Privacy Policy

SocialVibe OÜ and its affiliates (collectively, “Trendy,” “we,” “us,” or “our”) are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (“GDPR”) and other relevant privacy legislation. This Privacy Policy explains in comprehensive detail how we collect, use, share, and safeguard information about you when you use our Services, and provides important information about your rights and choices regarding your personal data.

This Privacy Policy is prepared and made available to comply with the General Data Protection Regulation (Regulation 2016/679 of 27 April 2016) and other applicable data protection laws. Before you share any personal data with us, please carefully review this Privacy Policy alongside our Terms and Conditions and any billing terms presented at checkout to understand how we process your information.

1. WHO WE ARE AND HOW TO CONTACT US

Data Controller:

SocialVibe OÜ

Registry Code: 17350611

Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Tähesaju tee 21-114, 13917, Estonia

Email: agent@heytrendy.app

Data Protection Matters:

For all privacy-related inquiries, data protection questions, or to exercise your rights under applicable data protection laws, please contact us at: agent@heytrendy.app

We are committed to responding to your privacy queries within 30 days of receipt, or sooner where required by law.

Supervisory Authority:

As we are established in Estonia, the supervisory authority overseeing our data protection compliance is:

the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Address: Tatari 39, 10134 Tallinn, Estonia

Email: info@aki.ee

However, as a data subject, you have the right to lodge a complaint with the supervisory authority in your country of residence. A complete list of European supervisory authorities is available at edpb.europa.eu.

2. WHAT THIS PRIVACY POLICY COVERS

This Privacy Policy governs the processing of personal data when you use our mobile applications, visit heytrendy.app, use Trendy for Business or the creator-facing Brands features, create or manage a brand workspace, participate in creator discovery or campaigns, communicate with other participants or our support team, or when publicly available social media information is processed through our Services.

Our Services Explained: Trendy provides AI-powered social media analytics, trend discovery, content recommendations, and business tools that help brands, agencies, social media managers, and creators discover potential collaborators, prepare campaign briefs, exchange proposals and messages, submit and review deliverables, and analyse campaign-related content. The features available to you depend on your role, plan, and the functionality offered at the time.

Creator Discovery Within the Trendy Network: Creators may be presented to brands or agencies as potential collaboration partners even if they have not submitted an application, joined a campaign, or created a Brands profile. Discovery uses the public profile information described below, including social media usernames and profile links through which brands may approach creators about relevant collaboration opportunities. Trendy does not provide creator email addresses to brands or agencies as collaboration contact details. Sections 4.7 and 6 explain the information, recipients, purposes, legal bases, and choices that apply.

Important Notice for Content Creators: If your publicly available social media information is processed but you do not use our Services as a registered user, please review Section 11: Content Author Rights. Public availability does not remove your rights under data protection law.

3. HOW WE COLLECT PERSONAL DATA

We collect personal data through multiple channels and methods, each serving specific purposes within our service delivery framework.

Direct Data Provision: The primary method of data collection occurs when you voluntarily provide information to us.

This happens when you create an account through our mobile application, authenticate using Apple ID or other supported login methods, connect your social media accounts to enable our analytical services, subscribe to our premium features, purchase a subscription or usage-based features through our website payment flow, contact our customer support team, participate in surveys or feedback collection, or engage with our marketing communications. In each of these interactions, you make a conscious decision to share specific information with us to enable our Services.

Automatic Data Collection: Our systems automatically collect certain technical and usage information when you interact with our Services.

This includes detailed logs of how you navigate through our application, which features you use most frequently, how long you spend in different sections, and patterns of interaction with our recommendations. We also collect technical information about your device, including operating system version, device model, screen resolution, and application version, which helps us optimise performance and compatibility across different platforms.

Third-Party Data Sources: We receive information from various third-party sources to enhance our Services.

When you authenticate through Apple ID, we receive limited authentication data according to your privacy settings with Apple. Our integrated third-party services, including subscription management platforms, analytics providers, technical service partners, and our web payment processor Stripe, share relevant operational data with us under strict contractual arrangements. Most significantly, we collect publicly available information from social media platforms as part of our trend analysis and content recommendation services, processing this information to identify emerging trends, popular content formats, and industry insights that benefit our users.

Social Media Platform Integration: When you choose to connect your social media accounts to our Services, we gain access to information according to the permissions you grant and the terms of service of each platform.

This may include your profile information, posting history, engagement metrics, follower demographics, and content performance data. We process this information to provide you with personalised analytics, trend identification, and content recommendations tailored specifically to your audience and content style.

4. INFORMATION WE COLLECT AND HOW WE USE IT

4.1 Account and Authentication Information

We collect essential information necessary to create and maintain your user account and provide secure access to our Services. When you register through our mobile application, we collect your chosen authentication method details, primarily through Apple ID integration, which provides us with a unique user identifier and optionally your email address and display name, depending on your privacy preferences with Apple.

We process this account information to establish and maintain your user profile, provide secure authentication and access control to our Services, enable communication about service-related matters including technical updates and important notices, manage your subscription status and billing arrangements, and provide personalised customer support when you contact us for assistance.

The legal basis for processing your account information is primarily contract performance under Article 6(1)(b) of the GDPR, as this processing is necessary to provide the Services you have requested.

