Privacy Policy
Last updated: 6 September 2026 · This policy explains what we collect, why, and how to get it deleted.
1. Who We Are
CollabX Ltd (“CollabX”, “we”) is the data controller for the personal data described in this policy. We are registered in the United Kingdom at Belfast, BT9 5AL, United Kingdom.
CollabX connects creators with businesses. If you are a creator, most of the data here is about you. If you are a business, we hold your company and contact details. We also, as explained in section 3, process a limited amount of data about people who comment on a creator’s Instagram posts and who are not themselves CollabX users.
For any privacy question or request, contact privacy@collabx.com.
2. Data We Collect
2.1 Account
Email address, name, password (stored only as a bcrypt hash), profile photo, role, and sign-in timestamps. If you sign in with Google, Meta or X we receive your identity and email from that provider instead of a password.
2.2 Creator profile
Stage name, biography, phone number, location and work locations, social handles, portfolio links, rates and availability, and the collaboration types you accept.
If you build a modelling comp card you may also provide physical measurements (height, weight, chest, waist, hips, inseam, shoe size, hair and eye colour, garment sizes) and a model type of female, male or non-binary. These are optional, are used only to populate your own portfolio, and you can clear them at any time.
2.3 Business profile
Company name, website, industry, size, brand description, registered address, VAT number, company registration number, and any verification document you upload. Verification documents are reviewed by our staff and are never shown to other users.
2.4 Content and activity
Portfolios and uploaded images, messages you send through the platform, enquiries sent to you through a public portfolio page, contracts and their payment status, and your searches and selections inside the AI portfolio builder.
3. Instagram Data
Connecting Instagram is optional. When you connect it, we store an encrypted access token (AES-256-GCM) and read the following on your behalf. We never post, message, or read your direct messages.
- Profile: username, biography, display name, website, follower and media counts.
- Media: your posts, captions, thumbnails, permalinks, timestamps, likes and comment counts.
- Insights: reach, impressions, saves, shares, video views, profile visits and link taps.
- Audience: aggregate age, gender, city and country breakdowns of your followers.
- Growth: daily follower gains and losses.
- Stories: reach, replies, exits and completion, received when a story expires.
3.1 Comments, including data about other people
If you grant the comments permission, we read up to 20 comments on each of your 20 best-performing posts and store the comment text so we can summarise how your audience responds. We do not store the commenter’s username, and no comment is ever attributed to a named person anywhere in the product.
Comments are private to you by default. Quotes appear on your public portfolio only if you switch on Share audience reception, and even then they are shown unattributed. Our lawful basis for processing this limited third-party data is legitimate interests: summarising public reactions to a creator’s own posts, minimised by discarding the identity of the commenter.
4. AI Processing
We use AI to choose portfolio images, to power natural-language search over your own photos, and to summarise comment sentiment. This means some content leaves our platform:
- OpenAI receives the image data itself (not just a link) for classification and ranking, and receives Instagram comment text for sentiment analysis, plus captions, bios, briefs and search queries for the features that use them.
- Voyage AI receives image data to produce a numeric vector used for similarity search within your own portfolio. We store the vector, not the image.
Neither provider uses this content to train their own models under our API agreements.
4.1 Sentiment analysis
Comment text is scored for sentiment, topic, purchase intent, and a brand-safety flag that marks a comment as hostile or controversial. These are automated inferences and can be wrong. They inform only how your audience reception is summarised; they do not decide anything about you, and we do not carry out automated decision-making that produces legal or similarly significant effects.
4.2 Improving our search
If you opt in as a contributor, we keep your search phrases, which suggestions you kept or skipped, the underlying scores, and archived copies of the images you selected, so we can improve ranking quality. This is linked to your account so we can delete it on request. It is never shown on your public profile.
5. Your Consent Choices
Four independent switches control optional processing. All default to off.
- AI image processing – required for the AI portfolio builder and for comment sentiment. You can withdraw it in Settings, which stops both.
- Training contributions – the improvement programme in 4.2. Withdrawing deletes the data described there.
