Privacy Statement

1. DEFINITIONS

1.1. App – Purple Cow mobile application(s) operated by the Company under the pcow.io domain and/or official app distribution channels.

1.2. Platform – collectively, the Website, App, dashboards, publishing portals, creator portal, business dashboard, APIs, and administrative panels operated by the Company.

1.3. Brand – a legal entity that creates an account on the Platform.

1.4. Brand Representative – a natural person authorized to act on behalf of a Brand on the Platform.

1.5. Creator (Content Creator) – an individual who creates an account on the Platform to apply to campaigns and/or deliver content.

1.6. Publishing Partner – a media outlet, publisher, channel owner, or publishing entity that receives publishing requests through the Platform and delivers publishing outputs.

1.7. Distribution Partner – an entity that manages or controls multiple Publishing Partners and receives publishing requests on behalf of such partners.

1.8. Client – any Creator, Brand, Publishing Partner, Distribution Partner, or other user of the Platform.

1.9. Company – Lumos Tech – FZCO, legal entity code 39926, registered office address Dubai Silicon Oasis, DDP, Building A1, 39926 – 001, Dubai, United Arab Emirates.

1.10. Direct marketing – activities intended to promote the Company’s services by direct means (email, phone, SMS, messaging, or similar channels).

1.11. EEA – European Economic Area.

1.12. GDPR – Regulation (EU) 2016/679 (General Data Protection Regulation).

1.13. UAE PDPL – UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

1.14. KSA PDPL – the Saudi Personal Data Protection Law and its implementing regulations.

1.15. Personal Data / Data – any information relating to an identified or identifiable natural person (“data subject”).

1.16. Terms & Conditions – the Company’s binding Terms & Conditions governing use of the Platform and services.

1.17. Website – the Company’s website at pcow.io and any subdomains or successor domains.

2. PURPOSE AND SCOPE OF THIS PRIVACY POLICY

This Privacy Policy explains how the Company collects, uses, stores, shares, and protects Personal Data when individuals: visit the Website; register, sign in, or use the Platform; use Video Mode or available publishing workflows; submit content, campaigns, publishing briefs, proofs, documents, or messages; make payments or receive payouts; contact the Company via Help Center or support channels; interact with Company social media accounts or marketing campaigns.

This Policy applies to all data subjects, including: (i) Creators; (ii) Brand Representatives; (iii) Publishing Partner/Distribution Partner representatives; (iv) Website visitors; (v) Social media visitors; (vi) Persons submitting inquiries/complaints; (vii) Supplier representatives; (viii) Potential clients; (ix) Job applicants; (x) People who book a call with us.

The Platform is not intended for individuals under 18 years old. The Company does not knowingly process Personal Data of persons under 18. If we learn that we hold data about someone under 18, we delete it, except records the law requires us to keep.

3. DATA CONTROLLER AND CONTACT DETAILS

Data Controller: Lumos Tech – FZCO (39926)

Address: Dubai Silicon Oasis, DDP, Building A1, 39926 – 001, Dubai, UAE

Telephone: +971-50-791-5299

Email: hello@pcow.io

Privacy and data requests: legal@pcow.io

Hosting / Infrastructure: Our main servers are in Frankfurt, Germany (Amazon Web Services). Some providers process data in the United States and other countries; they are listed in Section 9.

4. PERSONAL DATA WE PROCESS (BY DATA SUBJECT CATEGORY)

4.1. CREATORS (CONTENT CREATORS)

A) Account and identity data: Name, surname, gender, country, date of birth (age); email address, phone number; username (internal), profile photo, password (hashed); social sign-in identifier (Google); WhatsApp number and WhatsApp identifier, when you opted in to or out of WhatsApp updates, and messages you send us on WhatsApp.

B) Portfolio and eligibility data: Portfolio videos and media uploads; featured video upload for review/eligibility; equipment details (if collected); creator type (UGC Creator or Influencer), tier, track (including Expert), level L1 to L4, points and review history.

