Privacy Policy

Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, username, role (Business/Creator/Consumer)
• Profile Information: Avatar, bio, location, social media handles
• Business Information: Business name, address, phone number, website (for Business users)
• Creator Information: Portfolio media, follower counts, engagement metrics (for Creators)
• Payment Information: Billing address, payment method (processed securely by Stripe)

2.2 Automatically Collected Information

• Usage Data: Pages viewed, features used, time spent, clicks, navigation paths
• Device Information: IP address, browser type, operating system, device identifiers
• Location Data: Approximate location based on IP address; precise location for local creator matching (with permission)
• Cookies and Tracking: Session cookies, analytics cookies, preference cookies

2.3 Social Media Integration

When you connect Instagram, TikTok, or other social accounts, we collect:

• Public profile information (username, profile picture, follower count)
• Engagement metrics (likes, comments, shares) for campaign tracking
• Content you choose to share through our platform — including anything you schedule us to publish on your behalf, described in section 2.7

2.4 Instagram Data & Disconnection

When you connect your Instagram account, we import your public media for your portfolio. If you disconnect your Instagram account from Onlure:

• Your Instagram access token is immediately revoked
• All imported Instagram media is permanently deleted from your portfolio
• Your Instagram username and metrics are removed from your profile
• This action cannot be undone — you would need to reconnect and re-import

2.5 Point-of-Sale Data (Business Users)

A business can connect its point-of-sale register — Square, Clover, or Shopify POS — so that in-store purchases can be credited to the creator campaign that brought the customer in. Connecting a register is optional, is done by the business owner, and can be undone at any time. While a register is connected, we receive from that provider:

• Merchant Details: Business name, merchant or shop identifier, and store locations
• Order Records: Order identifier, timestamp, order total, currency, and which discounts were applied
• Payment Records: Payment identifier, amount, and whether the payment succeeded
• Campaign Discounts: We add one clearly named Onlure discount per campaign to the register so a cashier can apply it at checkout, and we remove it when the campaign ends

We request a deliberately narrow set of fields. From a connected register we do not receive or store cardholder names, card numbers, or any other payment credentials, we do not collect the individual items in a customer's basket, and we do not learn who made the purchase. What we keep is the order and payment identifier, the timestamp, the order total, and the discount that was applied. (A shopper who has separately chosen to link their own payment card is a different arrangement, described in section 2.6, and one they start themselves.)

This data is used for one purpose: matching a completed in-store purchase to an earlier campaign scan, so we can calculate what the business owes and what the creator earned. It is not used for advertising or profiling, and it is not sold.

A business can disconnect its register at any time from its Onlure dashboard. Disconnecting deletes the access credentials we hold and stops all further collection. To revoke our access at the provider as well, uninstall the Onlure app from your Square, Clover, or Shopify account.

2.6 Linked Payment Cards (Consumers)

You can choose to link a payment card to your Onlure account so that cashback for a participating offer is paid automatically, with nothing to scan and nothing for a cashier to ring in. Linking a card is entirely optional, you start it yourself, and you can undo it at any time. Onlure works with a card-linking provider, Fidel API, together with Visa, Mastercard and American Express to make this work.

When you link a card, the card number is entered directly into the provider's secure form. Onlure never receives or stores your full card number, your CVV, or your online banking credentials. What we keep about the card itself is the network it runs on, the last four digits, the expiry month and year, and the country it was issued in — enough for you to recognize which card you linked.

While a card is linked, the card networks notify us of purchases you make with it at participating Onlure merchant locations only. We do not receive your statement, your balance, your account number, or your purchases anywhere else. For each qualifying purchase we receive:

• Amount and currency of the purchase
• Merchant location and the local time of the purchase
• Card network references such as an authorization code and the provider's transaction identifier, used to recognize the matching refund if the purchase is later returned

We do not receive the items you bought. We use this to work out the cashback you earned, to hold it for the seven days a refund could still arrive, and to credit the creator whose recommendation brought you in. It is not used for advertising or profiling, it is not used to build a picture of your spending, and it is not sold.

