Privacy Policy

This policy explains how Cabana Studio (“Cabana,” “we”) handles personal information for: visitors to cabanastudio.io, people who request the demo, creators with accounts, visitors to creator Link Pages we host, and brand contacts whose details creators store in their CRM. Contact us anytime at privacy@cabanastudio.io.

• Account & profile: name, email, social handles, niche, photo, brand colors, portfolio content (work samples, rates, testimonials, bio).
• Free preview signup: name, email, Instagram/TikTok/YouTube handles, audience size, and the tool you currently use - so we can follow up about Cabana and tailor the preview.
• Payments & billing: subscription plan and status, and Stripe identifiers. Card numbers and bank details go directly to Stripe - we never see or store them.
• Connected accounts: when you connect social analytics (via Phyllo) we receive engagement metrics - reach, impressions, saves, followers, per-post stats. When you connect your inbox or DMs (via Unipile) we receive inbound messages so they can become tracked deals: sender name, email/handle, subject, and message content.
• CRM data you store: brand contacts’ names, business emails, companies, deal terms, and notes. You control this data; we process it on your behalf (see Section 7).
• Contracts you upload: the deal contracts (PDFs) you or a brand attach to a deal, for storage and AI-assisted review (see Section 5).
• Goals you set (optional): if you use the Goals feature, any income target, follower/growth milestones, and free-text notes you enter about your own business goals.
• Usage analytics: first-party pageview and click events on our public pages - a random visitor ID (cookie cab_vid), session ID, pages viewed, referrer, and UTM parameters. No third-party ad trackers. See the Cookie Policy.
• Product usage (signed in): when you use your dashboard we record which pages you visit and which features you click, tied to your account, so we can see what’s working, improve the product, and help with support. First-party only - never shared with or sold to anyone.
• Signup attempts: if a signup form submission fails (for example the email already has an account) we keep the attempted email/handle and the failure reason for up to 90 days, to prevent abuse and help you if you get stuck.
• Logs & events: an audit trail of actions in your account (e.g. deal approved, invoice sent) for security and support.

• Provide and operate the Service: portfolios, CRM, media kits, payments, and integrations.
• Generate analytics-based recommendations, including with AI (see Section 5).
• Process subscriptions, transaction fees, and payouts through Stripe.
• Communicate with you: service messages (always) and marketing about Cabana (with opt-out - every marketing email includes an unsubscribe link, honored within 10 business days; or email us to opt out).
• Measure and improve our site with first-party analytics.
• Security, fraud prevention, and legal compliance.

For people in the EEA/UK, our legal bases are: performance of a contract (running your account), legitimate interests (first-party analytics, security, B2B follow-up you asked for), consent where required (e.g. non-essential cookies in the EEA/UK), and legal obligations.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

We share personal information only with service providers that help us run Cabana (our subprocessors), with parties you direct us to share with (e.g. a brand paying your invoice via Stripe), and where required by law or in a business transfer.

We’ll update this list as providers change; creators on the DPA are notified of subprocessor changes with a chance to object (see the DPA).

Several features send data to Anthropic (Claude) to generate AI output. Under our commercial agreement, Anthropic does not use this data to train its models. AI output can be wrong - treat it as a suggestion, not advice.

• The Growth Brain: your connected analytics, deal, and affiliate data, to generate weekly recommendations, insights, and (where enabled) draft pitches.
• Contract review: the text of a contract you upload, to generate a plain-English summary of its terms. Before this text is sent, we automatically strip the brand’s name, contact details, and any email/phone number found in the document - the AI reviews deal terms, not who the brand is.
• Content planning: a deal’s brand name, product, and usage terms, to draft a content plan and script suggestions for that deliverable.
• Deal extraction: the text of an inbound message (email, DM, or intake-form submission) that may become a deal, to identify deal details like budget and deliverables automatically.

Two features use your profile data beyond running your own account, and both are off by default, revocable anytime, and controlled from Dashboard → Settings → Permissions:

• Creator gallery & referrals (free). If you opt in, your public page - name, handle, photo, bio, and niche - is listed in our public creator gallery (cabanastudio.io/creators) and may be shown to other creators or prospects as an example.
• Named features & case studies (paid). If you opt in, we may ask to feature your name, quotes, results, or likeness in our own marketing (ads, decks, case studies). Nothing is used until you separately approve that specific use; each use is compensated or credited as agreed with you.

Revoking either consent stops future use and removes your listing from the public gallery; it does not retract uses already published before you revoked.

If a creator stores your details in their Cabana CRM - for example because you emailed them, DM’d them, or filled in their intake form - that creator is the controller of your information and Cabana processes it on their behalf under our Data Processing Addendum. To access, correct, or delete that data, contact the creator directly (their portfolio page has their details). You can also email privacy@cabanastudio.io and we will forward your request to the creator and assist them in honoring it.

If you attach a contract to an intake form, we first strip your company name, contact details, and any email/phone number found in the document, then send that text to our AI (Anthropic) to generate a plain-English summary for the creator, under the same no-model-training terms described in Section 5 - the AI reviews deal terms, not who you are, does not act on your behalf or advise you, and the creator still needs to read the contract itself before relying on that summary.

• Export: download a complete copy of your account data anytime in Dashboard → Settings → Your data.
• Deletion: delete your account and data in Dashboard → Settings → Danger zone, or email us. We delete or de-identify your data within 30 days, except what we must keep for legal, tax, or security reasons (e.g. payment records).
• Access & correction: most data is editable in your dashboard; for anything else, email us.
• Marketing opt-out: unsubscribe link in any marketing email, or email us.
• US state rights (e.g. California, Colorado, Texas): where applicable, you have rights to know, access, correct, delete, and port your data, and to opt out of sales/sharing (we don’t sell or share for behavioral ads). We honor these requests for all users regardless of state, and we won’t discriminate against you for exercising them. Authorized agents may submit requests by email.
• EEA/UK rights: access, rectification, erasure, restriction, portability, objection, and the right to complain to your supervisory authority. Where we rely on consent you can withdraw it anytime.

We keep your data while your account is active. After deletion or a deletion request, we remove personal data within 30 days, except records we must retain (payment and tax records, security logs) - those are kept only as long as required and then deleted. One specific example: the record of your acceptance of our terms at signup (your email, the terms version, the timestamp, and the IP address and browser it came from) is kept for at least three years even after account deletion, because subscription-law record-keeping rules (e.g. California Business & Professions Code §17602) require it and it is our evidence in any billing dispute. Demo-signup leads that never convert are deleted or de-identified within 24 months of last contact. If you tell us why you are cancelling, the reason you picked from the list (with your plan) is kept as churn statistics - linked to your account while it exists, and unlinked from you if you later delete the account. Anything you typed in your own words is deleted within 30 days if you deleted your account, and within 180 days if you cancelled but kept it. Backups roll off on a fixed schedule.

Data is encrypted in transit (TLS) and at rest with our hosting providers. Access is scoped per creator with row-level security, and payment credentials never touch our servers. No system is perfectly secure - if we learn of a breach affecting your data, we will notify you and regulators as required by law.

We are US-based and our subprocessors store data primarily in the United States. Where we receive EEA/UK personal data, we rely on appropriate safeguards such as Standard Contractual Clauses with our subprocessors and, where applicable, the EU–US Data Privacy Framework.

The Service is for adults 18+ and is not directed to children under 13. We do not knowingly collect children’s data; if you believe a child has provided us data, email us and we will delete it.

We’ll post updates here and, for material changes, notify you by email or in the dashboard before they take effect.

Cabana Studio · privacy@cabanastudio.io