Privacy Policy

Last updated: 26 October 2026

1. Who We Are

This Privacy Policy explains how LIA S.R.L. ("LIA", "we", "us", or "our") collects, uses, and protects your personal data when you use the LIA platform and websites, including withlia.ai and creators.withlia.ai (together, the "Platform"). LIA is the data controller for the personal data described in this Policy.

We are committed to protecting your personal data and respecting your rights under the EU General Data Protection Regulation (GDPR) and applicable Italian data protection law. Our full company and contact details are in the Legal Notice and in Section 13 below.

2. Scope of this Policy

This Policy applies to all visitors, brands, and creators who use the Platform. It covers personal data we process as a controller. Where we process personal data on behalf of a brand customer (for example, data a brand uploads about its own contacts), that brand is the controller and its own privacy policy applies; we act as a processor under our agreement with that brand. For personal data generated during a live campaign that LIA and a brand each use for their own purposes, LIA and the brand act as independent controllers, each responsible for its own processing.

3. What We Mean by "Personal Data"

"Personal data" means any information relating to an identified or identifiable natural person. It does not include anonymised or aggregated data that can no longer be used to identify you.

4. Personal Data We Collect and Why

We collect the following categories of personal data, depending on how you use the Platform:

• Account & identity data — name, email address, password (stored hashed), and your brand or organisation affiliation. Used to create and secure your account.
• Authentication data — when you sign in with Google, Microsoft, or Meta (Facebook/Instagram), we receive basic profile information, your email, and access tokens. Used to authenticate you and connect the relevant services.
• Creator & social data — social media handles, connected Instagram Business account insights and audience metrics, YouTube channel/video data, and profile pictures. Used for creator onboarding, campaign matching, marketplace discovery, and performance measurement.
• Content data — images, videos, captions, and scripts you submit, and content generated for your campaigns. Used to run content submission, review, and approval workflows.
• Communications data — messages exchanged between brands and creators on the Platform, and related email correspondence. Used to operate messaging and support.
• Payment & payout data — payout preferences and account identifiers needed to pay creators. Payouts are processed by our payout provider (Lumanu), where creators set up their payout details directly; we do not store full card or bank details.
• Tax data — tax-identity and residence information (fiscal code/TIN, VAT number, address, date of birth, and the IBAN you are paid to) and the amounts paid to you, collected for our tax-reporting obligations including EU DAC7 and US W-9/1099, operationally via our payout provider (Lumanu).
• Safety & AI-derived data — brand-safety scores, content analysis, and transcripts of submitted audio/video, produced by automated analysis. Used for brand-safety verification and content validation.
• Website enquiry data — when you request an invitation or join the creator waiting list on withlia.ai: your email address and, for brands, your company, role and what you want to do with creators; for creators, your Instagram or TikTok handle and country. We also record the time of the request, your IP address and browser information. Used only to reply to you and, for creators, to contact you about creator programmes that fit your work.
• Technical & usage data — IP address, device and browser information, session identifiers, and logs of how you interact with the Platform. Used for security, fraud prevention, and to operate and improve the service.

Optional Gmail connection for brands and agencies

An authorised brand or agency user can connect a Google mailbox to a market in LIA. This is a separate, optional authorisation from signing in to LIA. We receive the connected email address, the permissions granted and OAuth tokens needed to maintain the connection; we do not receive your Google password.

We use this connection to send creator invitations and campaign replies from the selected mailbox and to synchronise related email conversations with the market's LIA inbox. We search incoming and sent messages involving creator addresses already associated with LIA email threads, read message headers, subjects, bodies and attachments, and use reply references to identify the corresponding conversations. Matching messages and attachments are stored in the relevant LIA workspace. We apply a hidden lia-thread label to processed messages to prevent duplicate imports; this does not change their read/unread state or delete messages from Gmail.

Connected-mailbox data is used for these email features and is available to authorised users of the relevant workspace. Message recipients receive the emails and attachments sent to them. Google handles authorisation and email delivery, and our AWS infrastructure hosts connection data, synchronisation jobs, messages and attachments. Disconnecting stops further sending and synchronisation and removes the stored refresh token. Previously synchronised messages are retained separately as described in Section 9 and can be included in a deletion request.

Google user data and Limited Use. LIA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data and developer policy. We do not sell Gmail data, use it for advertising or audience profiling, or use it to train or improve general-purpose AI or machine-learning models. Transfers and staff access are limited to providing the authorised email features with consent, security purposes, applicable legal requirements, or other cases expressly permitted by those policies. These restrictions govern Gmail data where other sections of this policy describe broader uses of other Platform data.

TikTok integrations (planned, subject to approval)

We are preparing optional TikTok integrations. They are not yet available and will only be enabled after the required platform approvals and account authorisation. Publishing this notice does not connect an account or start collecting TikTok data. Depending on the features you choose, we plan to process:

• Creator Insights — account and video identifiers, profile information, and available views, engagement and aggregated audience metrics from creators who explicitly authorise LIA. Used to populate the relevant creator and campaign dashboards and measure organic performance.
• Creator Discovery — available creator profiles, public video insights and aggregated audience information through an authorised TikTok One account. Used to search for potential partners, save shortlists and plan campaigns.
• Brand Mentions — identifiers, links and available metadata for public posts mentioning an explicitly authorised TikTok Business Account. Used to match returned posts to existing partnerships and track eligible deliverables without duplicates. Results depend on TikTok's API availability and limits and are not an exhaustive record of all posts.
• Ads Reporting — advertiser, campaign and ad identifiers and metadata, spend, impressions, clicks, video performance and available attributed conversion metrics from explicitly authorised advertiser accounts. Used to analyse paid campaign performance, including Spark Ads.
• Connection data — account identifiers, permissions, access tokens and, where provided, refresh tokens and expiry information. Used to maintain the connection you authorise; we do not ask for your TikTok password.