Where we process this information for service improvement or security monitoring purposes, we rely on our legitimate interests under Article 6(1)(f) of the GDPR.

4.1A Payment and Billing Information

When you purchase, renew, manage, or cancel a paid subscription or usage-based feature through our website, we and our payment service providers process payment and billing information necessary to complete the transaction and administer your account. For web payments, we use Stripe as our payment processor.

Depending on the payment flow you use, the information processed may include your email address, billing details, country, payment method metadata, subscription identifiers, customer identifiers, invoice and transaction information, payment status, renewal status, refund status, and limited card-related details such as card brand and the last four digits of a payment card where made available to us by Stripe. We do not store full payment card numbers or full card verification values on our own systems.

For recurring web subscriptions, Stripe stores the payment method information needed to process authorised renewals and payment retries. We use customer, subscription, invoice, transaction, and payment-status information to administer recurring billing, identify unpaid periods, retry failed payments, reconcile payments, and collect valid outstanding subscription balances in accordance with the billing terms accepted by you. This may include using a successful payment event to initiate collection attempts for other outstanding invoices for the same subscription. We also use this information to provide billing support, process cancellation and refund requests, maintain financial records, detect and prevent fraud, and comply with legal and tax obligations. This Privacy Policy describes data processing; it does not itself create a payment authorisation.

The legal basis for processing payment and billing information is primarily contract performance under Article 6(1)(b) of the GDPR where processing is necessary to provide paid Services you request, legal obligation under Article 6(1)(c) where we must comply with accounting, tax, record-keeping, and regulatory requirements, and legitimate interests under Article 6(1)(f) where processing is necessary for fraud prevention, security, chargeback management, and service administration.

For billing-related questions, cancellation support, or refund requests, you may contact us at contact@heytrendy.app.

4.2 Social Media Analysis and Profile Data

The core functionality of our Services involves comprehensive analysis of social media profiles and content. When you connect your social media accounts or provide profile URLs, we collect extensive information about your social media presence, including detailed posting history, engagement metrics such as likes, comments, shares, and views, follower demographics and activity patterns, content themes and categorisation, hashtag usage and performance, posting frequency and timing patterns, and cross-platform performance comparisons.

We use this information to provide the fundamental services you expect from our platform: generating detailed analytics reports about your social media performance, identifying content types and themes that resonate most with your audience, providing recommendations for optimal posting times based on your follower activity patterns, suggesting relevant hashtags and content ideas aligned with your niche, predicting potential performance of future content based on historical data, and creating personalised content calendars and strategic recommendations.

Legal basis for processing of your social media data is contract performance under Article 6(1)(b) of the GDPR, as these analytical services form the core offering you have subscribed to receive.

Additionally, where we use this information to improve our AI algorithms and service quality, we rely on legitimate interests under Article 6(1)(f) of the GDPR, specifically our interest in providing increasingly sophisticated and valuable analytical services to our users and developing cutting-edge social media intelligence tools.

4.3 Publicly Available Social Media Content

A significant component of our Services involves processing publicly available information from social media platforms to identify trends, emerging content formats, popular audio elements, and industry insights. This processing enables us to provide current and relevant recommendations to our users based on real-time social media trends and patterns.

We collect publicly available posts, captions, and hashtags from various social media platforms, engagement metrics associated with trending content, information about content creators including usernames, follower counts, and general geographic locations, trending audio tracks, visual elements, and content formats, timing patterns of successful content publication, and cross-platform content performance comparisons.

This information is processed to identify emerging trends and viral content patterns across different social media platforms, develop and train our AI recommendation algorithms to provide more accurate and timely suggestions, create comprehensive trend reports and industry insights for our users, enable predictive analytics about content performance potential, and maintain our competitive position as a leading social media analytics platform by ensuring our recommendations reflect current market dynamics.

Our legal basis for processing publicly available social media content is legitimate interests under Article 6(1)(f) of the GDPR. Our legitimate interests include operating our business as a social media analytics platform, providing comprehensive trend analysis services to our customers, developing and improving our AI-powered recommendation systems, maintaining competitive advantage in the rapidly evolving social media analytics market, and enabling our users to create more engaging and successful content by providing them with current trend insights.

Creator Research and Discovery: We also use limited public social profile information to help brands identify relevant creators within the Trendy network, including creators who have not submitted an application or created a Brands profile. This may include identifiable profile previews, handles, links, public posts, topics, and performance indicators rather than only anonymous trend statistics. The purpose is to enable relevant professional collaboration research and enquiries, subject to the legal basis, recipient restrictions, and choices in Section 4.7. Creator email addresses are not provided as contact details for this purpose.

4.4 Technical and Usage Data

Our systems collect comprehensive technical and usage information to ensure optimal performance, security, and user experience across our Services. This includes detailed information about your device such as operating system version, device model, screen resolution, and hardware capabilities, application usage patterns including feature utilisation, session duration, navigation paths, and interaction frequencies, performance data such as loading times, error rates, and crash reports, and security-related information including IP addresses, login timestamps, and access patterns.

