Privacy Policy

1. What we collect

Account: email, display name, handle, bio, language, role, and the wallet addresses linked to you (embedded wallet or your own).

Social accounts you connect or prove: platform, handle and ids, follower counts and whether the account is professional; the posts you submit and their public counters.

Referral clicks: a hash of the IP address, the device type, the referring page and the time. Conversions reported by projects: order ids, amounts and, for “first purchase” rules, a hash of the project's customer id.

Events projects send to their offer's hook addresses, stored encrypted for 30 days; conversations with the AI agents, stored encrypted. Emails we send you, error reports and security logs.

Cookies: only what the site needs (your session, your language and a referral code for 30 days). We do not use advertising or tracking cookies.

2. Why

To run the service (accounts, offers, posts, payouts), to verify accounts and results, to prevent fraud and abuse, to send notifications you can switch off, to operate AI checks and assistants, to keep the service secure and to meet legal obligations.

3. Who processes data for us

Hosting and database; Privy (sign-in and wallets); Resend (email); Google (YouTube Data API and Gemini AI checks of public posts); DeepSeek (only offer texts and public product pages, never personal data); Anthropic (the AI agents: the session's content, with personal details in test events masked); ScrapeCreators (public counters of TikTok and Instagram posts); Reclaim Protocol (account proofs); LI.FI and Alchemy (bridging and blockchain access); Sentry (error reports); Upstash (rate limiting). Each receives only what its task needs.

4. Blockchain data

Deposits, payout roots and claims are recorded on Robinhood Chain. Blockchain records are public and permanent; we cannot change or delete them.

5. How long we keep it

Hook events: 30 days (test events: at most 200 per offer). Account data: while your account exists and then as long as the law requires for payments and taxes. Security logs and error reports: as long as needed to investigate and fix problems.

6. Your rights

You can ask for access to your data, a copy, correction or deletion, and object to processing, by writing to legal@unbacked.xyz. We answer within 30 days. Data recorded on the blockchain cannot be deleted.

7. Security

Secrets that projects give us are encrypted with AES-256-GCM, identifiers such as IP addresses and customer ids are hashed, and access is limited to the people and systems that need it. See also our security page.

8. Transfers, children, changes

Our processors may handle data in other countries under contracts that protect it. Unbacked is not for people under the age of majority. We will tell you about material changes to this policy.