Sovian Privacy Policy

Effective Date: January 1, 2026 Last Updated: July 30, 2026

Sovian, a sole proprietorship based in Edmonton, Alberta, Canada (“Sovian,” “we,” or “us”) operates the websites, applications, dashboards, APIs, and other services described in our Terms of Service (collectively, the “Services”). This Privacy Policy explains what personal information we collect, how we use and disclose it, and the choices you have.

1. Scope and Roles

This Privacy Policy applies when you visit a Sovian website, download or use a Sovian app, create or use a brand, agency, or creator account, participate in a campaign, communicate through the Services, receive or make payments, use Sovian analytics or advertising tools, interact with our support or sales teams, or otherwise engage with the Services.

For most of the personal information described here, Sovian decides why and how the information is processed and acts as the controller or business responsible for that processing. In some business-to-business services — for example when we process a brand’s customer list, advertising-account data, conversion events, purchase data, or other information only on the brand’s instructions — Sovian acts as a service provider, contractor, or processor. In those cases the applicable customer is responsible for its own privacy notices, lawful basis, permissions, and instructions, and its agreement with Sovian may include additional data-protection terms.

This Privacy Policy does not govern brands, agencies, social networks, payment processors, identity-verification providers, or other third parties acting independently for their own purposes. Their privacy practices are governed by their own policies.

2. Personal Information We Collect

The categories we may collect depend on your role, how you interact with the Services, the features you use, and the information you choose to provide.

3. Sources of Personal Information

We may collect personal information from:

• You, when you create or update an account, apply for or manage campaigns, upload content, provide business-verification materials, make or receive payments, connect an integration, communicate with us, or exercise a privacy right.
• Brands, agencies, and other customers, for example when they invite creators by email, upload social handles, add team members, provide campaign briefs, or submit customer lists or advertising information for an optional advertising feature.
• Creators and other users, including information shared through marketplace interactions, campaign communications, ratings, approvals, and disputes.
• Social platforms and third-party data and analytics providers, including publicly available profile information and public and aggregate content-performance metrics for connected or campaign-associated handles. We use platform APIs where available and third-party data providers to collect public metrics.
• Payment, payout, identity-verification, tax, and fraud-prevention providers, primarily Stripe and Stripe Connect.
• Advertising platforms and brand advertising accounts when a customer authorizes Sovian to manage or measure advertising activity.
• Automatically from devices, browsers, applications, cookies, pixels, logs, and similar technologies when you use the Services.
• Publicly available sources, referrals, business partners, and other service providers where permitted by law.

Where a brand or agency uploads an email address or social handle to invite a creator, the creator must opt in and create an account before participating. A brand or agency that provides information about another person represents that it has the right to do so and has provided any required notice or obtained any required permission.

4. How We Use Personal Information

We use personal information to:

• Operate the Services. Create and authenticate accounts; provide creator discovery, campaign management, messaging, content workflows, tracking, analytics, payments, payouts, subscriptions, integrations, customer support, and other requested features.
• Facilitate marketplace relationships. Let creators and brands discover one another, evaluate opportunities, contract, communicate, exchange deliverables, approve content, rate performance, and manage campaigns.
• Process payments and payouts. Handle deposits, subscriptions, creator earnings, transfers, invoices, refunds, reversals, chargebacks, tax records, reconciliation, and accounting through Stripe and Stripe Connect.
• Verify users and businesses. Confirm account authenticity, verification status, business legitimacy, age eligibility, and compliance with platform rules — including our requirement that creators use their correct name, location, and a genuine photograph of themselves rather than an AI-generated avatar.
• Measure and improve performance. Analyze usage, content, creator, campaign, paid advertising, conversion, and product performance; troubleshoot; conduct research; and improve the Services.
• Provide advertising tools. Manage campaigns in a brand’s existing ad account, store and use advertising permissions and codes, process conversion and purchase data, measure paid and organic performance, and use optional customer lists as instructed by the brand.
• Personalize and recommend. Recommend creators, campaigns, content, and features; rank applications; identify high-performing content; and tailor the user experience.
• Communicate with you. Send transactional, service, security, support, administrative, product, and (where permitted) marketing communications through email, SMS, push notifications, and in-app messaging.
• Protect users and the Services. Detect, investigate, prevent, and respond to fraud, impersonation, stolen payment methods, unauthorized transactions, chargebacks, account takeovers, policy violations, artificial engagement, invalid traffic, security incidents, and unlawful conduct.
• Enforce rights and resolve disputes. Enforce agreements and policies, document approvals and performance, preserve evidence, resolve complaints, respond to payment disputes, and establish, exercise, or defend legal claims.
• Comply with law. Meet legal, tax, accounting, regulatory, sanctions, law-enforcement, and recordkeeping obligations, and respond to valid legal process.
• Corporate transactions. Evaluate or complete a financing, merger, acquisition, restructuring, sale of assets, bankruptcy, or similar transaction.

