1. Introduction

Lucyd B.V. (operating as Treffix) ("Treffix", "we", "us", or "our") operates the Treffix platform, a performance-based creator marketing marketplace. This Privacy Policy applies to all data collected through the Treffix website, web application, APIs, and any related services (collectively, the "Platform").

By creating an account or using the Platform, you consent to the data practices described in this policy. This policy is incorporated into our Terms of Service.

We do not sell, rent, or trade your personal data to third parties for advertising or marketing purposes.

2. Data We Collect

2.1 Account Data

When you create a Treffix account, we collect:

• First name and last name
• Email address
• Password (stored in hashed, encrypted form via Supabase Auth — we never have access to your plaintext password)
• Account type (creator or brand)
• Company name (brand accounts only)

2.2 TikTok Integration Data

When you connect your TikTok account to Treffix (creators only), we collect and store:

• TikTok open_id (a unique identifier assigned by TikTok to your account within our application)
• TikTok display name and username
• TikTok OAuth access token and refresh token
• View counts for specific TikTok videos you submit as part of campaign participation

Important: We store your TikTok OAuth access token and refresh token in our database. These tokens are required to enable automated, ongoing view count synchronization during campaign earning windows. We use these tokens only for the purpose of fetching view counts on submitted campaign videos. We do not access your TikTok messages, followers list, contact list, or any content beyond what is necessary for view verification.

2.3 Instagram Integration Data

When you connect your Instagram account to Treffix (creators only), we collect and store:

• Instagram user ID (a unique identifier for your Instagram Professional account)
• Instagram username
• Instagram long-lived OAuth access token (valid approximately 60 days, automatically refreshed)
• Instagram media IDs and permalinks for Reels you submit as part of campaign participation
• View counts and engagement metrics (views, likes, comments, shares) for submitted Reels, fetched via the Instagram API

Important: We request only two Instagram permissions: instagram_business_basic (to identify your account) and instagram_business_manage_insights (to read view counts on your submitted Reels). We do not access your Instagram messages, followers list, stories (unless submitted to a campaign), or any content beyond what is necessary for campaign performance verification.

Your Instagram account must be a Professional account (Business or Creator type) to connect to Treffix. Personal Instagram accounts cannot be connected due to Instagram API restrictions.

2.4 Campaign & Activity Data

Through normal Platform use, we collect:

• Brands: Campaign briefs, budgets, payout structures, requirements, tone guidelines, hashtag specifications, and campaign status history
• Creators: Video submission URLs, TikTok video IDs, Instagram Reel permalinks and media IDs, submission timestamps, performance data (view counts over time), payout amounts earned
• All users: Transaction history, dispute and appeal records, account activity logs

2.5 Payment Data

Payment processing is handled by Stripe, Inc. Treffix does not store, process, or have access to credit card numbers, bank account numbers, or full payment credentials. Stripe collects and processes payment data directly, subject to Stripe's own Privacy Policy. We do store: transaction amounts, transaction status, payout records, and references to Stripe transaction IDs for accounting and legal compliance purposes.

2.6 Creator Supplier, KVK, VAT & Legal-Acceptance Data

Before paid creator work, Treffix records the information needed to determine payout VAT treatment and produce self-billed transaction documents:

• Display name and the legal supplier name and address obtained from the current Stripe Connected Account
• Where a KVK check applies to your registered sole proprietorship: the eight-digit KVK number and normalized evidence returned by the KVK Basisprofiel, including legal and trading names, active-registration status, exact legal form, registered address, check time, review state, and a cryptographic fingerprint. We do not retain the raw KVK response in the supplier profile. Eligible creators using the small-business registration threshold do not provide a KVK number
• The Stripe Connected Account ID, current representative Person ID, identity-version counter, and relevant onboarding and update timestamps. These identifiers bind the KVK and tax evidence to the current Stripe context; the ordinary Treffix supplier profile does not copy identity documents, full bank-account details, or tax identifiers collected by Stripe
• Optional Dutch VAT ID and VAT/KOR/no-registration selection
• Age and Dutch tax-residency confirmations
• The exact version and text of VAT, paid-work, self-billing, Terms, and Privacy acknowledgements, with acceptance time, IP address, and user-agent evidence
• VAT-validation status and request references returned by the EU VIES service

Before your first campaign submission that can lead to payment, Treffix asks for your Dutch citizen service number (BSN) solely to meet applicable DAC7 identification, verification, reporting, correction, and audit obligations. The iOS app sends the BSN directly to a separately deployed EU tax-identity vault. The ordinary Treffix application and database receive only an opaque record reference, collection status, verification method, and timestamps; they do not receive the BSN or its ciphertext. The vault stores the identifier encrypted with keys held separately from the vault database. We do not use the BSN for login, advertising, profiling, fraud scoring, or general account matching, and we never display it back in the app.

