The Platform — both the Content Rewards web application and the Whop-hosted experience — is for users 18 and older only. We do not knowingly permit anyone under 18 to use it, including with parental consent, and if we learn that someone under 18 has created an account, we terminate it and delete their data.

Defined terms used here (such as Submission, Clip, Draft, Campaign, Brand, and Bot Score) have the meanings given in the Creator Terms and Organization Terms.

3.1 Account and identity data — name, email address, phone number (used for account and support communication, and for verification where offered), account sign-in data (you sign in through Whop’s login service), and business verification details for Brands.

3.2 Linked social account data. You can link a social account by connecting it through a platform’s official API (OAuth — see Section 4) or, where offered, by verifying ownership with a verification code placed in your account bio. For linked accounts and posts you submit to Campaigns, we collect publicly available profile and performance data (such as username, follower/subscriber count, and view and engagement metrics), whether obtained through platform APIs or from publicly available sources. Linking is always your choice; if you do not link an account, we do not collect linked-account data about you.

3.3 Submission and Campaign data — Clip URLs, Drafts, Pre-post Review chat, view and engagement metrics, approval/rejection status, and appeal content.

3.4 Fraud and device data — Bot Score inputs and signals, and technical/usage signals used to detect fraud.

3.5 Support and communications — messages you send to support and related metadata.

3.6 Usage and analytics — how you interact with the Platform.

Creators can connect their social media accounts, including TikTok, YouTube, Instagram, Facebook, and X, through each platform’s official APIs (such as TikTok Login Kit). The descriptions in this Section apply if you choose to connect a social account. The connection is read-only. We use it to verify that you own a post and to read post analytics. We do not post on your behalf. Connecting is always your choice.

4.1 Platforms and account requirements. - Instagram — Professional/Business or Creator account only. - Facebook. - TikTok. - YouTube. - X.

4.2 Data we access (read-only, per connected platform, where the platform exposes it): - Profile data: username, display name, profile picture, bio, follower/subscriber count, verification status. - Confirmation that you own the connected account/post (post ownership verification). - Your public videos and posts on the connected platform, and post metadata. - Content performance metrics: views, likes, comments, shares, and other API-provided analytics.

We use this data to verify campaign content, measure performance, calculate payouts, and share relevant profile information with Brands as described in Section 7.

4.3 Token storage, disconnection, and revocation. Tokens are stored server-side. You can disconnect a platform at any time in your account settings (Connected accounts) or revoke access in the platform’s own settings. Disconnecting or revoking stops tracking and payouts for that platform, CR invalidates the token within 24 hours, and we delete data received from that platform as described in Section 4.4 and Section 10.

4.4 Retention and deletion. Connected-account data and analytics are retained for as long as needed to operate Campaigns, verify views, handle disputes, and meet legal/tax obligations, after which they are deleted or de-identified. You can request deletion of your connected-account data at any time by disconnecting the platform or by contacting us at the address in Section 13. We do not collect or retain OAuth data beyond the read-only fields listed in this Section.

4.5 Whop and Discord. You sign in to the Platform through Whop’s login service (covered by Whop’s own terms and privacy policy). You may also optionally link a Discord account; linking identifies your Discord account to us and adds you to the Content Rewards Discord server. Discord linking is not used to read your messages or post as you.

4.6 Google and YouTube. Content Rewards uses YouTube API Services. Content Rewards’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through YouTube API Services is stored no longer than 30 days unless refreshed through the API, in accordance with YouTube’s API policies. By connecting a YouTube account you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google’s handling of your data. You can revoke Content Rewards’ access to your Google data at any time via Google security settings.

We use personal data to: operate the Platform and Campaigns; verify post ownership and views; calculate and make payouts; run fraud detection and the Bot Score; provide support; meet tax, sanctions, and other legal obligations; and improve and secure the Platform.

6.1 What it is. The Bot Score is a fraud-risk score from 0–100, powered by May Software Inc (a third-party processor, may.inc). It combines 100+ flag signals with a reinforcement-learning model trained on 130M+ monthly snapshots.

6.2 The logic, in plain terms. The model assesses signals associated with a Submission and the connected account to estimate the likelihood that views or engagement are non-genuine.

6.3 How it is used (automated flagging, human decisions). The Bot Score is shown to Brand and CR moderators as an input to manual review. A Submission whose score meets or exceeds a fraud threshold is automatically flagged for human review, and the related payout is paused while the flag is open. The flag itself does not reject a Submission: approval, rejection, and the resolution of every flag — including whether a paused payout is released or reversed — are decided by a person. Because a human reviews and decides before any final effect on you, the Bot Score does not produce a decision based solely on automated processing within the meaning of GDPR Article 22; if that changes, we will update this policy and provide the safeguards Article 22 requires.

