Last updated: March 15, 2026

1. Data Controller

The data controller is Vaiku ("Service"). Contact: info@vaiku.io.

2. Scope

This policy describes how Vaiku processes personal data of companies and content creators (influencers) using the service.

3. Personal Data We Collect

a) All users

Name, email address, password (hashed), username, profile type, language preference

b) Company users

Company name, business ID (Y-tunnus), billing address, Stripe customer ID (card data is processed by Stripe — we do not store card numbers)

c) Content creators

Bio, location, website, phone number, profile picture, interests, payment details (IBAN, address), previous campaigns and collaboration partners

d) Social media integrations (TikTok & Instagram)

OAuth tokens; username, display name, profile picture, bio; follower counts, engagement rate, videos/posts and their statistics; audience demographics (gender, age, location)

e) Campaign data

Applications (motivation text, expected reach, compensation proposal), content deliverables (URL, type, statistics), digital contracts (signatures, PDF)

f) Messaging

Message content, attachments, read status

g) Automatically collected

Campaign tracking link clicks: IP address, user agent, referrer, timestamp; cookies (see section 9)

4. Purposes and Legal Basis

Account creation and management, campaign management, payments, and messaging are processed on the basis of contract. Social media analysis (OAuth tokens, metrics, demographics) is processed based on your consent. Brand safety analysis, tracking link analytics, email notifications, and customer support are based on legitimate interest. Billing data is retained under a legal obligation (Accounting Act).

5. Sub-processors

In providing the service, we use third-party processors for database hosting, payment processing, email delivery, application hosting, social media integrations, automated content analysis, and customer support. Where data is transferred outside the EU/EEA, appropriate safeguards are in place in accordance with GDPR Article 46.

6. Data Retention

Account and profile data is retained for the duration of the account plus 3 years. Billing and accounting data is kept for 7 years (Accounting Act). Messages are retained for the duration of the account. Social media tokens are kept until the connection is revoked. Campaign data and contracts are retained for 7 years from the campaign end. Tracking link click data is kept for 2 years.

7. Data Subject Rights

Under the GDPR, you have the following rights:

Right of access — request a copy of your personal data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data
Right to restriction of processing
Right to data portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interest
Right to withdraw consent — for social media integrations at any time

To exercise your rights, contact us at info@vaiku.io. We will respond within one month.

You also have the right to lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, and destruction. These measures are reviewed and updated as necessary to address changes in risk and technology.

9. Cookies

The service uses essential and functional cookies only: a NextAuth session JWT (30 days) to maintain login state, a NEXT_LOCALE cookie (1 year) for language preference, and a Crisp cookie (session) for customer support chat. We do not use third-party tracking or analytics cookies.

10. Changes to This Policy

We may update this privacy policy as the service develops. Significant changes will be communicated via email or through a notification in the service. The latest version is always available at this page.

Create your first campaign›

Start earning as an influencer›