2.7 Technical Data

Through your use of the Platform, our infrastructure providers may collect standard technical data including:

• IP address and approximate geographic location
• Browser type, version, and device information
• Pages visited and actions taken within the Platform
• Session timestamps and duration

This data is collected by Supabase (our infrastructure provider) as part of normal database and authentication operation. It is used for security, fraud prevention, and platform stability.

2.8 Location Data

If you allow location access in the app or your browser, we use your device's approximate location to show campaigns near you and sort them by distance. Your location is sent to our servers only to answer that request. We do not save it to your profile or keep a location history. Location access is optional: you can turn it off at any time in your device or browser settings, and campaigns are then shown without distances.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Platform operation: To authenticate your account, provide platform features, and facilitate campaigns and payouts
• TikTok view verification: To use your stored TikTok OAuth tokens to fetch view count data from the TikTok API for submitted campaign videos
• Instagram view verification: To use your stored Instagram OAuth token to fetch view count and engagement data from the Instagram API for submitted campaign Reels
• Fraud detection: To analyze view count patterns and identify potentially fraudulent activity using our proprietary detection systems
• Payment processing: To process campaign launch fees and creator payouts through Stripe
• Creator eligibility and record integrity: To check current KVK registration facts, bind supplier and VAT evidence to the current Stripe account and representative context, and prevent payable submissions against stale or mismatched evidence
• Dispute resolution: To investigate and resolve disputes and appeals using submission and activity data
• Transactional communications: To send account-related emails such as payout confirmations, campaign updates, and security alerts
• Legal compliance: To meet tax reporting obligations, respond to lawful requests from authorities, and enforce our Terms of Service
• Platform improvement: To understand how the Platform is used and improve its features and performance

Under GDPR, our legal bases for processing are:

• Contract performance: Processing necessary to provide the Platform services you signed up for (account data, campaign data, TikTok and Instagram tokens, payouts)
• Legitimate interests: Fraud detection, platform security, abuse prevention
• Legal obligation: Tax records, regulatory compliance, responding to lawful requests
• Consent: Where we explicitly request consent (e.g., marketing communications, if introduced in the future)

4. Third-Party Services & Data Sharing

4.1 TikTok / ByteDance Ltd.

We use the TikTok Open API to authenticate creator accounts and retrieve video performance data. When you connect your TikTok account, OAuth token exchange occurs directly with TikTok's servers. TikTok's collection and processing of your data during this process is governed by TikTok's Privacy Policy. We do not sell or share your TikTok data with any party other than TikTok as required for API functionality.

4.2 Meta Platforms / Instagram

We use the Instagram API (via Instagram Login) to authenticate creator accounts and retrieve Reel performance data. When you connect your Instagram account, OAuth token exchange occurs directly with Meta's servers. Meta's collection and processing of your data during this process is governed by Meta's Privacy Policy and Instagram's Terms of Use. We do not sell or share your Instagram data with any party other than Meta as required for API functionality.

When you disconnect your Instagram account from Treffix, we immediately delete your Instagram access token, user ID, and username from our database. You can also revoke access from Instagram's Settings → Website permissions.

4.3 Stripe, Inc.

All payment processing is handled by Stripe. When processing payments, we share with Stripe your name, email address, transaction amounts, and payout destination information. During Connected Account onboarding, Stripe independently collects and processes the representative identity, bank-account, and tax information it requires. Treffix records the Connected Account ID, the current representative Person ID, onboarding-status signals, and an identity-version counter so that paid-work evidence can be tied to the current Stripe context and made stale when that context changes. Treffix does not treat those status signals as proof that the representative owns or is authorised to bind the KVK-registered business. Stripe's data practices are governed by Stripe's Privacy Policy. If you are a creator receiving payouts, you must create a Stripe Connected Account, subject to Stripe's Connected Account Agreement.

4.4 Supabase, Inc.

Treffix uses Supabase for database storage, authentication, and file storage infrastructure. All Platform data (account data, campaign data, transaction records) is stored on Supabase-managed servers. Supabase's data practices are governed by Supabase's Privacy Policy.

