Data Governance
Privacy Policy
Version 1.0 · Effective September 19, 2026
Aethos Solutions LLC (“Canvas UGC Marketplace”, “we”, “us”) develops and operates the Canvas UGC Marketplace, which connects app brands with content creators. This Privacy Policy explains how we handle personal information collected through canvasugcmp.com, the Canvas application, our emails and our support channels (together, the “Service”).
- We collect what the marketplace needs to run: account details, profile, the handles and links you register, view reports and screenshots, and payout identifiers. Card and bank details go straight to Stripe and never reach us.
- We do not sell personal information, do not share it for targeted advertising, and run no analytics or advertising trackers. Our cookies keep you signed in, protect account connections and keep bots out. Optional video players load only when you open a preview; their providers may use their own cookies.
- Brands and creators on the same campaign see each other’s marketplace activity, because that is how the marketplace works.
- You can edit your profile and download a profile copy in Settings. For a full data request or account deletion, email support@canvasugcmp.com.
1.Who We Are and What This Covers
Aethos Solutions LLC is the controller of personal information collected through the Service. This Policy applies to everyone who visits the site or holds an account, whether as a brand, a creator or an administrator. It does not cover the practices of TikTok, Instagram, Stripe or any other third party, even where we link to them.
2.Personal Information We Collect
- Account data: email address, an optional password (stored only as a salted hash), display name, role (brand or creator), and the time you accepted our terms.
- Profile data: country; for creators, portfolio URL, niches, languages and whether you are willing to run dedicated campaign accounts; for brands, company name, app URL, and any industry, location, description and image you add to your brand profile.
- Campaign data: the TikTok and Instagram handles you register for a campaign, warm-up check-ins, concept hooks and captions, the URLs of the posts you publish, and reviews and notes exchanged with the other side of the campaign.
- View reports and screenshots: the view counts you report and the screenshots you upload to support them.
- Rights files: video files a creator delivers when a brand buys usage rights.
- Payout identifiers: the identifier of your Stripe Connect account. We never receive card numbers, bank account numbers or government identifiers; Stripe collects those directly under its own privacy policy.
- Two-factor data: for accounts that enable it, an encrypted authenticator secret and hashed backup codes.
- Communications: what you send us by email or through the Service.
You can sign in with a one-time email code instead of a password. Codes expire after ten minutes and are stored as hashes. We use delivery and attempt limits to protect accounts from abuse.
If you choose Google sign-in, Google shares your account identifier, verified email address, name and available profile photo with Canvas. We use these details to create or identify your Canvas account and store encrypted OAuth access and refresh tokens. We do not request access to Gmail, Google Drive or your contacts. Google handles your Google password; Canvas never receives it. You can manage Canvas access in your Google account settings and continue signing in with an email code.
When you choose to connect an account, we receive the account identity, profile image, bio, available follower and engagement counts, and recent public posts and their available statistics through that platform’s official API. We store encrypted access credentials to refresh this information. We do not receive your social password or request permission to publish or message for you.
You choose which connected accounts and work samples to share when applying to a campaign. That campaign’s brand can view the selected information while the application is active or accepted. Withdrawing before acceptance or a brand declining ends that brand’s portfolio access. Connecting an account does not make your portfolio public or grant video reuse rights.
Disconnecting deletes the saved connection, credentials and statistics from our active database. You can also remove Canvas in the platform’s app settings. Campaign application and accepted-offer records are separate; contact support for an account deletion request.
- Session and device data: IP address and browser user agent, stored with each sign-in session and, for money-moving or metric-changing actions, in an append-only audit log.
- Rate-limit counters: short-lived counts keyed by IP address or account, used to stop abuse.
- Ledger and audit records: every wallet, campaign-fund and payout movement, and every administrative action, with the acting account and timestamp.
- Cookies: only the strictly necessary cookies described in our Cookie Notice. We run no analytics, advertising or session-replay tools.
- Stripe: whether your Stripe customer or Connect account exists, whether it has completed onboarding and whether payouts are enabled, plus payment and transfer identifiers and statuses sent to our webhook.
- Cloudflare: the connecting IP address and the result of the Turnstile human-verification check at sign-up.
- Other users: reviews, notes, view reports and rights requests that the brand or creator on the other side of your campaign submits about your activity.
3.Where It Comes From
Directly from you when you register, complete your profile, apply to or run a campaign, report views or set up payouts; automatically from your browser and our infrastructure when you use the Service; from Stripe and Cloudflare as described above; and from other users of the marketplace.
4.How We Use It
- To run the marketplace: create and secure your account, match creators to campaigns, run warm-ups, concept approvals and post reviews, compute earnings from verified views, record and allocate campaign funds, and instruct Stripe to send payouts.
- To verify and prevent fraud: check view reports and screenshots, detect inflated metrics, duplicate accounts and abuse, and keep an audit trail of every money-moving action.
- To communicate with you: email verification, password resets, campaign events (offers, approvals, rejections, funding alerts, payout notices) and support. These are service messages, not marketing. If we ever send marketing email, it will carry an unsubscribe link.
- To secure the Service: rate limiting, session management, two-factor authentication and incident investigation.
- To comply with law and enforce our terms: respond to lawful requests, meet tax and accounting obligations, resolve disputes, and enforce the Terms of Service and Creator Agreement.
- To improve the Service: using aggregated or de-identified statistics such as applications per campaign or average views per post. We do not use your personal information to train artificial-intelligence models.
We do not use personal information for targeted advertising, and we do not make automated decisions about you that have legal or similarly significant effects without human review; view reports above our automatic threshold are always checked by a person.
