.
• YouTube (Google) — scope yt-analytics.readonly, together with public channel data from the YouTube Data API. We read your channel's identifier and its subscriber, view and video counts, and YouTube Analytics reports for your own channel: views, likes, comments, shares, and the aggregated age, gender and country of your viewers. OneMediaKit uses YouTube API Services; the Google Privacy Policy applies to the data Google holds.

One purpose only: to show these figures in your own media kit, on the page and in the PDF you choose to share, and to keep them current with a daily refresh. Figures you hide are not shown. They are stored in your own space on our servers, with the access keys encrypted, and are deleted with your space.

We do not sell this data, do not use it for advertising, do not use it to build profiles of you for anyone else, and do not pass it to third parties except the processors listed above who host it for us. No person at OneMediaKit reads it except to fix a problem you reported, to keep the service secure, or when the law requires it. It is not used to train AI models.

OneMediaKit's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect whenever you like. In your dashboard, open Accounts and press Disconnect: the access key is deleted at once, every figure fetched through that platform is erased and the account leaves your public page until you connect it again. Figures you typed yourself stay. You can also withdraw the permission on the platform itself: your Google Account permissions for Google and YouTube, Business integrations in your Facebook settings for Facebook and Instagram, and the app permissions in your TikTok security settings. If you connected with Instagram login, you can also remove OneMediaKit in Instagram (Settings → Apps and websites): that deletes your Instagram data here. To erase everything, see Delete your data.

Your public kit — you decide who sees it

Your media-kit page shows exactly the sections and numbers you chose to publish, nothing more. New kits are password-protected by default: visitors need the password you hand out. You can make your kit public, change the password or re-protect it at any time from your dashboard.

Brand accounts and the Creator Network

If you are a creator who joined the Creator Network, a signed-in brand on a brand plan can see: your kit as it shows on the web (your visibility settings apply, and the password no longer stops them), a relative score computed by us from the numbers your kit already shows, and the count of brands following you. A brand never sees your e-mail address, the numbers you hid or content that only lives on your PDF. A brief a brand sends you arrives by e-mail from us, with the brand's address as the reply address; your own address reaches the brand only if you answer. Leaving the Creator Network removes your kit from every brand's search, dashboard, list and follow within the day.

If you hold a brand account, we store your company profile (name, website, industry, country, logo), your plan, its period and status, the creators you follow and your private notes on them, your lists and saved searches, and the briefs you sent (recipient, subject, text, date). Billing runs through Stripe as described above. This data is deleted 30 days after your account closes, except what invoicing law obliges us to keep. You can also delete the account yourself at any moment from your account page (Delete my brand account): a running subscription stops that minute, the profile, follows, lists, saved searches and briefs go at once, and copies in backups expire within 30 days.

Deals, invoices and payments

• Billing details: the legal name, address, tax and company numbers, bank details and logo you enter. They appear on the invoices you issue and on the invoices addressed to you, so the other party of the deal sees them on those invoices.
• Invoices and contracts: kept for both parties of the deal. Issued invoices are accounting records: they stay available to the other party and are kept after an account closes for as long as accounting law requires, then deleted.
• Calendar: events of a deal are shared with the other party of that deal. Private notes and the titles of your own blocks are never shown to anyone else.
• Payment through OneMediaKit: Stripe collects the identity and bank details needed to open your Stripe account, directly on its own pages. We receive only your Stripe account reference, its status and the payments made through OneMediaKit.

Cookies

We use cookies strictly for signing you in (session cookies), for the kit-password check, and for basic security. No advertising cookies, no cross-site tracking.

Retention

Messages sent through the contact form are stored with your name, email, subject and text so a person can reply, and emailed to our support address. A message refused by the anti-spam check is kept for fifteen minutes only, so you can correct and resend it, then deleted.

Your data lives as long as your account does. When a subscription ends, your kit goes offline and your space is archived intact so that you can come back: we keep it for twelve months from that date, and a new subscription restores it at the same address exactly as you left it. Twelve months after the archiving, the space and everything in it are deleted — kit, statistics, history, connections and uploads — and no copy is kept, except what invoicing law obliges us to keep, for as long as it obliges us to keep it. We warn you by e-mail before that date. You may also delete everything yourself at any moment from your dashboard (Billing, then Delete my account and data): the space goes at once and copies in backups expire within 30 days. Or ask us by e-mail and we do it within 30 days. Read-only platform keys are deleted with your space, and you can revoke them at any time from the platform itself (Facebook, TikTok, Google or Pinterest settings).

Where the data is

We operate from Switzerland. Our servers are in the European Union (France) and our mailboxes in Switzerland. Stripe and the AI model provider may process data in the United States; those transfers rely on the European Commission's standard contractual clauses or on the provider's certification under the EU-US and Swiss-US Data Privacy Frameworks.

Your rights

Under the GDPR and Swiss data-protection law you can ask for access, correction, deletion, portability or restriction of your personal data, and object to processing based on legitimate interest. One e-mail to support@onemediakit.com is enough — we answer within 30 days. You may also complain to your local supervisory authority.

Changes

When this policy changes in a way that matters, we tell members by e-mail before the change applies. The date at the top always reflects the current version.