Privacy Policy

We collect only what we need to run the marketplace. That falls into five buckets:

• Account data. Name, email address, password hash, company or brand name, and the Reddit usernames you connect or submit.
• Billing data. Plan, campaign balance, invoices, and the last four digits and brand of your card. Full card numbers are handled by Stripe and never touch our servers.
• Marketplace content. Campaign briefs, drafts, submitted links, proof screenshots, messages, support tickets, and payout details you provide as a creator.
• Usage and device data. IP address, browser and device type, pages viewed, feature usage, timestamps, and error logs.
• Public Reddit and search data. Publicly available thread, subreddit, and keyword data we fetch to power Discover, rank tracking, and Brand Brain.

We do not knowingly collect special category data (health, biometric, political, or similar). Please keep it out of campaign briefs, proofs, and support tickets.

Information can come directly from you, from activity within the service, from payment or integration providers, and from publicly available sources. Brand profiles may contain a website, audience, competitors and uploaded knowledge documents. Strategy enquiries can contain a name, email, business details, Telegram destination and growth goals. Supply only what is needed for the request and avoid including another person's private information without an appropriate reason.

• Operate the marketplace: create campaigns, match creators, verify proofs, settle campaign balance.
• Process payments, subscriptions, Campaign balance purchases, referral commissions, and payouts.
• Send account, task, submission, and billing notifications you have opted into.
• Detect fraud, bot activity, duplicate accounts, banned accounts, and payment abuse.
• Power AI features such as Scout and Brand Brain on the content you supply.
• Measure and improve product performance, and produce aggregate, non-identifying stats.
• Meet tax, accounting, and other legal obligations.

For example, a Campaign brief is used to explain the work to Creators, a submitted screenshot helps review delivery, and billing records support reconciliation and dispute handling. Keyword and competitor information helps tailor searches rather than defining a guaranteed marketing result. We use referral and first-touch campaign information to understand where sign-ups originate. Public statistics are aggregated rather than a directory of individual customer payments.

• Contract: running your account, campaigns, payments, and payouts.
• Legitimate interests: security, fraud prevention, product analytics, and service communications.
• Consent: marketing email, optional cookies, and any integration you explicitly connect (for example Slack).
• Legal obligation: tax records, accounting, and lawful requests.

Different purposes can rely on different legal bases, even when they involve the same record. A payment record may be needed both to fulfil a contract and meet accounting obligations. Where we rely on legitimate interests, your applicable right to object remains available. Withdrawing optional consent does not affect processing already lawfully carried out or records we must retain for a separate legal reason.

Scout and Brand Brain send the prompts, brand documents, and thread context you provide to our model providers so they can generate a response. Your content is used to answer your request and to keep your chat history available across devices. We do not sell it, and we do not use your private brand content to train public models. Chat history and uploaded knowledge files can be deleted from inside the app at any time.

Only upload knowledge files and provide context you are authorised to share for the requested processing. A business document may contain personal data even when it is labelled as marketing material. Remove unnecessary personal details before submitting it. AI responses may contain errors or reproduce details from the prompt, so review them before sharing. Deleting a document from your workspace does not remove copies you separately published or sent to another person.

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share only with processors that help us run the service, each bound by contract:

• Payments and invoicing (Stripe).
• Database, authentication, and application hosting.
• File storage for proofs, campaign images, and knowledge files.
• AI model providers for Scout and Brand Brain.
• Search, keyword, and SERP data providers.
• Email delivery and, if you connect it, Slack.

Between users, we share only what a job requires: brands see the submitted link, proof, and the Reddit username used; creators see the brief and the Brand name. We may also disclose data when required by law, to enforce our Terms of Service, or in a merger or acquisition, in which case this policy continues to apply.

The information shared depends on the function you use. Stripe supports checkout and billing, Backblaze B2 stores uploaded files, and search providers such as Outscraper supply relevant public search information. AI and scraping providers support the requested research or model response. Access by another marketplace participant is limited by the Task and workspace permissions; a public Reddit contribution is visible under Reddit's own arrangements, not only inside ReddBounty.

Cookies are small files stored on your device. We use three categories:

• Essential: sign-in sessions, security, and fraud prevention. The service cannot run without them.
• Functional: remembering preferences such as your dashboard view, filters, and notification settings.
• Analytics: aggregate measurement of which pages and features are used, so we can improve them.

We do not run third-party advertising or cross-site retargeting cookies. You can clear or block cookies in your browser, though sign-in stops working without the essential ones.

Similar technologies include local browser storage, which can remember sign-in state, preferences, tool-use information and a dismissed popup. Google Analytics is used for website measurement. Campaign tags and referring-page information may help us understand how visitors reach the service. Browser settings can limit storage or measurement, although some functionality may stop working. This section describes storage practices; it is not a claim that every browser offers identical controls.

We operate globally, so your data may be processed in the United States, the European Union, and other countries where our providers run infrastructure. Where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

A provider's processing location can differ from the location of your business or the audience of a Campaign. International processing may be necessary for hosting, payments, file delivery, search and AI responses. Questions about the safeguards applicable to your information can be sent to our privacy contact. This policy does not mean that your records are guaranteed to remain in one country or one data centre.

