Privacy Policy

Last updated: October 1, 2026

Who this covers

This explains how The Crexa Group ("Crexa," "we") handles personal information when you use crexa.io. Questions go to privacy@crexa.io.

What we collect

You give us:

• Account information — email address and password. Passwords are hashed by our authentication provider; we never see them in readable form.
• Sign-in via Discord — if you use Discord instead of a password, we receive your name, email address, and profile photo from Discord. We don't get access to your Discord account beyond that. Sign-in with Google is no longer offered; if you linked a Google account earlier, we keep only the name, email address, and photo it provided, and you can disconnect it in your account settings.
• Profile information — display name, photo or logo, bio, self-reported audience size, links to your social accounts.
• Campaign and listing content — titles, descriptions, cover images, source files, service listings, prices, and briefs you send to sellers.
• Submissions — links to clips you post, the platform, notes, and reported view counts.
• Messages — anything you send to another member through an order thread, or to us by email.

Generated as you use Crexa:

• Transaction records — campaigns funded, amounts, platform fees, earnings accrued, payout requests, transfers, order history.
• Verification records — every view count reported or pulled from a connected platform, by whom or from where, when, and whether it was approved or rejected.
• Fraud-prevention signals — when you submit a clip or a view count, we record a one-way hash of your IP address and browser details, and a device identifier. We use this only to catch duplicate accounts, banned users returning under a new account, and coordinated fake submissions. The hash can't be reversed to your actual IP address.
• How you found us — the campaign, referring site, and landing page from the link you first arrived on, linked to your account once you sign up. Used only to understand which of our own marketing efforts work, never sold or shared with advertisers.
• Ratings — scores and comments you give and receive after completed transactions.
• Activity timestamps — when your account was created and when you were last active.
• Moderation records — flags, suspensions, verification status, and administrative actions.
• Notification data — your preferences, and a push subscription if you enable browser notifications.

From third parties:

• Stripe — your connected account identifier and whether you're verified and eligible for payouts. We do not receive or store your bank details, card numbers, government ID, or the documents you submit to Stripe. Those are held by Stripe under their own privacy policy.

Connected social accounts (optional)

TikTok and Instagram. Clippers can connect a TikTok or Instagram account so Crexa can confirm view counts on submitted clips instead of relying on self-reported numbers. When you connect, we receive your account ID, display name or username, and an access token that lets us read data about your account (TikTok scopes: user.info.basic, user.info.stats, video.list; Instagram permissions: instagram_business_basic, instagram_business_manage_insights). We use this access for two things only: (1) for content you submit to a Crexa campaign, reading its view, like, and comment counts and the date it was posted, to confirm the clip belongs to your connected account, calculate your earnings, and show a verified badge; and (2) reading your account's follower count, as described under "Verified follower counts" below. We never post on your behalf, never read your messages, and never use this data for advertising or share it with anyone outside Crexa. We use TikTok and Instagram data only as described in this policy, and our use of it follows the TikTok and Meta (Instagram) platform terms and developer policies.

YouTube. Crexa uses YouTube API Services to read public view, like, and comment counts for YouTube videos you submit, to check your channel description for a verification code shown on your profile, and to read your channel's public subscriber count once your channel is verified. This does not require access to your Google account. By using Crexa's YouTube features you agree to the YouTube Terms of Service; see the Google Privacy Policy for how Google separately handles your data.

Verified follower counts. For each connected or verified account, we keep that account's current follower (or subscriber) count and refresh it about once a day. We keep only the latest number, with no history, and delete it when you disconnect. It's hidden from other members unless you turn on "Show verified audience" on your profile. If you do, each platform's number is shown separately, as that platform reports it; we don't combine them. If you've hidden your subscriber count on YouTube, we don't collect it.

Disconnecting and revoking. Disconnect TikTok, Instagram, or YouTube from your dashboard at any time and we delete the stored token, account details, and follower count immediately. If you instead remove Crexa's access from inside TikTok or Instagram, TikTok or Meta notifies us and we delete the same data right away. The same happens if Meta sends us a data deletion request. Raw view/like/comment counts and subscriber counts pulled from YouTube are kept for up to 30 days without being refreshed; after that we clear the stored count, though the dollar amount a view count already earned remains part of your permanent transaction record.

TikTok and Instagram view counts on submitted clips. The view, like, and comment counts we read from TikTok or Instagram for a clip you submitted to a campaign are kept with that clip's verification and earnings record for as long as needed to calculate and pay earnings, resolve payment disputes, and meet tax and legal obligations. We use them for nothing else, and we keep no other data about your other posts. On request, we delete these counts or de-identify them, except where we must keep them for a legal obligation or an open dispute.