We process this technical information to maintain and optimise the performance of our mobile application across different devices and operating systems, identify and resolve technical issues, bugs, and compatibility problems, monitor security threats and protect against unauthorised access or fraudulent activity, understand user behaviour patterns to improve our user interface and experience design, conduct analytics to enhance our Services and develop new features, and ensure compliance with technical and operational requirements.

The legal basis for processing technical and usage data is primarily legitimate interests under Article 6(1)(f) of the GDPR. Our legitimate interests include ensuring the security and performance of our Services, protecting our systems and users from technical threats, improving user experience through data-driven design decisions, and maintaining the technical infrastructure necessary to deliver our Services effectively.

4.5 Third-Party Service Integration Data

We integrate with several essential third-party services to provide comprehensive functionality and maintain high service standards. Each integration involves specific data processing arrangements designed to enhance your experience while maintaining appropriate privacy protections.

Adapty.io Integration: We utilise Adapty.io for subscription management and in-app purchase analytics.

Amplitude Analytics: Our integration with Amplitude enables sophisticated product analytics and user behaviour understanding.

Facebook SDK Integration: We utilise Facebook's software development kit for marketing attribution and advertising analytics.

Our legal basis for processing third-party integration data varies depending on the specific purpose. For subscription management and core service functionality, we rely on contract performance under Article 6(1)(b) of the GDPR. For analytics, marketing attribution, and service improvement purposes, we rely on legitimate interests under Article 6(1)(f) of the GDPR, specifically our interests in understanding product performance, optimising user experience, and measuring marketing effectiveness to sustain and grow our business.

4.6 Communication and Support Data

When you communicate with us through any channel, we collect and process information related to these interactions to provide effective support and maintain records of our communications. This includes support ticket submissions, email communications, in-app feedback submissions, survey responses, and any other forms of direct communication with our team.

We process communication data to provide timely and effective customer support, resolve technical issues and account problems, understand user feedback and feature requests, improve our Services based on user suggestions and reported issues, maintain records of support interactions for quality assurance, and ensure continuity of support across multiple interactions and team members.

The legal basis for processing communication and support data is primarily contract performance under Article 6(1)(b) of the GDPR, as providing customer support is essential to our contractual obligations. Where we use this information for service improvement or quality assurance purposes, we rely on legitimate interests under Article 6(1)(f) of the GDPR.

4.7 Creator Discovery, Contact Information, and Collaboration Data

Discovery Without an Application: Trendy's creator network helps brands, agencies, and creators find potential collaboration partners. A creator may appear in brand onboarding, search results, recommendations, or profile previews even if they have never submitted a brand application, created a Brands profile, or joined a campaign. Being shown does not indicate that the creator has expressed interest in a particular brand, endorsed it, or accepted a collaboration.

For this discovery purpose, we may process and present public names or display names, profile images and biographies, social network names, usernames and handles, profile links, public posts, content topics, languages, broad markets or location information, and public performance indicators. Sources include social profiles you connect or identify in Trendy and information available from public social media sources or our technical data providers. Public discovery is distinct from the voluntary Brands profile: the accounts selected for a Brands profile do not by themselves define every public profile that can appear in discovery.

Social Profiles and Communication: We may make a creator's public social media usernames and profile links available to eligible brands and agencies and their authorised representatives so they can approach the creator about relevant collaboration opportunities through the relevant social network. A creator does not need to have submitted an application, created a Brands profile, or expressed interest in that particular brand to be considered for discovery or approached through a displayed social profile. Trendy does not provide a creator's account email or a separate collaboration email to brands or agencies as creator contact details through discovery, Brands profiles, applications, or collaboration workflows. Where in-platform messaging is available, creators and brands may communicate through Trendy.

Social profile access and in-platform communication are limited to the collaboration purpose; they do not authorise unrelated promotions, data resale, or unrestricted onward sharing. You control any additional contact details you choose to include yourself in a message or other material shared with a participant.

Voluntary Brands Profiles and Collaboration Records: When you create a Brands profile or submit a brand collaboration application, we also process the profile and application information you provide, including selected accounts, content categories, languages, markets, collaboration preferences, and status. For a specific collaboration, we process proposals, messages, submitted materials, review decisions, and campaign-related measurements where those features are available. These records are shared with the relevant participants and authorised workspace members, rather than included in a general directory.

Recipients and Purpose: Discovery and contact information is available to brands and agencies using Trendy's business services and their authorised team members with the relevant role and service access. Eligible recipients may include brands to which you have not applied and with which you have no existing collaboration. We use the information to present relevant potential partners, enable collaboration enquiries and introductions, administer requested profiles or applications, support communication and related workflows, and address misuse. Access to your collaboration profile does not grant access to unrelated private Trendy chats, personal strategy notes, authentication credentials, or private account analytics.

Legal Bases: For limited discovery using public social information, we rely on legitimate interests under Article 6(1)(f) of the GDPR in helping participants identify relevant professional collaboration opportunities within the Trendy network, only where processing is necessary and a balancing assessment supports it. Public availability alone is not a legal basis, and discovery must respect your reasonable expectations, rights, and objections. The fact that recipients use Trendy does not itself establish a lawful basis. We rely on Article 6(1)(b) only for processing objectively necessary to provide profile, application, messaging, or collaboration features you actively request, Article 6(1)(f) for proportionate security, misuse prevention, support, and legal-claim management, and Article 6(1)(c) for applicable legal obligations. Where consent is required for a particular use, we obtain it under Article 6(1)(a). Electronic marketing consent, where required, is a separate responsibility of the sender.

