We read public data.

CreatorVet is a product of Tekprof Innovation LLP (LLPIN ACG-6926), Delhi, India, which operates the service and is responsible for the data described here.

What we read

CreatorVet analyzes publicly available data only, with one exception you control: a creator can choose to connect their own YouTube account (described below), which shares specific read-only data with their explicit consent. We never access private analytics, direct messages, stories, or anything behind a creator’s login otherwise, on any platform.

YouTube

Channel statistics, recent uploads, video titles and descriptions, and engagement counts as exposed by the YouTube Data API. CreatorVet uses YouTube API Services. By using CreatorVet you agree to be bound by the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy.

Retention: Public statistics from YouTube (view, like, subscriber and comment counts) are kept for up to 36 months, so a video can be compared with the channel’s own history. Other YouTube data (video titles, channel names and descriptions) is refreshed or deleted within 30 days. Scores we calculate from these statistics are CreatorVet’s own metrics, not YouTube data.

We do not sell YouTube data, and we do not transfer it to third parties. It is used solely to show an advertiser the public reach and performance of creators and placements they are vetting or tracking, and it is removed on request via the deletion route below. You can also revoke any access you may have granted via Google’s own security settings at security.google.com/settings/security/permissions.

Optional: connecting your own YouTube account (creators)

A creator building a media kit can optionally sign in with the Google account that owns their channel. This uses Google OAuth with two read-only scopes, and it is the only case where CreatorVet accesses non-public data — always at the creator’s own request:

• Channel identity (youtube.readonly): which channel the signed-in account owns — used solely to mark that creator’s own page “channel ownership verified”.
• Audience statistics (yt-analytics.readonly): aggregate age and gender split, top viewer countries, and average watch time for the creator’s own channel — shown only on the creator’s own page, and only the parts the creator individually chooses to display. No individual viewer is ever identified.

These permissions can never edit, post, delete or change anything on a channel. We store the OAuth token Google issues (server-side, never exposed) and the audience summary above; both are deleted when the creator disconnects via myaccount.google.com/permissions and asks us to remove them (deletion route below), and the same 30-day retention rule applies to the audience summary as to other YouTube data. Signing in with Google as a login method shares only your name and email address, used to create and access your account.

How this data is protected

Data obtained through Google APIs — OAuth tokens, channel identity and audience statistics — is protected by the following mechanisms:

• Encryption in transit: all communication between your browser, our servers and Google’s APIs uses HTTPS/TLS. Google user data is never transmitted over unencrypted connections.
• Server-side token storage: OAuth access and refresh tokens are stored only in our server-side database. They are never sent to a browser, never included in any API response, never written to client-side storage, and never logged.
• Access control: the production database is not exposed to the public internet; it is reachable only by the application server, which itself is accessible solely via key-based SSH authentication restricted to authorized personnel. Application access to Google user data follows least privilege — the two read-only scopes above are the only access ever requested.
• No third-party transfer: Google user data is not sold, not used for advertising, and not transferred to any third party, except as necessary to provide the feature the creator requested, to comply with applicable law, or as part of a merger or acquisition with prior notice to users.
• Deletion: tokens and audience data are deleted when a creator disconnects and requests removal (see the deletion route below), and audience summaries follow the 30-day retention rule above. In the event of a data breach affecting Google user data, we will notify affected users and relevant authorities without undue delay.

CreatorVet’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram (Meta)

Where a creator operates a public Instagram Business or Creator account, we read that account’s public data through Meta’s Instagram Graph API, using the Business Discovery endpoint. Specifically:

• Profile: username, name, biography, website, profile picture, follower count, following count and post count.
• Recent posts: caption, permalink, timestamp, media type, like count, comment count and — for Reels — view count.

This is the same information any person can see by visiting that profile. We do not read private accounts, stories, direct messages, or any audience-level or demographic data. We do not post, comment, or take any action on a creator’s behalf.

We use it for one purpose: to show an advertiser the creator’s public reach and the performance of sponsored posts naming that advertiser’s brand, so they can verify a placement ran and how it performed. We do not sell this data, and we do not share it with third parties beyond the advertiser it concerns.

Instagram data is stored for as long as an advertiser is actively tracking that creator, and is removed on request (see below) or when tracking ends.

Instagram accounts a creator connects

A creator can choose to connect their own Instagram Business or Creator account to their CreatorVet media kit, using Instagram Login. We ask Instagram for two permissions, and both only read:

• instagram_business_basic — the account’s id, username, name, profile picture and follower count, and the list of its Reels and posts: caption, type, date, link, picture, like count and comment count.
• instagram_business_manage_insights — the numbers only the account’s owner can see: the views and reach of each Reel and post, and for each live Story its views, reach, replies, shares, follows and profile visits, and how viewers moved through it (taps forward, taps back, exits, swipes away).

We read the list of Reels and posts, with their views and reach, when the creator works on their media kit and about once a day while they stay connected. We read Stories every hour while one is live, because Instagram keeps a Story’s numbers only for its 24 hours. We never post, comment, read messages or change anything on the account.

We use this for one purpose: the creator’s own media kit, which they choose to publish. It shows their follower count, the Reels and posts they pick with their views, likes and comments, the average views of their recent Reels, their latest Reels if they switch that on, and their Story performance as averages over the last 30 days. If the creator presses Let AI choose, the captions and numbers of their Reels and posts are sent to Google’s Gemini on Google Cloud (Vertex AI), which processes them for us to suggest what to show; nothing changes on the kit until the creator accepts a suggestion. This data is not shown in our advertiser product, not used to score or rank anyone, not combined with other creators’ data, not sold, and not shared.

The access token is stored on our servers and never shown to anyone. While the account stays connected, each new read replaces the list of Reels and posts, and Story numbers are kept for 30 days after each Story was posted, then deleted automatically. When the creator presses Disconnect on their kit, removes CreatorVet under Instagram’s Settings → Apps and websites, or sends a deletion request through Facebook or Instagram, Instagram becomes inactive on their kit and we delete, at once, everything we read through the connection: the access token, the list of Reels and posts with its views and other numbers, the Reels and posts on their kit, and every Story number. A deletion request returns a confirmation code you can check at creatorvet.com/data-deletion.

Instagram accounts a brand connects

A brand using our dashboard can choose to connect its own Instagram Business account, using Facebook Login. We ask Facebook for four permissions, and all of them only read:

• pages_show_list — the Facebook Pages the person manages, so we can find the Instagram Business account linked to each one.
• instagram_basic — that Instagram account’s id, username, name, profile picture and follower count, so the dashboard can show which account is connected.
• instagram_manage_insights and pages_read_engagement — Meta requires both for Business Discovery, the endpoint that reads another professional account’s public profile and posts.

With the connection, the brand’s creator lookups and the Instagram posts it tracks are read through the brand’s own account instead of CreatorVet’s: the same public data described under “Instagram (Meta)” above, only for the creators that brand looks up or tracks. We do not read the brand’s own posts, insights, messages, ads or Page content, and we never post, comment or change anything.

The access token is stored on our servers, never shown to anyone, and used only for that brand’s own lookups and tracked posts, never for another brand. Facebook tokens last about 60 days; after that the brand reconnects. When the brand presses Disconnect in its dashboard, removes CreatorVet under Facebook’s Settings → Apps and websites (or Business integrations), or sends a deletion request through Facebook, we delete the token and the record of the connected account at once. A deletion request returns a confirmation code you can check at creatorvet.com/data-deletion.

What we collect from you

Running a free check requires no account. If you use “Email this report”, we use the address you enter to send that one report — it is not added to a marketing list or shared with third parties. Brand and creator dashboard accounts store a username, a hashed password, and the brand or channel the account is scoped to. Standard server logs (IP, timestamp, requested URL) are kept briefly for abuse prevention and rate limiting.

Cookies & tracking

We set no advertising or cross-site tracking cookies.

Deleting your data

Email privacy@creatorvet.com from the address you used, or from an address associated with the channel or Instagram account in question, and tell us what you want removed. You can request:

• removal of a YouTube channel or Instagram account from our cache and tracked roster;
• disconnection of a connected Google/YouTube account, with deletion of its stored OAuth token and audience statistics;
• deletion of any personal data you submitted, such as an email address;
• deletion of a dashboard account and everything scoped to it;
• a copy of the data we hold that relates to you.

We action requests within 30 days and confirm by email when the deletion is complete. No account or login is required to make a request.

GDPR

Scores and verdicts are probabilistic assessments derived from public data, provided as assistive screening for a human decision — never as an automated decision with legal or similarly significant effect. Our lawful basis for processing public creator data is legitimate interest in providing advertisers an independent verification service; you may object at any time via the deletion route above.

Contact

General: hello@creatorvet.com
Privacy, data access and deletion: privacy@creatorvet.com

CreatorVet is operated by TEKPROF INNOVATION LLP, B-4/97 Second Floor, Khanpur, Sangam Vihar, South Delhi 110080, India.