Privacy Policy
This policy explains what personal information Riselist ("we", "us") collects, why, and what choices you have. It covers two groups of people:
- Customers and website visitors — brands, agencies and anyone who visits or uses our website.
- Creators — TikTok creators whose public profile information appears in our database. Most creators have not signed up with us. If you are a creator, you may prefer our short Creator Data Notice.
If anything here is unclear, email us at samuelaguda77@gmail.com.
1. Who we are
Riselist is run by Samuel Aguda, based in Lagos, Nigeria. It is an early-stage business; this policy will be updated with company registration details once registration is complete.
We are the data controller for the information described in this policy. That means we decide how and why it is used, and we are responsible for protecting it.
Data protection lead: Samuel Aguda, who you can reach at samuelaguda77@gmail.com.
Representatives:
- EU representative (GDPR Article 27): being appointed
- UK representative (UK GDPR Article 27): being appointed
2. Information about customers and website visitors
Riselist is at an early stage. Today we work with brands by email, so most of what we hold about customers is the emails and briefs they send us and our billing records. The table below also covers the account features of the platform we are building, so this policy will not need to change when they launch.
What we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email, company name, job title, password (stored scrambled) | You, when you sign up |
| Billing details | Billing name and address, tax number, payment status | You and our payment provider. We do not store full card numbers. |
| Platform activity | Searches, shortlists, saved creators, outreach drafts you write with our tools | Your use of the platform |
| Support messages | Emails and chats with us | You |
| Technical data | IP address, browser type and pages requested, in our hosting provider's server logs | Your device, via our hosting provider (GitHub Pages) |
| Marketing choices | Whether you want our newsletter | You |
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, provide the service, bill you | Contract with you |
| Keep the platform secure, prevent fraud and misuse | Legitimate interests (keeping our service safe) |
| Improve the product and understand how it is used | Legitimate interests (making the product better) |
| Send service messages (receipts, security alerts, changes to terms) | Contract with you |
| Send marketing emails | Your consent, or legitimate interests where the law allows it for existing customers. You can unsubscribe at any time. |
| Keep tax and accounting records | Legal obligation |
3. Information about creators
What we collect
We only collect information that the creator has made publicly visible on TikTok to anyone, without logging in. We do not collect:
- private accounts, or anything behind a login,
- direct messages, passwords or private contact details,
- phone numbers or home addresses,
- information about the creator's followers as individuals.
What we do collect:
| Type | Examples |
|---|---|
| Public profile | Username, display name, profile photo, bio, country or language shown, verified status |
| Public numbers | Follower, following and total like counts |
| Recent public videos | Up to the latest 30 videos: link, caption, date, views, likes, comments count, shares, sounds used, hashtags |
| Sponsored signals | Whether a post appears to be an ad or paid partnership (for example a "Paid partnership" label or #ad) |
| Public links | Links shown in the bio, including shop or storefront links (for example TikTok Shop or Amazon storefront) |
| Business contact email | Only an email address the creator has chosen to show publicly in their bio for business enquiries |
| Scores we calculate | For example engagement rate (views compared to followers), how often posts are sponsored, whether the creator sells products, posting frequency, content category |
About our scores: Our scores are estimates made by our software from the public numbers above. They are not facts the creator gave us and they can be wrong. They are not used to make decisions with legal or similarly serious effects on anyone. A brand always decides for itself whether to contact a creator.
Things we try hard not to collect or guess: We do not try to work out a creator's health, religion, ethnicity, sexual orientation, political views or other sensitive characteristics, and we do not use face recognition. We aim to exclude accounts that appear to belong to people under 18. If you think we hold data about a child, tell us and we will delete it.
Where it comes from
From public TikTok profile and video pages. We refresh it about once a week.
Why we use it
- To help brands find creators whose public work fits a marketing campaign.
- To show brands public performance information so they can make fair, informed choices.
- To help brands write a first business enquiry to the creator's public business email.
This is also good for creators: it helps them get found for paid work.
Our legal basis
Legitimate interests (GDPR and UK GDPR Article 6(1)(f); Nigeria Data Protection Act 2023, section 25). Our interest, and that of brands, is to find creators for business partnerships, using information the creator chose to publish to promote their work. We have written an assessment balancing this against creators' rights. We limit what we collect, keep it fresh, and make it easy to object. You can ask us for a summary of this assessment.
How creators find out
Because we collect this information from TikTok and not from the creator, the law (for example GDPR Article 14) requires us to tell creators about it. We do this by:
- publishing this policy and our Creator Data Notice;
- requiring that the first outreach email a brand sends through our tools includes a short line saying where the brand found the creator's details, with a link to our Creator Data Notice.
Creator choices
Creators can see, correct or remove their data at any time — see Section 8 and our Creator Data Notice. If a creator asks to be removed, we delete their profile and add them to a do-not-collect list so they are not added back at the next weekly refresh.
4. Who we share information with
We do not sell customers' personal information.
| Who | What and why |
|---|---|
| Brand customers | Creator profiles and scores, so they can find and contact creators. Customers must agree to our terms, which forbid them from reselling raw creator data, using it for anything other than business partnerships (for example not for hiring, credit, insurance or housing decisions), sending spam, or ignoring a creator's request to stop contact. |
| Service providers | Hosting (GitHub Pages for this website, and our application database host), email delivery, payments, customer support tools, and AI writing tools used for outreach drafts. They may only use the data to provide their service to us, under written contracts. |
| Professional advisers | Accountants and lawyers, where needed. |
| Authorities | Where the law requires it, or to protect rights and safety. |
| A buyer of our business | If the business is sold or merged, under the same protections. |
We will send you a current list of our main service providers on request.