C) Campaign and performance data: Campaign applications, acceptances, deadlines; draft uploads, watermark states, approvals, rejection reasons; edit requests and responses; delivery timestamps; ratings and reviews; disputes and resolution outcomes; product delivery data.

D) Fund Purchase flow data: Funded amounts, proof-of-purchase uploads, review status; wallet crediting events; service fee deductions.

E) Communication data: Messages sent/received, timestamps, attachments; flagging/moderation records.

F) Wallet, payouts, and compliance data: Wallet balance and transaction history; payout method details (PayPal email, InstaPay address, or bank name, account holder, IBAN, SWIFT/BIC, bank country and tax registration number); payment processor references; tax data (if required).

G) Connected social account data: When you connect an Instagram, TikTok, YouTube or Facebook Page account to your profile, we receive from that platform, with your authorisation through the platform’s official login: the account’s identifier and public username/handle; profile link; follower or subscriber count; following count; post or video count; total likes (TikTok) or total channel views (YouTube); account-level audience insights where the platform provides them (Instagram Business/Creator accounts: reach, views, accounts engaged, interactions and profile views over the trailing 28 days, daily follower changes, and follower demographics by country, city, age range and gender expressed only as aggregated percentages — never the identity of any individual follower); and your most recent public posts with their public metrics (views, likes, comments, shares, saves, reach), post link, caption and thumbnail. We also store the access token issued by the platform, encrypted, solely to refresh this data. We never receive your platform password, private messages, non-public or draft posts, or individual followers, and we never post, comment, follow or otherwise act on your account. When connecting a Snapchat account is offered, we receive similar data from a Snapchat account you connect. We also keep the handles and follower numbers you type in yourself; our team reviews them.

H) Identity and licence documents: Images or PDFs of your passport or national ID (front and back) and, where required, your government advertising permit (for example a Mawthooq licence: the document, its number and its expiry date) or proof of residence. We use them to verify your identity, to make payouts, to confirm the country that sets your pricing and to meet permit rules. They are stored privately: only authorised Purple Cow staff can open them, through links that expire after 15 minutes. We keep the result of each check and the document’s expiry date. We delete the images 90 days after the verification decision, unless a dispute or a legal hold needs them.

Data Sources: Provided directly by the Creator; generated from platform usage; received from social sign-in providers; received from social media platforms you choose to connect (Meta/Instagram, Meta/Facebook, TikTok, Google/YouTube) through their official APIs.

4.2. BRAND REPRESENTATIVES (BUSINESS USERS)

Name, role/title, company represented; business contact details; business profile data; campaign and publishing request creation details; billing and payment references; support tickets; audit logs; your business’s social accounts and their follower counts, if you connect them; business registration documents (trade licence, commercial registration, VAT certificate), which are stored and deleted like identity documents (Section 4.1(H)).

Important: The Company does not store full payment card details. Card payments are processed by payment processors (e.g., Stripe), and the Company stores only limited references needed for accounting, reconciliation, and support.

4.3. PUBLISHING AND DISTRIBUTION PARTNER REPRESENTATIVES

Identity and contact details; company represented, role; owned channels/outlets; packages, pricing, deliverables, lead times; publishing request assignments, fulfillment steps, proof of publication uploads; payout method identifiers; dispute and ticket history; audit logs.

4.4. ACCOUNT SECURITY DATA (ALL ACCOUNT HOLDERS)

Sign-in times, IP address, browser and device, two-step verification settings and trusted devices.

4.5. WEBSITE AND SOCIAL MEDIA VISITORS

Website Visitors: IP address, device identifiers, browser type, OS; page visits, session data, referral source; cookie identifiers.

Social Media Visitors: Public profile info; interactions with Company content; messages and attachments.

4.6. SUPPORT, INQUIRIES AND CALL BOOKINGS

Support / Inquiries: Name, contact details; ticket content and attachments; resolution actions.

People who book a call: the details you enter when you book (handled by Cal.com).

4.7. JOB APPLICANTS

Name, email address, phone number, CV, cover letter, LinkedIn and portfolio links, and the status of your application.

