The Platform — both the Content Rewards web application and the Whop-hosted experience — is for users 18 and older only. We do not knowingly permit anyone under 18 to use it, including with parental consent, and if we learn that someone under 18 has created an account, we terminate it and delete their data.

Defined terms used here (such as Submission, Clip, Draft, Campaign, Brand, and Bot Score) have the meanings given in the Creator Terms and Organization Terms.

3.1 Account and identity data — name, email address, phone number (used for account and support communication, and for verification where offered), account sign-in data (you sign in through Whop’s login service), and business verification details for Brands.

3.2 Linked social account data. You can link a social account by connecting it through a platform’s official API (OAuth — see Section 4) or, where offered, by verifying ownership with a verification code placed in your account bio. For linked accounts and posts you submit to Campaigns, we collect publicly available profile and performance data (such as username, follower/subscriber count, and view and engagement metrics), whether obtained through platform APIs or from publicly available sources. Linking is always your choice; if you do not link an account, we do not collect linked-account data about you.

3.3 Submission and Campaign data — Clip URLs, Drafts, Pre-post Review chat, view and engagement metrics, approval/rejection status, and appeal content.

3.4 Fraud and device data — Bot Score inputs and signals, and technical/usage signals used to detect fraud.

3.5 Support and communications — messages you send to support and related metadata.

3.6 Usage and analytics — how you interact with the Platform.

Creators can connect their social media accounts, including TikTok, YouTube, Instagram, Facebook, and X, through the supported connection methods on the Platform. The descriptions in this Section apply if you choose to connect a social account. We use read-only access to verify ownership and read account, content, and performance data; we do not post on your behalf. You choose whether to connect a social account. However, certain Campaigns require a connected account to verify ownership and access relevant analytics. If you do not connect the required account, you may be unable to submit content to those Campaigns.

4.1 Platforms and account requirements. - Instagram — Professional/Business or Creator account only. - Facebook — a Facebook Page you administer, not a personal profile. - TikTok. - YouTube. - X.

4.2 Data we access. The connection is read-only, and it also confirms that you own the connected account and posts. What we receive depends on the platform:

• Instagram — account id, username, display name, account type, profile picture, follower count and media count; your posts and their metadata; and insights for your account and posts, such as reach, likes, comments, shares and saves (instagram_business_basic, instagram_business_manage_insights).
• Facebook — the list of Pages you administer, including Pages held in business portfolios you can access, each Page’s details, and its posts and the engagement on them (pages_show_list, pages_read_engagement, business_management).
• TikTok — your account identifiers, username, display name, bio, profile picture and verification status; follower, following, likes and video counts; your videos and engagement metrics; and, where the connection and granted permissions support it, creator and audience insights, viewing statistics, and comments. Supported connections include TikTok Login Kit and TikTok’s Business API; the data available depends on the permissions granted.
• YouTube — your Google account name, email and profile picture; your channel and its statistics; and your videos with their statistics and analytics, including audience country, age-group and gender breakdowns, engagement, watch time, retention, and traffic sources where available (openid, profile, email, youtube.readonly, yt-analytics.readonly).
• X — where API access is available, your profile and public post metrics.

We use this data to verify campaign content, measure performance, calculate payouts, and share relevant profile, content, audience, and performance information with the Organization running your Campaign as described in Section 7.

4.3 Token storage, disconnection, and revocation. Tokens are stored server-side. You can disconnect a platform in your account settings (Connected accounts) or revoke access in the platform’s own settings. We stop using the revoked authorization and invalidate stored tokens when you disconnect. For YouTube, we also revoke the token with Google immediately when you revoke access through CR. Disconnection may interrupt tracking or verification. Disconnecting alone does not cancel earnings already earned, but payment may be held while remaining eligibility verification is completed. If you remove Content Rewards from your Facebook or Instagram settings, the platform notifies us and we start our deletion process for that account automatically. Data deletion is described in Sections 4.4, 4.6 and 10.