- Share insights – lets businesses browsing creators see your Instagram reach and engagement.
- Share audience reception – lets businesses and your public page show an aggregate summary of your comment sentiment, and unattributed quotes.
6. Lawful Bases
| Purpose | Basis |
|---|---|
| Creating and running your account | Performance of a contract |
| Matching creators with businesses | Legitimate interests: the service you came for |
| AI image processing and sentiment analysis | Consent |
| Improving search ranking (contributions) | Consent |
| Publishing your portfolio and any shared metrics | Consent, given by publishing and by the sharing switches |
| Storing comment text from your posts | Legitimate interests, minimised by discarding commenter identity |
| Payments and financial records | Legal obligation |
| Security, abuse prevention and rate limiting | Legitimate interests |
7A. What CollabX Staff Can See and Do
The CollabX team runs an admin panel to keep the platform safe. From it we see account and profile details, business and agency verification details (registered name, company number, VAT number and address), campaign, application and contract statuses, payment status and amounts (never card details, which we do not hold), reports, and aggregate statistics.
We do not browse your messages. A conversation can be opened by staff in exactly two situations: the contract it belongs to is in dispute, or one of its participants has reported it. Every such read is written to a permanent audit log naming the staff member, the conversation and the reason. We never see your Instagram access tokens, the text of comments on your posts, or insight data you have not switched on for sharing.
Businesses and agencies are verified by our staff before they can publish, invite or contract anyone; a rejection is explained to them. We may suspend an account or an agency for a breach of our terms, fraud or a risk to other users (Terms section 12.2); a suspended account keeps its data and its login, sees the reason, and can write to us. The suspension, its reason and who decided it are recorded in the same audit log. When we act on a report, the reporter is told only that it was reviewed.
8. Retention & Deletion
8.1 Deleting your account
You can delete your account in Settings. We remove your profile, portfolios, uploaded images, Instagram data and login connections, and we tell Instagram, Google or Meta to revoke the access you granted us.
Two exceptions. If you have been party to a contract, we must keep that contract and its payment records for accounting and tax purposes, so instead of deleting your row we anonymise it: your name, email, photo and credentials are erased and the record retains only the fact that a party existed. If you own an agency, we ask you to transfer or close the agency first, so that its other members and clients are not deleted along with you.
8.2 Disconnecting Instagram
Disconnecting inside CollabX stops future syncing and revokes the token, but keeps the insights already collected so that reconnecting does not lose your history. If you instead remove CollabX from within Instagram, Meta notifies us and we delete all Instagram-derived data immediately.
You can also ask Instagram to send us a data deletion request. We action it and give you a confirmation code with a page where you can check the status.
8.3 Periods
Financial records are kept for seven years as UK tax law requires. Training-contribution data is deleted within 30 days of withdrawing consent.
Some data is also aged out automatically, whether or not you delete your account:
- Instagram comment text: 90 days. It is re-read on each sync, so current comments stay available while older text is discarded. The aggregate summary is unaffected.
- Portfolio view records, your searches and your image feedback: 12 months.
Everything else is kept while your account is open and removed when you delete it.
10. Your Rights
Under UK and EU data protection law you can ask us to:
- give you a copy of your data, or send it to another provider;
- correct anything inaccurate;
- delete your data, subject to the retention exceptions in section 8;
- restrict or object to a particular use;
- withdraw a consent you gave, at any time, without affecting past processing.
Email privacy@collabx.com and we will respond within one month. If you are unhappy with our response you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EEA.
11. International Transfers
Some processors in section 7 are in the United States. Those transfers rely on the UK International Data Transfer Agreement or Standard Contractual Clauses, together with the safeguards in our agreements with each provider.
12. Children
CollabX is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
13. Changes
We will update this page when our processing changes and revise the date above. For material changes affecting existing users we give 30 days notice.
14. Contact
CollabX Ltd
Belfast, BT9 5AL, United Kingdom
Privacy: privacy@collabx.com
See also our Terms of Service.