Privacy Policy
This policy explains what personal information the Onedaydream Campaign Reporter ("the app", "we", "us") collects, why, who can see it, how long we keep it, and what happens when you ask us to delete it. Onedaydream (ODd Pty Ltd) runs the app to manage and report on influencer marketing campaigns for creators we represent and the brands they work with.
1. Who this policy covers
- Creators (talent) we represent or work with on campaigns.
- Prospective creators whose public social profiles our staff look up before any relationship exists.
- Brand contacts who send an enquiry through a creator's media kit or who receive a campaign report link.
- Our own staff who sign in to the app.
2. What we collect
About creators, from you or entered by our staff: your name, email address, Instagram and TikTok handles, profile photo, home state and city, follower counts, the content formats you create, your rates, the fees from past jobs we have booked for you, your tier and talent manager, internal notes by our staff, your media-kit content (display name, tagline, bio, categories, past brand collaborations, images, location), and the campaign shortlists, availability answers and proposed fees for jobs you are considered for. Some of this comes from our job-management system (Monvera): job descriptions, client names, creator and talent-manager names, and job files. Past fees come from an export of that system.
Campaign results. For each campaign post: the post link and image, and its results: impressions, reach, likes, comments, shares, saves, story views, story replies, link clicks and your follower count at the time, plus a gender split and top country for the audience (when imported from Instagram, these are your followers' figures). You can type these in through your personal submission link. If your Instagram is connected, you can import them from Instagram instead. For TikTok posts, our staff may fetch the post's public statistics (views, likes, comments, shares and saves) and its cover image, and we keep a record of each fetch: the post link, the date and the staff member who asked.
From Instagram, only if you connect your Instagram account to the app
(Instagram Login, with the instagram_business_basic and
instagram_business_manage_insights permissions):
- account details: username, name, account type, number of posts, following and follower counts, bio, profile picture and website;
- account insights for a rolling 30-day window: reach, views, profile views, accounts engaged, total interactions, likes, comments, shares, saves, follows and unfollows, and profile link taps;
- audience demographics for your followers and for the people who engaged with you, broken down by age, gender, country and city. These are totals per group. We never receive the identity of an individual follower;
- your recent posts, including captions, so you can choose the ones that belong to a campaign. Captions are shown to you but not stored. We keep the link, results and image of each post you submit. If you pick a post but do not submit it, its image may stay on our server until we clean it up or you ask for deletion.
From TikTok, only if you connect your TikTok account (the
user.info.basic permission): your TikTok account ID and display name, and
the access tokens that keep the connection working. We do not receive your TikTok
videos, statistics or audience through this connection.
Confirming a connection. If the account you connect does not match the handle we have on file, we ask you to confirm it is yours. The connection is not used unless you confirm, and the request expires after 30 minutes. If you confirm, our staff can see that the names differ.
Public information about creators and prospective creators: when our staff look up an account, including when we refresh the follower count of a creator we represent, we store a snapshot of its public profile: handle, display name, profile picture, bio, follower, following and post counts, website, category, whether it is verified or private, and an estimated engagement rate.
About brand contacts: the brand name, your name, email address, message and any brief you include when you send an enquiry through a creator's media kit.
About our staff: name, email, username, role, a hashed password, and which staff member made each lookup, fetch and quote. Some staff names also come from Monvera.
Technical records: our server records the IP address, browser type and page address of requests to the app. If your Instagram is disconnected, or you connect a different Instagram account, we keep the previous account's ID (and, after a switch, a note of which post images and audience figures came from it), so that a deletion request for that account can still find its data. If Meta sends us a deletion request for you, we keep the Instagram account ID it names and its confirmation code in our records as proof that we handled it.
We never receive your Instagram, TikTok or Facebook password, your private messages, or your followers' identities.
3. How we use it
To run and report on campaigns: to match creators to briefs, quote and plan campaigns, collect results, and produce campaign reports for the brand that commissioned the campaign. Reports can include an AI-written summary paragraph (see section 5). We do not use your information for advertising, and we do not sell it.
Our staff may also copy the audience breakdown of a connected Instagram account (age, gender and country of your followers), together with your handle and follower count, into our own internal talent-analytics tool, to match creators to briefs.
4. Who can see it
- Our staff, signed in to the app, according to their role.
- The brand for a campaign, and anyone they share the report link with. A published report shows the campaign details, the AI summary (which names creators), and for each creator: name, handles, and for each post the link, image, results, engagement rate, follower count at the time, an estimated media value, and the audience split (gender and top country). It never shows a creator's email address or our internal notes about the creator.
- A brand we send a quote to sees the names, platforms and proposed fees of the creators in that quote.
- Anyone, if you have a published media kit. A published kit is public. It shows your name and display name, handles, tagline, bio, categories, location, images, follower counts, past brand collaborations, the types of work you offer, totals of your past campaign results, your Instagram audience breakdown (age, gender, country and city), and the average gender split and top country across your campaigns. Published kits are also listed, with less detail, on a public kits page.