4.4 Retention, deletion, and Campaign reports. If you disconnect a social account or ask us to delete its data, we will stop collecting data through that connection and delete the affected data within the deadlines required by the platform and applicable law. We may retain anonymous counts of Campaign submissions and participants from CR’s own records, along with payment records we are legally required to keep. Views, engagement and audience reports may change when social-platform data is removed. We may retain anonymous statistics derived from social-platform data only where the platform’s rules and applicable law permit. Otherwise, we remove the deleted data’s contribution from those reports. While a connection remains active, we keep connected-account data only as long as needed for the purposes described in this policy and as permitted by the platform’s rules. Section 4.6 sets out the specific YouTube deadlines. We do not collect or retain OAuth data beyond the read-only fields listed in this Section.

4.5 Whop and Discord. You sign in to the Platform through Whop’s login service (covered by Whop’s own terms and privacy policy). You may also optionally link a Discord account; linking identifies your Discord account to us and adds you to the Content Rewards Discord server. Discord linking is not used to read your messages or post as you.

4.6 Google and YouTube. Content Rewards uses YouTube API Services. Content Rewards’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through YouTube API Services is stored no longer than 30 days unless refreshed through the API, in accordance with YouTube’s API policies. To delete stored YouTube data at any time, disconnect the YouTube account in Settings > Connected accounts or contact us at the address in Section 13. If you disconnect through CR, request deletion, or delete your CR account, we delete the affected YouTube API data as soon as possible and within 7 calendar days. If you revoke access through Google’s security settings, we delete the affected YouTube API data as soon as possible and within 30 calendar days. By connecting a YouTube account you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google’s handling of your data. You can revoke Content Rewards’ access to your Google data at any time via Google security settings.

4.7 Limited use. Data received from connected platforms is used only for the purposes described in this Section. It is not sold, and it is not used for advertising or ad targeting.

We use personal data to: operate the Platform and Campaigns; verify post ownership and views; calculate and make payouts; run fraud detection and the Bot Score; review Submissions and apply Campaign requirements using automated tools; provide support; meet tax, sanctions, and other legal obligations; and improve and secure the Platform.

6.1 What it is. The Bot Score is a fraud-risk score from 0–100, produced with the help of a third-party fraud-detection provider. The specific signals, weights and detection methods are proprietary and may change without notice.

6.2 The logic, in plain terms. The model assesses signals associated with a Submission and the connected account to estimate the likelihood that views or engagement are non-genuine.

6.3 How it is used. The Bot Score is shown to Brand and CR moderators as an input to manual review. A Submission whose score meets or exceeds a fraud threshold may be automatically flagged for human review, and the related payout is paused while the flag is open. The Bot Score does not by itself approve or reject a Submission. Decisions on Bot Score flags, including whether a paused payout is released or reversed, are made by a person. We may use automated tools to review submissions and apply Campaign requirements. If we introduce decisions based solely on automated processing that require additional notices or safeguards under applicable law, we will provide them.

6.4 Lawful basis. We process Bot Score data to operate the Platform and prevent fraud, relying on the performance of our contract with you and on our legitimate interests in protecting Brands and honest Creators, balanced against your rights.

6.5 Your rights. Your general data rights described in Section 9 (including access, correction, objection, and complaint to a supervisory authority) apply to Bot Score processing. If you disagree with a moderation outcome, you may raise it through the appeal process for flagged Submissions in the Creator Terms, where it is handled by a person.

Whop. Whop Inc is an independent platform and payment processor that you also contract with directly under Whop’s own terms and privacy policy. Campaign funding, withdrawals, and related KYC are handled through Whop; data you provide to Whop is governed by Whop’s privacy policy.

We share personal data with service providers that process it on our behalf. They fall into the following categories:

• Fraud and bot detection.
• Cloud hosting, storage and databases.
• Product and performance analytics.
• Error monitoring.
• Email and SMS delivery.
• Support messaging, including automated generation of support-chat replies.
• Automated review of submitted content, which may include audio and video processing.
• CRM, scheduling and internal workflow tools.

