Privacy Policy

STATUS: Working draft — internal placeholders filled, NOT yet reviewed by a licensed attorney. This describes how the product actually handles data. Before launch, have counsel confirm the data-rights, retention, children's, and international-transfer sections. Operating entity: Manna Media LLC (Nashville, Tennessee).

Effective date: July 31, 2026 Operator / data controller: Manna Media LLC, Nashville, Tennessee, USA Contact: bookings@mannamedia.co (monitored)

1. Who we are and what this policy covers

MannaMedia (the "Platform," "we," "us") operates a pay-per-verified-view creator marketing marketplace. There are two kinds of people who use us:

Creators — individuals who use our mobile app to connect their social accounts, post branded content, and get paid per verified view.
Brands — businesses that use our web dashboard to fund and run marketing campaigns.

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have. It applies to our mobile app, our website and dashboard, and the back-end services behind them.

We do not knowingly serve anyone under 18. See Section 8.

2. Data we collect

2.1 Information you give us directly

Account and identity: your name (or display name), email address, phone number (optional), and country. Brands also provide a company name and billing email.
Authentication: we store a password hash (we never store your password in plaintext).
Campaign content you submit: the URL and platform post ID of posts you enter into a campaign, and the associated captions/metadata we read from the connected platform.
Support and reports: anything you send us when you contact support, file a report, or block another user.

2.2 Social account data (via Phyllo / insightIQ)

When you connect a TikTok, Instagram, or YouTube account, you authorize our data provider Phyllo (insightIQ) to share, and us to receive, data about that account, including:

your platform handle, platform account ID, and follower count;
public post metadata and per-post engagement metrics (view counts, likes, comments, shares, saves);
audience geography and audience demographics where the platform makes them available.

We use this data to verify that a submitted post belongs to an account you actually control, to measure verified views, to score for fraud, and to match you to relevant campaigns. We poll these metrics on a decaying schedule for up to about 30 days per post.

2.3 Payment and payout data (via Stripe)

Payments, identity verification (KYC), tax forms (such as 1099s), and payouts are handled by Stripe. When you onboard to get paid, you provide information directly to Stripe.

We do not store your card numbers or bank account numbers. We store a Stripe account/customer identifier and the money movement itself (amounts, fees, status) in our ledger so we can pay you correctly and keep accurate financial records.

2.4 Device and usage data

Push tokens: if you enable notifications, we store your device push token to deliver notifications through Expo.
Usage and diagnostics: basic technical data needed to run and secure the service (for example, requests to our API, error logs, and interaction events). We use this to operate, debug, and improve the product.

2.5 The money ledger

All money-related events (earnings accruals, holdbacks, releases, payouts, fees, refunds, referral bonuses, commissions) are recorded in an append-only ledger. This is a system of record: entries are not edited or deleted. See retention (Section 6).

3. How we use your data

We use personal data to:

create and operate your account and authenticate you;
connect your social accounts and read the metrics needed to verify views and detect fraud;
run campaigns, match creators to campaigns, and process approvals;
calculate earnings and move money (via Stripe), including holdbacks, releases, referral bonuses, and agency commissions;
send transactional notifications (submission approved/rejected, earnings, releases, payouts, referral bonuses);
enforce our Terms, investigate fraud and abuse, handle reports and blocks, and comply with the law;
meet tax and financial recordkeeping obligations.

We do not sell your personal information, and we do not use it for cross-app advertising tracking. See Section 9 (CCPA) and Section 10 (GDPR) for the legal bases and your rights.

4. When we share data

We share personal data only with:

Phyllo (insightIQ) — to link social accounts and retrieve social metrics.
Stripe — to verify identity, process payments, generate tax forms, and pay you.
Expo — to deliver push notifications (device push tokens only).
Brands and creators, within a campaign — a brand running a campaign sees the submissions, post URLs, creator display names, and verified performance for that campaign; a creator sees the campaigns and brands they engage with.
Service providers that host and secure our infrastructure, under contract.
Authorities or acquirers — when required by law, to enforce our Terms, or in connection with a merger, acquisition, or sale of assets.

Each third party processes data under its own privacy terms. Review Phyllo's, Stripe's, and Expo's policies for details on their handling.