Your Choices: You may object to creator discovery or the display of your social profiles to brands, request restriction or removal of the relevant information, or withdraw any consent on which a particular use is based by contacting agent@heytrendy.app. You do not need to submit an application or close your entire Trendy account to make such a request. Objections to legitimate-interest processing are handled under Article 21 as described in Sections 9 and 11; consent may be withdrawn at any time. An objection to direct marketing stops that processing. Where an objection is upheld, or the relevant consent is withdrawn, we stop new disclosures for the affected purpose. This does not undo disclosures lawfully made beforehand; recipients remain responsible for their own lawful use and retention.

You can also edit a voluntary Brands profile and its selected accounts or use the available exit flow, subject to completion of active collaborations. Active work does not limit your statutory data protection rights; contact us if a product control does not address your request. Leaving Brands hides that voluntary listing but does not itself object to separately processed public discovery or remove every existing application or collaboration record. If you also want to be excluded from public creator discovery, please specify that in your request.

4.8 Brand Workspaces and Team Information

When you create, administer, or join a business workspace, we process account and contact details, brand names and descriptions, websites and official social profiles, campaign briefs and brand assets, team invitation email addresses, memberships and roles, messages, deliverables, and workspace activity relevant to running the service. Business users may provide information about colleagues or representatives; they must have authority to provide it and inform those individuals about the relevant use.

We use this information to create and maintain workspaces, administer invitations and role-based access, support collaboration workflows, provide analysis and AI-assisted drafts, maintain an activity history, and protect workspace security. Workspace owners and authorised team members can access information according to their roles; relevant brand and campaign information is also shared with creators when needed for the collaboration.

Where the individual is a party to our service contract, the legal basis for necessary service processing is Article 6(1)(b). For authorised staff using a workspace under an organisation's contract, we rely on legitimate interests under Article 6(1)(f) in providing and securing the organisation's requested service, unless another applicable legal basis is required. Consent and legal obligations apply to the particular uses for which they are required.

5. COOKIES AND TRACKING TECHNOLOGIES

Our website and mobile application may utilise various cookies and similar tracking technologies to enhance functionality, improve user experience, and provide essential services.

What Are Cookies: Cookies are small text files stored on your device when you visit our website or use our mobile application. These files contain information that helps our systems recognise your device, remember your preferences, and provide personalised experiences. Cookies may be session-based, which are automatically deleted when you close your browser or application, or persistent, which remain on your device for a specified period or until manually deleted.

Types of Cookies We Use: We employ several categories of cookies:

• Strictly necessary cookies are essential for the basic operation of our website and cannot be disabled without significantly impacting functionality.
• Performance and analytics cookies help us understand how users interact with our Services, which features are most valuable, and where improvements can be made.
• Functional cookies remember your preferences and settings to provide a more personalised experience.
• Marketing and advertising cookies, where implemented, help us deliver relevant promotional content and measure the effectiveness of our marketing campaigns.

Cookie Management and Your Choices: You have significant control over how cookies are used on your device. Most web browsers allow you to manage cookie settings through their privacy preferences, where you can choose to block certain types of cookies, delete existing cookies, or receive notifications when new cookies are being set. However, please note that disabling certain cookies may limit the functionality of our Services or prevent access to some features.

For our mobile application, cookie-like technologies are managed through your device's privacy settings and our in-app privacy controls. You can adjust these settings to limit data collection while maintaining access to core functionality.

Our website includes a cookie consent banner and related settings tools that allow you to make choices about non-essential cookies where required by law. These tools provide information about cookie categories and allow you to update your preferences according to your choices and browser settings.

Legal Basis for Cookie Processing: Our legal basis for using cookies varies depending on their purpose and function.

Strictly necessary cookies are processed based on legitimate interests under Article 6(1)(f) of the GDPR, as they are essential for providing the Services you have requested.

All other cookies require your consent under Article 6(1)(a) of the GDPR, which we obtain through our cookie consent mechanisms, banner, and related preference tools where required.

6. HOW WE SHARE YOUR INFORMATION

Trendy connects creators, brands, and agencies within a common professional network. We do not sell creator contact lists or provide personal information to brands, data brokers, or other companies for unrelated commercial exploitation. Information made available through creator discovery and collaboration features may be used only for the limited purposes described in this Privacy Policy and our Terms of Use, subject to the applicable legal basis, permissions, and access restrictions.

Service Providers and Technical Partners: We engage carefully selected service providers and technical partners who assist us in delivering various aspects of our Services. These relationships are governed by strict contractual arrangements that require these partners to maintain the same level of data protection that we provide and to use your information only for the specific purposes we have authorised.

Our cloud infrastructure is provided by Amazon Web Services, which hosts our application data, user information, and analytical systems in secure, enterprise-grade data centres.