5. Payments, Payouts, Identity Verification, and Tax Records

Sovian uses Stripe and Stripe Connect to support wallet deposits, subscriptions, creator payouts, transfers, identity verification, fraud monitoring, and related functions. Stripe processes deposits and subscriptions; Stripe Connect processes creator payouts and, together with its providers, handles creator identity verification and tax onboarding.

We do not store complete payment card numbers, bank-account numbers, government identification images, or biometric verification materials. Stripe and its providers may collect and process that information under their own privacy policies. Sovian may receive limited information such as payment status, transaction history, the last four digits of a payment method, verification status, fraud or risk signals, and chargeback evidence.

We may use and retain payment, payout, verification, device, fraud, and account information to process transactions; prevent unauthorized activity; determine whether funds should be released, held, offset, reversed, or refunded as permitted by our agreements and applicable law; respond to chargebacks; comply with legal obligations; and protect Sovian, payment providers, creators, brands, and other users.

Sovian may collect optional W-9 or other business-verification documents from brands. Creator identity verification and tax reporting, including issuance of applicable tax forms, may be handled through Stripe Connect. You remain responsible for providing accurate information and satisfying your own tax obligations.

6. Creator Profiles, Campaigns, and Marketplace Visibility

Sovian maintains two related but distinct sets of creator records:

• The Sovian creator pool (a catalog of vetted creators visible to brands using our discovery features), and
• Each brand’s address book (creators the brand has invited or engaged, which is the record all campaign engagement flows through).

A creator profile in the Sovian creator pool may be visible to brands and agencies using Sovian discovery. Before a creator is hired or contracted, brands may generally view profile, portfolio, social handles and links, public content, ratings, campaign history, and performance information. A creator’s direct email address and phone number generally become available only after the creator is invited into a brand’s address book or contracted for a campaign, unless the creator separately chooses to share them.

Creators may view information about campaigns and participating brands, including brand identity, campaign details, campaign history, and ratings made available through the Services. Brands and creators must use information obtained through Sovian only for legitimate marketplace and campaign purposes and in accordance with our Terms.

Creators must use their correct legal name and location and a genuine photograph of themselves. Creators may not impersonate another person, create accounts for another person, or use an AI-generated avatar as their profile photo. Sovian may display verification badges — a system-verified blue badge and an admin-assigned orange “top” badge for prolific creators and larger influencers — based on our then-current criteria; a badge is not a guarantee of any particular campaign outcome.

Content and campaign records may remain available to relevant brands, creators, and Sovian personnel after a campaign ends where needed to administer the relationship, document rights and approvals, provide analytics, resolve disputes, enforce agreements, or comply with law.

7. Social Accounts, Content Metrics, and Campaign Tracking

Creators may connect social accounts and post handles for platforms Sovian supports (currently including TikTok, Instagram, YouTube, and others we may add). We use a mix of platform APIs (via OAuth, where the creator has connected an account) and third-party data providers to collect public content and metrics such as views, likes, comments, shares, saves, and follower counts for creator accounts and campaign-associated posts.

Where a creator has connected an account via OAuth, we may also receive private insight metrics from the platform — such as reach, impressions, watch time, and audience information — that are only available to the account owner. We use these private insights to power campaign analytics for the creator and the associated brand.

Which posts count toward a campaign is determined by the campaign type set for that campaign — ambassador, influencer, or UGC-ads — plus the join anchor (only posts published on or after the creator’s activation), the campaign’s tracking filter (influencer only), and Sovian’s fraud and integrity gates. We do not use this data to identify individual viewers or subscribers of a creator’s audience.

Sovian generally stops collecting new performance information for an existing account or handle after the applicable campaign ends or after the account or handle is removed from the campaign. Previously collected campaign analytics may be retained under Section 13.