6.4 Lawful basis. We process Bot Score data to operate the Platform and prevent fraud, relying on the performance of our contract with you and on our legitimate interests in protecting Brands and honest Creators, balanced against your rights.

6.5 Your rights. Your general data rights described in Section 9 (including access, correction, objection, and complaint to a supervisory authority) apply to Bot Score processing. If you disagree with a moderation outcome, you may raise it through the appeal process for flagged Submissions in the Creator Terms, where it is handled by a person.

Whop. Whop Inc is an independent platform and payment processor that you also contract with directly under Whop’s own terms and privacy policy. Campaign funding, withdrawals, and related KYC are handled through Whop; data you provide to Whop is governed by Whop’s privacy policy.

We share personal data with service providers that process it on our behalf, including:

• May Software Inc — Bot Score / fraud detection (may.inc).
• Amazon Web Services — cloud hosting, storage, and email delivery.
• Convex — application data/backend.
• Neon — database.
• ClickHouse — analytics database.
• Intercom — support messaging.
• OpenAI — automated support-chat responses (support messages you send may be processed to generate replies).
• Upstash — support-content search infrastructure.
• Sentry — error monitoring.
• Resend — email delivery.
• Twilio — SMS delivery, where offered.
• Sendblue — messaging.
• Attio — CRM.
• PostHog — product analytics.
• ElevenLabs — voice/audio processing.
• Cal.com — demo and call scheduling.
• Slack — internal routing of support and feedback.

Sharing with Brands. When you participate in a Brand’s Campaign, we share with that Brand the information needed to run it: your profile information (such as username, display name, profile picture, and follower/subscriber count), your Submissions and Drafts, and the view, engagement, and fraud-signal data used to review Submissions and calculate payouts.

We also share with the social platforms you connect (Instagram, TikTok, YouTube, X, Facebook) to the extent needed to operate the OAuth connection, and with tax, legal, and sanctions-screening providers and authorities as required.

CR maintains a data processing agreement with each service provider that processes personal data on CR’s behalf as a processor, and maintains a current list of sub-processors available on request at legal@contentrewards.com.

Personal data may be processed in the United States and other countries. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for transfers out of the EU/UK. Where personal data is transferred out of the EEA or UK, CR relies on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary safeguards as appropriate.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to processing, and to withdraw consent. EU/UK users may lodge a complaint with a data-protection supervisory authority. To exercise rights, contact us at the address in Section 13. We will not retaliate for exercising these rights.

Data deletion requests. Any user may request deletion of their personal data, including data received from a connected social platform, by disconnecting the platform in account settings or by emailing legal@contentrewards.com. We honor verified deletion requests within the timeframes required by applicable law.

Sale of personal information. We do not currently sell your personal information to third parties as defined by applicable privacy laws, including the California Consumer Privacy Act (CCPA). If our practices change in the future, we will update this Privacy Policy and provide you with the opportunity to opt out in accordance with applicable law.

California residents may have the right to know what personal information is collected, used, shared, or sold; to delete personal information; to correct inaccurate personal information; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights. To exercise them, contact us as described in Section 13.

Do-Not-Track. Some web browsers transmit “Do-Not-Track” (DNT) signals. As there is no uniform standard for recognizing or responding to DNT signals, we do not currently respond to DNT browser signals.

We keep personal data only as long as needed for the purposes above or as required by law (for example, tax records). Drafts and Pre-post Review chat are retained as evidence even if a Campaign is deleted (see the Creator and Organization Terms). We then delete or de-identify data.

CR uses commercially reasonable administrative, technical, and organizational safeguards, including encryption of data in transit (TLS) and access controls. No method of transmission or storage is completely secure, and CR cannot guarantee absolute security.

We and our analytics providers (such as PostHog) use cookies and similar technologies to operate and improve the Platform. You can manage cookies through your browser and, where offered, through our cookie controls.

13.1 Contact: legal@contentrewards.com, or by mail at Content Rewards Inc., 12055 Summit Circle, Beverly Hills, CA 90210, USA. For EU/EEA and UK data-protection purposes, CR can be contacted at legal@contentrewards.com, and CR will designate and publish an Article 27 representative where it is required to do so.

13.2 Changes. We may update this Privacy Policy. Material changes are notified through the Platform or by email; the “Last updated” date reflects the current version.

Content Rewards Inc — a Delaware corporation · HQ: Beverly Hills, California · Last updated: August 19, 2026