Privacy Policy
Last updated: 17 Sept 2026
This policy explains what personal data Fitkura processes, why, and what rights you have. It covers the public site, creator and brand accounts, tracked links, and payouts.
Who is responsible
Fitkura is the controller for the processing described here. You can exercise any of the rights below from your account or by contacting us.
What we collect
Account data (email, name, handle) and the profile content you add; payout and tax data required by law, collected via Stripe and our tax forms (identity, address, tax number); click data on tracked links (timestamp and a pseudonymised device fingerprint); conversion data brands send us; the work email and company name you give us if you request a brand invite; and support correspondence.
Why we process it
To run creator–brand partnerships and pay you (contract); to answer a brand invite request you send us, used for that reply and nothing else (steps taken before a contract, at your request); to meet tax and accounting obligations such as collecting and verifying the tax details DAC7 requires of platforms (legal obligation); to attribute sales and prevent fraud (legitimate interest); product analytics without advertising profiles (legitimate interest); and marketing emails only with your consent, withdrawable at any time.
Attribution data
Tracked-link clicks store a timestamp and a hashed device fingerprint used solely to match sales and detect fraud. Your raw IP address and browser user-agent are never stored — only a secret-keyed hash of them, cleared after 13 months. The commission ledger is retained under accounting law.
Automated checks on payouts
Our fraud checks run automatically over click and conversion patterns, and a flag they raise holds the affected payout until someone looks at it. The hold is automatic; the outcome is not — a person reviews every flag before anything is confirmed. You can contact us to put your side and ask for a held payout to be reviewed again.
Who receives data
Stripe (payments, identity checks, payouts), EU-region hosting and database providers, and a transactional email provider — each under a data-processing agreement. Your data is stored in the EU; where Stripe processes it outside the EU, that transfer runs on the European Commission’s standard contractual clauses, and you can ask us for a copy. We never sell personal data and we don’t run third-party advertising trackers.
Cookies
The public site works without tracking cookies. We set exactly two, both strictly necessary: a session cookie when you log in, and a language cookie, kept for a year, when you choose a language. No third-party cookies and nothing else stored in your browser. That’s the whole list.
How long we keep data
Account data for the life of your account. Payout and tax records for the statutory ten years. Fraud flags for 24 months after resolution; support correspondence for 24 months; product-analytics events for 36 months; a brand invite request for 12 months if it does not become an account.
Your rights
You can request access to your data and a machine-readable export, correction, and deletion — records we must keep by law are anonymised instead of deleted. You can object to legitimate-interest processing, ask us to restrict processing while a dispute over accuracy or grounds is open, withdraw consent at any time, and complain to your data-protection authority.
Public content and reviews
Your public storefront (name, handle, bio, links) is visible to anyone. Reviews between creators and brands are private to the two parties and are removed when an account is erased.
Privacy questions or requests: support@fitkura.com