4.8. SUPPLIERS AND POTENTIAL CLIENTS

Suppliers / Contract Parties: Representative identity and contact details; communications and contract documentation.

Potential Clients: Publicly available business contact data; pre-sales communications.

4.9. AUTOMATED AND AI-ASSISTED PROCESSING

We use AI providers acting for us. OpenAI (United States) screens direct messages, after our own systems have masked any contact details, and community posts for prohibited content; a message or post it flags is blocked automatically, and a person reviews the block if you ask. OpenAI also helps Businesses draft campaign briefs and transcribes the voice notes Businesses record for a brief. Anthropic (United States) can read the expiry date from identity document images; a member of our team makes every verification decision. These providers process the data only to give us the result, under terms that do not allow them to train their models on it.

5. THE WEBSITE VISITOR (COOKIE POLICY)

5.1 Cookies

Cookies are small files stored on your device that help the Website function properly, improve user experience, measure performance, and (where enabled) support advertising and marketing. The Website may use first-party cookies (set by the Company) and third-party cookies (set by service providers such as analytics, authentication, payments, support tools, and marketing platforms).

5.2 Cookies Purple Cow sets

These are first-party cookies on pcow.io and app.pcow.io. We also keep matching values in your browser’s local storage, under the same rules.

pcow_accessToken, pcow_refreshToken: keep you signed in. 7 days. Strictly necessary.

pcow_trustedDevice: remembers a device after two-step verification. 30 days. Strictly necessary.

pcow_oauthTransaction, pcow_socialPendingRegistration: complete a Google sign-in or sign-up securely. 10 minutes. Strictly necessary.

XSRF-TOKEN: protects forms against cross-site attacks. Session. Strictly necessary.

pcow_consent, pcow_consent_seq: remember your cookie choice. Up to 13 months. Strictly necessary.

pcow_locale, pcow_lcut: remember your language. 1 year. Functional.

pcow_ref, pcow_rep: credit the Creator or sales representative whose invite link you opened. 90 days. Functional.

pcow_aid: an anonymous visitor ID for measuring our pages and ads. 395 days. Marketing: set only after you accept marketing cookies.

5.3 Analytics cookies from our providers

Only after you accept analytics cookies: Google Analytics, Microsoft Clarity (which can record how you move through a page), PostHog (United States) and Sentry’s browser error monitoring. They set their own cookies, such as _ga, _ga_*, _clck and _clsk.

5.4 Marketing cookies from our providers

Only after you accept marketing cookies: Google Ads, Meta (Facebook and Instagram), TikTok and Snap (Snapchat). They set their own cookies, such as _gcl_*, _fbp, _fbc, _ttp and _scid. See also Section 5.8.

5.5 Providers that run without consent

These are needed for a service you ask for, so your cookie choice does not switch them off: Stripe (payments, on payment pages), Cloudflare Turnstile (bot protection, on the call-booking form) and Intercom (support chat). Each may set its own cookies.

5.6 Your choice and the legal basis

Analytics and marketing cookies stay off until you accept them, wherever you are; they rely on your consent (GDPR Art. 6(1)(a)). Strictly necessary cookies are always on, because the Website and Platform cannot work without them (legitimate interest – GDPR Art. 6(1)(f)). Functional cookies are set only when you use the feature they serve: choosing a language, or opening an invite or sales-representative link.

5.7 Cookie management

You can change your choice at any time: on this website with the Cookie settings button below, and in the app from Cookie settings in the footer or in Settings → Privacy & data. One choice covers pcow.io and the app. When you turn a category off, we delete its cookies stored on our domains. You can also block or delete cookies in your browser; blocking strictly necessary cookies may stop the Website from working.