4.5 Hosting, email, security, error monitoring and push notifications

Treffix uses the following processors to run the Platform. Each processes personal data only on our instructions under a data processing agreement:

• Vercel Inc. hosts the Treffix website and application servers and processes request data such as IP address, browser information and request logs.
• Resend (Plus Five Five, Inc.) sends our transactional and account emails and processes your email address, the email content and delivery status.
• Functional Software, Inc. (Sentry) collects error and performance reports from the website and the iOS app in its EU region. Reports can include technical device and browser information, the page or screen involved and an account identifier; we do not intentionally send BSNs, payment details or passwords to Sentry.
• Expo (650 Industries, Inc.) and Apple deliver push notifications to the iOS app. They process a device push token and the notification content.
• Upstash, Inc. runs the rate limiter that protects sign-up, sign-in and other requests against abuse. It processes short-lived counters keyed by IP address, account ID or a one-way hash of an email address. These counters expire automatically, at the latest within a few hours.
• Amazon Web Services EMEA SARL (AWS) provides the key management service (AWS KMS, Frankfurt region) that encrypts BSNs for the tax-identity vault described in Section 4.9. The BSN passes through AWS KMS only to be encrypted; the encryption keys never leave AWS KMS and are not available to the ordinary Treffix application.

Where these providers process data outside the EEA, the safeguards in Section 9 apply.

4.6 Maps and address search

The campaign map loads map images from OpenFreeMap. Your browser or app requests these images directly, so OpenFreeMap receives your IP address and the map area you are viewing, but no account data. When a Brand searches for a store address while creating a campaign, the search text is sent directly from the Brand's browser to PDOK Locatieserver (the Dutch government address service run by Kadaster) and, for chain-store searches, to public OpenStreetMap Overpass servers.

4.7 European Commission VIES

We send Dutch VAT IDs to the European Commission's VAT Information Exchange System (VIES) to check registration status. We retain the returned validation status, check time, and request reference for tax evidence.

4.8 Netherlands Chamber of Commerce (KVK)

Where a KVK check applies to your registered sole proprietorship, we send the eight-digit number you provide to the official KVK Basisprofiel API. We use the response to check that the returned number matches, the registration is active, the legal form is exactly "Eenmanszaak", and required name and registered-address fields are present. We retain the normalized evidence listed in Section 2.6 and its fingerprint, not the raw provider response. This is a register-data and eligibility check; KVK does not thereby confirm to Treffix that the person using the account owns, controls, or is authorised to represent the business. This KVK check does not apply to eligible creators using the small-business registration threshold.

4.9 DAC7: reporting Creator earnings to the Dutch Tax Administration

Treffix is a digital platform under the EU DAC7 rules (in the Netherlands: the Wet implementatie EU-richtlijn gegevensuitwisseling digitale platformen). Lucyd B.V. must therefore collect, verify and report information about Creators who are paid for campaign work through Treffix to the Dutch Tax Administration (Belastingdienst). This applies from your first paid campaign reward; for services there is no minimum amount.

For each calendar year, we report the following about you:

• Your name, primary address and date of birth
• Your BSN (citizen service number) and the country that issued it, and your VAT ID and KVK number if you have them
• The bank account your payouts go to, where this is available to us
• Per quarter: the total rewards paid or credited to you, the number of paid campaign activities, and the fees Treffix charged you

How your BSN is handled. You enter your BSN in the Treffix iOS app before your first paid submission. It goes straight to a separate, access-restricted EU tax-identity vault, where it is encrypted. The ordinary Treffix application and database never receive it; they only see a reference, the status and timestamps. We use your BSN only for DAC7 identification, verification, reporting, corrections and audits, never for login, marketing, profiling or anything else. Our legal basis is a legal obligation (Article 6(1)(c) GDPR). You can browse and prepare without a BSN, but you cannot start a paid submission until it is provided.

When we report. We report by 31 January for the previous calendar year. The first report, covering 2026, is due by 31 January 2027. The Belastingdienst may share the report with the tax authorities of the EU member state where you live.

How long we keep it. DAC7 records, including your encrypted BSN, are kept for 7 years after the end of the year they relate to and are then deleted, unless a documented legal hold applies. Treffix remains responsible for this processing, also where a processor runs part of the vault or the filing.

If your details are wrong or change, email privacy@treffix.com.

4.10 Legal Disclosure

We may disclose your personal data if required to do so by law, court order, or governmental authority, or if we reasonably believe disclosure is necessary to: (a) comply with applicable law; (b) protect the rights, property, or safety of Treffix, our users, or the public; or (c) enforce our Terms of Service.

4.11 Business Transfers

In the event of a merger, acquisition, sale of assets, or reorganization of Treffix, your personal data may be transferred to the acquiring entity. We will inform you where the law requires it.

4.12 No Data Selling

Treffix does not sell, rent, lease, or otherwise trade your personal data to any third party for marketing, advertising, or commercial purposes.

