1. Who we are and what this policy covers
Phenomens is a platform that connects brands with creators on TikTok, Instagram and YouTube and pays creators per verified view. This Privacy Policy covers personal data processed through the phenomens.com website, the brand and creator dashboards and our mobile apps (together, the “Platform”).
The company responsible for your data (the data controller) is Devition Yazılım ve Bilişim Teknolojileri A.Ş. (Türkiye) (“Phenomens”, “we”, “us”). Phenomens is operated by this company, which also pays creators directly.
The Platform is not intended for anyone under 18. If we learn that we hold data of a person under 18, we delete it.
2. Data we collect
- Account data: name, email address, phone number, password (stored as an irreversible hash), account type.
- Creator data: social media usernames, connected accounts, your creator code, links to content you submit to campaigns and the performance data of that content.
- Social media platform data: data we receive from the official TikTok, Instagram and YouTube APIs, described in section 3.
- Brand data: company name, tax details, billing address, contact person details, campaign and brief content.
- Payout data: for creators, IBAN, account holder name, tax status and identity details required by law; for brands, balance and invoice records. Card details are never stored by Phenomens and are processed by licensed payment providers.
- Communications: in-Platform messages, support requests and information you send through our contact form.
- Technical data: IP address, device and browser information, session records, cookies and security logs.
3. Data we receive from TikTok, Instagram and YouTube
We read platform data primarily from the platforms’ official APIs. When you connect an account, you sign in on the platform’s own page; we never see your password. All permissions we request are read-only.
| Platform | How | What data |
|---|---|---|
| TikTok | When you connect your account with Login with TikTok (TikTok Login Kit), using read-only permissions. | Account ID (open_id), display name and avatar; @username, bio, verified badge and profile link; follower, following, total likes and video counts; the list of your public videos; for videos you submit to a campaign, their view, like, comment and share counts, publish time and share link. user.info.basic, user.info.profile, user.info.stats, video.list |
| Instagram (Meta) | (a) When you connect your Instagram professional account with Instagram Login. (b) When you apply as a creator, your public professional-profile data through Meta’s Business Discovery feature, queried from our own Phenomens Instagram account. | (a) Account ID, username, profile picture, account type, follower and media counts; for posts and Reels you submit to a campaign, their link, type, publish time and Instagram’s official insights: views, reach, likes, comments, shares and saves. (b) Follower and media counts; publish time, like, comment and (for Reels) view counts of your recent public posts. (a) instagram_business_basic, instagram_business_manage_insights · (b) Business Discovery |
| YouTube (Google) | Through YouTube API Services (YouTube Data API): an API key for public channel and video data and, if you choose to connect your channel with your Google Account, read-only authorization. | Channel ID, title, @handle, profile image and channel description (to check your verification code); subscriber and video counts; for videos (including Shorts) you submit to a campaign, their title, publish time, duration and view, like and comment counts; the same data for your recent public videos when we evaluate your application. API key (public data) · youtube.readonly (optional Google authorization) |
Instead of connecting an account, we may ask you to add a one-time verification code to your profile bio or channel description to prove ownership. We read that code from your public profile data, and you can remove it once you are verified.
If you do not connect your account, or the official API cannot read a post, we may read the public information of the posts you submit to campaigns (view, like, comment, share and save counts, publish date, cover image, and the username and public account ID of the account that posted it) through a third-party measurement provider acting on our behalf and on our instructions (a processor based in the United States). Only the post’s link is sent to the provider; your name, contact details and payout details are not. We use this information only to measure views, to check that the post belongs to your account and was published after you joined the campaign, and to calculate your earnings.
Instagram views are read from Instagram’s official insights. Meta may deliver this data with a delay of up to 48 hours, so Instagram metrics shown in your dashboard and in brand reports, and the earnings based on them, may update with a delay.
What we never do
- We never post, comment or send messages on your behalf, and never edit or delete your content.
- We never read your private messages or your private or draft content.
- We never sell platform data, pass it to data brokers or use it for ad targeting.
- We never use platform data to make eligibility determinations about people, such as for employment, housing, credit, insurance or education.
- We never show a post’s statistics to any brand other than the brand of the campaign you submitted it to, and we never share the statistics of content you have not submitted to a campaign.