For subscription management and payment processing, we work with Adapty.io and Stripe. Stripe processes web billing transactions, customer and subscription identifiers, payment method metadata, invoices, failed payment and retry information, outstanding balances, refunds, disputes, and related financial reporting. Adapty.io may support subscription management and in-app purchase analytics where applicable. Depending on the processing activity, Stripe acts as our processor or as an independent controller, including for certain legal compliance, fraud prevention, and financial-service purposes. Where Stripe acts as an independent controller, its processing is governed by Stripe's Privacy Policy.

Our analytics and product improvement efforts are supported by Amplitude and other analytics providers who help us understand user behaviour and optimise our Services.

Marketing and advertising attribution services are provided through our integration with Facebook and other advertising platforms. Data shared with these partners is limited to anonymous usage events and attribution information necessary for marketing analytics.

Brands, Agencies, and Collaboration Participants: We share the creator profile, social media usernames and links, application, and collaboration information described in Section 4.7 with the eligible recipients described there. We also share brand, brief, and campaign information with the relevant creators, and workspace information with authorised team members as described in Section 4.8. A creator's lack of an application does not prevent discovery or collaboration enquiries through a displayed social profile where the requirements in Section 4.7 are met. Creator email addresses are not provided to brands or agencies as collaboration contact details; participants control any additional information they choose to share themselves in messages or other collaboration materials.

Brands and agencies are generally independent controllers when they decide how to use received creator details for their own outreach, selection, and collaboration activities. They are responsible for providing their own required privacy information, using a lawful basis, maintaining security, observing retention limits, and responding to rights requests. Our Terms restrict the use of received details to relevant collaboration purposes and require compliance with applicable electronic marketing rules; contact access is not consent to newsletters or unrelated promotional messages. Contact a recipient directly to exercise rights relating to its own records, or contact us for assistance identifying the relevant recipient.

Social Media Platform Integration: When you connect your social media accounts to our Services, we may share limited information with these platforms as necessary to maintain integration functionality and provide the analytical services you expect. This sharing is strictly limited to information required for technical integration and is governed by the terms of service and privacy policies of each social media platform.

We do not share your personal analytical insights, content recommendations, or strategic advice with social media platforms beyond what is necessary for technical functionality. The detailed analysis and recommendations we provide remain confidential to your account.

Legal Requirements and Protection of Rights: We may disclose your information when required by applicable law, court orders, governmental requests, or regulatory investigations. In such circumstances, we will disclose only the minimum amount of information necessary to comply with the legal requirement and will notify you of such disclosure when legally permitted to do so.

We may also share information when we believe in good faith that disclosure is necessary to protect our rights, property, or safety, or that of our users or the general public. This includes situations involving fraud prevention, security threat response, or protection against legal liability.

Business Transfers and Corporate Transactions: In the event of a merger, acquisition, sale of assets, or other corporate transaction affecting our company, your information may be transferred to the acquiring entity as part of the business assets. In such circumstances, we will ensure that the acquiring entity agrees to maintain the same level of privacy protection outlined in this Privacy Policy and will provide advance notice of any such transfer where required by law.

Aggregated and Anonymous Information: We may share aggregated, anonymised, or statistical information that cannot be used to identify individual users. This might include industry trend reports, general usage statistics, or research insights that benefit the broader social media and content creation community. Such sharing supports industry knowledge development while maintaining complete privacy protection for individual users.

7. INTERNATIONAL DATA TRANSFERS

We are committed to ensuring that all international data transfers maintain the high level of data protection required by European data protection laws and provide appropriate safeguards for your personal information.

Our Operational Framework: Our primary operations are based in Estonia, which is a EU member and therefore provides the full protections of the GDPR. However, some of our essential service providers and technical partners operate from locations outside the EEA, necessitating international data transfers to enable comprehensive service delivery.

Transfer Safeguards and Mechanisms: When we transfer your personal data outside the EEA, we implement appropriate safeguards to ensure your information receives adequate protection. These safeguards include European Commission adequacy decisions for countries that have been determined to provide essentially equivalent data protection to the EEA, Standard Contractual Clauses approved by the European Commission for transfers to countries without adequacy decisions, and additional technical and organisational measures where necessary to ensure appropriate protection levels.

For transfers to the United States, we rely on various mechanisms depending on the specific service provider. Where available, we utilise the EU-US Data Privacy Framework for companies that have certified their participation in this programme. For other US-based service providers, we implement Standard Contractual Clauses along with additional safeguards such as encryption, access controls, and regular security assessments.

Business Recipients: Brands, agencies, and their authorised team members may be located in countries outside the EEA. Where making information available to a business recipient constitutes a restricted international transfer by Trendy, the applicable transfer requirements and safeguards must be satisfied before that disclosure. Participation in Brands or acceptance of our Terms is not a general waiver of those requirements. A brand's subsequent processing and transfers are also subject to its own applicable legal obligations.

Your Rights Regarding International Transfers: You have the right to obtain information about the specific safeguards we have implemented for international transfers of your personal data. You may also object to transfers to specific countries if you have concerns about the level of protection provided. If you have questions about our international transfer practices or would like more detailed information about the safeguards we have implemented, please contact us using the details provided in this Privacy Policy.

