Legal

Privacy Policy

Effective date: 2026-01-01 · Last updated: 2026-03-16

This Privacy Policy explains how SATOSHI FRAMEWORK SASU ("Creatorlayer", "we", "us") collects, uses, and protects personal data in connection with the Creatorlayer service (creatorlayer.eu, creator-portal.creatorlayer.eu, lender-portal.creatorlayer.eu, api.creatorlayer.eu). This policy applies to creators who connect their platforms via the Creatorlayer consent UI.

1. Who we are (Controller)

Data controller: SATOSHI FRAMEWORK SASU, a French simplified joint-stock company (SASU).
Contact: hello@creatorlayer.eu

2. What data we collect

When a creator connects their platform(s) via the OAuth consent flow, Creatorlayer may collect and process the following categories of personal data:

  • Platform identity data: platform handle, creator ID, display name, and channel URL from each connected platform (e.g. YouTube, Twitch, Spotify).
  • OAuth access tokens: short-lived tokens used to retrieve income data from connected platforms on the creator's behalf. Tokens are not stored beyond the duration necessary to complete the data retrieval.
  • Income and revenue data: historical monthly revenue, payout records, and revenue metrics as reported by the connected platform's API.
  • Content typology data: content category or genre classification (e.g. gaming, education, music) used to compute the risk profile.
  • Derived risk metrics: computed indicators including risk tier, cashflow volatility, data quality score, and ND (non-data) codes. These are deterministic outputs derived from the raw income data.
  • Consent records: timestamp, IP address, and record of consent granted or withdrawn.

We do not collect biometric data, health data, or any special category data under Art. 9 GDPR.

3. Legal bases for processing

  • Art. 6(1)(b) GDPR — Performance of a contract: Processing of OAuth tokens and platform income data is necessary to provide the Creatorlayer service, which the creator has requested by initiating the consent flow. This covers retrieval of revenue data and computation of the Risk Tape.
  • Art. 6(1)(a) GDPR — Consent: Processing of content typology data and any data shared beyond the core service (including forwarding a Risk Tape to a named lender) is based on the creator's explicit, freely given consent, recorded at the time of authorization. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
  • Art. 6(1)(f) GDPR — Legitimate interests: We may process minimal technical data (server logs, error traces) for the purpose of maintaining service integrity and security, where our legitimate interest in operating a secure service is not overridden by the creator's interests or rights.

4. How we use your data

  • To generate a standardized Risk Tape that can be shared with lenders or fintechs in the Creatorlayer network, subject to your explicit consent.
  • To compute and display your Creator Score within the Creatorlayer app.
  • To maintain a record of your consent and the data access you authorized.
  • To respond to your requests regarding your data rights.

We do not sell your data. We do not use your data for advertising. We do not use automated decision-making with legal or similarly significant effects without human review.

5. Data sharing

Risk Tape data is shared with third-party lenders or fintechs only upon the creator's explicit consent for a specific named recipient. We do not share income data with any party without prior authorization. We may engage sub-processors (e.g. hosting providers) who are contractually bound to process data only on our instructions and in compliance with GDPR.

6. Data retention

  • OAuth access tokens: deleted immediately after the income data retrieval is complete.
  • Raw income data: retained for a maximum of 24 months from the date of collection, or until the creator requests erasure, whichever is earlier.
  • Derived risk metrics (Risk Tape): retained for as long as the creator maintains an active Creatorlayer account, or for a maximum of 36 months, whichever is shorter.
  • Consent records: retained for 5 years for legal compliance purposes, even after consent withdrawal or account deletion.

7. Your rights (GDPR Chapter III)

As a data subject, you have the following rights:

  • Right of access (Art. 15): You may request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16): You may request correction of inaccurate data.
  • Right to erasure (Art. 17): You may request deletion of your data. Requests will be honoured within 30 days, subject to legal retention obligations.
  • Right to data portability (Art. 20): You may request an export of your Risk Tape and underlying income data in machine-readable JSON format.
  • Right to withdraw consent (Art. 7(3)): You may withdraw consent at any time via the Creatorlayer app. Withdrawal does not affect the lawfulness of processing before withdrawal.
  • Right to object (Art. 21): You may object to processing based on legitimate interests.
  • Right to lodge a complaint: You may lodge a complaint with your national supervisory authority. In France, this is the CNIL (Commission Nationale de l'Informatique et des Libertés).

To exercise any of these rights, contact us at hello@creatorlayer.eu. We will respond within 30 days.

8. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, or loss. These include encryption in transit (TLS), access controls, and audit logging. Our infrastructure is hosted within the EU.

9. International transfers

We do not transfer personal data outside the European Economic Area (EEA) as part of our core operations. Any sub-processors engaged are bound to EEA data residency or appropriate transfer mechanisms under Chapter V of the GDPR.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version at creatorlayer.eu/privacy. Material changes will be communicated to active users via the Creatorlayer app.

11. Contact

For any questions, data rights requests, or privacy concerns:
Email: hello@creatorlayer.eu
Company: SATOSHI FRAMEWORK SASU
Jurisdiction: France (EU)