Creator Program Privacy Notice

This notice explains how Inkitt GmbH (“CandyJar,” “we,” “us,” or “our”) processes personal data for the CandyJar Creators program (the “Program”). Inkitt GmbH is located at Saarbrücker Str. 36, 10405 Berlin, Germany. This notice supplements the CandyJar Privacy Policy. If the documents conflict on a Program-specific issue, this notice controls.

1. Data we collect

We may collect:

• your name and contact email;
• your CandyJar userID, received from a CandyJar app link when available or collected after a post submission so rewards can reach the correct account;
• campaign attribution such as the CandyJar app, Rewards tab, or campaign that brought you to the Program site;
• public post URLs and registration information;
• public post content and publicly visible information such as view counts, tags, captions, publication status, and engagement;
• Program review decisions, view snapshots, coin calculations and grants, reward history, suspected fraud or policy issues, and support communications; and
• email delivery and bounce information when our email provider makes it available; and
• with your consent, approximate location, device and browser information, pages viewed, and selected site-link clicks.

We collect this information from you, from public social platforms, from CandyJar account and coin systems, and from service providers that help operate the Program.

2. How and why we use the data

We process Program data:

• to register you, receive and review submitted posts, administer your participation, connect your contact email to the correct CandyJar userID, calculate and grant coins, and send operational messages necessary to provide the Program;
• for our legitimate interests in verifying eligibility and organic views, measuring and improving the Program, preventing fraud and abuse, protecting rights, and maintaining security;
• to comply with legal obligations and respond to lawful requests; and
• with consent where applicable law requires it, including for uses that are optional rather than necessary to operate the Program.

We may also use creator posts as permitted by the CandyJar Creators Program Terms & Content Guidelines. We do not use the Program contact email for unrelated marketing unless you have separately permitted that use. Registration, submission, reward, and Program-status messages are operational communications. Program decisions are not made solely through automated decision-making.

3. How we share the data

We may share Program data with:

• Inkitt GmbH affiliates and team members who operate, review, support, secure, or evaluate the Program;
• service providers such as Supabase for form submissions and operational records; Google Workspace for files; Google Analytics for website measurement; Iterable or another communications provider for Program email; and CandyJar systems for account matching and coin grants;
• professional advisers, auditors, rights holders, and contractors when reasonably necessary; and
• authorities or other parties when required by law or needed to protect rights, safety, security, or the Program.

Public social posts remain subject to the social platform's privacy practices. When CandyJar uses a post under the Program Terms, the post and information embodied in it may appear on CandyJar, affiliate, advertising, or distribution channels.

We do not sell Program registration data. International transfers and safeguards are described in the CandyJar Privacy Policy.

4. Website analytics

We use website analytics to understand approximate geography, device and browser types, pages viewed, and selected link clicks so we can improve the site. Advertising signals and ad personalization are disabled. We do not send registration or submission responses, CandyJar account details, contact information, or public post links to Google Analytics.

5. Retention

We generally retain registration, submission, review, and reward records for up to three years after the creator's last participation. We may retain records longer when reasonably necessary for legal claims, fraud prevention, rights management, accounting, or audit obligations. Copies of posts containing CandyJar footage may be retained and used in accordance with the license granted in the Program Terms. Public posts may also remain available through the social platform after Program records are deleted.

6. Your choices and rights

You may stop participating at any time by no longer submitting posts and contacting us. Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, or to withdraw consent where processing relies on consent. These rights may be subject to applicable legal exceptions.

To exercise privacy rights or contact the Data Protection Officer, use the contact information in the CandyJar Privacy Policy. Program questions may be sent to leah@candyjar.com.

7. Age and changes

The Program is limited to people age 18 or older. We may update this notice when the Program or our processing changes. We will publish the updated notice with a new effective date and provide additional notice when required by law.