Privacy Policy
Last updated: 17 Jul 2026
This policy explains what personal data Fitkura processes, why, and what rights you have. It covers the public site, creator and brand accounts, tracked links, and payouts.
Who is responsible
Fitkura is the controller for the processing described here. You can exercise any of the rights below from your account or by contacting us.
What we collect
Account data (email, name, handle) and the profile content you add; payout and tax data required by law, collected via Stripe and our tax forms (identity, address, tax number); click data on tracked links (timestamp and a pseudonymised device fingerprint); conversion data brands send us; and support correspondence.
Why we process it
To run creator–brand partnerships and pay you (contract); to meet tax and accounting obligations such as DAC7 reporting (legal obligation); to attribute sales and prevent fraud (legitimate interest); product analytics without advertising profiles (legitimate interest); and marketing emails only with your consent, withdrawable at any time.
Attribution data
Tracked-link clicks store a timestamp and a hashed device fingerprint used solely to match sales and detect fraud. Raw fingerprints are kept for 13 months, then reduced to hashes. The commission ledger is retained under accounting law.
Who receives data
Stripe (payments, identity checks, payouts), EU-region hosting and database providers, and a transactional email provider — each under a data-processing agreement. We never sell personal data and we don't run third-party advertising trackers.
Cookies
The public site works without tracking cookies. Logging in sets one essential session cookie. That's the whole list.
How long we keep data
Account data for the life of your account. Payout and tax records for the statutory ten years. Fraud flags for 24 months after resolution; support correspondence for 24 months.
Your rights
You can request access to your data and a machine-readable export, correction, and deletion — records we must keep by law are anonymised instead of deleted. You can object to legitimate-interest processing, withdraw consent at any time, and complain to your data-protection authority.
Public content and reviews
Your public storefront (name, handle, bio, links) is visible to anyone. Reviews between creators and brands are private to the two parties and are removed when an account is erased.