Privacy

Information we process

• Public creator profile facts such as display name, username, public platform URL, official public bio text, public counts, pricing signals, categories, hashtags, and social links when source-backed.
• Creator, representative, agency, sponsor, claim, correction, and removal contact details submitted through forms, auth, or email handoff.
• Verification challenge records for profile claims and removals, including code metadata, attempt status, limited evidence excerpts, hashed IP/user-agent metadata, and audit events.
• Approved profile/card/banner identity-image metadata, source records, removal status, blocked image hashes, and admin audit logs.
• Advertising-account legal and billing details, reviewed country/tax evidence hashes, creative rights confirmations, wallet and finalized public-blockchain transaction evidence, invoices, corrections, refunds, and accounting records.
• Privacy-limited ad events containing a random event ID, campaign, creative, placement, event type, and time. Raw ad events do not store visitor accounts, wallet identity, cookies, fingerprints, IP addresses, or user agents.

How we use it

We use the data to publish and maintain public-source profiles, verify representation, process removals or corrections, review and deliver Sponsored placements, prevent unsafe imports, monitor exact Base USDC payments, issue NZ records, resolve disputes, secure the service, and keep audit evidence. Providing private advertising details is voluntary, but missing required identity, rights, billing, country, wallet, or tax evidence means verification or checkout cannot proceed.

Measurement

SpicyBrowse counts ad impressions, one-second 50%-viewable impressions, and outbound clicks, then reports daily campaign and creative totals. It also uses static, aggregate funnel markers to understand key on-site steps without identifying a visitor. A connection address may be held briefly in Edge-function memory only to rate-limit abuse; it is not written to the ad-event record or used to build a profile. SpicyBrowse does not use cookies, fingerprinting, cross-site tracking, invented conversions, or creator-sensitive behavioral profiles.

Who receives it

Access is limited by role to the person who submitted the record, approved SpicyBrowse administrators, and contracted infrastructure providers needed to host, secure, back up, or deliver the service. A verification code is intentionally placed on the creator-controlled public profile, and Base wallet addresses and transactions are public on the blockchain. SpicyBrowse does not sell personal information. Before production collection opens, each overseas provider must be documented and covered by a Privacy Act 2020 permitted basis and appropriate safeguards.

What we do not want

Do not send explicit media, private or paywalled content, passwords, government IDs, subscriber-only material, unauthorized private-content dumps, face-search requests, lookalike requests, fake reviews, or hidden ranking requests. Those requests may be rejected or deleted.

Public-source profiles

Unclaimed profiles can be created from source-backed creator-controlled public evidence. They remain claimable, correctable, reportable, and removable. Exact official or creator-provided bios may appear when source-backed and free of illegal or prohibited themes; visible legal/copyright disclaimer blocks may be stripped from display while restricted evidence stays in review records.

Retention, access, correction, and contact

Raw privacy-limited ad events are deleted after 90 days. NZ advertising invoices, payments, exchange-rate evidence, corrections, refunds, and cryptoasset records are retained for at least the required seven-year tax-record period. Other personal information is kept only while needed for its lawful marketplace, safety, dispute, suppression, or audit purpose. You may ask for access to or correction of your personal information through Contact; use Report or Remove Profile for profile or image action.

The collecting agency is SpicyBrowse, operated in New Zealand. The operator's legal name and service address must be added here before production personal-information collection opens; until then, this implementation is staging-only.