Privacy Policy

Last updated: 15 October 2026

Who we are

Earn (the Earn app and earnbycontent.com) is operated by Brave New, Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, USA, Delaware file number 7689642 (“we”, “us”), the controller of your personal data. Questions about your data: hello@earnbycontent.com.

Our representative in the EU (Article 27 GDPR) is Z Gen Kibernetika Korlátolt Felelősségű Társaság (Z Gen Kibernetika Kft.), 1011 Budapest, Fő utca 10. 1. lház. 2. em. 1. ajtó, Hungary, company registration number 01-09-470675. You and any data protection authority in the EU can contact it about our handling of your data at that address or at hello@earnbycontent.com.

Earn is only for people aged 18 or over. If we learn that an account belongs to someone younger, we close it and delete its data.

What we collect

• Your email address, name, date of birth, phone number, postal address, country, tax identifier, the public social-media accounts you add and the profile picture of your TikTok account.
• The photos you add to your profile (up to 3, one of them as your profile picture) and your references: up to 5 earlier videos, as a link or a video you upload.
• Your application and the answers you give when you sign up (your goal, how often you post, your topics, how you want to work and where you heard about Earn), follower range, chosen job types, signed agreement (including the signature you draw, if you sign with your finger), project membership and work status.
• The view counts and results of the videos you make for campaigns, and the level, badges and score the app works out from them.
• If you use Sign in with Apple: the identifier Apple gives us, the email address Apple shares (which may be a private relay address), your name if you choose to share it, and a token that lets us end the Apple sign-in when you delete your account.
• If you connect your TikTok account in the app (TikTok Login Kit): TikTok asks you to let Earn read your profile, and we read it once: your TikTok user identifier, username, display name, profile picture, whether the account is verified, and its follower, like and video counts. We do not keep TikTok's access token: we revoke it as soon as the profile is read.
• Your payout method and the payment details needed to pay you, the invoice details you give us (individual or business, company name, VAT number and billing address), and the invoices we issue on your behalf for our payments to you.
• If we pay you through Stripe: the identifier of the Stripe account you open, what Stripe tells us about it (whether it can receive our transfers and pay out to your bank, its country and payout currency, whether Stripe needs more information from you, and why a bank sent a payout back) and the transfers we send to it. Stripe asks for your identity, bank account and tax details on its own pages; we do not receive your bank account number or identity documents.
• Messages, uploaded videos, images, PDFs, submitted post links and support requests.
• Your notification destination, language, app version and technical details such as network address, device or browser type and referral or campaign tags.
• Whose invite code you joined with. If you open someone's invite link: that code and a hashed form of your network address, kept for 7 days. If you open an offer link we sent you or a campaign's page on our website: that offer or campaign and a hashed form of your network address, also kept for 7 days.
• Reports you make, conversations you block, and which version of the terms you accepted and when.
• If we ask you to verify your identity before your first payout: the outcome of that check and a reference to it.

We do not collect the password of your own TikTok account, and we never ask for it. We do store, encrypted, the logins of the campaign accounts we own.

Why we collect it

• To check that the TikTok page you gave us is real and active and, if you connect it, that it is yours.
• To show the brands whose campaigns you apply to, are invited to or join who you are and what you have made, so they can choose creators for the campaign.
• When a job uses a campaign account, to give you its login on our website and to see that it is set up.
• To show suitable jobs, manage your work, communicate with you, make payments and issue the invoices for them on your behalf.
• To pay fairly: we check the view counts of posts and look for fake engagement before we pay fees and bonuses.
• To confirm once, before the first payout, that we pay the person who signed the agreement.
• To email you and, if you enable them, send push notifications about your account and suitable jobs.
• To keep the sign-up form free of spam (rate limits by network address).
• To credit invites: if you open an invite link and then sign up in the app from the same network within two days, the app fills in that invite code, and you can remove it. We record who invited whom, and the team sees how many people joined with your code.
• To know which campaign you applied for: if you open a campaign's page and then apply in the app from the same network within two days, your application notes that campaign, so the team can see what you came for.
• To find the offer we sent you: if you open an offer link and then open the app from the same network within two days, the app shows that offer, and you decide whether to accept it.
• To keep the community safe: messages are checked automatically for abusive language, and the team reviews every report and block.
• To keep collaborations and payments on Earn: in a conversation with a brand, messages from both sides are checked by fixed rules for contact details, outside links and payment details, and such a message is not sent. We keep no record of a creator's refused message.

