Privacy notice

[REGISTERED COMPANY NAME] ([SSM NUMBER]), [REGISTERED ADDRESS], Malaysia, decides how your data is handled here and is the data user under the PDPA. Reach us at [SUPPORT EMAIL].

Your account: your name, email address, and the password or Google sign-in you use. The sign-in itself is handled by Clerk, and we never see your password. If your login has a picture, we keep a copy of its address; it is shown on Kreadors only for a creator who has not yet uploaded a photo of their own, and never for a business.

Creators: your display name, handle, headline and bio, your photo and cover picture, the town you work from, languages, niches, your rate card and add-ons with the reach figures you give for each item, the social accounts you list and the figures they carry, your past work, how far you travel, whether you take product, the date you are busy until, how quickly you answer requests, and the number of paid bookings you have backed out of.

Businesses: your brand name and logo, where you are, the campaigns you post and their pictures, the creators you have saved, and, if you give them, a billing email and address, your SSM registration number and your tax number, which go on your receipts.

Bookings and orders: what was requested, quoted, offered or proposed, what was agreed, delivered and approved, the messages between the two sides both before and on an order, the files attached to them, delivered drafts, published post links and the views, reach and other figures recorded against them, with a copy of each post's cover picture and caption where the platform gives them, reviews, disputes and how they were settled, and a record of each payment and refund with the reference the payment gateway gave it.

Payouts: the bank, the name on the account and the account number a creator gives us so we can pay them, plus their full legal name and IC or passport number, and their tax number where they give it. The money needs the account; the law needs the person, because a payment to an individual is reported under their identity and the invoice we issue carries it. We ask for nothing beyond that: no photograph of the card, no bank statement, no selfie.

Invitations, before you have an account: we sometimes build a starting page for a creator from their public profile — display name, handle, follower count, niche and town, as shown publicly on the day — and send them a private link to claim it. That page is reachable only by the link, appears nowhere on Kreadors, and nothing on it is ever marked as verified. If it is not for you, one button deletes it, and we keep only a scrambled form of the handle so we never add you again.

We do not collect your browsing habits across other sites, and Kreadors carries no advertising trackers.

To run the marketplace: show a creator's page to businesses searching, take a booking, hold the money, deliver the work, settle a dispute, pay a creator, and email both sides when something needs their attention.

To keep it honest: figures read from a connected account, an operator checking a creator's reach claim against the post it came from, the record of what an order actually delivered, the response rate and back-out count on a creator's page, and the sign-off record on a business's page.

To meet the law: receipts, the tax record of who was paid what, and anything a regulator can require us to keep. This is why we hold a creator's legal name and IC — not to verify them, but because a payment has to be reported against a person.

A creator's published page is public: their name, handle, town, pictures, rate card, portfolio, reach figures, reviews, response rate, busy date, and the number of paid bookings they have backed out of after they started. That is the point of it. It is public only once they publish it — an unpublished page is reachable by its link and appears in no search, and search engines are told not to list it.

A business's page is public too: its name and logo, its state, its open campaigns, the reviews creators have written about it, and how it behaves on orders — how long it takes to sign off a draft, how many drafts it left to the deadline, how many campaigns it has completed, how many creators it has booked and how much it has paid them in total. Its billing details, SSM number and tax number are on no public page.

The two sides of a booking see what is on it: the request, the quote, the messages, the drafts, the money, and each other's name and picture. Creators proposing on a campaign see the campaign and the business; the business sees each proposing creator's page. A review is hidden from the other side until both have written one or 14 days pass.

Bank details, your IC or passport number and your tax number are seen by nobody but you and the person making the payment. They appear on no page a business can reach, and on no public page at all.

Kreadors operators — a named list of people — can open any order, its messages and its drafts. They do so to settle a dispute, to sort out a payment or refund, or to check a reach claim, and the record of what they did stays on the order.

We use a small number of suppliers to run the service, and they only get what they need to do their part: Clerk for sign-in, Neon for the database, Vercel for hosting and file storage, Resend for the emails we send you, and Phyllo for connecting a creator's TikTok, Instagram, YouTube or Facebook: when you connect an account, the platform's permission is held by Phyllo, which reads your profile and post figures on our behalf and can only read, never post. Some of them process data outside Malaysia, which the PDPA allows where the data is properly protected.

A business pays on a secure payment page run by our Malaysian payment gateway, which handles the card, bank or e-wallet details itself. We receive only that the payment succeeded, the amount, the method used and the gateway's reference, and we never see a card number. Refunds go back through the same gateway.

Creators are paid by bank transfer from our own account, so your bank sees a transfer from us and nothing more.

We do not sell your data, and we do not hand it to anyone for their own marketing.

Your account and page for as long as you have an account. Orders, receipts, payment and payout records for [RETENTION YEARS] years after the order closes, because tax and accounting rules require it — a deleted account does not erase a receipt we are obliged to keep.

Messages, attachments and drafts stay with the order they belong to, because they are what a dispute is decided on. A conversation that never became a booking is kept while both accounts exist.

Ask us to close your account and we remove your page from Kreadors and delete what we are not required to keep. An invitation page you did not claim is deleted the moment you ask.

You can ask for a copy of what we hold about you, have anything wrong corrected, limit how we use it, or withdraw consent where we relied on it. Most of it you can change yourself — a creator on their page and rate card, a business under My business — which is faster than asking us.

Write to [SUPPORT EMAIL] and we will answer within 21 days, as the PDPA requires. If you are not satisfied, you can complain to the Personal Data Protection Commissioner of Malaysia.

Traffic is encrypted. Uploaded files — pictures, attachments and drafts — are stored privately and served only to people entitled to see them, through links that expire. Operator screens are limited to a named list of email addresses. No system is perfect: if data of yours is ever exposed, we will tell you and the Commissioner rather than hope you do not notice.

Kreadors sets only the cookies it needs to keep you signed in. Your search filters live in the page address, not in a cookie. There are no advertising or cross-site tracking cookies, which is why there is no banner asking you to accept them.

Kreadors is for people 18 and over. If we learn an account belongs to someone younger, we close it and delete what we hold.