For paid advertising services, a brand may authorize Sovian to operate within the brand’s existing advertising account. In that case Sovian may receive advertiser account IDs and access tokens; store Spark Ads codes or Meta partnership-ad permissions; create, manage, optimize, or measure campaigns; receive conversion events, purchase data, clicks, paid and organic views, and ROAS; and process optional customer lists provided by the brand for targeting or measurement.

A brand that provides customer lists, conversion data, purchase data, advertising credentials, or similar information represents that it has all required rights, notices, lawful bases, and permissions. Sovian will process such information for the customer’s authorized advertising services and will not use one brand’s customer data to advertise Sovian or benefit unrelated customers, except in aggregated or deidentified form where permitted by law and contract.

8. Artificial Intelligence and Automated Processing

Sovian uses artificial intelligence and automated systems to recommend creators to brands, rank applications, generate campaign briefs and starting copy, auto-populate brand and product information from a public website, tag and cluster public content, detect fraud and artificial engagement, analyze campaign performance, and support other platform functions.

Text-generation and website-analysis features are powered primarily by OpenRouter (with Google Gemini as a first-party fallback for website analysis). Multimodal video and audio analysis is performed against public content — for example, TikToks and Instagram posts collected from the public web — using native provider endpoints such as Xiaomi MiMo (default) and Google Gemini. We do not send content that a creator has uploaded privately to Sovian to third-party AI providers for training or analysis; our multimodal analysis operates only on public content we have already collected from platforms.

Inputs to these systems may include account, profile, public content, campaign, performance, device, transaction, and fraud-related information. Outputs may include recommendations, rankings, predictions, summaries, risk signals, and suggested actions. Automated outputs may be inaccurate and are generally used to support human decision-making and platform operations.

We may change AI providers over time. Where required by law, we will provide additional information or choices about solely automated decisions that produce legal or similarly significant effects. If you believe an automated process has materially affected your account and you would like us to review the result, contact [email protected].

We do not permit third-party AI providers to use Sovian data for their own independent marketing. Any use of information for model training or product improvement will be subject to applicable law, contractual restrictions, and appropriate safeguards.

9. How We Disclose Personal Information

We may disclose personal information to:

• Creators, brands, agencies, and authorized account users, as needed to operate the marketplace, evaluate opportunities, manage campaigns, communicate, exchange deliverables, provide analytics, and resolve disputes.
• Payment, payout, identity-verification, tax, fraud-prevention, banking, and financial-service providers, primarily Stripe and Stripe Connect.
• Infrastructure and platform providers, including Convex (backend and database), Amazon S3 via Railway (image, audio, document, and avatar storage), Railway (application hosting for our web apps and sidecar services), and Cloudflare (CDN, edge networking, DNS, media delivery, and security).
• Analytics and error-monitoring providers, including PostHog for product analytics and Sentry for error reporting.
• Communications providers, including email, SMS, and push-notification providers we use to send transactional and support messages.
• Social platforms, data, advertising, and attribution providers, including TikTok, Meta, YouTube/Google, and others when you connect an account, submit a handle, authorize an integration, participate in a campaign, or use an advertising feature.
• AI providers, including OpenRouter, Google (Gemini), and Xiaomi (MiMo), as described in Section 8.
• Professional advisors, including auditors, insurers, accountants, lawyers, and consultants where reasonably necessary.
• Government authorities, courts, law enforcement, regulators, card networks, issuing banks, payment processors, and affected parties where required or permitted by law — including to respond to legal process, report suspected unlawful activity, investigate fraud, or defend against payment disputes and legal claims.
• Potential or actual investors, buyers, sellers, lenders, and advisors involved in a financing, merger, acquisition, restructuring, sale of assets, bankruptcy, or similar corporate transaction.
• Other parties at your direction, with your consent, or as otherwise disclosed when the information is collected.

We may also disclose information that has been aggregated or deidentified so it cannot reasonably be linked to an individual. We do not sell personal information for money. Based on the practices described in this Privacy Policy, we do not disclose personal information for cross-context behavioral advertising as that term is defined under applicable U.S. state privacy laws. If our practices change, we will update this Privacy Policy and provide legally required choices.

10. Cookies, Pixels, and Similar Technologies

Sovian and its service providers use cookies, pixels, local storage, SDKs, log files, and similar technologies to authenticate users, maintain sessions, remember preferences, protect accounts, prevent fraud, measure use of the Services, diagnose problems, understand product performance, and measure our own marketing campaigns and conversions. These technologies may collect device, browser, IP address, referral, page-view, event, session, and conversion information.

