CrushIt Privacy Policy
Version 2026-09-08 · DRAFT FOR COUNSEL REVIEW — not yet effective
This Privacy Policy describes how CrushIt collects, uses, shares and protects personal information on the CrushIt platform. Users under 18 should also read the Minor Privacy Notice, which adds protections that apply to them.
1. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account | name, email, password (hashed by our identity provider), phone (optional) | you |
| Age | date of birth (stored encrypted; used to determine your age band), age band | you |
| Guardian | Guardian's name, email, relationship, verification record | you / your Guardian |
| Athlete profile | handle, sport, position, school, class year, state, height/weight, bio, social handles and follower counts | you |
| Content | photos, videos and captions you upload (we remove location metadata from images) | you |
| Deals | offers you view/accept, contracts, deliverables, signatures (with time and IP address), messages with brands | you / brands |
| Financial | wallet ledger, payout requests, tax status (W-9 collected, 1099 thresholds). Bank and tax ID numbers are collected and held by Stripe, not CrushIt | you / Stripe |
| Technical | IP address, device and browser type, approximate country (for US-only enforcement), request identifiers, security logs | automatic |
| Consent records | which documents you accepted, when, and from what IP address | automatic |
We do not collect precise geolocation, biometric identifiers, or Social Security numbers.
2. How we use information
To operate the Platform (accounts, marketplace, contracts, payments, CrushCards (personalized CrushCards, which may include AI-generated images)); to verify age and Guardian relationships; to generate compliance and disclosure records you need for your school or association; to detect and prevent fraud, abuse and child-safety violations; to send transactional email (and marketing email only with your consent); to comply with law, including tax reporting and lawful requests; and to improve the Platform using aggregated or de-identified data.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not serve targeted advertising to anyone under 18, and we do not use minors' data to train AI models.
3. How we share information
With brands when you accept their offer (your profile, deliverables and messages within the deal); with your school's compliance officer when a disclosure is required or you file one; with your Guardian if you are under 18 (they can see your profile, deals, wallet and messages); with service providers acting on our instructions — hosting (Vercel), database and authentication (Supabase), media storage (Cloudflare), payments (Stripe), email (Resend), background jobs (Inngest), error monitoring (Sentry), AI caption assistance (Anthropic; only the text needed to generate a caption, never your photos) — each bound by contract to use data only for the service; with authorities when required by law or to report child-safety violations to NCMEC; and in a corporate transaction, subject to this Policy.
4. Your rights
Depending on your state (including California, Colorado, Connecticut, Texas, Virginia, Oregon and others), you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to opt out of sale/sharing and targeted advertising (we do neither), and to appeal a decision. Submit requests from your account settings or at privacy@authentic-influencer.com. We verify requests using your account credentials. Guardians may exercise these rights for minors they are linked to. We honor Global Privacy Control signals. We will not discriminate against you for exercising your rights.
5. Retention
We keep information only as long as needed for the purpose collected, then delete or de-identify it:
- Account and profile data: while your account is active, then deleted within 30 days of a deletion request or 24 months of inactivity, except as needed below.
- Contracts, signatures, consent records, ledger entries and tax records: 7 years after the transaction, for legal, tax and audit obligations. These are retained even if the account is deleted.
- Uploaded media: deleted with the account, except media attached to an executed contract, which is retained with the contract.
- Security and audit logs: 24 months.
- Data of users blocked at the age screen: not stored.
6. Security
Data is encrypted in transit (TLS) and at rest. Dates of birth are additionally encrypted at the field level. Access is role-based and logged; staff access to money and minors' data requires multi-factor authentication. We maintain a written information security program, test it at least annually, and require security commitments from vendors. If a breach affects your data, we will notify you and regulators as required by law.
7. Children and teens
We do not knowingly allow children under 13 to create accounts. Teens 13–17 must have a verified Guardian; see the Minor Privacy Notice for the default protections applied to teen accounts.
8. Changes and contact
We will notify you of material changes and ask for renewed acceptance where required. Questions: privacy@authentic-influencer.com.