Privacy policy

Pozto is made by MOSAIK Studio, Inc., a Delaware corporation ("we"). It's software that tells brands whether the creators they send products to posted about them. This policy explains what personal information we collect on pozto.co and in the Pozto app, why, how long we keep it, and the choices you have.

Two kinds of information

Information about our own users and visitors. When you visit pozto.co, fill in a form, or use the app, we decide what we collect and why. We are responsible for it.

Information brands put into Pozto. Brands add the creators they work with, the products they send, and their Shopify gift orders. For that information the brand decides what goes in and why; we process it for them, under our terms. If you are a creator and want to know what a brand holds about you, ask that brand. We will help them answer, and you can also send us a privacy request.

What we collect

Your account

• Your email address, to sign you in with a link we email you (there are no passwords).
• Your team, the brands you work on, and who invited whom.
• A sign-in cookie that keeps you signed in for 60 days after your last visit, and at most a year.

What brands add to Pozto

• Creators' names, public social handles, and emails if the brand adds them.
• Products, shipments, and shipping and delivery dates.
• Gift orders from a Shopify order export: the order number, date, products, ship date, and the customer's name and email, used only to match the order to a creator. We keep only orders the brand marks as gifts; other orders in the file are never stored.

Public posts

To find creators' posts we read public information from TikTok, Instagram and YouTube, through their official tools (oEmbed and the YouTube Data API) and the public pages anyone can open without signing in: captions, thumbnails, profile photos, follower and view counts, dates and links. We don't sign in to anyone's account or read private content.

Public brand pages

At pozto.co/brands we publish pages about brands, made from public posts: for each brand, the creators who posted a video naming it in the last 30 days (their public name, handle, profile photo and follower count) and those videos' links, thumbnails, dates and views. We don't say whether a creator was sent product or paid. A creator can take their handle off a page right away with “I'm a creator here: leave me off” at its bottom, and a brand can ask us to take its page down with “Ask to remove this page”; we do it within 7 days. You can also send us a privacy request.

Public creator pages

At pozto.co/creators we publish a page for each creator with 5,000 or more followers who appears on a public brand page: their public name, handle, profile photo, follower count, typical views, engagement (likes and comments per view), how often they post and how many of their videos are labelled as an ad or gifted, their latest videos' links, thumbnails, dates and views, the brands with a Pozto brand page that their videos named or tagged in the last 90 days with those videos, the hashtags they use and other accounts their captions tag. Pages are listed together at pozto.co/creators. We don't say whether a brand sent them product or paid them. A creator can remove their page with “Is this your account? Remove this page” at its bottom: we give a code to put in the account's bio, and once we read it there the page is removed for good and the creator is left off every brand page and out of Find creators. We read the bio only to look for that code, for up to 7 days, and don't keep it. You can also send us a privacy request.

Creator profiles

If you set up a creator profile, we keep: the accounts you add and when you proved they're yours; the public numbers we read from them (followers, views, likes, comments, and your latest videos' links and dates) and our copies of your profile photo and video thumbnails; what our automatic check found in your latest videos (whether they show a physical product, their language and topics, and whether any was unsafe for brands); what you write on your profile (About, topics, country, languages, what you're open to, your rate, and whether brands can contact you); when you confirmed you're 18 or older and agreed to the terms; reports from visitors, kept as a one-way hash of their network address; and which brands contacted you, when and with what subject (the message itself is emailed to you, not kept). Your public page at pozto.co/creators shows your public name, handle, photo, numbers, latest videos and what you wrote; never your email address or the check's details. A brand sees your email address only if you reply to it. Hiding your profile takes the page down at once, and deleting your account deletes the profile.

Affiliate programs

If you run or join an affiliate program, we keep: the program's terms; each partner's name, email, link token and code; how many times their link was visited (a count, not who visited); the sign-ups credited to them (the email address someone signed up with on the brand's site or in its Stripe account, kept once per program: the partner sees a count, not the emails); the sales credited to them (the order or payment id, amount, currency and date, and any refund); their commissions and the payouts the brand marked paid; and the payout details a partner enters (such as a PayPal email), which only that brand sees; and the materials the brand gives its partners (images, captions and guidelines). We email partners about their applications, commissions and payouts, in the brand's name; each email has a link to stop them. A partner who gives a US tax form (W-9 or W-8BEN) gives what the form asks: name, address, tax classification, tax identification number and, on a W-8BEN, citizenship and date of birth. It is encrypted on its own, on top of the database's encryption; only the owners of the brands whose programs the partner is in can open it, and each opening is recorded. A buyer's email on an order is compared with the partner's, to flag a partner buying through their own code, and isn't stored with the sale. If you come to pozto.co through a partner's link, a cookie keeps that partner's link token for 60 days, so they're credited if you subscribe.

Find creators and Competitors

Signed-in brands can search the creators whose public videos Pozto read for its brand pages, reports and competitor searches, and public creator accounts Pozto finds for search by topic (through web and YouTube searches) and reads again every month: their public name, handle, profile photo, follower count, views, and the captions of their videos from the last 90 days, with the brands those captions name. Brands also see which of these creators posted about the brands they follow. A team’s own creators and deals are never shown to another team. A creator who left a brand page is left out of search too, and you can send us a privacy request to be left out of it.

Forms on pozto.co

When you ask for a demo, contact us or sign up, we keep what you type (such as your name, email, company and message), the page you sent it from, your browser type, and a one-way hash of your IP address used to stop spam. New submissions are posted to a private channel in our team chat so we can reply.

How people use the site

We measure visits ourselves, without third-party analytics or advertising tags: pages viewed, sections seen, scroll depth, clicks, and where a visit came from. This uses a random visitor ID kept in your browser's local storage, and a hashed IP address; we never store your IP address itself. If your browser sends Do Not Track or Global Privacy Control, we don't record any of this. If you sign up, we keep the first page you visited with your account, so we know how you found us.

How we use it

• To run Pozto: sign you in, show your creators and their posts, and send the emails the app needs (sign-in links, invites).
• To reply to you, and to keep the service secure and free of abuse.
• To help you: the people who run Pozto can see the app as you see it, without changing anything, to answer questions or fix problems.
• To understand which parts of the site and app help people, so we can improve them.

We don't sell personal information, share it for advertising, or use it to make decisions with legal effects on anyone.

Who helps us

These providers process information for us, only to run Pozto:

• Amazon Web Services: hosting, and sending email.
• MongoDB Atlas: our database.
• Google (YouTube Data API) and TikTok: reading public posts.
• Google (Gemini): watching public videos for the video check and creator profile checks.
• Slack: notifying our team about form submissions.

We may also share information if the law requires it, or with a buyer if Pozto is ever sold, under this policy.

How long we keep it

• Account and brand information: while the account is open. When you ask us to close it, we delete its data within 30 days.
• Affiliate programs, their partners, sales, commissions and payouts: while the brand's account is open, as part of its brand information.
• Partners' tax forms: until the partner replaces the form or closes their account. A brand that downloaded or printed one keeps its own copy, as the IRS asks payers to.
• Customer names and emails from Shopify gift orders: removed as soon as the order is matched to a creator or marked "not a gift", and after 90 days at the latest.
• Sign-in links: 20 minutes. Sign-in sessions: 60 days after your last visit, and at most a year.
• Records of who viewed customer information: one year.

How we protect it

Everything travels over encrypted connections, and our database is encrypted at rest. Only the people who run Pozto can reach the systems, with two-factor authentication. If a breach affects your information, we will tell the affected brands within 72 hours of confirming it.

Your choices and rights

You can ask us for a copy of your information, or to correct or delete it, by sending us a privacy request. We answer within 30 days. Depending on where you live you may have more rights, such as objecting to some uses or complaining to a data protection authority. Pozto is for businesses and isn't meant for children under 16.

International transfers

Our providers may store information in the United States and other countries. Where the law requires it, we rely on standard contractual safeguards.

Changes

If we change this policy in a way that matters, we'll update the date above and tell signed-in users before it takes effect.