Privacy Policy
Last updated: 8 October 2026
This policy explains how Newcollab collects, uses, and shares personal data on
newcollab.co and
app.newcollab.co. It is written for Google, TikTok, Instagram, and payment-provider reviews as well as for you. Questions:
team@newcollab.co.
1. Who we are
Newcollab is a creator–brand collaboration product: a public PR directory, gifted PR applications, media kits, an in-app assistant (Polly), paid UGC listing cards, creator Pro, and a gifted UGC roster for brands. We are the controller of personal data processed for those services. We are not a law firm; this page describes our actual practices.
2. Data we collect
Depending on how you use Newcollab, we may process:
- Account data: name, email, password hash or social login ID, role (creator or brand), location you enter.
- Creator profile and kit: bio, niches, handles, rates, portfolio posts, shipping address and phone when you apply for gifted PR.
- Connected social accounts: TikTok Login Kit and Instagram Login Kit (Creator or Business) can give us your handle, user ID, follower counts, and public media used to build your kit and matching.
- Google Sign-In: name, email, Google user ID, and profile photo if Google provides them (see section 8).
- Gmail, if you connect it for Polly Autopilot: your Gmail address and a send-only access token, stored encrypted (see sections 9 and 10).
- Collaboration data: brand applications, gifted-list status, pitches, timeline events, kit views by brands, Polly chat messages.
- Brand data: company name, site, campaign notes, roster picks, shipping CSVs they export from a roster they locked.
- Payment data: Stripe (and, where still used, PayPal) handles card and payout details. We store subscription status, customer IDs, and invoices — not full card numbers.
- Usage and device data: pages viewed, referring site, approximate location from IP, cookies, and crash/diagnostic logs.
- Emails you send to team@newcollab.co and lifecycle emails we send you.
3. How we use it (and why)
We use personal data to run the product you signed up for (contract): accounts, kits, directory, gifted applications, pitches, Polly, subscriptions, and brand rosters. We also use it to keep the service secure, prevent abuse, measure what works, send product and campaign emails you can unsubscribe from, and meet legal duties (legitimate interests / legal obligation). Marketing emails and optional cookies that are not strictly necessary rely on consent where the law requires it.
4. Who we share it with
We do not sell personal data. We do not rent Google, TikTok, or Instagram user data. We share only as needed to operate Newcollab:
- Brands you apply to: kit, selected posts, and the shipping details you submitted so they can decide and ship a PR package.
- Creators on a brand roster: the brand sees applicants they unlocked on their roster page.
- Creator search for brands, including our ChatGPT app and the brand launch page: creators with a published kit can appear with their public handle, niches, follower range, country, gifting preference, brands from their portfolio, kit link, and the photos already shown on their public kit. Creators without a published kit appear only as anonymous stats (niche, follower range, country) with no handle, name, contact details, or address. Unpublish your kit or email team@newcollab.co to be removed.
- Processors: Google (Firebase Auth, Gemini for Polly, Analytics), Meta (Instagram Login, ads pixel), TikTok (Login Kit), Stripe, Microsoft Clarity, email delivery, and hosting.
- Law enforcement or a buyer of the business, if we are legally required or transferring the product under the same protections.
Paid UGC “Apply here” cards send you to a third-party brief. That site has its own privacy policy.
5. TikTok Login Kit
If you connect TikTok, we request the account and video data needed to fill your Newcollab kit and match brands (identity, public stats, and media you authorize). We use it only for your Newcollab account, kit, and matching. We do not post to TikTok for you, do not use TikTok data to advertise to other people, and do not sell it. Disconnect TikTok in Account Settings; deleting your Newcollab account also removes the connected TikTok data we stored.
6. Instagram Login
Instagram Login (Creator or Business) is used the same way: handle, professional account metrics, and media you authorize for kit and matching. We do not post on your behalf. Disconnect in Account Settings or delete your Newcollab account.
7. Polly (AI assistant)
Polly is Newcollab’s in-app creator assistant. To answer you she may send the current message, recent thread, and a short profile snapshot (niche, kit facts, brands already in the thread) to Google Gemini. We do not use that content to train a public model we own. Do not paste secrets (passwords, full card numbers) into Polly. Chat history is stored on your account so the conversation can resume.
8. Google Sign-In and Google user data
You can create or log into a Newcollab account with Google. That uses Firebase Authentication on Google Cloud project auth-app-feed3. When you choose Google, we receive the information Google shares for a basic sign-in: your name, email address, Google user ID, and profile photo if you have one. We use that only to authenticate you, create or link your Newcollab account, and show your name in the app. We do not sell Google user data, do not use it for advertising, and do not share it with brands except as part of your public creator profile if you choose to display a name there.
Google’s own practices are described in the
Google Privacy Policy. You can stop using Google Sign-In by deleting your Newcollab account in Account Settings, which removes the Google-linked profile from our production database as described below.
9. Gmail for Polly Autopilot
Creators on Pro can connect Gmail so Polly Autopilot sends the brand pitches they approved from their own address. This is optional and only happens after you click Connect Gmail and accept Google’s consent screen.
