Privacy Policy

Last Updated: October 4, 2026

Introduction

This privacy policy ("Policy") describes how Lustrace Digital OÜ, operating as Collabios ("Company," "we," and "our") processes, collects, uses and shares personal data when using this website https://Collabios.com (the "Website"). The data controller is Lustrace Digital OÜ, registered in Estonia under registry code 16948107, with registered address at Harju maakond, Kuusalu vald, Pudisoo küla, Männimäe/1, 74626, Estonia. You can reach our privacy team at privacy@collabios.com. Please read the following information carefully to understand our practices regarding your personal data and how we will process data.

Purposes of Processing

What is personal data?

We collect information about you in a range of forms, including personal data. As used in this Policy, "personal data" is as defined in the General Data Protection Regulation, this includes any information which, either alone or in combination with other information we process about you, identifies you as an individual, including, for example, your name, postal address, email address and telephone number.

Why do we need your personal data?

We will only process your personal data in accordance with applicable data protection and privacy laws. We need certain personal data in order to provide you with access to the website. If you registered with us, you will have been asked to tick to agree to provide this information in order to access our services, purchase our products, or view our content. This consent provides us with the legal basis we require under applicable law to process your data. You maintain the right to withdraw such consent at any time. If you do not agree to our use of your personal data in line with this Policy, please do not use our website.

Collecting Your Personal Data

We collect information about you in the following ways. We obtain your personal data directly from you when you register for or use the website. For creators, we may also collect information from publicly available sources and from connected platforms where you have made your profile public. We also collect technical data automatically, such as your IP address and browser user agent, when you use the website.

Information You Give Us. This includes:

the personal data you provide when you register to use our website, including your name, postal address, email address, telephone number, username, password and demographic information (such as your gender);
the personal data that may be contained in any video, comment or other submission you upload or post to the website;
the personal data you provide in connection with our rewards program and other promotions we run on the website;
the personal data you provide when you report a problem with our website or when we provide you with customer support;
the personal data you provide when you make a purchase through our website; and
the personal data you provide when you correspond with us by phone, email or otherwise.

Information from Social Networking Websites.

Our website includes interfaces that allow you to connect with social networking sites (each a "SNS"). If you connect to a SNS through our website, you authorize us to access, use and store the information that you agreed the SNS could provide to us based on your settings on that SNS. We will access, use and store that information in accordance with this Policy. You can revoke our access to the information you provide in this way at any time by amending the appropriate settings from within your account settings on the applicable SNS.

Information Automatically Collected.

We automatically log information about you and your computer or mobile device when you access our website. For example, when visiting our website, we log your computer or mobile device operating system names and version, manufacturer and model, browser type, browser language, screen resolution, the website you visited before browsing to our website, pages you viewed, how long you spent on a page, access times and information about your use of and actions on our website. We collect this information about you using cookies.

Automated Decision Making and Profiling.

We do not make decisions that produce legal or similarly significant effects concerning you based solely on automated processing within the meaning of Article 22 GDPR. We do carry out profiling within the meaning of Article 4(4) GDPR, for example to power recommendation and ranking signals and the creator AI-crawler discovery preference. You have the right to object to this profiling under Article 21(1) GDPR, on grounds relating to your particular situation.

User Profiling and Submissions.

Certain user profile information, including your name, location, and any video or image content that such user has uploaded to the Services, may be displayed to other users to facilitate user interaction within the Services or address your request for our services. Your account privacy settings may allow you to limit the other users who can see the Personal Information in your user profile and/or what information in your user profile is visible to others. Please remember that any content you upload to your public user profile, along with any Personal Information or content that you voluntarily disclose online in a manner other users can view (on discussion boards, in messages and chat areas, etc.) becomes publicly available, and can be collected and used by anyone. Your user name may also be displayed to other users if any when you send messages or comments or upload images or videos through the Services and other users can contact you through messages and comments. Additionally, if you sign into the Services through a third party social networking site or service, your list of "friends" from that site or service may be automatically imported to the Services, and such "friends", if they are also registered users of the Services, may be able to access certain non-public information you have entered in your Services user profile. Again, we do not control the policies and practices of any other third party site or service.

Cookies

What are cookies?

We may collect information using "cookies." Cookies are small data files stored on the hard drive of your computer or mobile device by a website. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer or mobile device until you delete them) to provide you with a more personal and interactive experience on our website.

We use two broad categories of cookies: (1) first party cookies, served directly by us to your computer or mobile device, which are used only by us to recognize your computer or mobile device when it revisits our website; and (2) third party cookies, which are served by service providers on our website, and can be used by such service providers to recognize your computer or mobile device when it visits other websites.

