Starcovery Privacy Policy

Starcovery LLC (the "Company") operates the Site and the Service. This Privacy Policy ("Privacy Policy") describes how we collect, use, and safeguard the information you provide to us and the information we collect about creators.

For purposes of this Agreement, "Site" refers to the Company's website, which can be accessed at www.starcovery.com.

"Service" refers to the Company's services accessed via the Site, the Starcovery command-line tool, the API, and MCP clients, in which organizations search for Instagram and TikTok creators, build campaigns, send proposals to creators, hire creators, fund campaigns, and pay creators, and in which creators claim their handles and receive payouts.

"Creator" refers to a person with a public Instagram or TikTok profile in our catalog, whether or not that person holds an account with us.

The terms "we," "us," and "our" refer to the Company.

"You" refers to you, as a user of our Site or our Service.

By accessing our Site or our Service, you accept our Privacy Policy and Terms of Use (found here: /terms), and you consent to our collection, storage, use, and disclosure of your Personal Information as described in this Privacy Policy.

I. Information we collect

We collect "Non-Personal Information" and "Personal Information." Non-Personal Information includes information that cannot be used to personally identify you and is not tied to your account, your browser, or your IP address, such as aggregate usage metrics. Personal Information includes your name, email address, the IP address and browser of each signed-in session, the information we collect through cookies, product analytics, and error reporting described below, your organization name, the briefs you type into search, the messages you send to the assistant and its replies, the Lists you save, the campaigns you create, API keys you create, invitations you send, handle claims you open, payout account facts, feedback you send, what you tell us you asked an AI assistant or a search engine before you found us, a customer identifier from our card payment processor once you pay by card, and any email address you submit when claiming an agent-created account.

1. Information collected via technology

You can search without creating an account. When you view or use the Service, we receive the IP address of each request, and we may receive information from your browser or our application, such as the website you came from (known as the "referring URL"), the type of browser you use, the device from which you connected to the Service, the time and date of access, and other information about your visit. We use the IP address of a caller who is not signed in to count the free daily allowance, to recognize a repeated search, and to limit its request rates, and the IP address of any caller to limit the rate of sign-in, account, and search parsing requests. We also keep a one-way hash of the email address entered to sign up, sign in, ask for a confirmation or password reset link, invite a member, or claim an agent account, to limit how often each address is used, with Gmail addresses read the way Gmail delivers them. These records keep the address, or a hash of it, for up to 24 hours. We use product analytics and error reporting services to understand aggregate traffic, performance, and errors. Product analytics events are tied to your account and organization identifiers. Error reports and performance traces may include the page you were on, your IP address, your account identifier, the web address of the request that failed, and the values the failing code was handling. Product analytics also records your sessions on the Site: the pages you view and what they show, your clicks, scrolling, and mouse movement, the address and timing of each request the page makes, and the browser console. A recording of a signed-in session is tied to your account. The value you type into a form field is masked in these recordings, but a brief or message you send is recorded where the page then displays it. Product analytics may also show you a short survey about your results; if you answer, it records your rating and any comment you type, tied to your account when you are signed in. We track this information using cookies, or small text files which include a unique identifier. Cookies are sent to a user's browser from our servers and are stored on the user's computer hard drive. Cookies let us collect information about that user and keep a record of authenticated sessions, both on an individual and aggregate basis. For example, the Company may use cookies to collect the following information:

• Referring and exit URLs
• Browser type and version
• Device type and operating system
• Access timestamps and pages viewed
• In-product events such as searches run, creators viewed, and links clicked

The Company may use both persistent and session cookies; persistent cookies remain on your computer after you close your session and until you delete them, while session cookies expire when you close your browser. For example, we store a cookie for your signed-in session, which lasts 7 days and renews while you keep using the Site, or ends when you close your browser if you sign in with your password and clear Remember me; cookies that store your theme preference and your sidebar layout for a year; a cookie that ties a search conversation you start without signing in to your browser for 30 days; a cookie that holds a referral code for 10 minutes when you start Google sign-in from a referral link; and a product analytics cookie that holds an identifier for your browser, and your account identifier once you sign in, for a year, with a copy in your browser's storage.

