Privacy notice

1. Who this notice covers

This notice describes personal information processed through Mercatr for visitors, creators, brand representatives and administrators. The operator identified above is responsible for the processing described here. It does not cover a third-party website's independent practices after you leave Mercatr.

2. Information we process

Account information includes your email address, name, account role, workspace memberships and sign-in records. Creator information can include your username, biography, country and city, languages, categories, rates and connected social profile details. Brand information includes organisation details and the representatives using its workspace.

Campaign and transaction records include briefs, applications, offers, accepted terms, drafts, messages, uploaded files, publication links, verification results, reviews, disputes, notifications and audit records. When you connect X, we use its authorisation flow to confirm the account ID and handle belonging to you. We retain the verified identity and a record of your connection attempts. We do not retain X access tokens or use this connection to collect posts or follower statistics. Manual support is available if connection attempts fail. When separate API reporting is enabled, we may read supported publication counters and availability, retain dated observations, and show the source and freshness to the campaign parties. Missing API access is not proof of zero performance. Other platforms require supported account types and appropriate authorization before automatic collection.

Bank details supplied for payout setup are sent to the payment provider. Mercatr retains the recipient reference, account name, bank information and last four account digits for the current payout workflow. We record transaction references, amounts, currencies and settlement results. Card entry is handled by the payment provider rather than by a Mercatr card form.

Hosting and security systems may process network and technical information, including IP addresses, request logs, device or browser information, timestamps and error records. Email systems process delivery details needed to send sign-in and service notifications.

3. Why we use information

We use information to authenticate users, run profiles and campaigns, communicate about work, process payments, review content and resolve disputes. We also use limited information to prevent abuse, enforce access controls, diagnose failures and keep a record of administrative and financial actions.

Depending on the activity and applicable law, the basis for processing is performance of an agreement or steps you request before entering one, legitimate interests in operating and protecting the service, compliance with legal obligations, or consent where required. You can ask the privacy contact to explain the basis for a particular use. Optional tracking that requires consent must not be enabled before the required choice has been provided.

4. Public information and sharing within Mercatr

Approved, active creator profiles and published marketing content are visible to visitors. Do not put private contact details in a public biography. Campaign participants can see information needed to negotiate and deliver their work. Files uploaded to a deal are available to both parties and authorised dispute reviewers; they are not published in the public creator directory.

Administrators have role-based access for support, moderation, finance or content publishing. Sign-in tokens, private messages, deal files and bank references are not intended for public display. A recipient may keep information they lawfully receive, so removing it from Mercatr does not necessarily remove their copy.

5. Service providers and international processing

We use hosting, storage, email and payment providers to operate the service. The deployment uses Resend for transactional email and Cloudflare R2 for configured object storage and database backups. Cloudinary hosts uploaded creator profile photos, and Bunny Stream hosts and processes creator introduction videos. These optional uploads are displayed on public creator profiles; photo and video delivery URLs may be accessible to anyone who has the link. Video playback connects the viewer to Bunny. Paystack processes supported payments when enabled. X receives requests when its creator-data integration is enabled. Which integrations operate for your activity depends on the service configuration.

Providers may process information in countries other than your own. Where applicable law requires safeguards for an international transfer, those safeguards must be arranged for the relevant provider and activity. Contact us for information about the providers and arrangements that apply to your data. We may also disclose information when required by law, to protect rights or safety, or in connection with a business transfer subject to appropriate protections.

6. Cookies and advertising

Mercatr uses necessary sign-in and security cookies to maintain sessions and protect requests. Blocking these cookies may prevent sign-in or other account features from working.

Optional advertising attribution and the X advertising pixel are disabled by default and controlled separately from the X creator-data integration. When attribution is enabled, you can allow or decline advertising through the advertising preferences control. After permission, we save ad click identifiers, campaign labels, the landing page path and capture time, then link them to your account when you verify your sign-in email. Anonymous attribution storage expires after 90 days without a further capture; saved account attribution follows our account-data retention policy.

With advertising permission, we can share the saved X click identifier, a hashed email address, and signup or first-funding event information with X to measure advertising. Hashing an email does not make it anonymous. You can withdraw permission through advertising preferences; this stops future queued sharing, but cannot recall events already shared or requests already in flight. Connecting a creator profile does not itself enable advertising tracking.

7. Retention and account closure

We keep information for as long as needed for the purpose for which it was collected, including running the account, fulfilling deals, resolving disputes, preventing fraud and meeting applicable recordkeeping requirements. Financial and audit records may need to remain after account closure. We do not promise that all data is deleted immediately when a request is received.

Backups are used for recovery and may retain earlier copies until they expire under the configured backup policy. A deletion request should be considered across active systems and recovery procedures. Contact us to ask about a specific record, request closure or request an explanation of the retention period that applies.

8. Your choices and rights

You can edit information exposed through your account settings and contact us about information you cannot change yourself. Depending on applicable law, you may have rights to access, correct or erase personal information, restrict or object to processing, receive a portable copy, and withdraw consent for processing based on consent. Withdrawal does not undo lawful processing that already occurred.

Send a request to the privacy contact above. We may ask for proportionate information to confirm identity and protect another person's data. Explain what information and action your request concerns. If a request cannot be fulfilled in full, we should explain the applicable reason and available next steps. You may complain to the relevant data protection authority, including the Nigeria Data Protection Commission where Nigerian data protection law applies.

9. Security, children and updates

We use access controls, authenticated file access and operational safeguards, but no online service can guarantee absolute security. Keep sign-in links private and report suspected unauthorised access promptly. The marketplace is intended for adults aged 18 and over; contact us if you believe a child has supplied personal information.

We may update this notice as the service, providers or processing activities change. The effective date above identifies the published version. Material changes should be communicated through an appropriate service channel.