Cookie settings

Third-party cookie resources:

Google: https://policies.google.com/technologies/types

Google Analytics: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

Microsoft Clarity: https://learn.microsoft.com/en-us/clarity/setup-and-installation/cookie-list

PostHog: https://posthog.com/privacy

Meta: https://www.facebook.com/policies/cookies/

TikTok: https://www.tiktok.com/legal/page/global/cookie-policy/en

Snap: https://snap.com/en-US/cookie-policy

Stripe: https://stripe.com/cookies-policy/legal

Cloudflare: https://www.cloudflare.com/cookie-policy/

Intercom: https://www.intercom.com/legal/privacy ; https://www.intercom.com/legal/cookie-policy

5.8 Advertising measurement

If you have accepted marketing cookies, then when you take a key step on the Platform (for example signing up, verifying your WhatsApp number, booking a call, being approved, joining or funding a Campaign, delivering content or paying), our servers send Meta, Google, TikTok and Snap a hashed (coded) version of your email address, phone number, name and account ID, your city and country, and your IP address, browser details and any ad-click identifiers kept with your consent, so they can measure our ads. For this collection and transfer, Purple Cow and each platform are joint controllers; each platform is an independent controller for its own use of the data afterwards, under its own privacy policy. Turn marketing cookies off to stop it.

6. PURPOSES AND LEGAL BASES FOR PROCESSING

6.1 Account creation and Platform access – Legal basis: contract performance (GDPR Art. 6(1)(b)).

6.2 Service delivery (Video Mode and publishing workflows)– Legal basis: contract performance and legitimate interest.

6.3 Payments, wallets, deductions, and payouts – Legal basis: contract performance, legal obligation, legitimate interest.

6.4 Customer support and ticketing – Legal basis: legitimate interest and contract performance.

6.5 Security, fraud prevention, and platform integrity – Legal basis: legitimate interest.

6.6 Analytics and product improvement – Legal basis: legitimate interest and/or consent.

6.7 Direct marketing – Legal basis: consent where required and/or legitimate interest with opt-out. Verification codes are sent by WhatsApp through Twilio or through Meta’s WhatsApp Business Platform. Service updates on WhatsApp are sent only if you turn them on: when you verify your number, in Settings → Notifications, or by replying “updates on” in the chat. To stop them, reply STOP or pause them in Settings → Notifications.

6.8 Legal compliance and enforcement – Legal basis: legal obligation and legitimate interest.

6.9 Audience verification and creator eligibility – Reading follower counts, audience insights and public post metrics from connected social accounts to (i) verify the audience size on which Nano Influencer eligibility, tier and pricing are based instead of relying on numbers entered by hand, (ii) display verified audience figures and a “Verified” indicator to Businesses, and (iii) detect artificially inflated audiences. Legal bases: performance of the contract (Terms of Service) – GDPR Art. 6(1)(b); legitimate interest in preventing fraud and keeping pricing fair – GDPR Art. 6(1)(f); and the corresponding grounds under the UAE PDPL and KSA PDPL. Connecting an account is your choice; without a connected account a Nano Influencer profile cannot be verified and, from the date announced in the App, will not be shown to Businesses.

6.10 Promoting the Platform – Purple Cow may use Content submitted, uploaded or delivered through the Platform, including the people, names and voices that appear in it, to operate, improve, market and promote the Platform and Purple Cow in any media, including paid advertising, under the licence in Terms & Conditions §13.3. This use continues after a Campaign ends and after an account is closed. We may also use a Business’s name and logo to identify it as a customer. Purple Cow does not clone a Creator’s face or voice from their Content without the Creator’s written agreement. Legal basis: contract performance (GDPR Art. 6(1)(b)) and legitimate interest in promoting the Platform (GDPR Art. 6(1)(f)).

7. PLATFORM INTEGRITY, MODERATION, AND AUTOMATED PROCESSING

The Platform may use automated or semi-automated tools to: detect prohibited content (e.g., sending phone number/email/social profiles in messages); flag suspicious activity and enforce Terms & Conditions; generate audit logs for admin review and dispute resolution; prevent fraud and abuse of wallets, referrals, or payments.

Where automated tools trigger restrictions, the Company may apply human review, especially for disputes or appeals.