2. Information you provide us by registering for an account

In addition to the information provided automatically by your browser when you visit the Site, to create an account you sign in with Google, which shares your name, email address, and profile image with us, or you register with an email address and a password, which we verify by email. When you choose a password, we check a partial hash of it against a public breached-password service; the service does not receive the password. Agents may also create an anonymous identity via our agent registration protocol and later bind it to a human email through the claim flow. Every account belongs to at least one organization, which owns its campaigns, credits, API keys, and handle claims. When you invite someone to your organization, we store their email address and send them an invitation. By registering, you are authorizing us to collect, store, and use that account information in accordance with this Privacy Policy.

3. Creator profile information

Our catalog is built from public Instagram and TikTok profiles. For each profile we collect the handle, display name, biography, profile link, profile image, follower, following, like, and post counts, whether the account is verified, private, or a business or organization account, country, language, the share of a TikTok audience in each country, public videos with their captions, post dates, lengths, countries, engagement counts, and whether each is marked as an ad, a paid partnership, or eligible for commission, and any email address posted in the display name, the biography, the profile link, a caption, or a public web page about the creator. Each time we refresh a profile, we keep a dated copy of its profile details and video counts. We group the profiles we believe belong to one person across Instagram and TikTok. We copy profile images and videos to our own media hosting. Organizations spend credits to reveal a creator's contact address; we record which organization revealed which profile. A creator, or an organization acting for a creator, may claim a handle by sending a verification code from the claimed account to the Starcovery platform account by direct message. When the message carries the claim's code exactly and we confirm it came from the claimed Instagram account, the claim is approved automatically; staff verify every other claim, including every TikTok claim. We read Instagram profiles through HikerAPI and TikTok profiles through LamaTok, which receive only the public handle or profile identifier we look up, and we read public web pages about a creator through Firecrawl. When we detect a sponsored post, we send the creator's handle and follower count, any public contact address of that creator and of creators like them, the sponsoring brand's handle and name, and the post's address and public view, like, and comment counts to Clay, which finds the people we tell about the sponsorship. If you are a creator and have a question about the information we hold about your profile, email team@starcovery.com.

4. Children's privacy

The Site and the Service are not directed to anyone under the age of 13. The Site does not knowingly collect or solicit information from anyone under the age of 13, or allow anyone under the age of 13 to sign up for the Service. In the event that we learn that we have gathered personal information from anyone under the age of 13 without the consent of a parent or guardian, we will delete that information as soon as possible. If you believe we have collected such information, please contact us at team@starcovery.com.

II. How we use and share information

Personal Information:

Except as otherwise stated in this Privacy Policy, we do not sell, trade, rent, or otherwise share for marketing purposes your Personal Information with third parties without your consent. We do share Personal Information with vendors who are performing services for the Company. Those vendors use your Personal Information only at our direction and in accordance with our Privacy Policy. They include:

• Payment processors. Stripe processes card payments and holds your card details and the billing details you enter on its pages; we store a customer identifier and the amounts paid. Mercury issues campaign funding invoices to hiring organizations and pays creators; bank account details, tax forms, and identity documents move only through Mercury's own secure links, and we store none of them beyond the last four digits of the bank account.
• Email delivery services. Resend sends the mail we send you, including verification, invitation, campaign, proposal, and promotional mail, and receives your email address and the content of each message; it reports delivery, bounces, and complaints back to us. A copy of each message we send you, with your email address and its content, goes to our team mailbox, which Google Workspace hosts, and mail staff write to you or to a creator by hand, including proposals, goes through that mailbox too. When we check an outreach list, Bouncer receives each email address on it to check that it can receive mail, including addresses we later leave out of the sending.
• A social inbox service, Zernio, which connects to our Instagram and TikTok accounts and receives the direct messages, comments, and reactions sent to them, with the sender's account identifier, handle, name, profile image, and follower count and the text and attachments of each, and passes each to us. The direct message that carries a handle claim's verification code reaches us this way.
• Authentication and security services. Google signs you in when you choose Google sign-in and shares your name, email address, and profile image with us. Better Auth receives your name, email address, account identifier, IP address, and country with each sign-in, sign-up, sign-out, and change to your account or organization, your browser with each sign-in, sign-up, sign-out, and password request, and your organization's name and the email addresses you invite; checks the email address entered at sign-up, in an invitation, and in an agent account claim; and receives a keyed hash of a password that fails to sign in, to detect and block account abuse. Have I Been Pwned receives a partial hash of each new password, as described in Section I, and never the password itself.
• Hosting, database, storage, and media delivery services, which hold the information described in this Privacy Policy. Vercel hosts the Site, the API, the staff app, and our crawler, stores campaign and organization attachments and creator profile images, and measures page traffic and page speed. PlanetScale hosts our databases. Upstash holds rate-limit counters and short-lived caches. Inngest runs our background jobs and holds the event payloads that start them. Bunny stores and streams creator videos. Backblaze B2 holds our raw crawl archive, creator video vectors, and backups. Turbopuffer holds the index of creator video embeddings that search runs on and receives the text of each search to match against it, and Qdrant holds the earlier copy of that index until that account is closed. ClickHouse Cloud holds dated creator profile snapshots and crawl results; copies of our request logs, with your IP address, browser, and the pages and API routes you request; performance traces; copies of the sampled AI model calls Braintrust receives; copies of the AI model calls we send through OpenRouter, with the briefs, instructions, context, and replies in each, and any credential in a web address removed; sign-in and security events, with the email address and IP address replaced by a one-way hash; mail events, with the recipient address of mail we send and the sender address of mail sent to us replaced by a one-way hash, and the subjects of mail we send and receive, with any email address in them masked; the direct message, comment, and reaction events Zernio delivers from our Instagram and TikTok accounts, with the sender's account identifier and handle replaced by a one-way hash and the message and comment text removed; the recipients Clay sends us for a sponsorship alert and whether each was added, with the email address replaced by a one-way hash and only its domain kept; the product analytics events and error reports described below; the title of each report you send through Report a Problem, with the page it was sent from and whether you were signed in, but not the rest of the report; payment records from Stripe, with your email address replaced by a one-way hash and your name, phone number, and postal address removed; our Mercury bank transactions and balances, including the names of the people and companies we pay or who pay us and the notes on each payment; and vendor usage and billing records. Hex, a data notebook service, reads that copy and our databases so staff can analyze them.
• Product analytics and error reporting services. PostHog receives the product analytics events, session recordings, survey answers, and web vitals described in Section I from the Site, the API, the command-line tool, and MCP clients, and also holds a synced copy of our payment records from Stripe, including your name, email address, phone number, billing address, and the brand and last four digits of your card, for revenue analysis. It also receives the model, token counts, cost, and timing of each AI model call we make, without the text sent or returned. Sentry receives the error reports and performance traces described in Section I, and the reports you send through Report a Problem together with the page you were on.
• AI model and web search providers. AI models from DeepSeek, reached through Vercel AI Gateway and run by the inference providers it routes them to, and Anthropic's Claude models, reached through OpenRouter, receive the briefs you type, campaign content, your assistant conversations, the text of the websites you paste, and the records the assistant reads for you, such as campaigns, Lists, credit balance, API key names, attachment file names, and revealed contact addresses, to produce search results, campaign matches, and assistant replies and to decide which search terms may be published; they also receive creator profile information and the evidence our contact research gathers, to judge whether a found contact address belongs to the creator and whether two profiles belong to one person. Braintrust, an AI quality monitoring service, receives a sample of those model calls, with the briefs you type, the instructions and context sent with them, and the model's replies, so staff can grade and improve their quality. Firecrawl receives the website addresses you paste and the web searches the assistant runs, and returns the text of those pages; it also receives a creator's name, handle, biography, and profile link to research a contact address. An embedding service receives the text of each search to turn it into a search vector, and creator profile information and public videos with their audio to index creators.
• An issue tracker, GitHub Issues, which receives the reports you send through Report a Problem together with the page you were on, and the error reports and operational alerts Sentry files there, so that staff can fix them.