5. Data Retention

We retain your data for the following periods:

• Account data (name, email, account type): Retained for the lifetime of your account, plus 2 years after account deletion (for legal audit purposes)
• TikTok OAuth tokens (access & refresh tokens): Deleted immediately when you revoke TikTok access or delete your Treffix account
• Instagram OAuth tokens (long-lived access token): Deleted immediately when you disconnect Instagram or delete your Treffix account
• Transaction and payout records: Retained for 7 years from the date of the transaction (tax and financial compliance requirements)
• Creator supplier, KVK, Stripe identity-context, VAT, self-billing, and DAC7 evidence: Declaration, supplier-profile, normalized KVK, and profile-bound Stripe account, representative, and identity-version evidence is retained for 7 years after the end of the relevant reporting period and then anonymized by the approved retention job, unless a documented legal hold applies. The encrypted BSN is held inside the isolated tax-identity vault; the ordinary Treffix database retains only its opaque vault reference and status evidence. Minimum tax-identity status, binding, and replay metadata may be retained beyond profile anonymization only for as long as legally or security necessary under a separately approved retention schedule; it cannot make an anonymized account ready or mint a new collection session.
• Versioned legal acceptances: Retained while needed to establish the agreement and for applicable limitation periods
• Video submission data: Retained for 2 years after the relevant campaign ends
• Campaign briefs and data: Retained for 2 years after campaign end
• Dispute and appeal records: Retained for 3 years from resolution date

After the applicable retention period, data is deleted or anonymized in accordance with our internal data lifecycle policies.

6. Your Privacy Rights

6.1 Your Rights under the GDPR

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to our legal retention obligations
• Right to data portability: Request your personal data in a structured, machine-readable format
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to object: Object to processing of your personal data where we rely on legitimate interests as our legal basis
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time

You also have the right to lodge a complaint with your national data protection authority (e.g., the Dutch Autoriteit Persoonsgegevens, or the ICO in the UK).

6.2 How to Exercise Your Rights

To exercise any of the above rights, email us at privacy@treffix.com with the subject line "Privacy Rights Request". We respond within the time limits set by the GDPR. We may ask you to verify your identity before fulfilling the request.

7. Cookies & Tracking

7.1 Session Cookies

We use session cookies that are strictly necessary for authentication and maintaining your logged-in state. These cookies are required for the Platform to function and cannot be disabled.

7.2 What We Do Not Use

Treffix currently does not use:

• Third-party advertising or tracking cookies
• Analytics platforms (Google Analytics, Mixpanel, Segment, etc.)
• Social media tracking pixels
• Fingerprinting or cross-site tracking technologies

If this changes, we will update this policy.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal data:

• Encryption in transit: All data transmitted between your browser and Treffix's servers is encrypted using HTTPS/TLS
• Access controls: Supabase Row Level Security (RLS) policies ensure that users can only access their own data. Administrative access is restricted to authorized Treffix personnel
• Password security: Passwords are hashed using industry-standard algorithms via Supabase Auth. Plaintext passwords are never stored or transmitted
• TikTok token storage: OAuth tokens are stored in our database and used only for view verification. We recommend revoking TikTok access through TikTok's settings if you believe your tokens may have been compromised
• Instagram token storage: OAuth tokens are stored in our database and used only for Reel view verification. Tokens are automatically refreshed approximately every 60 days. Disconnect Instagram through your Treffix connections page if you believe your token may have been compromised
• Creator identity boundaries: KVK and tax evidence is bound to the current Stripe account, representative, and identity version. A changed context makes prior evidence stale. The ordinary supplier profile retains only normalized KVK evidence and minimum Stripe references, while BSNs are handled by the separate tax-identity vault described above

Despite these measures, no data transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that affects your rights and freedoms, we will notify affected users and relevant supervisory authorities in accordance with applicable law.

9. International Data Transfers

Treffix is based in the Netherlands. Your data may be processed and stored in data centers located within the European Economic Area. Our infrastructure providers (Supabase, Stripe, Vercel, Resend, Sentry, Upstash, Amazon Web Services, Expo, Apple, OpenFreeMap, TikTok, Meta Platforms) may process data in locations outside the EEA. Where data is transferred outside the EEA, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with an adequacy decision.

10. Children's Privacy

Treffix does not knowingly collect personal data from children where parental consent is required by applicable law. If you believe a child has provided personal data without the required consent, contact us at privacy@treffix.com so we can review and address the request.

11. Third-Party Links

The Platform may contain links to third-party websites (e.g., TikTok, Instagram, Stripe). This Privacy Policy applies only to the Treffix Platform. We are not responsible for the privacy practices of third-party sites and encourage you to review their privacy policies before providing any personal data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. The date at the top of this page shows when it was last updated. Where the law requires it, we will inform you of material changes.

13. Contact & Data Requests

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern:

• Privacy requests: privacy@treffix.com (subject: "Privacy Rights Request")
• Legal inquiries: legal@treffix.com

You also have the right to file a complaint with your national supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.