Audience authenticity review. For connected social accounts, the Platform automatically compares the metrics the platform reports — for example followers against views and engagement over time, follower growth patterns, and audience geography — and derives an internal authenticity indicator that helps our team identify audiences that may be artificially inflated. This indicator is a prioritisation tool for human review only. No decision that restricts an account, changes eligibility or affects payment is taken solely on the basis of this automated processing: an authorised admin reviews the underlying evidence and decides, and the review is logged. The indicator and the underlying metrics are internal and are not shown to Businesses or other Creators. You may request an explanation of, and contest, any decision that affects you (Section 12).

Tier and pay. If you are an Influencer, your tier, and the pricing track that sets your pay, follow your verified follower counts: a drop is applied automatically and a rise is approved by our team. We tell you when your tier or track changes and why. If a change was made automatically, a person reviews it if you ask through Help in the app, and we answer within 7 days.

Staff access. Authorised Purple Cow staff can see account data, and change account and profile content, to provide support and keep the Platform safe. The changes they make are logged.

8. PAYMENTS, WALLETS, PAYOUTS, AND FINANCIAL DATA HANDLING

8.1 Card payments may be processed via payment processors such as Stripe. The Company does not store full card details.

8.2 Wallet balances are maintained for Brands (spend), Creators, and eligible publishing partners (earn). Wallet transactions may include: deposits, deductions, refunds, payouts; funding amounts for “Fund Purchase”; service fee deductions; transaction references and reconciliation logs.

8.3 Payout methods are PayPal, InstaPay and bank transfer, where available in your country. We store the payout details needed to pay you, and payouts are prepared in batches twice a month.

8.4 Invoices, receipts, and accounting records may be retained as required by law.

9. SHARING OF PERSONAL DATA (RECIPIENTS)

Personal Data may be shared with: hosting: Amazon Web Services (Germany); content delivery and security: Amazon CloudFront and Cloudflare; email: SendGrid (United States); support chat: Intercom (United States); product analytics, with your consent: PostHog (United States), Google Analytics and Microsoft Clarity; error monitoring: Sentry (Germany); payments: Stripe; accounting: Zoho Books (United States); payouts: PayPal and the banks that process transfers; WhatsApp messages: Twilio (United States), with Meta Platforms as WhatsApp’s operator; AI processing: OpenAI and Anthropic (United States), as described in Section 4.9; ad measurement, only with marketing consent: Meta, Google, TikTok and Snap (Section 5.8); call booking: Cal.com; enterprise enquiries: Typeform; bot protection: Cloudflare Turnstile; sign-in: Google; Brands and Creators involved in the same transaction; a creator agency you belong to; publishing partners involved in a publishing request; courier/shipping providers; agencies and service providers that help us market the Platform; professional advisers (legal/accounting); authorities and courts where the law requires; a successor in a business transfer; anyone else with your consent.

All processors operate under contractual safeguards and confidentiality obligations.

Social media platforms. When you connect an account, you authorise the operating platform — Meta Platforms Ireland Limited / Meta Platforms, Inc. (Instagram, Facebook), TikTok Technology Limited / TikTok Pte. Ltd. (TikTok), Google Ireland Limited / Google LLC (YouTube) — to share the data described in Section 4.1(G) with us under that platform’s own terms and privacy policy. Purple Cow does not share your Purple Cow data with these platforms beyond the identifiers needed to complete the login. Purple Cow’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Purple Cow uses YouTube API Services; by connecting a YouTube channel you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and acknowledge the Google Privacy Policy (https://policies.google.com/privacy). You can revoke Purple Cow’s access at any time on the platform side — Google: https://security.google.com/settings/security/permissions; Instagram and Facebook: Settings → Apps and websites; TikTok: Settings → Security & permissions → Apps and services — and at any time in Purple Cow by disconnecting the account (see https://pcow.io/data-deletion).

9.1 What other people can see. Creator and Business profiles are public and may appear in search engines. A Creator profile includes the display name, shown as first name and last initial, profile photo, bio, gender, city and country, languages, rating, level, follower counts per platform and portfolio. Reviews are public and show the reviewer’s first name and last initial. After hiring, a Business sees what it needs to work with the Creator, including the delivery address when a product has to be shipped. A creator agency sees its members’ names, contact details, earnings, balances and payout requests.