Legal bases. To take you on and to run your work and payments: our contract with you and the steps before it. To keep invoices and payment records and to report payments to tax authorities: our legal obligations. To prevent fraud and abuse, look up the public profile you give us, review applications and videos, count how the service is used, credit invites, find the offer or campaign that brought you and show the leaderboard: our legitimate interests, which you can object to. For push notifications and the biometric part of the identity check: your consent, which you can withdraw at any time.

When you add your TikTok or Instagram handle while signing up, and when an authorised team member reviews an application, we send only that public handle to Monid and its underlying data provider, Apify. They return public profile details such as the profile name, bio, avatar, follower and post counts, engagement signals, and up to six public post previews. The app shows you the name, picture and follower count it found, so you can check it is your account. We do not send them your email address, internal notes or private account data.

To keep brands from taking a collaboration off Earn, what a brand writes to you and the briefs it writes are also read by Clef, an AI model Cloudflare runs on the infrastructure that hosts the service (Workers AI). A brand's message that looks like an attempt to move the work or its payment off Earn waits for a team member, who delivers it or keeps it back. Your own messages are never read by an AI model.

Applications and submitted videos are reviewed by our team. A person reads every application and makes every decision; nothing is accepted or rejected automatically. To help the team sort applications, each one is also read by Claude, an AI model made by Anthropic, PBC, which we reach through Cloudflare's AI Gateway. It gets your sign-up answers (country, language, topics, weekly pace, how you want to work and your intro), the public numbers of the social accounts you gave us, the public profile picture of your main account, and up to six public post previews with their captions. It never gets your name or email address, and it is told not to judge your looks or guess your age, gender or background. Against criteria the team sets, such as how well made the content is and how far it reaches, it tags the application Interesting or Not interesting for brands on Earn, with a few short reasons; the tag only orders the team's list. If your application is turned down, you can ask the team in the app to take a second look. A submitted video is checked automatically by fixed rules (its length and format, the brief's checklist and the ad tag in the caption), without an AI model.

We pay creators through Stripe Connect. When you set up your payouts, we open a Stripe Express account for you with your email address and country, and Stripe's own pages ask for the rest: who you are, your bank account and, where the law requires it, your tax details. Stripe checks your identity, which can include a photo of an identity document and a selfie, under its own terms (the Stripe Connected Account Agreement) and its privacy policy, and it decides how it uses the data of your Stripe account. We see only what we need to pay you, as listed above.

The law requires us to report what we pay creators to tax authorities. For creators in the United States, we file Form 1099 with the US Internal Revenue Service and the states that require it, and Stripe asks you for your taxpayer identification number when you set up your payouts. For creators in the European Union, we report under the EU platform reporting rules (DAC7) to the tax authority of the EU country where we are registered for them, which passes the report on to the tax authority of your country; the United Kingdom has similar rules. These reports contain your name, address, date of birth, tax identification number (and VAT number, if you have one), the country that issued it, the bank account we pay you to where we know it, and what we paid you and for how many jobs in each quarter. You receive a copy of what we report about you.

Before your first payout we may ask you to verify your identity once. The check opens in your browser and is run by Sum and Substance Ltd (Sumsub): you photograph an identity document and take a selfie, which Sumsub compares with the photo on the document. The comparison uses biometric data, so it only runs with your explicit consent, which you give at the start of the check. Sumsub keeps the document and the images; we receive and keep only the outcome and a reference to the check.

App storage and tracking

The native app stores its sign-in session securely on your device. The website sets only sign-in and security cookies, and, after you open an invite link, a cookie that holds the invite code for 30 days so the sign-up form can credit it. We do not use third-party advertising SDKs or sell personal data. Fonts are served from our own domain.

We count how the service is used with PostHog, hosted in the EU. Public landing visits carry a hash of your network address and browser that changes every day. Signed-in creator web activity carries a coded account ID; we send fixed page names and completed actions, not full URLs, form contents, messages or payment details. These counts are never used for advertising.

The Earn mobile app also sends PostHog usage events: the screens you open, the steps of signing up and of a job (for example that a job was reserved or a video submitted), the notifications you open, and app errors. They carry a random ID made on your phone and, once you sign in, the same coded account ID as the web app, never your name or email address. Under the same coded ID our server also counts what happens to your application, videos and payouts (for example that you were selected, a video was approved or a payout was sent), with no messages or feedback text. We use them only to see where the app is hard to use and to fix errors. You can turn off mobile usage events, including the ones our server sends about your account, in the app under Settings → Share usage data.