- What we access: we request only the
gmail.send scope plus your Gmail address (openid, email). We cannot read, search, label, or delete anything in your mailbox, and we never access your inbox, contacts, or attachments. - How we use it: solely to send the pitch emails and day-4 follow-ups you approved in Newcollab, to the brand address shown on each pitch, and to record that the email was sent (Gmail message and thread IDs) so follow-ups stay in the same thread and appear on your Timeline. Nothing is sent without your approval.
- Sharing: we do not sell, rent, or share Google user data with anyone. The only recipient of an email is the brand you approved it for. We do not use Gmail data for advertising, and no human at Newcollab reads it except to fix a problem you report to us, for security, or where the law requires it.
- AI and machine learning: Polly writes pitch drafts from your Newcollab profile, not from your Gmail. Data from Google Workspace APIs is never used to develop, improve, or train generalized or non-personalized AI or machine-learning models.
- Retention and deletion: we keep your Gmail address, the encrypted OAuth token, and a record of the pitches sent while Gmail is connected. Click Disconnect Gmail in Polly at any time: we revoke the token with Google and delete it from our database immediately. Deleting your Newcollab account removes all of this too. You can also revoke access at myaccount.google.com/permissions.
Newcollab’s use and transfer of information received from Google APIs to any other app will adhere to the
Google API Services User Data Policy, including the Limited Use requirements.
10. How we protect your data
We use technical and organizational security procedures to protect the confidentiality and integrity of personal data, including Google user data:
- Encryption in transit: all traffic to newcollab.co, app.newcollab.co, our API, and Google’s APIs uses HTTPS (TLS).
- Encryption at rest for Google tokens: Gmail OAuth tokens are encrypted with AES (Fernet: AES-128 with HMAC-SHA256) before they are stored. The encryption key is kept as a server secret, separate from the database. Short-lived access tokens are held only in server memory and are never stored or logged.
- Least privilege: we request the narrowest Google scope that makes the feature work (send-only Gmail access), and Google sign-in data is limited to basic profile information.
- Protected sign-in flows: OAuth requests use a signed, expiring state token to prevent forgery, and passwords are stored only as salted hashes. Card data is handled by Stripe and never stored on our servers.
- Restricted access: only the Newcollab team can access our production systems and credentials, and only to the extent needed to run, support, and secure Newcollab.
- Backups and deletion: backups are encrypted, and deleted data ages out of them within 30 days.
No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires. Report security issues to
team@newcollab.co.
11. Cookies, analytics, and ads
Strictly necessary cookies keep you logged in and remember this cookie choice. They do not require consent. Analytics and marketing cookies are off in the EEA, UK, and Switzerland until you accept them in our banner. You can change that anytime via
Cookie settings. The choice is stored for 13 months on newcollab.co and app.newcollab.co.
If you accept analytics, we load:
- Google Analytics 4 (G-5RET5C6MZ8), including cross-domain measurement. Google receives Consent Mode signals so ads storage stays denied unless you also accept marketing.
- Microsoft Clarity for session diagnostics (how the product is used, not to identify you to brands).
If you accept marketing, we load:
- Meta Pixel (2008333943133119) on pages where we measure sign-up and checkout, so we can see if our own ads worked.
- TikTok Pixel (D8RDMRBC77U5P88O6G70) for the same purpose on TikTok ads.
Rejecting optional cookies does not block the product. You can also block cookies in your browser. Google offers a browser Analytics opt-out.
12. Payments
Creator Pro and brand seats are billed by Stripe. Stripe’s terms and privacy policy apply to card data. We keep subscription state and what you bought so we can deliver credits and invoices. Some older brand booking flows may still use PayPal. We never store full PAN (card) numbers on our servers.
13. International transfers
We and our processors (including Google, Meta, TikTok, Stripe, and Microsoft) may process data in the United States and other countries. Where required, we rely on contractual safeguards those providers offer for international transfers.
14. Retention
We keep account, kit, application, and billing records while the account is open and as long as we need them for disputes, tax, and security. Polly threads and kit-view logs are kept to operate the product. After you delete your account we remove production copies as described below; encrypted backups may linger up to 30 days.
15. Your rights
Depending on where you live (including the UK/EEA and California), you can ask to access, correct, delete, or export your data, object to or restrict some processing, and withdraw consent. We do not sell personal information as that term is used in CCPA/CPRA, and we do not use Google, TikTok, or Instagram data for cross-context behavioral ads to third parties.
Creators can delete their account from Account Settings. That request permanently removes your profile, media kit, pitches, saved brands, Polly threads, messages, and connected social data from our production database. Paid subscriptions are canceled immediately. Encrypted backups may retain residual copies for up to 30 days, and payment processors keep invoices they are legally required to store. After deletion you can create a new account with the same email. Email team@newcollab.co if you cannot use Settings or you are a brand.
16. Children
Newcollab is not directed at children under 13, and we do not knowingly collect their data. Gifted PR, shipping, and paid plans are for users 18 or over (or the age of majority where you live). If we learn we have an underage account, we delete it.
17. Changes
We will update this page when our practices change and revise the date above. Material changes that affect Google, TikTok, or Instagram user data will stay consistent with this disclosure.