Cookies we use

Our website uses the following types of cookies for the purposes set out below:

Essential Cookies

These cookies are essential to provide you with services available through our website and to enable you to use some of its features. For example, they allow you to log in to secure areas of our website and help the content of the pages you request load quickly. Without these cookies, the services that you have asked for cannot be provided, and we only use these cookies to provide you with those services.

Functionality Cookies

These cookies allow our website to remember choices you make when you use our website, such as remembering your language preferences, remembering your login details and remembering the changes you make to other parts of our website which you can customize. The purpose of these cookies is to provide you with a more personal experience and to avoid you having to re-enter your preferences every time you visit our website.

Analytics and Performance Cookies

These cookies are used to collect information about how visitors use our website, including the number of visitors, the websites that referred them to our website, the pages they visited, what time of day they visited our website, whether they have visited our website before, and other similar information. Some of the analytics tools we use (Google Analytics and Microsoft Clarity) set identifiers on your device, such as the _ga, _gid, _clck and _clsk cookies; where they do so, this happens only on the basis of your analytics-cookie consent. We use this information to help operate our website more efficiently, to gather broad demographic information and to monitor the level of activity on our website. We use Google Analytics and Microsoft Clarity for this purpose. You can find out more information about Google Analytics cookies here: https://developers.google.com/analytics/resources/packages/documents/cookies. You can find out more about how Google protects your data here: https://policies.google.com/privacy. You can prevent the use of Google Analytics relating to your use of our website by downloading and installing the browser plugin available via this link: https://tools.google.com/dlpage/gaoptout

Targeted and advertising cookies

These cookies track your browsing habits to enable us to show advertising which is more likely to be of interest to you. These cookies use information about your browsing history to group you with other users who have similar interests. Based on that information, and with our permission, third party advertisers can place cookies to enable them to show advertisements which we think will be relevant to your interests while you are on third party websites. You can disable cookies which remember your browsing habits and target advertising at you by visiting http://www.youronlinechoices.com/uk/your-ad-choices. If you choose to remove targeted or advertising cookies, you will still see adverts but they may not be relevant to you. Even if you do choose to remove cookies by the companies listed at the above link, not all companies that serve online behavioral advertising are included in this list, and so you may still receive some cookies and tailored adverts from companies that are not listed.

We use Meta Business Tools to measure the performance of our advertising. When you accept marketing cookies, the Meta pixel runs in your browser and we also report the same conversion to Meta from our servers through the Conversions API, so a single purchase is counted once rather than twice. Before anything is sent, your email address is hashed with SHA-256; your IP address, your browser's user agent and the _fbp and _fbc cookies are shared as they are, together with the purchase value and currency. This processing relies on your consent (Article 6(1)(a) GDPR, read together with Article 5(3) of the ePrivacy Directive). The marketing cookie category is the control that switches the Meta pixel and the Conversions API reporting on and off. Turning off marketing cookies stops this processing, and withdrawing your consent is as easy as giving it; withdrawal does not affect processing carried out before it.

Social Media Cookies

These cookies are used when you share information using a social media sharing button or "like" button on our website or you link your account or engage with our content on or through a social networking website such as Facebook or X. The social network will record that you have done this.

Disabling cookies

You can typically remove or reject cookies via your browser settings. In order to do this, follow the instructions provided by your browser (usually located within the "settings," "help" "tools" or "edit" facility). Many browsers are set to accept cookies until you change your settings.

If you do not accept our cookies, you may experience some inconvenience in your use of our website. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit our website.

A concrete inventory of every cookie and browser-storage item Collabios sets — with name, purpose, and duration — is maintained on the in-product privacy page at /settings/privacy.

AI assistants and LLM access

Separately from cookies, Collabios gives creators an independent discovery preference to allow — or block — AI crawlers and large language models (such as GPTBot, ClaudeBot, Perplexity, Google-Extended) from accessing their public profile. The legal basis is GDPR Article 6(1)(f) legitimate interest (creators joined a discovery marketplace to be found, including by AI assistants), with the Article 21 right to object exercised via the toggle in privacy settings. This preference is distinct from cookies and from SEO indexing, and is on by default for new accounts. For the full policy, the list of recognised crawlers, and how disabling is enforced, see our AI and LLM transparency page.