4. Creator applications and your consent
When you apply as a creator, we review your public professional-profile data and the metrics of your recent public content (for example posting frequency, average and median views, and views relative to followers) to evaluate your application. We only do this for people who have applied and given the consent below; we do not evaluate, or build profiles of, people who have not applied.
“By applying as a creator and connecting my social media accounts, I agree that Phenomens may read my public professional-profile data and the metrics of the content I submit to campaigns through the official TikTok, Instagram and YouTube APIs, in order to evaluate my application and calculate my pay-per-view earnings, and may share those metrics with the brand running the campaign.”
Indicators calculated by Phenomens (such as a trust score) are kept separate from the data provided by the platforms and labelled as “calculated by Phenomens”. Application decisions are made by a member of our team; we do not make decisions based solely on automated processing. You can withdraw your consent at any time; your application can then no longer be evaluated and we stop reading new data from your connected accounts.
5. Why we use your data and our legal bases
Because Phenomens is operated by a company established in Türkiye, we comply with the Turkish Personal Data Protection Law No. 6698 (KVKK). For users in the European Union or the United Kingdom we also rely, where applicable, on the legal bases of the General Data Protection Regulation (GDPR / UK GDPR).
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and providing the Platform | Account, contact and technical data | Performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) |
| Verifying that a connected social media account belongs to you | Platform account ID, username, verification code in your bio / channel description | Contract; legitimate interest in preventing impersonation (Art. 6(1)(b), 6(1)(f); KVKK Art. 5/2-c, 5/2-f) |
| Evaluating your creator application | Public professional-profile data and metrics of your recent public content | Your consent given when you apply; steps prior to a contract (Art. 6(1)(a), 6(1)(b); KVKK Art. 5/1, 5/2-c) |
| Calculating and paying pay-per-view earnings; checking that a post is yours and was published after you joined | Metrics, publish date and the posting account’s username / public ID of content submitted to campaigns (from the official API or from public data through our measurement provider); payout details | Performance of a contract; legitimate interest in paying the right account (Art. 6(1)(b), 6(1)(f); KVKK Art. 5/2-c, 5/2-f) |
| Showing your creator profile to brands on Phenomens (creator directory, invitations, applicant and member lists) | Display name, username, profile picture, bio, city, categories; connected platforms with their usernames and follower counts; total posts and views on Phenomens | Contract (the marketplace service you sign up for); the legitimate interest of brands in finding creators (Art. 6(1)(b), 6(1)(f); KVKK Art. 5/2-c, 5/2-f) |
| Reporting post statistics only to the brand of the campaign the post was submitted to | Links and metrics of content submitted to the campaign; the cost calculated from them | Contract; the brand’s legitimate interest in seeing campaign results; for data read from a connected account, the consent you give when you connect it (Art. 6(1)(b), 6(1)(f), 6(1)(a); KVKK Art. 5/2-c, 5/2-f, 5/1) |
| Preventing fake views, fraud and abuse; security | Metric history, device and session logs | Legitimate interests; legal obligation (Art. 6(1)(f), 6(1)(c); KVKK Art. 5/2-f, 5/2-ç) |
| Invoicing, accounting and tax obligations | Identity, payout and invoice records | Legal obligation (Art. 6(1)(c); KVKK Art. 5/2-ç) |
| Marketing messages and analytics cookies | Email / phone, cookie data | Consent, which you can withdraw at any time (Art. 6(1)(a); KVKK Art. 5/1) |
7. International transfers
Your data is processed by the data controller established in Türkiye. Our service providers (such as hosting, email and notification delivery), our measurement provider that reads public post counts (United States) and TikTok, Meta and Google may process data abroad (for example in the European Union, the United States and Singapore), so some of your data is transferred outside Türkiye.
For these transfers we rely on the safeguards in Article 9 of the KVKK (where there is no adequacy decision, the standard contracts published by the Turkish Personal Data Protection Board, notified to the Board) and, for users in the European Union or the United Kingdom, the safeguards under the GDPR / UK GDPR (standard contractual clauses). You can request a copy of these safeguards at [email protected].