In general, the Personal Information you provide to us is used to run the Service and to help us communicate with you. We use it to run searches and campaigns, send proposals to creators, record hires, invoice campaign funding, and pay creators. We also use Personal Information to contact users in response to questions, solicit feedback from users, provide technical support, and inform users about promotional offers.

We may share Personal Information with outside parties if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to meet any applicable legal process or enforceable governmental request; to enforce applicable Terms of Use, including investigation of potential violations; address fraud, security, or technical concerns; or to protect against harm to the rights, property, or safety of our users or the public as required or permitted by law.

Non-Personal Information

In general, we use Non-Personal Information to help us improve the Service and customize the user experience. We also aggregate Non-Personal Information in order to track trends and analyze use patterns on the Site. This Privacy Policy does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information to our partners, advertisers, and other third parties at our discretion.

In the event we undergo a business transaction such as a merger, acquisition by another company, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy, and that any acquirer of our assets may continue to process your Personal Information as set forth in this Privacy Policy. If our information practices change at any time in the future, we will post the policy changes to the Site so that you may opt out of the new information practices. We suggest that you check the Site periodically if you are concerned about how your information is used.

III. Campaigns, proposals, hires, and payouts

Starcovery Proposals sends campaigns to creators. Starcovery Payouts moves campaign money between hiring organizations and creators. Staff run both by hand and record each step in the Service.

Campaign records

A campaign stores the name and brief you enter, its shortlist of creators (handle, name, profile image, follower count, and fit score), your chat messages and attachments, contract terms (compensation, deliverable, the platforms the creator posts on, and creator posting date), and disclosure statements. Campaigns are public by default. Any signed-in user or credentialed agent can read a public campaign's name, brief, status, dates, and shortlist, with the identifiers of the organization and the user that created it, once any declassifying date set in its contract has passed. Contract terms are readable by the organization that owns the campaign, by the hired organization, by an organization a proposal reached as described under Proposals, and by staff. The market information answer decides when we may show a campaign's name and its compensation per creator in the going rate, the list of campaigns and the typical pay other organizations and creators see. The going rate shows nothing about the organization that ran the campaign, and it never includes a campaign before its declassifying date. Disclosure statements are readable by the organization that owns the campaign, by an organization a proposal reached, and by staff. Chat messages and attachments are readable only by the organization that owns the campaign and by staff. Attachments are held in private storage.

Proposals

Staff send proposals to creators from the team mailbox, team@starcovery.com, and read replies there. We record the delivery status of each proposal and whether the creator accepted or declined it. An organization that holds an approved claim on the handle a proposal went to reads that proposal on the Site, with the campaign name, the hiring organization's name, the contract terms, and the disclosure statement, and can accept or decline it there. We email each answer to the owners and admins of the hiring organization, and an answer given on the Site also to staff. Correspondence between you, creators, and staff stays in that mailbox.

Hires

When a creator accepts a proposal, staff record a hire naming the hiring organization, the hired organization, and the contract terms. Each organization can read the hire, the other organization's name, and the payout amount.

Funding

When a hiring organization requests campaign funding, we record the amount and the requesting user. Staff issue the invoice through Mercury and record the reserved, released, and refunded amounts in a campaign funding ledger. We do not store the invoice or the bank details used to pay it.

Payout accounts

When a creator organization opens a payout account, we record the request and notify staff. Staff invite you to Mercury, which collects your bank account details, tax documents, and identity documents through its own secure links; we do not receive or store them. We record the country on file, which setup steps are complete, open items staff enter for you, and may record the last four digits of the bank account on file and the date it last changed.

Payouts

Each payout is recorded against the hire with its amount and paid date, readable by both organizations and by staff. Before staff mark a payout paid, they record each live post of the hire with its link, platform, view count, and engagement count, readable by the hiring organization and by staff.