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access is restricted by row-level database policies, role-based permissions, and least-privilege staff access. Proof and image files are served through short-lived signed URLs. No online service can promise absolute security. If a breach affects your personal data, we will notify you and the relevant regulator as required by law.

Security also depends on the information you choose to publish and how you protect your account. Use a strong password, restrict team access and avoid placing credentials in uploaded documents. A signed file link may allow the holder to view the file while it remains valid, so do not share it publicly unless intended. If you suspect unauthorised access, contact us with relevant details, but do not send passwords or security codes.

• Account and profile data: while your account is active.
• Campaigns, submissions, and proofs: up to 24 months after completion for dispute handling.
• Payment and campaign balance ledger records: up to 7 years, as tax law requires.
• Support tickets: 24 months.
• Server and security logs: up to 12 months.

After you delete your account we remove or anonymise personal data within 30 days, except records we must keep for legal, tax, or fraud-prevention reasons.

Retention depends on the record's purpose, the status of a dispute and applicable legal duties. An account closure request does not necessarily require deletion of an invoice or transaction ledger. Where information is retained under an exception, it remains subject to appropriate access restrictions. Public Reddit posts, third-party records and copies independently held by other people are not deleted simply because your ReddBounty account is closed.

Depending on where you live, you can request access, correction, deletion, restriction, a portable copy of your data, or object to processing based on legitimate interests. EEA and UK users may also complain to their local supervisory authority. California residents can request disclosure of the categories collected and shared, request deletion, and opt out of sale or sharing; we do not sell or share personal data, and we will never discriminate against you for exercising a right.

Email hello@reddbounty.com with the address on your account. We verify identity before acting and respond within 30 days.

Explain which right you wish to exercise and which records or activity the request concerns. We may ask for proportionate information to verify identity and prevent disclosure to the wrong person. Please do not send unnecessary identity documents unless requested. Some rights have exceptions, including where another person's rights or legal retention duties are involved. If a request is restricted or cannot be fulfilled, we will explain the applicable reason.

Transactional email about your account, campaigns, and billing is part of the service and cannot be switched off while your account is open. Product and marketing email is optional and every message includes an unsubscribe link. Notification preferences live in your settings.

Requesting a free AI visibility report authorises delivery of that requested report; it is not, by itself, consent to unrelated marketing. Optional marketing choices are kept separate from the report request. Essential service messages may still be sent after you unsubscribe from promotional messages, for example about security, an invoice or a Task requiring attention. Use notification settings for available controls and contact us if an unsubscribe request appears not to have worked.

ReddBounty is not for anyone under 18. We do not knowingly collect data from children. If we learn that a minor has created an account, we close it and delete the data.

The age restriction applies to both Brands and Creators. Do not submit information about children in a Campaign, brand document, enquiry or screenshot unless there is a lawful and necessary basis to do so. If you believe information about a person under 18 has been provided to the service, contact us with enough detail to locate it without circulating the information more widely.

The service links to Reddit and other third-party sites we do not control. Their privacy practices are their own. Anything you post publicly on Reddit is governed by Reddit's own policies, not this one.

Following a link, connecting an integration or posting to a public community can expose information to a separate operator. Their retention and deletion practices may differ from ours. A screenshot of a public discussion can also include usernames or other contextual information about people who are not ReddBounty customers. Keep proof relevant to the Task and avoid including unrelated private conversations.

We use automated systems to score threads, match creators to campaigns, detect fraud and banned accounts, and generate AI drafts. These systems support human decisions rather than replace them. Where an automated check materially affects you, for example a suspension or a rejected submission, you can ask for human review by emailing hello@reddbounty.com and we will have a person look at it.

A thread score, competitor suggestion or AI readiness assessment is an aid to interpretation and may be incomplete. Automated checks can flag a record for review without proving misconduct. To request a human review of a material decision, identify the affected account, Task or result and explain the concern. Do not assume a search recommendation is a legally binding decision or an endorsement of the information it contains.

If a breach creates a risk to your rights, we notify the relevant supervisory authority within 72 hours of becoming aware of it and inform affected users without undue delay, with a description of what happened, what data was involved, and what we are doing about it.

Notification depends on the nature of the incident and the legal reporting threshold. We may need to investigate what happened, contain the incident and identify the affected records. A notification will explain the available facts and practical protective steps where appropriate. If you report a potential incident, avoid disclosing another user's information publicly while we assess it.

We may update this policy as the product evolves. Material changes are announced in the app or by email at least 14 days before they take effect, and the date at the top of this page always reflects the current version. Continued use after the effective date means you accept the update.

A privacy notice explains processing and is not a substitute for consent where consent is legally required. The revised date helps you identify the version you are reading. A material change may concern a new purpose, a new category of information or a significant change in your available controls. You may contact us about the change and continue to exercise the rights that apply to your information.

Privacy questions, data requests, and legal notices all go to hello@reddbounty.com. It is the only contact address we operate, and it is monitored on business days. See also our Terms of Service and Refund Policy.

Use a subject such as “Privacy request” and identify the account or report concerned. A request about someone else's records requires appropriate authority, not just access to a public username. We may ask you to clarify the scope to avoid an unnecessarily broad disclosure. Questions about a public post on Reddit may also need to be directed to Reddit or the community concerned because we cannot control their independent records.