5. FTC disclosure and public content

Branded posts are advertising. We require creators to include the campaign's disclosure (for example, "#ad" or "Sponsored by [Brand]") in the caption, and we check for it before earnings accrue. Your public posts remain governed by the social platform where you posted them; this policy covers only the data we collect and process.

6. How long we keep data (retention)

Active accounts: we keep your data while your account is active and as needed to provide the service.
After account deletion: you can delete your account in the app (see Section 7). When you do, we anonymize your personal profile data (name, email, phone are scrubbed).
Financial records are retained after deletion. Ledger entries, payouts, and related tax/financial records are kept in de-identified or legally required form after account deletion because we are obligated to maintain accurate financial and tax records (for example, for 1099 reporting and anti-fraud/audit purposes). These records reference an anonymized account, not your scrubbed profile.
Reports, blocks, and push tokens tied to a deleted account are removed as part of deletion.

Retention periods for financial records follow applicable tax and accounting law — as a working default we retain financial and tax records for at least seven (7) years (aligned with common U.S. tax-record guidance). *(Attorney/accountant to confirm the exact period for your situation.)*

7. Your rights and choices

Regardless of where you live, you can:

Access / export your data — request a copy of your personal data. In-app data export is available (or being rolled out); you can also email us.
Delete your account — in the mobile app, go to Profile → Danger zone → Delete account and confirm. This triggers DELETE /me, which anonymizes your profile while retaining the financial records described in Section 6. You may also request deletion by email.
Correct inaccurate data.
Report or block — report content or block a brand/creator from within the app.
Manage notifications — turn off push notifications on your device.

To exercise any right, use the in-app controls or contact bookings@mannamedia.co. We will verify your request and respond within the timeframe required by applicable law.

8. Children

The Platform is for adults. You must be at least 18 years old to use it. We do not knowingly collect personal data from anyone under 18. If we learn we have collected data from someone under 18, we will delete it. If you believe a minor has used the Platform, contact bookings@mannamedia.co.

9. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of "sale" or "sharing" of personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Categories collected: identifiers (name, email, phone, account IDs), commercial information (campaign and payout activity), internet/usage activity (diagnostics), geolocation at the audience-aggregate level (from social platforms), and professional information (creator/brand profile). We collect these for the business purposes in Section 3.
Sources: you, your connected social accounts (via Phyllo), and Stripe.
Disclosure for a business purpose: to the service providers in Section 4.
Non-discrimination: we will not discriminate against you for exercising your rights.

To exercise CCPA rights, use the in-app controls or email bookings@mannamedia.co. You may use an authorized agent. We will verify your identity before acting.

10. European/UK privacy rights (GDPR/UK GDPR)

Note: the Platform launches for U.S. creators and brands. If we offer the service to individuals in the EEA/UK, the following applies. *(If you actually take EEA/UK users, counsel should confirm scope and whether an EU/UK representative must be appointed under Art. 27 GDPR.)*

If the GDPR or UK GDPR applies to you, our legal bases for processing are:

Contract — to provide the service you signed up for (accounts, campaigns, payments).
Legal obligation — tax, financial recordkeeping, and fraud prevention.
Legitimate interests — securing the Platform, preventing fraud, improving the product (balanced against your rights).
Consent — where required (for example, optional notifications); you may withdraw it at any time.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. International transfers (for example, to U.S.-based providers such as Stripe, Phyllo, and Expo) are made under appropriate safeguards such as Standard Contractual Clauses. To exercise these rights, contact bookings@mannamedia.co.

11. Security

We protect data in transit using HTTPS/TLS and use standard, industry-accepted cryptography. Passwords are stored only as salted hashes. Money movement is driven by verified payment-provider webhooks with idempotency, not by client-side calls. No system is perfectly secure, but we work to protect your information and to limit access to those who need it.

12. Changes to this policy

We may update this policy. When we make material changes, we will update the effective date and, where appropriate, notify you in the app or by email. Continued use after an update means you accept the revised policy.

13. Contact

Questions or requests: bookings@mannamedia.co Operator: Manna Media LLC · Nashville, Tennessee, USA · *[street mailing address to be added]*