Credits, searches, and reveals

Credit purchases and spends are recorded in an organization credit ledger with the amount, the kind of entry, and the acting user. Each search records the brief you typed. We also count how often each search term is searched, without a reference to the user or organization that typed it. A term that is searched repeatedly, returns creators, and passes moderation may be published as a public search page with its results and listed in our sitemap. Do not type information into a brief that you do not want published. Each contact reveal records the organization and the creator profile revealed.

Each assistant conversation stores your messages, the replies, the brief, the filters, and the creators it found. A conversation belongs to your organization, and in the Service only its members and the API keys and agents bound to it can read it, even when someone else opens its link. A conversation you start without signing in is tied to a cookie on your browser, expires 30 days after you start it, and moves to your organization when you open it after signing in.

Staff access and notifications

Staff read campaign requests, hires, funding, payout accounts, payouts, deliveries, and handle claims in the staff app, which is limited to a list of staff email addresses. When you request a proposal send, campaign funding, or a payout account, we notify staff by email with your name, email address, organization name, and the request details.

Retention of money records

Campaign funding records, hires and their post records, payout records, and reveal records are retained after you delete your account, with the reference to your user removed. An organization cannot be deleted while it holds campaign funding records or reveal records, while it is the hired organization on a hire, while one of its campaigns has a hire, while one of its campaigns has sent a proposal, or while it holds an approved handle claim. Deleting a creator organization deletes its payout account.

IV. How we protect information

We implement security measures designed to protect your information from unauthorized access. Your account is protected by your Google sign-in or your password, and we urge you to take steps to keep your personal information safe by securing your Google account or password and by logging out of your account after each use. API keys and agent tokens are stored hashed. We further protect your information from potential security breaches by implementing certain technological security measures including encryption, firewalls, and secure socket layer technology. However, these measures do not guarantee that your information will not be accessed, disclosed, altered, or destroyed by breach of such firewalls and secure server software. By using our Service, you acknowledge that you understand and agree to assume these risks.

V. Your rights regarding the use of your Personal Information

You have the right at any time to prevent us from contacting you for marketing purposes. When we send a promotional communication to a user, the user can opt out of further promotional communications by following the unsubscribe instructions provided in each promotional e-mail. Promotional emails carry an image that records in product analytics, each time it loads, an identifier of the email and the browser or email app that loaded it, and the links to the Site in the formatted version of those emails carry the same identifier. Please note that notwithstanding the promotional preferences you indicate by unsubscribing through the link in any marketing email, we may continue to send you administrative emails including, for example, periodic updates to our Privacy Policy.

You may request a copy of the Personal Information we hold for your account by emailing team@starcovery.com from the email address on your account. You may delete your account from the Account pane of Settings, or by emailing team@starcovery.com from the email address on your account. Deletion removes your sign-in credentials, sessions, and organization memberships, disables your API keys, and deletes each organization in which you are the only member, unless it is blocked from deletion as described in Section III. Money records are retained as described in Section III. Campaigns, chat messages, attachments, search records, and credit ledger entries in an organization that continues to exist are retained with the reference to your user removed. If you are the only owner of an organization with other members, transfer ownership or remove the members before deleting your account.

VI. Links to other websites

As part of the Service, we may provide links to or compatibility with other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Site and the Service. Therefore, this Privacy Policy does not apply to your use of a third party website accessed by selecting a link on our Site or via our Service. To the extent that you access or use the Service through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that site or application. We encourage our users to read the privacy statements of other websites before proceeding to use them.

VII. Changes to our Privacy Policy

The Company reserves the right to change this policy and our Terms of Use at any time. We will notify you of significant changes to our Privacy Policy by sending a notice to the primary email address specified in your account or by placing a prominent notice on our site. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. You should periodically check the Site and this privacy page for updates.

VIII. Contact us

If you have any questions regarding this Privacy Policy or the practices of this Site, please contact us by sending an email to team@starcovery.com.