- A talent manager receives a private link. It shows the creators they manage whose availability we are currently asking about: their names, photos, home state and city, the proposed fee lines, the talent manager's own notes about that shortlisting, and the client, campaign, deadline, usage terms and where the content will be posted.
- You, through your own submission link.
5. Service providers we use
We use these providers to run the app. We don't sell or rent personal information to them or to anyone else.
- DigitalOcean hosts the app, its database and its daily backups in Sydney, Australia.
- Resend sends our email: invitations and reconnection requests to creators, availability requests to talent managers, and enquiry notifications and auto-replies. It handles the recipients' email addresses and the message, which can include creator names, the client's name, and an enquirer's name, email address and brief.
- Anthropic provides the AI features. It receives the text we send it: to write a report summary, the campaign, client and brand details and the creators' names, handles and post results; to read a client brief or job one-pager, the document's text (up to a length limit). A brief sent as an email file includes its sender and recipient details.
- ScrapeCreators looks up public profile and post statistics. It receives only a public handle or a public post link and returns public figures. Signed-in staff use it by asking for a lookup, and once a week the app uses it to record the public TikTok follower count of creators we represent.
- Monvera, our job-management system (hosted on Supabase, with a separate file service), which we read job and talent details from. The app sends it search text (which can be a creator's or client's name), job codes, and the ID of any job file we open.
- Meta (Instagram). When our staff look up an Instagram account, the handle is usually sent to Instagram's Business Discovery service first.
- Image hosts. Some images, such as profile pictures and brand logos, load in your browser directly from the servers they are hosted on (such as Instagram's or TikTok's), which see your IP address.
- Google Fonts supplies the typefaces for the app and these pages. Your browser requests them directly from Google, which sees your IP address.
Some of these providers, including Anthropic, Resend, Google and Meta, are based in the United States, so information we send them is handled outside Australia.
6. Storage, security and how long we keep it
Data travels over HTTPS. Instagram and TikTok access tokens are encrypted in our database and are used only by the app's server. Staff sign in with individual accounts, and passwords are stored only as hashes. Uploaded brief documents are stored privately and can only be downloaded by signed-in staff. Post and media-kit images are stored at web addresses that anyone who has the address can open.
We keep a creator's record while we represent you, and for 7 years after for our financial records. We keep a weekly history of your follower counts (your public TikTok follower count, which our data provider looks up, and, if your Instagram is connected, your Instagram follower count and its 30-day reach, views, profile views and accounts engaged) for as long as we keep your creator record. An audience breakdown copied into our internal talent-analytics tool, and the handle and follower count copied with it, are deleted when we stop representing you, or sooner if you ask us to delete them (see section 7). We delete prospect lookups (snapshots of public profiles of creators we do not represent) after 12 months, and enquiries we have archived 12 months after they arrive; other enquiries are kept until we archive them. We keep records of deletion requests as proof that we handled them. Our database is backed up daily and each daily backup is kept for 7 days. Deleted information can remain in these backups until they expire.
7. Deletion
A deletion request through Meta. If you ask Meta to have us delete your data, we delete: your Instagram connection and tokens; your Instagram account details, insights and audience demographics, including any copy in our internal talent-analytics tool and the handle and follower count copied with it; the post images we hold for you, from Instagram and TikTok posts alike; the record of our fetches from Instagram; any audience split that Instagram filled in on a campaign post; the Business Discovery lookups of your profile that are linked to your record or made under your current handle; our weekly history of your Instagram figures; and our record of that Instagram account's ID. If the request is for an Instagram account you have since replaced, we keep your current connection and delete only the data that account left with us that has not since been replaced, and that account's weekly history; lookups of that account are not deleted by such a request. You get a confirmation code and a status page. Copies in our backups are removed as those backups expire (see section 6).
What a Meta request does not delete. Our own record of working with you stays: your name, email, handles, profile photo, rates, media-kit content (including any name, bio or photo copied from a staff lookup when your record was created), your follower count (which may be the last count Instagram gave us), and the results of campaign posts you delivered, including results imported from Instagram and reports already sent to brands, and quotes already sent. Post images are removed from those reports. Lookups of your public profile through ScrapeCreators and our record of TikTok post fetches also stay. A Meta request does not touch your TikTok connection or TikTok figures.
TikTok. To have us delete your TikTok information, email us at the address below, or ask us to disconnect your TikTok account. We delete your TikTok connection, tokens, the TikTok account details we received from TikTok and our weekly history of your TikTok follower count, and we stop recording that history unless you connect TikTok again. Your handle, current follower count, campaign results and post images, and our records of public TikTok lookups and fetches, stay as our record of working with you.
Any other request — to delete your media kit, or your record with us — email hello@onedaydream.com.au. We will reply within 30 days and tell you what we deleted and, if we keep anything, why. See also our Data Deletion Instructions.
8. Access and correction
You can ask what we hold about you, or ask us to correct it, at hello@onedaydream.com.au.
9. Changes
If this policy changes, we will update the date at the top.
10. Contact
See also the Terms of Service and Data Deletion Instructions.