Privacy Policy

• ZERO1 MEDIA SL
• Carrer València 74, 4-4 — 08015 Barcelona, Spain
• VAT / NIF: ESB70826946
• Email: info@huuk.app

No Data Protection Officer (DPO) has been appointed as appointment is not mandatory under Art. 37 GDPR. You can address any privacy request to the email above.

This Policy applies to:

• the marketing website https://huuk.app;
• the web application https://dashboard.huuk.app;
• any related email, support and transactional communication.

The Service is reserved to users aged 18 or older. We do not knowingly collect data from minors.

• Visitors of the marketing website.
• Creators — UGC content creators who register on the platform to offer video services to brands.
• Brands — companies that register on the platform to discover creators, commission projects and purchase content.

We process the following categories of personal data:

• Account data — first name, last name, email, hashed password, role (Creator/Brand), language, profile picture. Legal basis: 6.1.b (contract). Purpose: create and manage your account. Retention: until account deletion + 24 months.
• Creator profile — date of birth, phone, gender, physical traits, city, languages, bio, FAQs, portfolio videos, prices. Legal basis: 6.1.b (contract). Purpose: allow brands to discover and book creators. Retention: until account deletion + 24 months.
• Brand profile — company name, logo, sector, website, brief defaults. Legal basis: 6.1.b (contract). Purpose: allow creators to evaluate the brand. Retention: until account deletion + 24 months.
• Tax & payout data — legal name, address, tax ID, IBAN, ID document (KYC via Stripe Connect). Legal basis: 6.1.b (contract) + 6.1.c (legal obligation). Purpose: onboard payouts, anti-money laundering. Retention: 10 years (Spanish fiscal law).
• Payment data — information relating to payments processed through Stripe, including transaction status and the information required for invoicing. Legal basis: 6.1.b + 6.1.c. Purpose: process payments and issue invoices. Retention: 10 years (fiscal).
• Chat & deliverables — 1:1 messages between brand and creator, attachments, delivered videos, scripts. Legal basis: 6.1.b (contract). Purpose: provide collaboration features. Retention: until account deletion + 24 months.
• Platform activity — project history, statuses, revisions, disputes, actions taken by users and records related to the collaboration. Legal basis: 6.1.b (performance of the contract). Purpose: operate the platform, resolve incidents, manage disputes and ensure traceability of collaborations. Retention: until account deletion + 24 months.
• Transactional email — email content sent via Resend (welcome, password reset, project events, notifications). Legal basis: 6.1.b (contract). Purpose: operate the Service. Retention: 24 months.
• Marketing / CRM — email, name, role, language, lifecycle events. Legal basis: 6.1.a (consent, where required) / 6.1.f (legitimate interest: onboarding & service updates). Purpose: marketing emails, onboarding flows. Retention: until withdrawal of consent.
• Technical logs — IP address, user-agent, timestamps, error logs. Legal basis: 6.1.f (legitimate interest: security, fraud prevention). Purpose: security, debugging. Retention: 12 months.
• Cookies & analytics — see the Cookie Policy. Legal basis: 6.1.a (consent). Purpose: analytics and advertising. Retention: see the Cookie Policy.

We do not intentionally process special categories of data (Art. 9 GDPR). Creators may voluntarily disclose information (e.g. in their bio or portfolio) that could be considered sensitive; in that case the legal basis is explicit consent through publication on a public profile.

We process personal data to:

• Provide the Service (registration, authentication, profile management, chat, project management, deliveries, payments).
• Process payments and payouts and meet tax obligations.
• Communicate with you about your account, projects and the Service.
• Send marketing communications where you have consented or where permitted by law.
• Monitor, secure and improve the Service.
• Comply with legal obligations and defend our rights in legal proceedings.

Personal data are mainly stored within the European Union:

• Supabase — database, authentication and storage (EU region).
• Cloudflare R2 — public media assets.
• Hostinger — landing page hosting (EU).
• Lovable — application hosting.

Where transfers outside the EEA occur (e.g. Stripe, Resend, Customer.io, Google, Meta, LinkedIn, TikTok, PostHog), they are protected by Standard Contractual Clauses (SCC) adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

We share personal data only with the sub-processors listed below, each bound by a Data Processing Agreement.