5. International transfers
We are based in Nigeria. Our servers and service providers are located in the United States and the European Union. Our customers and creators are located all over the world.
This means your information may be stored or used in a country that is not your own, including countries whose laws may not protect data in the same way. When we move personal data across borders, we use the protections required by the law that applies, for example:
- EU / UK data: the European Commission's Standard Contractual Clauses (and the UK Addendum) with our service providers, or a country the EU/UK has approved as "adequate". Nigeria currently does not have an EU or UK adequacy decision, so we apply the same protections described in this policy to all data no matter where it is held.
- Nigeria (NDPA sections 41–43): we only transfer data where the recipient country or organisation gives an adequate level of protection, or where another basis allowed by the NDPA applies, and we record our reasons.
You can ask us for a copy of the safeguards we use.
6. How long we keep information
| Information | How long |
|---|---|
| Customer account data | While your account is open, then up to 2 years after it closes (so we can deal with questions or disputes) |
| Billing and tax records | As long as tax law requires — usually 6 years |
| Website technical logs | Up to 12 months |
| Marketing preferences | Until you unsubscribe, then we keep only your email on a "do not email" list |
| Creator profile | While the creator's TikTok account stays public and active. If an account becomes private, deleted or unreachable, we remove it from search within 30 days and delete it within 90 days. |
| Creator video data | Only the latest 30 videos. Older video details are deleted at each refresh. |
| Creator history (trends) | Weekly summary numbers (for example follower count) kept for up to 24 months, then deleted |
| Do-not-collect list | As long as we operate, holding only the minimum needed (for example the TikTok username and a scrambled ID), so we never re-add that person |
| Outreach drafts | While the customer's account is open, then deleted with the account |
7. Keeping information safe
We use reasonable technical and organisational measures, including encrypted connections (HTTPS), encryption of stored data where available, strong passwords and two-factor login for staff, access limited to people who need it, and regular backups.
No system is perfectly secure. If a data breach is likely to put people at risk, we will tell the relevant regulators within the legal time limits (usually 72 hours under GDPR, UK GDPR and the NDPA) and tell affected people where required.
8. Your rights
Everyone can contact us at samuelaguda77@gmail.com to ask what we hold about them. Creators can also follow the simple steps on our Creator Data page at https://getriselist.com/creators.html#remove.
How we respond
- We will reply within 30 days. Removal requests from creators are handled within 7 days.
- If a request is very complex, we may need up to 2 more months, and we will tell you why within the first 30 days.
- It is free. We may ask for a simple proof that the account or email is yours (for example, an email from the address in your bio, or a code posted in your bio). We only use that proof to deal with your request.
If you are in the EU, the European Economic Area, Switzerland or the UK
You have the right to:
- Access — get a copy of your data, including where we got it.
- Correct — fix wrong or incomplete data.
- Erase — ask us to delete your data.
- Object — tell us to stop using your data based on legitimate interests. For creator data, we treat an objection as a request to remove you and stop collecting about you; we will not argue the point.
- Restrict — ask us to pause using your data while a problem is checked.
- Portability — get data you gave us in a common digital format.
- Withdraw consent — where we rely on consent, at any time.
- Complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU, see the list at edpb.europa.eu. We'd like the chance to fix it first, so please contact us — UK residents can use our complaint process at samuelaguda77@gmail.com.
If you are in Nigeria
Under the Nigeria Data Protection Act 2023 you have the right to be informed, to access, correct and delete your data, to restrict or object to processing, to data portability, to withdraw consent, and not to be subject to a decision based only on automated processing that seriously affects you. You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
If you are in California
California law gives you the right to:
- Know what personal information we collect, use and disclose;
- Delete your personal information;
- Correct inaccurate personal information;
- Opt out of the "sale" or "sharing" of your personal information;
- Limit use of sensitive personal information (we do not intentionally collect sensitive personal information);
- Not be treated differently for using these rights.
Notes for California creators: much of what we hold is information you made publicly available, which California law treats differently. Even so, we will honour any request to know, correct or delete, and you can opt out by emailing samuelaguda77@gmail.com with the subject "Do Not Sell or Share My Personal Information", or by following the steps at https://getriselist.com/creators.html#remove. We also honour browser "Global Privacy Control" signals for website visitors. An authorised agent can make a request for you with your signed permission.
Categories collected in the last 12 months: identifiers (username, email, IP address), commercial information (customers' purchases), internet activity (website use), professional information (public creator business details), and inferences (our creator scores). See Sections 2–4 for sources, purposes and recipients.
If you live somewhere else
Many countries give similar rights. Contact us and we will help wherever we reasonably can.
9. Cookies
Our website currently sets no cookies at all. If that changes, we will update our Cookie Notice and ask for your consent before setting any non-essential cookie.
10. Children
Our website is for businesses, not for children. We do not knowingly collect data from children under 18 for our creator database. If you believe we have, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will change the "Last updated" date and, for important changes, tell customers by email or on the platform.
12. Contact us
Riselist
Lagos, Nigeria
Email: samuelaguda77@gmail.com
Data protection lead: Samuel Aguda
Creator data and removal: https://getriselist.com/creators.html