Privacy Policy

Mogiu is a creator-marketing platform operated by Zalify Inc., a Delaware corporation. For the purposes of the EU and UK General Data Protection Regulation, Zalify Inc. is the data controller for the personal data described in this policy, except for the content a brand customer creates and manages in its own workspace, for which that brand is the controller and we act as its processor.

• Zalify Inc., a Delaware corporation
• 651 N Broad St, Suite 206, Middletown, DE 19709, USA
• hello@zalify.com

This policy applies to mogiu.com, the Mogiu application, and the Mogiu creator sign-up at mogiu.com/creator. It does not apply to the third-party sites and platforms we link to or integrate with, which have their own policies.

Three groups of people appear in Mogiu, and not every section applies to all of them.

• Brand users — people who work for a brand and use Mogiu to run campaigns.
• Creators with an account — people who signed up at mogiu.com/creator.
• Creators and business contacts we have not met — people whose public professional profile or published business contact details we hold so that a brand could evaluate and contact them. If this is you, read If you never signed up. You have the same rights as everyone else, including the right to have your record deleted.

From brand users

Your name, email address and profile picture, and either a password or the one-time codes we email you. Your organisation’s name and logo, your role in it, and who invited you. Records of your sign-in sessions, including IP address, browser user-agent and expiry. And the content you create in the product — briefs, notes, comments, messages and the commercial terms you agree with creators.

From creators with an account

The profile details returned by the account you sign in with — see Signing in with Google, Instagram or TikTok — together with any bio or handle you add yourself. Records of your sign-in sessions, including IP address and browser user-agent. Any shipping address you save so brands can send you product. And your participation in campaigns: what you applied to, what was agreed, what you delivered, and any balance owed to you.

About creators and business contacts without an account

So that our brand customers can identify and approach people to work with, we hold professional profile information collected from publicly available sources and obtained from third-party business-data providers. It covers:

• public social profile information — handle, display name, public biography, profile picture, audience and engagement figures, and recent public posts;
• business contact details — a work or business email address, and for company contacts a name, job title and employer;
• information a brand records about you in its own workspace, such as notes, labels and the status of its conversation with you.

We also keep our own copies of profile pictures and post thumbnails so they keep working after the source platform changes its links.

From everyone who visits the site

Our hosting provider records the usual server-side information — IP address, user-agent and the URL requested. We do not run analytics, advertising or session-recording software on this site. See the Cookie Notice for the full list of cookies and browser storage.

You can create a Mogiu account using an existing account elsewhere. We ask each platform for the minimum needed to identify you, and we use it only to create and authenticate your Mogiu account and to show a brand which account you are.

• Google — your Google account identifier, name, email address and profile picture.
• Instagram — under the instagram_business_basic permission: your Instagram user identifier, username, name and profile picture.
• TikTok — under the user.info.basic scope: your TikTok open identifier, display name, username and avatar.

We do not post on your behalf, read your messages, or import or back up your content on any of these platforms. Instagram and TikTok do not give us your email address; where a platform returns none, we generate an internal placeholder identifier that is not a real mailbox and never receives mail.

You can revoke Mogiu’s access at any time from the platform itself — Google at myaccount.google.com/permissions, Instagram under Settings then Apps and websites, TikTok under Settings and privacy then Manage app permissions. Revoking access stops any further access; to have what we already hold deleted, follow Data Deletion.

We use personal data to:

• create and secure accounts, authenticate you, and operate the platform;
• run campaigns — helping brands and creators find each other, agree terms, exchange messages, ship product and track what was delivered;
• maintain the professional directory our brand customers search when looking for people to work with;
• send service email such as login codes, invitations and notifications;
• protect the service against fraud, abuse and security incidents;
• meet our tax, accounting and other legal obligations.

Where the EU or UK GDPR applies, our legal basis is performance of a contract with you for the first, second and fourth of these; our legitimate interests in operating a business-to-business service for the third and fifth, balanced against the limited, professional nature of the data; legal obligation for the last; and your consent where you connect an account at that platform’s permission screen, which you may withdraw at any time.

Mogiu uses AI models to do work that would otherwise be manual — drafting and summarising text, and helping assess whether a creator is a fit for a campaign. When a feature runs, the records and text it needs are sent to our AI providers, which process them under contract on our instructions and return a result. Those results are suggestions shown to a person, who decides what to do with them. We do not make decisions producing legal or similarly significant effects about you by automated means alone.