We record which version of this consent language you agreed to and when, so it stays clear what you were told at the time.

You can unlink a card whenever you want, from your Onlure wallet. Unlinking removes the card from the monitoring program, and the networks stop sending us anything about it. Cashback you already earned stays yours.

2.7 Posting to Your Social Accounts (Creators and Businesses)

Onlure has a post scheduler. You write a caption, attach a photo or video, pick a time, choose which of your connected accounts it should go to, and at that time we publish it for you. Instagram, TikTok, YouTube, Facebook Pages and Snapchat can each be a destination.

Permission to post is asked for separately, and it is not the same permission as the analytics connection described in sections 2.3 and 2.4. Granting one does not grant the other, and if you decline posting permission — or change your mind later — the connection you already use for your portfolio and your metrics is untouched. You start this yourself; we never ask for posting permission on your behalf or in the background.

To publish a post at the time you asked, we store:

• The file you uploaded — the photo or video, held in private storage until it publishes
• The caption you wrote, and for YouTube the title we take from its first line
• The time and time zone you chose, so the post goes out at the hour you meant wherever you happen to be
• An encrypted access token for each account you picked, and that account's username and profile picture so you can see which one you are about to post to

We publish only the exact content you composed, only at the time you set, and only to the accounts you connected. We do not post on our own initiative, we do not edit your caption, we do not add our own branding or promotional content to your post, and we never publish anything of ours to your account.

What this permission does not give us is worth stating plainly. We cannot read your private messages, we do not receive your followers' names or contact details, and we cannot read, edit or delete posts we did not create for you. A scheduled post that has already published is yours — edit or remove it in the platform's own app, exactly as you would any other post.

You can withdraw posting permission at any time from your Onlure dashboard. Doing so deletes the stored token immediately and cancels every post still waiting to go out. Each platform also lets you revoke our access from its own settings, and we treat that the same way. Posting to any of these accounts is additionally governed by that platform's own terms, which apply to your account alongside ours.

How We Use Your Information

We use your information to:

• Provide Services: Create and manage your account, process bookings, facilitate creator-business connections
• Match and Connect: Power AI-driven creator discovery, recommend relevant creators to businesses
• Process Payments: Handle booking payments and creator payouts through Stripe
• Communicate: Send transactional emails (booking confirmations, payment notifications), marketing emails (with consent), platform updates
• Improve Platform: Analyze usage patterns, identify bugs, develop new features, conduct A/B testing
• Prevent Fraud: Detect fake accounts, suspicious activity, and platform abuse
• Comply with Law: Respond to legal requests, enforce our terms, protect rights and safety

How We Share Your Information

4.1 Within the Platform

• Business Users can see Creator profiles, engagement metrics, and booking history
• Creators can see booking details, earnings data, and business information
• Public Users can see Business information and Creator profiles

4.2 With Third-Party Service Providers

• Supabase: Database and authentication services
• Stripe: Payment processing
• Vercel: Hosting and content delivery
• Postmark: Email delivery
• Telnyx: SMS notifications (opt-out anytime by replying STOP)
• Apple Push Notification service & browser push services: Push notifications
• Wise: Creator payouts (Interac e-Transfer)
• Square, Clover and Shopify: Point-of-sale attribution, when a business connects their register (see section 2.5)
• Fidel API, with Visa, Mastercard and American Express: Card linking and purchase notifications, when a consumer links a payment card (see section 2.6)
• OpenAI: AI-assisted features (creator search, campaign briefs)
• Analytics Providers: PostHog (product analytics and error diagnostics), Vercel Analytics, Meta and Google advertising measurement

4.3 Legal and Safety

We may disclose your information when required by law, to comply with legal processes, to protect our rights, or to prevent fraud and abuse.

4.4 Business Transfers

If Onlure is acquired or merged with another company, your information may be transferred to the new entity. We will notify you before your information becomes subject to a different privacy policy.

We do NOT sell your personal information to third parties.

Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential Cookies: Keep you logged in, remember your preferences
• Analytics Cookies: Understand how you use the platform
• Marketing Cookies: Show relevant ads and track campaign performance (with consent)

You can control cookies through your browser settings. Note that disabling cookies may affect platform functionality.

Data Retention

We retain your information for as long as:

• Your account is active
• Needed to provide services (e.g., redemption history for accounting)
• Required by law or for legitimate business purposes (e.g., fraud prevention)

Point-of-sale records (section 2.5) are kept as part of the campaign they attribute, because they are the record of what a business was charged and what a creator was paid. Disconnecting a register stops new records from being collected but does not erase the ones behind completed campaigns.

Linked-card purchase records (section 2.6) are kept for the same reason: they are the evidence behind cashback we paid you and money a business was charged, and we need them to handle a refund or a dispute. Unlinking a card stops all further collection immediately; the records behind cashback already paid remain, along with the record of the consent you gave.

After account deletion, we may retain anonymized data for analytics and aggregated statistics.

6.1 Deleting Your Data

You can delete your account yourself, from inside the product, on any platform you use it on:

• On the web: creators go to Dashboard → Settings; businesses go to Dashboard → My Business. Both pages end with a Delete Account section.
• In the iOS and Android apps: the same option lives under Settings, and it does the same thing — there is one deletion path behind every screen, so the outcome never depends on which app you happened to open.
• By email: write to privacy@onlure.ca and we will do it for you.

Deletion takes effect immediately. There is no waiting period and no deactivated state you could be talked out of.

What deletion removes: your name, email address, password, avatar, bio, phone number, social handles and connected-account tokens, along with your portfolio media. Your profile stops being reachable and stops appearing in search or recommendations.

What survives, and why: the financial and contractual record of work already done — a completed booking, a payout we made, a redemption a business was charged for. Those records belong to the other party as much as to you, and some of them are our tax record. They stay, with every field that identified you cleared, so nothing in them leads back to a person. We cannot honestly promise to erase a brand's paid booking history because you closed your account, so we do not promise it.

Two things can hold a deletion up, and both are about not stranding someone: an active booking still in progress, and an unsettled balance owed to you or by you. The product tells you which one it is and what to finish first.

If you delete your Instagram or Facebook account, or revoke Onlure from that platform's settings, the platform notifies us automatically. We then clear everything we hold from that connection: the access token, the username, the follower and engagement numbers, and every piece of portfolio media we imported from it. Your Onlure account itself is left alone — only the connection goes. We return a confirmation code to the platform for that request, which is why you may have arrived at this section from Instagram or Facebook.

Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your account and data (subject to legal retention requirements)
• Data Portability: Receive your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing emails, disable location tracking, unlink a payment card (section 2.6)
• Object to Processing: Object to certain uses of your data
• Withdraw Consent: Revoke consent for data processing where consent was the legal basis

To exercise these rights, contact us at privacy@onlure.ca

Security

We implement security measures to protect your information, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Secure authentication with password hashing
• Row-level security policies in our database
• Regular security audits and monitoring
• Access controls limiting who can view your data

However, no system is completely secure. Please use a strong, unique password and enable two-factor authentication when available.

Children's Privacy

Onlure is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

International Data Transfers

Your information may be transferred to and processed in countries outside of Canada, including the United States (where our hosting provider Vercel operates). We ensure appropriate safeguards are in place, such as standard contractual clauses or Privacy Shield frameworks (where applicable).

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information we collect and how we use it
• Right to delete your personal information (with exceptions)
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at privacy@onlure.ca

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under GDPR including:

• Right to access, rectification, erasure, and data portability
• Right to restrict or object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

Our legal basis for processing your data includes: contract performance, legitimate interests, consent, and legal obligations.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or platform notification. The "Last Updated" date at the top will reflect when changes were made. Continued use of Onlure after changes constitutes acceptance of the updated policy.

Contact Us

For questions, concerns, or requests regarding your privacy, please contact us: