Privacy Policy

Last updated: 16 October 2026

This notice explains personal information handled through WDMF Hub at wdmfhub.com, including its creator and client portals and authorised integrations.

1. Who to contact

WDMF Hub supports WDMF’s creator campaign operations. WDMF Ι.Κ.Ε. is located at Tatoiou 56, Kifisia, 14561, Greece. For questions about this notice or a personal-data request, contact our team at we@viralpassion.gr, with “WDMF Hub privacy” in the subject, or write to that address.

The company identified in your campaign agreement remains responsible for its contractual and accounting records. Where Hub information is handled on behalf of a client, that client determines the purposes of that processing; we will help direct a request to the responsible organisation.

2. Information handled by the Hub

Account and contact details: name, email, role, authentication information and, where supplied, phone number and delivery address.
Creator information: social handles, profile links, images, biography, categories, demographic details supplied for campaign selection, public profile statistics and engagement metrics.
Campaign information: assignments, briefs, uploaded videos and images, captions, review comments, approvals, delivery dates and correspondence.
Payment administration: agreed fees, invoices, legal and tax details, bank details supplied for payment, and recorded payment status. A Hub status is an administrative record, not a bank transfer.
Technical information: request and security logs, browser and device information, IP addresses, session cookies and interface preferences.

Information comes from you, authorised colleagues or campaign partners, your interactions with the service, and public social profiles. Public social information may be refreshed through providers such as Apify; this is separate from a connection authorised through TikTok.

3. Purposes and legal bases

We use information to arrange and deliver creator collaborations, provide account access, manage submissions and approvals, communicate about campaigns and administer payments. Processing necessary for a contract with you or requested steps before that contract relies on GDPR Article 6(1)(b). Accounting and other mandatory records rely on legal obligations under Article 6(1)(c).

Account security, business contact management, relevant creator discovery and campaign coordination may rely on legitimate interests under Article 6(1)(f), subject to your rights and reasonable expectations. Where consent is required, including optional permissions, we request it for the specific purpose; it can be withdrawn without affecting earlier lawful processing. Not supplying information needed for a collaboration may prevent us from providing that part of the service.

4. TikTok and other social platforms

The Hub currently uses social profile information for creator discovery and campaign coordination. This notice does not mean that TikTok account connection, Direct Post, advertising, Shop or LIVE API access is available or approved.

If an official TikTok connection is introduced, the connection screen must identify the enabled feature and requested permissions before you authorise it. Profile access may involve an account identifier, display name and avatar; video or statistics access requires the corresponding permission. Publishing, advertising, Shop and LIVE are distinct functions and are not authorised merely by accepting these terms or this policy. The notice and permission flow must be updated before a new use begins.

You can manage connected apps in TikTok’s settings and revoke access there. You can also request deletion of information held in the Hub using the contact above, identifying your account or social handle. Revocation does not itself delete existing Hub records or content already published on TikTok. Requests concerning TikTok’s own records should be made to TikTok. Its Privacy Policy applies to its service.

5. Recipients and service providers

Authorised team members receive information needed for their role. Clients receive relevant campaign material and review information through the client portal; that portal is not a creator banking or tax-record service. Suppliers supporting hosting, authentication, storage, email delivery, public-profile updates and file synchronisation process the information needed for those services. Depending on the enabled workflow, these include Vercel, Supabase, Cloudflare, Resend, Microsoft, Google and Apify.

When an authorised team member uses AI-assisted planning, selected briefs and campaign reference material may be sent to Anthropic. When a member connects an external assistant, information retrieved with that member’s granted permissions is returned to that service and is also subject to its terms. Do not include unnecessary personal or confidential information in briefs or assistant prompts.

Information may also be disclosed to professional advisers or authorities where required by law or necessary to establish or defend legal claims. International processing may occur where a provider operates outside the EEA. Applicable GDPR transfer requirements, including an adequacy decision or appropriate contractual safeguards where required, must be met. Contact us for information about the safeguards relevant to your data.

6. Retention and security

Retention depends on the purpose: active collaboration records are needed for campaign delivery, financial records for applicable accounting obligations, and limited records for resolving disputes or protecting the service. Information that is no longer needed should be deleted or anonymised, subject to legal retention requirements. Request a review or deletion using the contact above; there is no single retention period for every category.

The Hub uses authenticated access, role restrictions and protected portal sessions. Access links and verification codes must be kept confidential. No online service can guarantee absolute security.

7. Cookies and preferences

Authentication cookies support sign-in and portal verification. Browser storage may remember interface preferences such as the display theme. Blocking necessary cookies may prevent protected features from working. Optional tracking, if introduced, requires its own appropriate notice and consent where applicable.

8. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing, including processing based on legitimate interests. You may withdraw consent at any time. Email the contact above with your request and enough information to locate your records; do not send passwords or unnecessary identity documents. We may ask for proportionate verification before disclosing or changing personal information.

Requests are normally addressed within one month; any lawful extension and its reason will be explained. You may complain to the Hellenic Data Protection Authority or your local supervisory authority. Campaign selection and approval involve human decisions; AI-assisted drafts do not replace the responsible campaign team.

9. Children and updates

The service is intended for professional collaborations. A minor must not submit personal information without an appropriate arrangement with their legal representative and the campaign team. Contact us if information about a child has been provided without that arrangement.

Updates will appear here with a revised date. Material changes in purpose or permissions require appropriate notice and, where necessary, renewed consent. See also our Terms of Service.