We do not sell personal data and we do not share it for advertising. We disclose it in four situations.

With the brand or creator you are dealing with

Mogiu is a two-sided platform. A brand running a campaign sees the profiles, contact details and conversation history relevant to that campaign; a creator sees the brand they are working with. A brand can also generate a shareable link to a campaign’s creator list — anyone holding that link can view the records on it, so treat it as confidential.

With our service providers

We use third parties to host our infrastructure, store files, deliver email, provide electronic signature, supply business and professional data, and provide the AI models behind the features described above. Each acts as our processor under a written agreement, may use the data only to provide its service to us, and is required to protect it. We will tell you which providers are involved in processing your data if you ask us at hello@zalify.com.

Where the law requires it

We may disclose data where we are legally required to, where we need to establish or defend legal claims, or to protect the rights and safety of our users.

In a corporate transaction

If Zalify Inc. is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction, subject to this policy.

We are based in the United States and our providers operate in the United States and elsewhere. If you are in the European Economic Area, the United Kingdom or Switzerland, your personal data will be transferred outside your country. Where that happens we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with the measures described below. You can ask us which mechanism applies to a particular transfer.

We keep personal data only as long as we need it for the purposes in this policy, and then for as long as the law requires us to — typically for the duration of your relationship with us plus the period needed for tax, accounting and legal-claim purposes.

• Account and campaign records are kept while the account is active, and are removed on request.
• Credentials for an account you connected are removed when you disconnect it or when your Mogiu account is deleted.
• Sign-in sessions expire on a rolling basis, and the access tokens issued from them are short-lived.
• A record we hold about a person without an account is kept while that person is a live prospect for our brand customers, and is deleted on request.
• Backups are retained on a rolling basis and overwritten in the ordinary course. Data deleted from the live system persists in backups until they roll over.

Deletion is performed on request rather than on an automated schedule. When we receive a request we act on it as described in Data Deletion.

We use security procedures designed to protect the confidentiality of your data. Traffic to Mogiu and between Mogiu and its providers is encrypted in transit with TLS. Data is stored with providers that encrypt data at rest. Access to production data is limited to the personnel who need it, application access is scoped so that one organisation cannot read another’s workspace, passwords are stored only as hashes, and access tokens are short-lived. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the relevant regulator as the law requires.

Wherever you live, you can ask us for a copy of the personal data we hold about you, correct it if it is wrong, or have it deleted. Write to hello@zalify.com. We will respond within 30 days, and we will not charge you or treat you differently for exercising a right.

If you are in the EEA, the UK or Switzerland

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests — including the right to object at any time to your profile being held in our directory. Where processing is based on consent, you may withdraw it at any time without affecting processing already carried out. You may also complain to your local supervisory authority.

If you are in California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect, use and disclose; the right to delete it; the right to correct it; and the right to limit the use of sensitive personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising. In the last 12 months we collected the categories of personal information described in What we collect and disclosed them for business purposes to the categories of recipient listed under When we share data. You may authorise an agent to act for you; we may ask for proof of that authority.

If you are a creator or a business contact reading this because you found your details in a Mogiu outreach email, we hold a professional profile about you that we built from public sources or obtained from a data provider, so that a brand could evaluate whether to work with you.

You do not need an account to exercise your rights. Email hello@zalify.com with the handle, profile link or email address we contacted you at, and ask us to tell you what we hold, correct it, stop contacting you, or delete it. We will act on it within 30 days. Full instructions are on the Data Deletion page.

Mogiu uses a small number of strictly necessary cookies to keep you signed in, plus browser storage for preferences such as your chosen language and layout. We do not run analytics or advertising trackers. Two embedded third-party features on our public pages set their own cookies. The full inventory, and how to control it, is in the Cookie Notice.

Mogiu is a business tool and is not directed at children. You must be at least 18 to use it, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, tell us and we will delete it.

We may update this policy as the product changes or the law does. The date at the top of the page always shows the current version. If a change materially affects how we handle your personal data we will tell you in the app or by email before it takes effect.

For any privacy question or request — access, correction, deletion, objection, or a complaint — contact:

• Zalify Inc., a Delaware corporation
• 651 N Broad St, Suite 206, Middletown, DE 19709, USA
• hello@zalify.com

If you are not satisfied with our response you may complain to your local data protection authority.