Deleting your data. To have your connected-account data removed, do any one of these: disconnect the account in your Crexa dashboard; remove Crexa from your TikTok or Instagram app settings; or email privacy@crexa.io from your account email and ask us to delete it. Disconnecting or removing access deletes your token, account details, and follower count immediately. For any other request we respond promptly and within 30 days.

What is public

Crexa is a marketplace, and parts of it are public by design. Visible to anyone, signed in or not:

• Display name, photo or logo, bio, self-reported audience size, social links
• Role and verification badge
• Follower counts from your connected accounts, but only if you turn on "Show verified audience"
• Payouts that have settled to you (display name, campaign, verified views, amount and date) on Crexa's scrolling live tape, but only if you turn on "Show my settled payouts on the Crexa live tape"
• Trust score and ratings you've received, once revealed
• Active service listings
• Campaigns you've published, including cover image, terms, remaining budget, and edit history
• Approved clips on a campaign, and the display name of the clipper who submitted them

Not public: your email address, payout amounts and history (unless you opt in to the live tape), Stripe details, private campaign source files, pending or rejected submissions, order messages, connected-platform tokens, follower counts from connected accounts (unless you choose to show them), and unrevealed ratings.

How we use it

• Operating the platform — accounts, matching, earnings calculation, payouts
• Confirming view counts on clips submitted from a connected TikTok, Instagram, or YouTube account
• Showing your verified follower counts on your profile, if you choose to
• Sending transactional notifications by email and, if you enable them, browser push. These are service messages, not marketing.
• Detecting fraud and abuse, including automated screening of view submissions for implausible growth and matching device/IP signals across accounts
• Understanding which of our own marketing campaigns bring people to Crexa
• Responding to support requests and resolving disputes
• Meeting legal obligations, including tax and financial recordkeeping
• Maintaining audit records of financial and administrative actions

We do not sell your personal information. We do not share it with advertisers.

Who we share with

Service providers, limited to what they need:

| Provider | Purpose | |---|---| | Supabase | Database, authentication, file storage | | Stripe | Payment processing and payouts | | Resend | Transactional email delivery | | Lovable | Application hosting | | Tinybird | Website analytics — only loaded if you accept optional cookies; see our Cookie Policy |

Other members — as described in "What is public," plus what's necessary to complete a transaction you enter into.

Legal — where required by law, subpoena, or to protect rights, safety, or property.

Business transfer — if Crexa is acquired or merged, information may transfer. You'll be notified.

How long we keep it

• Account and profile information — while your account is active, and a reasonable period after
• Connected-platform tokens — until you disconnect, we detect a revocation, or the token expires and can't be refreshed, whichever comes first
• Follower counts from connected accounts — only the latest number, deleted when you disconnect
• Raw view/like/comment counts and subscriber counts read from YouTube — up to 30 days without a refresh, then cleared; the earnings view counts produced stay in your permanent transaction record
• Financial records — transactions, payouts, fees, and transfers retained as required for tax, accounting, and legal purposes, typically at least seven years
• Audit records — view verification history, rating history, campaign edit history, and administrative logs are permanent and append-only by design. They cannot be edited or deleted, because they're the authoritative record for resolving payment disputes. Deleting your account does not remove them, though they can be dissociated from your identifying information where legally permissible.
• Fraud-prevention hashes — kept across accounts so they keep working after a deletion; they can't be reversed to an actual IP address
• Notification logs — retained briefly for delivery troubleshooting

Your choices and rights

You can view and edit your profile at any time, delete service listings and unpublished campaigns, turn notifications off in settings, turn "Show verified audience" on or off, and disconnect a connected TikTok, Instagram, or YouTube account at any time.

Wherever you live, you can ask us to access, correct, delete, or send you a portable copy of your data, or object to certain processing, by emailing privacy@crexa.io or using Delete account in settings. We'll verify your identity before acting. Deleting your account deletes any connected TikTok or Instagram tokens and all stored follower counts immediately.

Limits on deletion. We cannot delete financial and audit records we're required to keep, or that are necessary to resolve outstanding obligations between members. Where full deletion isn't possible, we'll explain what's retained and why.

California residents. We do not sell or share personal information as those terms are defined under the CCPA. You have the rights above and won't be discriminated against for exercising them.

Security

Data is encrypted in transit. Access to member records is enforced at the database level, so members can only read and write their own data. Sensitive fields — payout account identifiers, suspension status, fee arrangements, connected-platform tokens — can only be modified by the platform's own systems, never by a member acting on their own account. Payment card data never touches our servers.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we'll notify you as required by law.

Children

Crexa is not for anyone under 18. We don't knowingly collect information from children. If we learn we have, we delete it. Contact privacy@crexa.io if you believe a minor has created an account.

Changes

We may update this policy. Material changes are posted with a new version number and effective date, and you may be asked to accept them before continuing to use Crexa.

Contact

The Crexa Group Detroit, MI privacy@crexa.io