8. How long we keep data
| Data | Period |
|---|---|
| Account and profile data | While your account is open. Deleted or anonymised within 30 days after you delete your account. |
| Platform access tokens (OAuth) | While the connection exists, encrypted. Deleted immediately when you disconnect. |
| TikTok and Instagram profile data and content metrics | For the connection, the related campaign and the payout / dispute period. Deleted within 30 days after you disconnect or delete your account. |
| YouTube: public statistics read with an API key | No longer than 30 days; refreshed or deleted within that period. |
| YouTube: data read with your Google authorization | While the authorization is valid; we check its validity at least every 30 days. Deleted within 7 days if you disconnect in Phenomens or ask us to delete it, and as soon as we detect it (within 30 days at the latest) if you revoke access in your Google settings. |
| Application evaluation reports | For the application and the life of your account; deleted with your account. Any YouTube data in them follows the YouTube rules above. |
| Payout, invoice and accounting records (including the view totals a payout was based on) | For statutory retention periods (generally 10 years under Turkish tax and commercial law). |
| Security and access logs | Up to 2 years. |
| Technical error logs (no content, passwords or payment details) | 30 days, for security and reliability. |
Anonymous statistics that cannot be linked to a person may be kept after these periods.
9. Disconnecting a platform and revoking access
You can disconnect a platform at any time:
- In Phenomens: on the Social accounts page (Sosyal hesaplar), open the account’s menu and choose Remove account (Hesabı kaldır). Your access tokens are deleted immediately and no new data is read.
- On TikTok: in the TikTok app go to Profile → Menu (☰) → Settings and privacy → Security & permissions → Apps and services → Phenomens → Remove access.
- On Instagram: Settings and activity → Website permissions → Apps and websites → Active → Phenomens → Remove. On the web: instagram.com/accounts/manage_access.
- On YouTube / Google: you can revoke Phenomens’ access to your Google Account data at any time on the Google security settings page (security.google.com/settings/security/permissions).
Menu names may differ slightly depending on the app version and language.
After you disconnect, we stop reading data from that account and delete its data within the periods in section 8. Because views of your content in ongoing campaigns can no longer be updated, that content may stop earning. To delete all of your data, see Data Deletion and Account Deletion.
10. Your rights
Under Article 11 of the KVKK and, if you are in the European Union or the United Kingdom, the GDPR / UK GDPR you have the right to:
- know whether we process your data and obtain a copy of it,
- have inaccurate or incomplete data corrected, have your data erased or restrict its processing,
- object to processing based on legitimate interests and to direct marketing,
- receive the data you provided in a portable format,
- withdraw your consent at any time where processing is based on consent,
- contest decisions based solely on automated processing that significantly affect you.
Send your request from your registered email address to [email protected]; we respond within 30 days. If you are not satisfied with our response, you can complain to the Turkish Personal Data Protection Board; if you live in the European Union or the United Kingdom, you can also contact the data protection authority of your country.
11. Security
We use administrative and technical measures such as encryption in transit (TLS), irreversible password hashing, encrypted storage of platform access tokens, role-based access control and monitoring of access logs. If you notice anything suspicious, please tell us right away.
13. Platform terms and YouTube API Services
Phenomens uses YouTube API Services. By using our YouTube features you agree to be bound by the YouTube Terms of Service (www.youtube.com/t/terms). How Google processes data is described in the Google Privacy Policy (www.google.com/policies/privacy). You can revoke Phenomens’ access to your Google Account data at any time on the Google security settings page.
When you connect TikTok, the TikTok Terms of Service and TikTok Privacy Policy continue to apply; Phenomens uses only the permissions listed in section 3, in line with the TikTok Developer Terms of Service.
For Instagram, the Instagram Terms of Use and the Meta Privacy Policy apply; we process Instagram data in line with the Meta Platform Terms.
Phenomens is not affiliated with, endorsed or sponsored by TikTok, Meta / Instagram or Google / YouTube.
14. Changes and contact
We may update this policy from time to time and will announce material changes on the Platform or by email before they take effect. Send privacy questions to [email protected] and other questions to [email protected]. A Turkish version of this policy is available here.
Devition Yazılım ve Bilişim Teknolojileri A.Ş. (Türkiye)