6.Cookies and Tracking
The Service sets only strictly necessary cookies: a session cookie that keeps you signed in, a short-lived cookie used during two-factor sign-in, and security cookies set by Cloudflare. Stripe’s own pages set Stripe’s cookies when you pay or onboard there. We use no analytics, advertising or session-replay tools and no tracking pixels in our emails. Opening a video preview loads an official TikTok or Instagram player, which receives your IP address and browser information and may use provider cookies under its own policies. Profile images and covers are served from the platform’s image servers. Details and controls are in the Cookie Notice.
7.How Long We Keep It
| Data | Retention |
|---|---|
| Account and profile data | While your account is open. On deletion, the profile is anonymised and sign-in records are removed. |
| Sessions | Expire after 7 days of inactivity and are deleted on sign-out or password reset. |
| Rate-limit counters | Minutes to hours. |
| Connected social accounts | Saved credentials and the latest statistics stay until you disconnect or request deletion. Temporary connection diagnostics expire after one hour. |
| Campaign data, concepts, post links, reviews | While the campaign and your account exist, then anonymised. |
| View-report screenshots | Deleted automatically 120 days after upload. |
| Rights files | Retained for the brand that purchased them; the creator may request our copy be deleted after delivery is confirmed. |
| Ledger, payout items, batches and audit log | Kept for seven years after the transaction for accounting, tax and fraud-investigation purposes. These records are append-only and are retained after account deletion, linked to an anonymised account identifier. |
| Support email | Up to three years after the matter closes. |
Where the law requires a longer period, or a dispute or investigation is open, we keep the relevant data until it ends.
8.Your Choices
- Access, correction and portability. You can view and update your profile and payout details in the Service. To get a copy of your data in a machine-readable format, email support@canvasugcmp.com from the address on your account.
- Deletion. Email support@canvasugcmp.com to close your account. We delete or anonymise what Section 7 allows and keep only the financial and audit records it describes.
- Email. Service messages are part of running your account and cannot be switched off while it is open. Any marketing email will carry an unsubscribe link.
- Cookies. You can block or delete cookies in your browser, but you will not be able to sign in without the session cookie.
- Do Not Track and Global Privacy Control. Because we do not sell or share personal information for advertising, there is nothing for these signals to switch off. We treat a Global Privacy Control signal as a valid opt-out request where the law gives it that effect.
- Stripe. Information you gave Stripe is controlled by Stripe; use the Stripe dashboard link in the Service or contact Stripe directly.
9.Security
We use technical and organisational safeguards designed for a platform that moves money: TLS everywhere, salted password hashing, two-factor authentication required for administrators, per-request content-security policies, rate limiting, append-only financial and audit records enforced at the database level, private file storage with short-lived signed links, and least-privilege payment keys. No system is perfectly secure, and we cannot guarantee the security of your information. If we learn of a breach affecting you we will notify you as the law requires.
10.International Transfers
We are based in the United States and use Cloudflare’s global network, so your information may be processed in the United States and in other countries where our providers operate. Those countries may not offer the same protections as yours. Where we transfer personal information from the United Kingdom, the European Economic Area or Switzerland, we rely on our providers’ standard contractual clauses or equivalent safeguards.
11.Children
The Service is for adults. We do not knowingly collect personal information from anyone under 18, and creators must not feature minors in content without lawful consent. If you believe a minor has given us personal information, contact us and we will delete it.
12.Changes
We may update this Policy. Material changes will be announced by email or a prominent notice on the Service before they take effect. The version and effective date appear at the top of this page. Using the Service after the effective date means the updated Policy applies.
13.US State Privacy Rights
Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Utah and other states with comprehensive privacy laws (“State Privacy Laws”) may have the rights below, to the extent the relevant law applies to us. We honour these requests for all users regardless of state.
- Know and access: the categories and specific pieces of personal information we hold, its sources, purposes and recipients.
- Correct inaccurate personal information.
- Delete personal information, subject to the exceptions in Section 7.
- Portability: receive a copy in a portable format.
- Opt out of sale, sharing for targeted advertising, and profiling with legal or similarly significant effects. We do none of these.
- Limit use of sensitive personal information. We collect none within the meaning of these laws; payout and identity data go to Stripe.
- Non-discrimination for exercising any right.
- Appeal a decision we make on your request by replying to our response; we will answer within 45 days.
| Category | Examples | Purposes | Disclosed to |
|---|---|---|---|
| Identifiers | Email, display name, IP address, account and Stripe identifiers | Service operation, security, payouts, legal | Cloudflare, Stripe, Resend, campaign counterparties (display name only) |
| Customer records | Country, company, payout method and handle | Service operation, payouts, tax | Stripe |
| Commercial information | Wallet, campaign funds, payout and rights-purchase history | Service operation, accounting, fraud prevention | Stripe, professional advisers |
| Internet activity | Session timestamps, user agent, audit log, rate-limit counters | Security, fraud prevention | Cloudflare |
| Audio-visual content | Screenshots, rights video files, post links | Verification, rights delivery | Cloudflare (storage), campaign counterparties |
| Professional information | Portfolio URL, niches, languages | Matching creators to campaigns | Campaign counterparties |
| Inferences | None drawn | Not applicable | Not applicable |
| Sensitive personal information | None collected by us; Stripe collects identity and financial data directly | Not applicable | Not applicable |
14.Contact
Privacy questions, rights requests and complaints go to:
- Email: support@canvasugcmp.com
- Mail: Aethos Solutions LLC, 3680 Wilshire Blvd, Ste P04-1212, Los Angeles, CA 90010, United States