8. DATA RETENTION

We retain information about you only for as long as necessary to provide and manage our Services, to manage our business, and for financial and legal purposes and up to three (3) years after termination of Services provision, unless a longer retention period is required or permitted by law.

Records of your communications with our support team, including email exchanges, support tickets, and feedback submissions, are retained for up to three (3) years to enable effective ongoing support and maintain institutional knowledge about resolved issues.

B2B Profiles and Collaboration Records: We maintain Brands profiles while they are active and workspace or collaboration information for as long as needed to provide the relevant service. Following a departure, closure, or removal request, we limit continued retention to the applicable purposes described in this section, normally within the general period of up to three (3) years after service termination unless a different period is required by law or necessary for specific legal claims. Retention of necessary collaboration history or evidence of privacy choices does not authorise continued discovery disclosure after a successful objection, or new disclosures for a purpose for which consent is withdrawn.

The 90-day period below concerns raw public data collected for trend analysis. It does not require deletion of an active Brands profile or a necessary collaboration record after 90 days. Public profile data used for ongoing discovery is reviewed or refreshed for that service and remains subject to necessity, objection, and erasure requirements. Brands may retain their own records under their privacy notices and applicable law; leaving Trendy does not automatically delete those independently held records.

Payment, billing, subscription, invoice, refund, dispute, and related transaction records, including records of failed payments, collection attempts, outstanding balances, and cancellation requests, may be retained beyond Account deletion or subscription cancellation where necessary to comply with accounting, tax, audit, fraud prevention, payment network, and legal obligations, administer valid outstanding balances, or establish, exercise, or defend legal claims. Retention is limited to the data and period necessary for the applicable purpose; an outstanding balance does not justify indefinite retention of unrelated Account data. Stripe may also retain records in accordance with its own legal and regulatory obligations and privacy practices.

For publicly available social media content that we analyse for trend identification purposes, we retain raw data for 90 days before processing it into anonymised trend reports. This short retention period ensures our trend analysis remains current whilst minimising privacy impact on content creators whose public information we process.

After it is no longer necessary for us to retain information about you, or otherwise upon your request, we will dispose of your information in a secure manner or anonymise the information. Our secure deletion procedures include overwriting storage media, destroying backup copies, and verifying complete removal from all systems and databases.

Aggregated data is retained and used by Trendy for analysis, algorithm improvement, and service enhancement purposes. This anonymised data cannot be used to identify individual users and helps us improve our AI recommendation systems and trend identification capabilities for all users.

In some cases, your social media content may continue to exist on the original social media platforms even after you delete your account or we remove it from our Services. You will need to contact the relevant social media platform directly if you would like to remove this content. Additionally, if you have connected your social media accounts to our Services, you may revoke our access at any time through your social media platform settings or by contacting our support team.

Certain information may be retained for longer periods where required by applicable law, regulatory obligations, or legitimate legal interests such as defending against legal claims. In such cases, the information is securely stored with restricted access and used only for the specific purpose requiring retention.

8A. SUBSCRIPTION MANAGEMENT INFORMATION

For web subscriptions, we use billing and subscription information to administer automatic renewals, cancellations, access restrictions for non-payment, refund requests, and outstanding invoices. A failed payment does not itself cancel a subscription. Where the subscription remains in force, invoices may continue for subsequent billing periods, and authorised recovery of outstanding balances may result in several separate charges for unpaid periods.

Section 4 of our Terms of Use sets out the contractual rules for recurring charges, continuing invoices during non-payment, cancellation, and collection of outstanding amounts. It also describes our full, no-questions-asked refund guarantee for the first web subscription payment when requested within seven (7) calendar days after that payment, its scope and exclusions, and the mandatory consumer rights that remain unaffected.

For web cancellation support or a refund request, contact contact@heytrendy.app. Purchases billed by Apple or Google are managed through the applicable platform. Requests to a bank or card provider concerning disputed or unauthorised charges are separate from our refund request process; your applicable rights remain unaffected.

9. YOUR PRIVACY RIGHTS

Depending on the data protection laws that apply to you, you may have the right to:

• Access and obtain a copy of your information
• Request rectification of inaccurate information
• Request erasure of your information
• Request that we transfer your information to a third party in machine-readable format
• Object to our processing of your information, withdraw your consent, or ask us to restrict the processing of your information
• Opt out of certain disclosures of your information to third parties, including for targeted advertising purposes

Right of Access: You have the right to obtain confirmation of whether we process your personal data and, where we do, to access that personal data along with specific information about our processing activities.

We may charge a reasonable fee for additional copies of your information beyond the first copy, but the initial access request is provided free of charge.

Right of Rectification: You have the right to have inaccurate personal data corrected and incomplete personal data completed.

You can exercise this right by updating information directly through your account settings for most types of data, or by contacting us for assistance with corrections that cannot be made through self-service options. We will implement corrections promptly and notify any third parties with whom we have shared the incorrect information where practically possible.

Right of Erasure: Under certain circumstances, you have the right to have your personal data deleted from our systems. These circumstances include situations where the personal data is no longer necessary for the purposes for which it was collected, where you withdraw consent and there is no other legal basis for processing, where you successfully object to processing based on legitimate interests, where the personal data has been unlawfully processed, or where deletion is required for compliance with legal obligations.