• Supabase Inc. — DB, auth, storage, edge functions. Data: all account / profile / chat data. Location: USA (EU region for storage). Safeguards: SCC + DPF.
• Stripe Payments Europe Ltd. — card payments, invoicing. Data: payment data, invoices. Location: IE / USA. Safeguards: SCC + DPF.
• Stripe Connect — creator payouts, KYC. Data: identity, IBAN, address. Location: IE / USA. Safeguards: SCC + DPF.
• Resend Inc. — transactional email. Data: email, name, message content. Location: USA. Safeguards: SCC + DPF.
• Customer.io (Peaberry Software) — CRM, marketing automation, onboarding. Data: email, name, surname, role, language, phone, gender, date of birth. Location: USA (EU region). Safeguards: SCC + DPF.
• Cloudflare Inc. (R2) — asset hosting. Data: public media assets. Location: USA. Safeguards: SCC + DPF.
• Lovable — hosting of dashboard.huuk.app. Data: all app traffic. Location: EU. Safeguards: DPA.
• Hostinger International Ltd. — hosting of huuk.app. Data: access logs. Location: EU (Cyprus). Safeguards: DPA.
• Google LLC (GA4, Tag Manager, Google Ads) — analytics, advertising. Data: cookies, anonymised IP, events. Location: USA. Safeguards: SCC + DPF, consent.
• Meta Platforms Ireland Ltd. (Pixel) — conversion tracking. Data: cookies, events. Location: IE / USA. Safeguards: SCC + DPF, consent.
• LinkedIn Ireland Unlimited — conversion tracking. Data: cookies, events. Location: IE / USA. Safeguards: SCC + DPF, consent.
• TikTok Technology Ltd. (Pixel) — conversion tracking. Data: cookies, events. Location: IE / USA / CN. Safeguards: SCC, consent.
• PostHog Inc. — product analytics. Data: product events, anonymous ID. Location: USA / EU. Safeguards: SCC + DPF, consent.

We may also share data with legal, accounting and tax advisors of ZERO1 MEDIA SL bound by professional secrecy, and with competent authorities where required by law.

We do not sell personal data and do not share personal data with third parties for cross-context behavioural advertising in the meaning of the CCPA, beyond the advertising cookies you explicitly authorise.

Where personal data are transferred to a country outside the European Economic Area without an adequacy decision, we rely on:

• Standard Contractual Clauses (SCC) under Commission Implementing Decision (EU) 2021/914;
• EU-US Data Privacy Framework for certified US recipients;
• supplementary measures (encryption in transit and at rest, access controls).

You can request a copy of these safeguards by writing to info@huuk.app.

We retain personal data only for as long as necessary for the purpose for which they were collected:

• Account and profile data: until you delete your account, plus 24 months for legal defence.
• Tax, payout and invoicing data: 10 years under Spanish law (Ley General Tributaria, Código de Comercio).
• Technical logs: 12 months.
• Marketing: until you withdraw consent or unsubscribe.
• Backups are retained only for as long as strictly necessary to ensure service continuity and disaster recovery.

You have the right to:

• access your personal data (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your data (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time without affecting the lawfulness of prior processing;
• lodge a complaint with the Spanish supervisory authority AEPD (www.aepd.es) or with the authority of your country of residence.

To exercise your rights, write to info@huuk.app. We respond within 30 days.

If you are a California resident, you have the right to:

• know what personal information we collect, use and disclose;
• request deletion of your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell personal information);
• limit the use of sensitive personal information;
• non-discrimination for exercising these rights.

To submit a request, email info@huuk.app with the subject "CCPA Request".

We implement technical and organisational measures appropriate to the risk, including:

• TLS encryption in transit;
• Passwords are stored using secure hashing algorithms managed by our authentication provider.
• Row-Level Security (RLS) on the database;
• least-privilege access controls and MFA on administrative tools;
• regular backups and monitoring;
• KYC and fraud-prevention via Stripe.

No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

The Service is reserved to users aged 18 or older. If we discover that we have collected data from a minor, we will delete it without undue delay.

We may update this Policy from time to time. The "Last updated" date at the top reflects the latest version. For material changes we will notify you by email or in-app.

• ZERO1 MEDIA SL — Carrer València 74, 4-4 — 08015 Barcelona, Spain
• Email: info@huuk.app