In the brand portal, our server counts the same way for each company: the fixed names of the pages its people open and the steps it takes, such as signing up, signing the agreement, sending a campaign, picking a creator, deciding on a video and buying credit (with the amount), and our team's decisions on its campaigns. These events carry one coded ID for the company, the same whoever on its team acts, and never a person's name or email address, the company's name, messages or what is typed into a form.

Who else sees it

When you join a brand's campaign, that brand sees your name (or, if you have not given one, your social handle), your social handle, the status of your work for that campaign and the messages in that campaign's conversation. When you apply to a brand's job, that brand also sees your country, level, follower range and the note you write. It can also open your profile: the photos you added (your profile picture first), your references (links, and videos you uploaded, which it can play) and the TikTok and Instagram accounts you connected, with their public follower, like and video counts. A brand sees the videos you submit for its jobs and what you write with them. A brand with a live campaign that is open to you (by its countries, follower ranges, type of work and level) can also find you among the creators it may invite to that campaign: it sees your name, social handle, country, level, follower range and ratings, and can open the same profile. Its invitation is the campaign itself, which you can accept or decline. A brand that approved one of your videos can rate working with you, from one to five stars with an optional short comment; other brands see the ratings and comments, never which brand gave them, and the ratings affect the order in which brands see applicants and creators to invite. Brands do not see your email address, phone number, postal address, date of birth, tax identifier or payout details. Brands agree to use this information only to run the campaign, to keep it confidential and to protect it at least as well as this policy requires. The service providers named below process data only to run the service for us, under the same obligations.

When we pay you through Stripe, Stripe receives the amount and your Stripe account pays it out to your bank. When we pay you another way, your payout details go to the payment service you chose (your bank, PayPal, Wise or Revolut) and to our bank.

Brands pay us through Stripe: Stripe processes the card or bank payment and the company's billing details (company name, contact email, address and VAT number), and we receive the payment's status and its invoice. We never see a full card number.

Other creators: once the app's leaderboard is open, other creators on Earn see your first name, TikTok handle, TikTok profile picture and how much you earned in the period shown. Nobody outside the app sees it. You can take yourself off other creators' leaderboards at any time with the "Hide me from other creators" switch at the bottom of the Leaderboard, which opens from the top left of your profile in the app; you still see your own place.

Where it is stored

Account data, messages, uploads and cached public profile summaries are stored with Cloudflare, Inc., which hosts the service and runs the AI check of brands' messages and briefs described above. Anthropic, PBC processes the application details described above when its model reads an application for the team. Expo processes notification destinations and notification delivery for the mobile app. Apple processes Sign in with Apple. PostHog processes the usage counts. Monid and Apify process a public social handle when you add it while signing up or when an authorised team member requests a profile review. TikTok processes the sign-in when you connect your TikTok account. Stripe, Inc. and its affiliates process the payments brands make and the payouts to creators paid through Stripe. Sumsub processes the identity documents and selfies of the identity check. Rate-limit counters are deleted automatically within about a day.

We are a company in the United States, so your data is processed there, and some of these providers also process data outside the EEA. Where a provider does, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, where the provider is certified) or on the Commission's Standard Contractual Clauses.

How long we keep it

We keep active account data while we provide the service. Applications that did not lead to an active account are deleted one year after they were sent. Invoices, payment records and the tax reports above are kept as long as the accounting and tax laws that apply to us require (generally 8 years; DAC7 records up to 10 years). When you delete your account, access ends at once, and within a week we delete your personal data: your profile and contact details, payout and invoice details, social accounts, messages, uploaded files and everything the app worked out about you. We keep only what the law requires or others rely on: payment and invoice records, the signed agreement and the terms you accepted, the videos you delivered to a brand, and reports needed to keep the community safe.

Your rights

You can ask for a copy of your data (also in a portable format), correct it, ask us to restrict its use, object to what we do on the basis of our legitimate interests, withdraw a consent, or initiate permanent account deletion inside the Earn app under Settings → Delete account. You can also email hello@earnbycontent.com from the address you signed up with. If you are in the EU/EEA you also have the right to complain to your local data protection authority (in Hungary: NAIH).

Changes

If this policy changes in a way that matters, we will email you before it takes effect.