However, this right is not absolute and may be limited where we need to retain information for compliance with legal obligations, for the establishment, exercise, or defence of legal claims, for reasons of public interest, or where continued processing serves compelling legitimate interests that override your rights.

Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another service provider without hindrance from us.

Right to Object: You have the right to object to processing of your personal data based on legitimate interests, including processing for direct marketing purposes. When you object to processing based on legitimate interests, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless continued processing is necessary for legal claims.

Right to Restrict Processing: In certain circumstances, you have the right to limit how we process your personal data while maintaining the data in our systems.

When processing is restricted, we will only process the data with your consent, for legal claims, for protecting the rights of others, or for important public interest reasons.

Right to Withdraw Consent: Where our processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, but it will stop further processing for that purpose.

You can withdraw consent through the relevant preference control where available or by contacting agent@heytrendy.app. To stop new Brands profile disclosures or object to creator discovery processing, specify the profile, social accounts, and processing you want restricted. These requests are separate from any ongoing campaign obligations. Where rectification, erasure, or restriction must be communicated to recipients under Article 19 of the GDPR, we do so unless this is impossible or involves disproportionate effort; you may ask us to identify those recipients.

How to Exercise Your Rights: For requests that cannot be fulfilled through self-service options, you can contact us directly via email indicated in Article 1 of this Privacy Policy or through our in-app support system. When submitting a request, you need to provide sufficient information to enable us to verify your identity and understand the specific nature of your request.

We will normally respond to your rights requests within 30 days of receipt, or inform you if additional time is needed for complex requests.

If you are not satisfied with our response to your rights request, you have the right to lodge a complaint with your local supervisory authority. You can also contact us to discuss your concerns and seek resolution before involving regulatory authorities.

10. DATA SECURITY

Trendy maintains industry standard security safeguards to protect your information. This includes ensuring our team members receive comprehensive security and privacy training so they understand the measures they need to implement to protect your information. Access controls are in place to limit access to your information to those who need it to perform their jobs. For example, information about you may be provided to our customer support representatives to help you with your requests, or to our data analysts to improve our AI recommendation algorithms. Individuals who are authorised to handle your information must adhere to strict confidentiality obligations. We encrypt data in transit and at rest to ensure that your information is kept private. Our mobile application uses industry-standard encryption protocols for all communications between your device and our servers. All data stored in our cloud infrastructure hosted by Amazon Web Services is encrypted using advanced encryption standards, with encryption keys managed through secure key management systems. We undertake comprehensive security and privacy reviews of our service providers to ensure that they follow our stringent requirements to safeguard your information, and we enter into robust data protection agreements with all our service providers. More detailed information about our security practices and infrastructure can be provided upon request by contacting our support team. We are committed to maintaining transparency about our security measures whilst protecting the integrity of our security systems.

11. CONTENT AUTHOR RIGHTS

If you are a content creator who publishes material on social media platforms but does not directly use our Services as a registered user, this section explains how we may process your publicly available information and your rights regarding such processing.

Creator Discovery as Well as Trend Analysis: The Services may present limited publicly available profile information to eligible brands and agencies for collaboration discovery even where you have not registered, joined Brands, or applied for a campaign. This may include a public name or handle, image, profile link, public posts, topics, and public performance indicators. Sources include publicly accessible social media platforms and technical data providers. It does not indicate your willingness to collaborate or grant permission to use your content. Brands may approach you through a displayed social media profile. We do not provide creator email addresses as collaboration contact details through this public-data process.

For this discovery purpose, our legitimate interest is enabling relevant professional collaboration research within the Trendy network, subject to necessity, a documented balancing assessment, and your rights. We must consider your reasonable expectations and possible privacy impact; public availability alone does not justify any use. Before a new use of existing personal data, and where data is obtained indirectly, we provide the information required by Articles 13 and 14 of the GDPR within the applicable time limits, including before disclosure where Article 14 requires it. This notice does not by itself replace an individual notification where one is required.

Understanding Our Processing of Public Content: We analyse publicly available social media content to identify trends, emerging topics, popular content formats, and industry insights that benefit our users. The information we process includes public posts, captions, hashtags, engagement metrics, public profile information, content format and timing data, and trending elements that appear in your public posts. Our processing is strictly limited to information that is already publicly available and accessible to any internet user.

Purposes of Processing: We process publicly available content creator information to identify emerging trends and viral content patterns, develop and train our AI algorithms and recommendation systems, create industry trend reports and performance benchmarks, and maintain our competitive position as a social media analytics platform by ensuring our recommendations reflect current market conditions.

Legal Basis: We rely on legitimate interests under Article 6(1)(f) for the public-data purposes described here only where the processing is necessary and our interests are not overridden by your rights and freedoms. Relevant interests include providing social media analysis, trend insights, and limited professional creator discovery. Analytical processing and disclosure of identifiable creator profiles are separate purposes and require their own assessment. We do not treat a public profile as general consent to marketing or to disclosure of non-public contact details.

Your Rights as a Content Creator: You have the right to be informed about our processing activities, access information we hold about you, request correction of inaccurate information, and most importantly, object to our processing of your publicly available information through our opt-out mechanism.

Objection and Removal Requests: Contact agent@heytrendy.app with your social media usernames and platforms and specify whether your request concerns creator discovery, trend analysis, contact disclosure, or more than one purpose. You do not need to create an account or submit an application to exercise your rights. We aim to review exclusion requests promptly, normally within 48 hours, and respond within the applicable statutory deadline. For processing based on legitimate interests, we assess your objection under Article 21 and cease that processing unless the law permits continuation on compelling grounds or for legal claims. Where the processing is for direct marketing, we stop that processing on objection. Necessary restriction and recipient notifications are handled as required by law.

Genuinely anonymised statistical insights may remain where they can no longer identify you. Removal from our systems does not itself remove material from its original social platform or erase a recipient's independently held lawful records.

Data Minimisation and Retention: We limit collection to information needed for the relevant analytical or discovery purpose and avoid unrelated private or sensitive information. The 90-day period for raw trend-analysis data and the retention criteria for current discovery profiles and collaboration records are described in Section 8. Identifiable discovery information is kept only while necessary for that service and subject to correction, objection, restriction, and erasure rights. Public availability does not justify indefinite retention.

12. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

Our Services extensively utilise artificial intelligence, machine learning, and automated processing systems to provide social media analytics, content recommendations, and trend identification capabilities.

AI-Powered Features: Our AI systems analyse your historical social media performance, current market trends, and audience behaviour patterns to provide personalised recommendations for content creation, posting timing, hashtag selection, and engagement optimisation. Our content recommendation engine suggests topics, formats, and creative approaches likely to resonate with your audience. Performance prediction capabilities estimate how your content might perform before publication, whilst trend identification systems continuously monitor social media platforms to identify emerging topics and viral content patterns.

Machine Learning and Algorithm Development: Our machine learning systems are trained using anonymised user behaviour patterns, aggregated social media performance metrics, publicly available trend data, and historical content performance information. We continuously refine our algorithms based on performance feedback and evolving social media dynamics. Our development process incorporates privacy-by-design principles, using anonymised datasets and maintaining strict access controls over training data.

Automated Decision-Making: We do not make automated decisions that significantly affect you without human oversight and your control. All AI-generated recommendations are presented as suggestions to inform your decision-making rather than automatic actions. You maintain complete control over which recommendations to implement and when to override automated suggestions. We maintain human oversight through regular algorithm audits, performance monitoring, and user feedback analysis.

AI Training and Data Usage: We may use aggregated, anonymised data from our Services to train and improve our AI models. Training data cannot be used to identify specific users and is processed using robust anonymisation procedures. You can opt out of having your anonymised data included in AI training through your account privacy settings.

B2B Discovery and Drafting: AI and automated analysis may use profile topics, languages, markets, selected accounts, public performance indicators, and brand or campaign context to organise discovery, suggest potential collaborators or relevant campaigns, and prepare editable descriptions or briefs. This may constitute profiling under the GDPR. Suggestions do not establish that an individual has agreed to a collaboration, accepted campaign terms, or granted content rights. Brands and creators review and decide whether to pursue an opportunity, accept a proposal, and approve submitted work.

AI System Limitations: AI-generated recommendations are based on historical patterns and statistical analysis, which may not account for unprecedented events or unique circumstances. Recommendations should be considered as informed suggestions rather than guaranteed outcomes. We encourage users to combine AI insights with their own expertise and creative intuition.

13. CHILDREN'S PRIVACY

Our Services are specifically designed for professional use by adults and are not intended for individuals under 18 years of age.

We do not knowingly collect personal information from individuals under 18. By registration users confirm they are at least 18 years old and using our Services for business or professional purposes. If we become aware that we have collected information from someone under 18, we immediately delete such information and suspend the associated account.

Parental Rights: If you believe your child has provided information to our Services, contact us immediately by email indicated on the Article 1 of the Privacy Policy. Parents have the right to request information about data we may hold, request immediate deletion, and object to processing. We respond to such requests within 48 hours.

Content Creator Protections: For publicly available content that may be created by minors, we maintain enhanced monitoring and implement automatic exclusion procedures for content appearing to be created by individuals under 18. If we identify such content in our systems, we immediately exclude it and remove any derived analytical insights.

14. CHANGES TO THIS PRIVACY POLICY

We may periodically update this Privacy Policy to reflect changes in our Services, privacy practices, or applicable laws.

Types of Changes: For minor changes such as clarifications or contact updates, we update the policy and note the revision date. For material changes affecting how we collect, use, share, or protect your information, we provide comprehensive notification through multiple channels including in-app notices, email notifications, and website announcements, typically with at least 30 days advance notice.

User Choice and Implementation: During notice periods, you can review updated policies, contact us with questions, adjust your privacy settings, or discontinue use if you disagree with changes. For changes requiring new consent, we implement explicit consent mechanisms before accessing affected features.

Existing Users and New Uses: Publication of this Privacy Policy or continued use of Trendy does not itself supply consent where the law requires it or retroactively authorise a new purpose. Before materially expanding creator contact disclosure or other personal-data use, we provide the relevant notice and obtain any required choice or consent. You may request restriction or deletion subject to applicable law. We maintain previous versions for transparency and accountability.