Creator privacy notice

Last updated: 12 October 2026

This notice is for creators, influencers and affiliates who work with Venneir or Piranha, or who we are thinking of working with. It explains what we collect about you, why, who we share it with, how long we keep it and how to have it deleted. If you shop with us as a customer, our main privacy policy covers that.

We run our creator programme in our own app, called Starlight (starlight.venneir.com). When this notice says "we", it means Venneir Limited, company number SC622322, registered in Scotland at 4 Lynedoch Place, Glasgow G3 6AB. Venneir and Piranha are both brands of Venneir Limited, and Venneir Limited is the controller of your data.

What we collect

When you apply or sign up

  • Your name, email address and country.
  • The platform you post on most and your handle there.
  • What you want from us (collabs, an affiliate link and code, or both), and anything you tell us about what you make.
  • Who invited you, if someone did.
  • That you confirmed you are 18 or over, and the exact wording you agreed to.
  • A scrambled (hashed) copy of your IP address and a random id for your device, so we can stop fake sign ups and people referring themselves.

While you work with us

  • Messages, emails, texts, WhatsApp and Instagram messages you send us, and calls with our team. Calls may be recorded.
  • Your delivery address, so we can send you products, and parcel tracking for those deliveries.
  • Agreements you sign: your name, signature, the time, your device and browser, and a scrambled copy of your IP address.
  • The content you make for us and how it performed.
  • Sales made through your link or code, your commission, and the bank details you give us so we can pay you.
  • Notes our team writes about your partnership.

From your social accounts

We only ever use the platforms' official tools. We never scrape, and we never send messages or post as you.

  • Public profile numbers. For Instagram business and creator accounts and for YouTube channels, we can read what the platform makes public. That includes your name, bio, profile picture, followers, how many posts you have, and likes, comments and views on your recent posts. We may do this before we contact you, to see if a partnership would fit.
  • Accounts you connect. If you choose to connect Instagram or TikTok in your creator portal, we read your profile, followers, your posts and their results (views, reach, likes, comments, shares and saves). On Instagram this also includes a summary of your audience: their top countries, age bands and gender, shown as percentages, never as individual people. On TikTok we ask only for the permissions user.info.basic, user.info.profile, user.info.stats and video.list. On Instagram we ask only for instagram_business_basic and instagram_business_manage_insights.
  • We refresh these numbers once a day. We keep your login tokens encrypted, and only our servers can read them.

If you are also a Venneir customer

If you have had products made by us, such as Click in veneers, we can match your creator account to your customer records by your name, email, phone number, postcode or order number. We do this so you, and the team who look after you, can see your scans, designs and impression kits when you choose a product. These pictures show your teeth, so we treat them with extra care. They are only shown to you and to our team, through links that expire.

If you click a creator's link

When a shopper opens a creator's link, we record the visit so the creator is paid fairly for the sales they bring. We keep a shortened IP address (the last part removed), scrambled copies of the IP address and browser that change every 90 days, the type of device, the country, the page landed on and the website you came from. We keep the full IP address for 90 days only, to catch fraud. If you have said no to tracking in the shop's cookie banner, we record nothing about you, only that the link was used.

Why we use it, and our legal reasons

  • To run our partnership with you: collabs, products, agreements, tracking your sales and paying you. The legal reason is our contract with you.
  • To find creators who might suit our brands, using public profile numbers. The legal reason is our legitimate interest in finding partners. We only look at public, business facing accounts, and you can ask us to stop at any time.
  • To show you numbers from accounts you connect. The legal reason is your consent, which you can take back at any time by disconnecting.
  • To show you your scans and designs. The legal reason is your explicit consent, which you can take back at any time.
  • To prevent fraud and keep payments fair. The legal reason is our legitimate interest.
  • To keep tax and payment records. The legal reason is that the law requires us to.

We do not sell your data, and we do not use your social data for advertising.

Who we share it with

Only Venneir and Piranha staff can see your details. We use these companies to run Starlight, and each one only gets what it needs:

  • Supabase (database, logins and file storage, hosted in London).
  • Vercel (hosts the Starlight website).
  • Resend (sends and receives our emails).
  • Twilio (calls, texts, WhatsApp and video calls).
  • Meta (Instagram and WhatsApp), TikTok and Google (YouTube), to read social numbers and send messages you start with us.
  • Shopify (our shops: creator codes, free product orders and sales).
  • Wise (sends your payments).
  • DPD (delivers and tracks your parcels).
  • Anthropic (an AI writing helper our team can choose to use to tidy a reply to you. It sees the draft reply and may see your first name, nothing else).
  • Cloudflare (checks a sign up is from a real person, when switched on).

We may also share data if the law requires it, or if Venneir Limited is sold or merged.

YouTube

Starlight uses YouTube API Services. By letting us read your YouTube channel, you also agree to the YouTube Terms of Service, and Google's use of data is covered by the Google Privacy Policy. We refresh YouTube data at least every 30 days and delete older copies after 30 days. You can remove any app's access to your Google account at Google's security settings.

Data outside the UK

Our main database is in London. Some of the companies above process data in other countries, including the United States and the European Union. When they do, we use approved safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

How long we keep it

  • Social account logins: until you disconnect, then deleted straight away along with the numbers we read through them.
  • YouTube data: refreshed or deleted within 30 days.
  • Shopper link visits: full IP addresses 90 days; shortened and scrambled details 13 months.
  • Payment, commission and tax records: six years, because UK law requires it.
  • Everything else: while we work together, or while we are considering a partnership, and until you ask us to delete it.

Your rights

You can ask us to show you, correct, delete or send you a copy of your data, to stop using it, or to stop using it for a particular reason. In your creator portal, Profile has Download my data and Delete my data. You can also email us at accounts@venneir.com. We answer within one month. When you ask us to delete your data, we first pay any money we owe you, then delete it, keeping only the payment records the law makes us keep.

Disconnecting your social accounts

  • In Starlight: go to your creator portal, Profile, and tap Disconnect next to the account.
  • Instagram: in the Instagram app go to Settings, Apps and websites, and remove Starlight. We are told at once and delete what we read through that connection.
  • TikTok: in the TikTok app go to Settings and privacy, Security, Apps and services permissions, and remove Starlight. Disconnecting in Starlight also cancels our access with TikTok.

Under 18s

Our creator programme is only for people aged 18 or over. If we learn we have data about someone younger, we delete it.

Keeping it safe

Your data is stored encrypted, social logins are encrypted again with their own key, and only staff who need it can see it. No system is perfectly safe, and if something goes wrong that affects you, we will tell you and the regulator as the law requires.

Complaints

Please talk to us first at accounts@venneir.com. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection regulator where you live.

Changes

If we change this notice we will update the date at the top, and tell you in your creator portal if the change matters to you.