We currently use PostHog for product analytics and session-level measurement and Sentry for error monitoring. The tools we use may change over time.

Where applicable law requires consent or an additional preference mechanism for non-essential cookies or tracking technologies, we will present one. You can also control many technologies through your browser settings, device settings, or platform controls. Blocking certain technologies may affect the functionality of the Services.

Some browsers offer a Do Not Track signal. Because there is no uniform industry standard for interpreting it, we do not currently respond to that signal. Where required by law, we will recognize legally mandated browser-based opt-out preference signals for the activities to which they apply.

11. Communications, Support, and Recordings

We may communicate with you through email, SMS, push notifications, in-app messages, and customer-support tools. We use these communications to operate the Services, provide support, send security and transaction notices, administer campaigns, and (where permitted) send product or marketing information.

You can opt out of marketing emails by using the unsubscribe link, and you can opt out of marketing text messages by replying STOP where available. You may continue to receive non-marketing messages necessary for your account, transactions, campaigns, security, or legal obligations.

Sovian may record or transcribe sales calls, support sessions, interviews, onboarding meetings, and other meetings. When recording or transcription is used, a recording or note-taking participant or tool may be visibly present and additional notice may be provided. If you do not wish to be recorded, please raise that concern before continuing. We use recordings and transcripts for documentation, training, quality assurance, support, and business operations, subject to applicable law.

We may access, review, retain, or disclose communications sent through the Services where reasonably necessary to provide support, moderate the platform, investigate fraud or policy violations, resolve disputes, enforce agreements, protect users, or comply with law.

12. Legal Bases for Processing

Where the laws of the European Economic Area, United Kingdom, Switzerland, or another jurisdiction require us to identify a legal basis, we rely on one or more of the following:

• Performance of a contract or steps requested before entering a contract, including providing accounts, marketplace services, campaign workflows, payments, payouts, analytics, and support.
• Legitimate interests, including operating and improving the Services, preventing fraud and abuse, protecting users and the platform, measuring performance, communicating with business users, enforcing agreements, and developing new features, balanced against your rights and interests.
• Consent, including where required for optional communications, certain cookies or tracking technologies, connected services, or other consent-based processing. You may withdraw consent at any time, without affecting prior lawful processing.
• Compliance with legal obligations, including tax, accounting, regulatory, sanctions, law-enforcement, and recordkeeping requirements.
• Protection of vital interests or the public interest where applicable and legally permitted.

Where Sovian processes personal information solely on a customer’s instructions as a processor or service provider, the customer determines the applicable legal basis and is responsible for responding to data-subject requests relating to that processing, subject to the parties’ agreement.

13. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services and fulfill the purposes described here, including to comply with law, maintain security, prevent fraud, resolve disputes, enforce agreements, and establish, exercise, or defend legal claims. Retention periods vary based on the type of information, the nature of the relationship, legal requirements, and operational needs.

When you delete your account, we delete or deidentify personal information we are not required or permitted to retain. Deleting an account does not require us to delete information needed to complete transactions, maintain campaign or content records, comply with law, respond to chargebacks, prevent fraud or abuse, enforce agreements, preserve suspension or termination records, or defend legal claims. We may retain a minimal suppression record to prevent a deleted or suspended account from being improperly recreated.

14. Data Security

Sovian maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These may include access controls, authentication, encryption in transit, monitoring, vendor management, incident response, and employee or contractor confidentiality obligations, as appropriate to the nature of the information and the Services.

No system, transmission, or storage method is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed without authorization. You are responsible for maintaining the confidentiality of your login credentials, using secure devices and networks, and promptly notifying us if you suspect unauthorized access.

15. International Data Transfers

Sovian is based in Canada and provides Services to users in multiple countries. Personal information may be transferred to, stored in, or processed in Canada, the United States, and other countries where Sovian, its customers, or its service providers operate. Many of our core providers — including Stripe, Convex, Cloudflare, Railway, PostHog, Sentry, and OpenRouter — process information in the United States. Xiaomi MiMo is a non-U.S. AI provider. Google (Gemini) and other providers may process information in multiple regions. These countries may have data-protection laws that differ from the laws where you live.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include contractual protections, transfer-impact assessments, consent, or other lawful transfer mechanisms.

16. Your Privacy Rights and Choices

Depending on where you live and subject to applicable exceptions, you may have the right to:

• Request confirmation of whether we process your personal information and access a copy of it.
• Request correction of inaccurate personal information.
• Request deletion of personal information.
• Request restriction of or object to certain processing.
• Receive certain personal information in a portable format.
• Withdraw consent where processing is based on consent.
• Opt out of certain marketing communications.
• Appeal our denial of a privacy request where applicable.
• Request information about or review of qualifying automated decision-making where applicable.
• Lodge a complaint with a data-protection authority or regulator.

You can update certain account information or delete your account through account settings. To submit any other privacy request, email [email protected]. Please describe your request and the account or email address involved. We may need to verify your identity before completing a request, and we may ask for additional information reasonably necessary for verification. Authorized agents may submit requests where permitted by law, subject to proof of authority and identity verification.

Privacy rights are not absolute. We may deny or limit a request where permitted by law — including where information must be retained to complete a transaction, protect security, prevent fraud, preserve legal claims, comply with law, or protect another person’s rights, or where the request is manifestly unfounded or excessive. We will not unlawfully discriminate against you for exercising a privacy right.

17. Canadian, U.S., and Other Regional Disclosures

Canada. Personal information about individuals in Canada is handled in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Alberta’s Personal Information Protection Act (PIPA) and other provincial privacy laws. Residents of Canada may access, correct, or challenge the accuracy of their personal information and may file a complaint with our privacy contact at [email protected]. If your concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada or, if you are an Alberta resident, the Office of the Information and Privacy Commissioner of Alberta.

United States. Residents of certain U.S. states may have additional rights under comprehensive state privacy laws. The categories we may collect are described in Section 2; sources are described in Section 3; purposes are described in Sections 4 through 8; and recipient categories are described in Section 9. Sovian does not sell personal information for money. Based on the practices described here, Sovian also does not share personal information for cross-context behavioral advertising. We may disclose personal information to service providers, contractors, payment providers, advertising platforms, and other recipients for business purposes such as providing the Services, analytics, fraud prevention, security, communications, payments, and customer-directed advertising operations. We may process information considered sensitive under certain state laws — such as account credentials, precise financial or identity-verification information received in limited form, optional gender information, and information used to verify identity or prevent fraud. We process sensitive personal information only for permitted purposes, to provide requested Services, for security and fraud prevention, or with consent where required. We do not use sensitive personal information to infer characteristics about you for unrelated advertising purposes. To exercise an applicable state privacy right, email [email protected]. If we deny a request and your state provides a right to appeal, you may appeal by replying to our decision and clearly stating that you wish to appeal. You may also contact your state attorney general or other applicable regulator.

EEA, U.K., and Switzerland. If you are located in the European Economic Area, United Kingdom, or Switzerland, the legal bases we rely on are described in Section 12. You may exercise the rights described in Section 16 by contacting [email protected], and you may also lodge a complaint with the data-protection authority in your country or region.

18. Children and Minors

The Services are intended only for individuals who are at least 18. We do not knowingly collect personal information from, permit accounts for, or market the Services to anyone under 18. If we learn that an individual under 18 has provided personal information, we may suspend or close the account and delete the information, subject to legal, fraud-prevention, safety, and recordkeeping requirements. Contact [email protected] if you believe a minor has used the Services.

19. Third-Party Services and Links

The Services may include links to, integrations with, or functionality provided by third parties — including social networks, payment providers, identity-verification providers, advertising platforms, app stores, communications tools, and customer systems. Sovian is not responsible for the privacy practices of third parties acting independently. Review their privacy policies before providing information or authorizing access.

When you connect a third-party account or integration, you authorize Sovian and the third party to exchange information as necessary to provide the requested functionality. You can remove certain integrations through Sovian or the third party, but previously transferred information may be retained as described here or in the third party’s policy.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, technology, law, or our practices. We will post the updated version and revise the effective date at the top. If a change is material, we may provide additional notice through the Services, by email, or another reasonable method. Changes become effective on the date stated in the updated Privacy Policy unless otherwise specified.

21. Contact Us

Sovian A sole proprietorship Attn: Privacy Contact Edmonton, Alberta, Canada

• Email: [email protected]

If you are located in Canada, you may also contact the Office of the Privacy Commissioner of Canada, and Alberta residents may contact the Office of the Information and Privacy Commissioner of Alberta. If you are located in the European Economic Area, United Kingdom, or Switzerland, you may also lodge a complaint with the data-protection authority in your country or region.