10. INTERNATIONAL DATA TRANSFERS

When we transfer data outside the UAE, Saudi Arabia or the EEA, we rely on an adequacy decision where one exists, on standard contractual clauses, or on another lawful transfer basis that the UAE PDPL, the KSA PDPL and the GDPR allow.

11. DATA RETENTION

We keep personal data only as long as we need it. Unless the law requires a different period, we apply this schedule:

Account and profile data: until you delete your account. We erase it 7 days after your deletion request unless you cancel; if money is still moving on the account (a balance to pay out, a payout in progress or work held in escrow), erasure waits until it is settled. Erasure is complete within 30 days of the deletion date, except money records and data under a legal hold. Backup copies are removed within 90 days.

Deactivated accounts: deleted after 24 months, with a warning email 30 days before. A Creator’s balance is settled as for any deletion (Terms & Conditions §9.6): it is paid out first if it has reached the payout minimum, and given up if it has not. Unused Business wallet credit is not given up automatically: the deletion waits until the credit is refunded under the Refund Policy or the owner confirms giving it up.

Money records (invoices, payments, payouts, wallet ledger and tax records): 10 years after the transaction.

Identity, licence, residence and business documents: the images are deleted 90 days after the verification decision, unless a dispute or a legal hold needs them. We keep the result of the check and the document’s expiry date.

Server logs: 30 days. Network access logs, which include IP addresses: 1 year.

Sessions and trusted devices: they expire after 7 days and 30 days; their records are then kept as security logs.

Security logs: 24 months. Consent records: 24 months, except your latest choice, which we keep while it applies.

Moderation evidence: 12 months after the case closes.

Support tickets: 3 years after resolution.

Job applications: 12 months after the role is filled or closed.

Advertising measurement events: 13 months.

Content: content a Business paid for and approved stays available to that Business under its licence after the Creator’s account is deleted, and content licensed to Purple Cow under Terms & Conditions §13.3 may continue to be used as that licence allows.

Disputes and legal holds: data needed for a dispute, an investigation, a legal claim or a legal hold is kept until the matter ends.

Connected social account data. The encrypted access token is deleted when you disconnect, when the platform refuses our next refresh, or when your account is deleted. Audience snapshots are kept for up to 400 days from capture; only the 30 most recent public posts per connected account are kept and older ones are removed on each refresh. Data from YouTube API Services is refreshed or deleted within 30 days. The last verified follower count remains on your profile until you disconnect. Where an audience authenticity review has taken place, the record of that review (outcome, reviewer and date) may be retained for fraud-prevention and legal purposes without the underlying platform data.

12. DATA SUBJECT RIGHTS

Under the UAE PDPL, the KSA PDPL and, where it applies, the GDPR, you can ask for access, correction, erasure, restriction, objection, portability and withdrawal of consent. You can download your data and ask for deletion yourself in Settings → Privacy & data; for anything else, email legal@pcow.io. We may ask you to confirm your identity first. We reply within 30 days, or tell you within that time if we need longer, as the law allows. Some requests are limited by law, for example where we must keep money records (Section 11). You can complain to the UAE Data Office, the Saudi Data & AI Authority (SDAIA) or your local data-protection authority.

You can disconnect any connected social account at any time from your profile (Verification → Social accounts). Disconnecting stops all further retrieval and deletes the stored access token and audience data for that account. Step-by-step instructions, including how to delete your whole account, are at https://pcow.io/data-deletion.

13. SECURITY MEASURES

The Company applies appropriate technical and organizational measures including encryption, access controls, logging, monitoring, secure authentication, and incident response plans. No system can be guaranteed 100% secure.

14. CHILDREN’S PRIVACY

The Platform is not intended for individuals under 18. If we learn that we hold data about someone under 18, we delete it, except records the law requires us to keep.

15. QUESTIONS, COMPLAINTS, AND DISPUTES

Contact: hello@pcow.io / +971-50-791-5299.

16. CHANGES TO THIS PRIVACY POLICY

This policy may be updated and will be published on the Website with an updated date.