TikTok data will be available only to relevant authorised users in the associated LIA workspace. These integrations are intended for discovery, monitoring and reporting, not for publishing content, sending TikTok messages, replying to comments or creating or changing ads. Account authorisation can be revoked; see the Data Deletion Policy for disconnection and deletion requests.

5. How We Use Your Data

• To provide, operate, and secure the Platform and your account.
• To match creators with brand campaigns and run campaign, content, and payment workflows.
• To perform brand-safety verification, content validation, and fraud prevention.
• To enable communication between brands and creators.
• To measure campaign and content performance and provide analytics.
• To provide AI-assisted features (e.g. content analysis, caption/script and media generation).
• To respond to your requests and provide support.
• To comply with our legal, accounting, and tax obligations.

Automated decisions. Some checks are automated, including AI content-safety screening that can exclude content or limit campaign participation. Where such processing significantly affects you, you can ask us to have a person review the decision, express your view, and contest it.

6. Legal Bases for Processing

Under the GDPR, we rely on the following legal bases:

• Performance of a contract — to provide the Platform and the services you or your brand have requested, and to take steps at your request before entering into a contract (for example, answering an invitation request or a waiting-list sign-up).
• Legitimate interests — to secure the Platform, prevent fraud, verify brand safety, and improve our services, balanced against your rights.
• Consent — when you connect a social or third-party account, or opt in to marketing communications. You may withdraw consent at any time.
• Legal obligation — to meet accounting, tax, and other legal requirements.

7. Who We Share Your Data With

We do not sell your personal data. We share it only as needed to run the Platform: with brands and creators you collaborate with on the Platform, and with the service providers (sub-processors) listed below, who process data on our instructions under appropriate contractual safeguards.

Optional TikTok connections and Slack alerts. For the planned integrations described above, TikTok will receive the authorisation and API requests needed to provide the selected features and will supply the permitted account, content and reporting data. If a client enables Brand Mentions alerts, we plan to send post identifiers, links and the metadata needed for campaign tracking to the Slack workspace and channel configured by that client for the relevant brand and market. We will not include OAuth tokens in those alerts. People with access to that channel can see the alerts; the client controls channel membership and the retention of copies in its Slack workspace. These optional features do not enable sharing until the relevant connection and alerts are authorised and configured.

TikTok and the client's Slack service also process data under their own applicable terms and privacy notices. Before enabling these integrations, we will provide the applicable recipient and transfer information and any advance notice required by Section 13. Where these services involve transfers outside the EEA, the safeguards described in Section 8 apply.

We may also disclose data where required by law, to enforce our agreements, or in connection with a corporate transaction (e.g. merger or acquisition).

8. International Data Transfers

Our core infrastructure is hosted in the European Union. Some of our sub-processors are located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision.

9. How Long We Keep Your Data

We keep personal data for as long as your account is active and for a reasonable period afterwards to operate the Platform, resolve disputes, and meet our legal obligations. Financial and transaction records are retained for the period required by Italian accounting and tax law. Where we are required to report under EU Directive 2021/514 (DAC7), we retain the reported tax data until 31 December of the fifth year following the year of reporting. Website enquiries (invitation requests and waiting-list sign-ups) are kept for up to 24 months after our last contact with you. When data is no longer needed, we delete or anonymise it. See our Data Deletion Policy to request deletion.

For the planned TikTok integrations, connection tokens will be kept only while needed for the authorised connection and removed when it is disconnected. Previously collected profile, post and reporting data will be kept only while needed for the purposes described above, subject to deletion requests and the limited legal retention exceptions in our Data Deletion Policy. Revoking a connection and requesting deletion of previously collected data are separate actions; you can request both together.

For Gmail connections, the stored refresh token is removed when you disconnect the mailbox in LIA. Synchronised messages and attachments remain in the relevant workspace while needed for its campaign communications, subject to the retention rules and deletion requests described in this policy. Revoking access in your Google Account stops further authorised access but does not by itself delete copies already stored in LIA. See our Data Deletion Policy for how to request removal of the connection and previously received Gmail data.

10. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data ("right to be forgotten");
• request restriction of, or object to, processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent; and
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority.

To exercise any of these rights, contact us using the details in Section 13.

11. Cookies

The Platform uses essential cookies and similar technologies that are strictly necessary to keep you signed in and to keep the service secure. You can control cookies through your browser settings; disabling essential cookies may prevent you from logging in or using parts of the Platform.

12. Security & Children

We protect your data with technical and organisational measures, including encryption of data in transit (TLS), access controls, and secure cloud infrastructure. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

The Platform is not directed to children. Creators must be at least 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal data from children.

13. Changes & Contact

We may update this Policy from time to time. We will post the updated version here and revise the "Last updated" date above. Where a change materially affects how we handle your data, such as a new recipient of your personal data or a transfer to a new country, we will tell you by email before it takes effect. For any privacy question or to exercise your rights, contact: