Privacy Policy

This policy explains what data Winfall collects, why, and what your choices are. It covers two kinds of people: users with Winfall accounts (brands and creators), and creators whose public information appears in our research even though they do not have an account.

When you use Winfall with an account, we collect:

• Account data: name, email, and login credentials handled by our auth provider.
• Brand profile data: what you tell us about your company in the brand interview, by voice or text, plus your search prompts and saved research. This powers your matches and is never shared with other customers or sold.
• Creator profile data: your niche, audience description, platforms, rates, and what you will not promote, from the creator interview.
• Payment data: handled by Stripe. Winfall never stores your card number or bank credentials; we keep records of subscriptions, credits, and payouts.

Winfall’s research covers creators who may not have Winfall accounts. This data comes from public sources: content and statistics published on platforms like YouTube, Instagram, and TikTok, and licensed data providers who compile public platform information. It can include channel names, follower and engagement statistics, published content, and publicly listed contact details.

We hold this data to help brands evaluate potential partnerships. Where research touches a person’s reputation, we surface only cited sources with quoted material; Winfall never authors claims about people. If you are a creator and want information about you corrected or removed, contact privacy@winfall.ai and we will act on it.

We collect standard technical data (IP address, browser, device type) and product usage data (searches run, credits spent, clicks on attribution links) to operate the Service, meter credits, prevent fraud, and improve the product.

Winfall uses AI services to run its research: generating search queries from your prompts, scoring creator fit, and drafting research summaries. Your inputs and relevant profile data are sent to these providers to produce your results, under contracts that restrict them to processing on our behalf.

We share data only with the service providers that run Winfall: Stripe (payments), Supabase (database and auth), Vercel (hosting), Resend (email), AI providers (Anthropic, Google), and licensed creator-data providers. Each processes data to provide their service to us. We do not sell personal information, and we do not share your brand profile with other customers.

We may disclose data if required by law, or as part of a merger or acquisition, in which case this policy continues to apply to it.

Winfall uses cookies for signing you in and keeping your session, and for attribution: when someone clicks a creator’s link, a cookie lets us credit the creator if a purchase follows. That cookie’s lifetime matches the attribution window set on the specific offer (90 days unless the offer declares a different window). We do not run third-party advertising cookies.

Data is encrypted in transit, database access is governed by row-level security so accounts can only read their own records, and money-moving events are signature-verified and audit-logged.

We keep account data while your account is active. After closure we delete or anonymize personal data within a reasonable period, except records we must keep for legal, tax, or fraud-prevention reasons. Research data from public sources is refreshed and pruned as sources change.

You can access and update your account data in the product. For a copy of your data, deletion, or a correction (including creators without accounts), email privacy@winfall.ai. Depending on where you live, you may have additional rights under laws like the GDPR or the CCPA; we honor requests under those laws.

If this policy changes materially, we will give notice by email or in the product before the change takes effect. Questions: privacy@winfall.ai.