Sharing with Organizations (Brands and agencies). When you participate in a Campaign, we share with the Organization running it the information needed to run it: your profile information (such as username, display name, profile picture, and follower/subscriber count), your Submissions and Drafts, and the view, engagement, and fraud-signal data used to review Submissions and calculate payouts. We may also share audience and performance statistics for your submitted content with that Organization, including an agency acting on its behalf. Depending on the platform and permissions granted, this may include country-level audience location, age-group and gender breakdowns, views, engagement and watch-time statistics. These statistics help the Organization assess Campaign performance and review Submissions.

Organizations may share reports containing your Campaign activity and earnings with selected individuals.

Public rankings. Your username, profile picture, Campaign performance and earnings may appear in public rankings, including ‘Top creators’ sections.

We also share with the social platforms you connect (Instagram, TikTok, YouTube, X, Facebook) to the extent needed to operate the OAuth connection, and with tax, legal, and sanctions-screening providers and authorities as required.

CR maintains a data processing agreement with each service provider that processes personal data on CR’s behalf as a processor, and maintains a current list of sub-processors available on request at legal@contentrewards.com.

Personal data may be processed in the United States and other countries. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for transfers out of the EU/UK. Where personal data is transferred out of the EEA or UK, CR relies on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary safeguards as appropriate.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to processing, and to withdraw consent. EU/UK users may lodge a complaint with a data-protection supervisory authority. To exercise rights, contact us at the address in Section 13. We will not retaliate for exercising these rights.

Data deletion requests. Any user may request deletion of their personal data, including data received from a connected social platform, by disconnecting the platform in account settings or by emailing legal@contentrewards.com. We honor verified deletion requests within the timeframes required by applicable law and the relevant platform’s rules, including the YouTube deadlines in Section 4.6.

Sale of personal information. We do not currently sell your personal information to third parties as defined by applicable privacy laws, including the California Consumer Privacy Act (CCPA). If our practices change in the future, we will update this Privacy Policy and provide you with the opportunity to opt out in accordance with applicable law.

California residents may have the right to know what personal information is collected, used, shared, or sold; to delete personal information; to correct inaccurate personal information; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights. To exercise them, contact us as described in Section 13.

Do-Not-Track. Some web browsers transmit “Do-Not-Track” (DNT) signals. As there is no uniform standard for recognizing or responding to DNT signals, we do not currently respond to DNT browser signals.

We keep personal data only as long as needed for the purposes above or as required by law (for example, tax records). Drafts and Pre-post Review chat are retained as evidence even if a Campaign is deleted (see the Creator and Organization Terms). We then delete or de-identify data. Connected-platform data remains subject to Section 4: keeping records for Campaign administration or disputes does not override a platform’s deletion requirements. We retain anonymous CR participation counts and legally required payment records as described in Section 4.4.

CR uses commercially reasonable administrative, technical, and organizational safeguards, including encryption of data in transit (TLS) and access controls. No method of transmission or storage is completely secure, and CR cannot guarantee absolute security.

12.1 Types of cookies we use.

• Essential cookies: required for the basic functioning of the Platform, such as authentication and session management.
• Analytics cookies: used to help us understand how users interact with the Platform and identify usage trends.

Advertising and measurement: we and our third-party service providers may use cookies, pixels and similar technologies to measure use of the Platform and to support advertising and remarketing.

12.2 Your cookie choices. Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all or some cookies, or to alert you when cookies are being set. If you disable or refuse cookies, some parts of the Platform may become inaccessible or not function properly.

13.1 Contact: legal@contentrewards.com, or by mail at Content Rewards Inc., 12055 Summit Circle, Beverly Hills, CA 90210, USA. For EU/EEA and UK data-protection purposes, CR can be contacted at legal@contentrewards.com, and CR will designate and publish an Article 27 representative where it is required to do so.

13.2 Changes. We may update this Privacy Policy. Material changes are notified through the Platform or by email; the “Last updated” date reflects the current version.

Content Rewards Inc — a Delaware corporation · HQ: Beverly Hills, California · Last updated: October 4, 2026