Advertising

We use Meta Business Tools (the Meta pixel and the Conversions API) to measure the performance of the advertising we run on Meta's platforms, such as Facebook and Instagram. This measurement is active only when you have accepted marketing cookies. When it is active, the pixel records events in your browser and our servers report the same conversions to Meta through the Conversions API; the two are deduplicated so that one purchase counts as one conversion. The data involved is listed in the "Targeted and advertising cookies" section above. Where we work with other advertising partners, they may use their own tracking technologies, and their use of those technologies is subject to their own privacy policies.

Using Your Personal Data. We may use your personal data as follows:

to operate, maintain, and improve our website, products, and services;
to manage your account, including to communicate with you regarding your account, if you have an account on our website;
to operate and administer our rewards program and other promotions you participate in on our website;
to respond to your comments and questions and to provide customer service;
to send information including technical notices, updates, security alerts, and support and administrative messages;
with your consent, to send you marketing e-mails about upcoming promotions, and other news, including information about products and services offered by us and our affiliates. You may opt-out of receiving such information at any time: such marketing emails tell you how to "opt-out." Please note, even if you opt out of receiving marketing emails, we may still send you non-marketing emails. Non-marketing emails include emails about your account with us (if you have one) and our business dealings with you;
to process payments you make via our website;
as we believe necessary or appropriate (a) to comply with applicable laws; (b) to comply with lawful requests and legal process, including to respond to requests from public and government authorities; (c) to enforce our Policy; and (d) to protect our rights, privacy, safety or property, and/or that of you or others;
for analysis and study services;
as described in the "Sharing of your Personal Data" section below.

Sharing Your Personal Data

We may share your personal data as follows:

Third Parties Designated by You. We may share your personal data with third parties where you have provided your consent to do so.
Our Third Party Service Providers. We may share your personal data with our third party service providers who provide services such as data analysis, payment processing, information technology and related infrastructure provision, customer service, email delivery, auditing and other similar services.
Third Party Sites

Our website may contain links to third party websites and features. This Policy does not cover the privacy practices of such third parties. These third parties have their own privacy policies and we do not accept any responsibility or liability for their websites, features or policies. Please read their privacy policies before you submit any data to them.

Third parties we work with

We rely on a small number of carefully-chosen third parties to operate Collabios. Some are data processors acting on our instructions (e.g. hosting, email). Others are independent or joint controllers that determine the means and purposes of their own processing — notably payment providers. For each, appropriate safeguards (EU Standard Contractual Clauses, Data Privacy Framework certification, DPAs) are in place where data leaves the European Economic Area.

Stripe Inc. — Payment processing and creator payout onboarding. Stripe acts as an independent controller for payment authorisation and fraud-prevention, and as a joint controller with us for onboarding. Located in San Francisco, USA. Transfers rely on EU SCCs and Stripe's Data Privacy Framework certification. Privacy policy: https://stripe.com/privacy
Amazon Web Services (AWS) — Cloud hosting, database and file storage. Processor. Data stored in the EU region (Stockholm). Privacy policy: https://aws.amazon.com/privacy/
Sweego — SMS notifications and phone-number verification. Processor. Based in France; data is processed within the EU, so no transfer safeguards are required. Privacy policy: https://www.sweego.io/
Google LLC — Analytics (Google Analytics 4, only when you consent to analytics cookies) and optional social sign-in (OAuth). For OAuth, Google acts as an independent controller. Privacy policy: https://policies.google.com/privacy
Sentry — Error tracking. Processor. EU ingest region; optional session replay is strictly gated by your analytics-cookie consent. Privacy policy: https://sentry.io/privacy/
Microsoft Corporation — Session recordings and heatmaps (Microsoft Clarity), only when you consent to analytics cookies. Microsoft acts as an independent controller for this data. Sensitive fields (payment, messaging) are masked before recording. Privacy policy: https://privacy.microsoft.com/privacystatement
Meta Platforms Ireland Ltd. — Measurement of the performance of our advertising on Meta's platforms (Meta Business Tools: the Meta pixel and the Conversions API). Meta acts as a joint controller with us, under Article 26 GDPR, for the collection of event data through these tools, and as an independent controller for the processing it carries out afterwards. Located in Ireland; personal data is transferred to Meta Platforms, Inc. in the United States under the EU Standard Contractual Clauses set out in Meta's Data Transfer Addendum. This processing is active only when you consent to marketing cookies. Privacy policy: https://www.facebook.com/privacy/policy/
Plausible Insights OÜ — Privacy-friendly website analytics (traffic measurement). Processor. Cookieless, and no identifier is stored on your device, so no consent is required; data is hosted in the EU (Germany) and does not leave the EEA. Privacy policy: https://plausible.io/privacy
SMTP email provider — Transactional and opt-in marketing emails. Processor. Full inventory maintained in our internal processor register; contact privacy@collabios.com for the current provider list.

User Generated Content

You may share personal data with us when you submit user generated content to our website, including via our rewards program, forums, message boards and blogs on our website. Please note that any information you post or disclose on our website will become public information, and will be available to other users of our website and to the general public. We urge you to be very careful when deciding to disclose your personal data, or any other information, on our website. Such personal data and other information will not be private or confidential once it is published on our website.

If you provide feedback to us, we may use and disclose such feedback on our website, provided we do not associate such feedback with your personal data. If you have provided your consent to do so, we may post your first and last name along with your feedback on our website. We will collect any information contained in such feedback and will treat the personal data in it in accordance with this Policy.

International Data Transfer

Your information, including personal data that we collect from you, may be transferred to, stored at and processed by us outside the country in which you reside, where data protection and privacy regulations may not offer the same level of protection as in other parts of the world. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy. Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses, in accordance with GDPR requirements.

Security

We seek to use reasonable organizational, technical and administrative measures to protect personal data within our organization. Unfortunately, no transmission or storage system can be guaranteed to be completely secure, and transmission of information via the Internet is not completely secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem by contacting us.

Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. On an erasure request, we delete your personal data from our live systems immediately and erase your media from storage. Automated encrypted backup snapshots are retained for up to 30 days, after which they roll off; data within that window is not accessed except in disaster recovery. The specific retention periods are as follows:

Account data — Retained for the duration of your account plus 3 years after account deletion.
Transaction and payment records — Retained for 7 years from the end of the financial year in which the transaction occurred, in accordance with the Estonian Accounting Act §12 and Taxation Act §58.
Server logs — Retained for 90 days.
Cookie data — Retention varies per cookie type: session cookies are deleted when you close your browser; analytics cookies are retained for up to 2 years.
Communication records (messages tied to a booking) — Retained for 7 years from the end of the financial year in which the related booking was completed, in accordance with the Estonian Accounting Act §12 and to enable defence of legal claims under GDPR Art. 17(3)(b)(e). Account deletion does not erase these messages — your name is replaced with "Deleted user" in the counterparty's view, while the message contents are preserved as marketplace evidence.
Communication records (pre-hire messages with no resulting booking) — Retained for 24 months after the last message; deleted automatically thereafter.
Communication records (conversations both parties have hidden) — Hard-deleted 90 days after the second hide, provided no booking is linked and no new message has been sent.
Email marketing consent records — Retained indefinitely as proof of consent in compliance with GDPR requirements.

Our Policy on Children

Our website is not directed to children under 18. If a parent or guardian becomes aware that their child (a minor under 18) has provided us with information without their consent, they should contact us. We will delete such information from our files as soon as reasonably practicable.

Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right to Access (Article 15) — You have the right to request a copy of all personal data we hold about you. We will provide this information within one month of your request.
Right to Rectification (Article 16) — You have the right to correct inaccurate personal data. You can update your information directly via your account settings or by contacting us.
Right to Erasure (Article 17) — You have the right to request the deletion of your account and all associated personal data, subject to any legal retention obligations.
Right to Restriction of Processing (Article 18) — You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
Right to Data Portability (Article 20) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object (Article 21) — You have the right to object, on grounds relating to your particular situation, to processing of your personal data that is based on Article 6(1)(e) or 6(1)(f) GDPR (including profiling based on those grounds). You also have the right to object at any time to the processing of your personal data for direct marketing purposes (including profiling for such purposes); upon such an objection, we will cease processing your data for that purpose.
Right to Withdraw Consent — Where processing is based on your consent, you have the right to withdraw that consent at any time via your cookie settings or account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If you wish to exercise any of these rights, please contact us at privacy@collabios.com. In your request, please make clear: (i) what personal data is concerned; and (ii) which of the above rights you would like to exercise. For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will respond to your request within one month. Please note that we may need to retain certain information for legal obligations and/or to complete any transactions that you began prior to requesting such change or deletion.

Complaints

We are committed to resolve any complaints about our collection or use of your personal data. If you would like to make a complaint regarding this Policy or our practices in relation to your personal data, please contact us through the information listed on our website. We will reply to your complaint as soon as we can and in any event, within 30 days. We hope to resolve any complaint brought to our attention, however if you feel that your complaint has not been adequately resolved, you reserve the right to contact your local data protection supervisory authority.

Data Protection Contact

For any data protection inquiries, please contact our Data Protection Contact at privacy@collabios.com.

You may also contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at info@aki.ee.

Contact Information

We welcome your comments or questions about this Policy. You may contact us in writing or through our website.