Privacy Policy

1. Introduction

Ripple ("we," "our," or "us") is operated by a company based in Montreal, Quebec, Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at ripple.gg and related services (the "Service").

This Privacy Policy explains how we process your personal data. Where consent is required by applicable law, we will request it separately.

2. Who We Are & Role

Ripple is an influencer marketing marketplace connecting video game studios ("Studios") with content creators ("Creators"). Ripple acts as the data controller for personal data processed under this Privacy Policy.

3. Information We Collect

3.1 Account Information

When you register, we collect your email address, display name, and a hashed password. You may optionally provide a profile picture. We also store your account role (Studio or Creator).

3.2 Studio Information

If you register as a Studio, we collect your studio name, description, website URL, and organization details. You may upload assets (images, videos, files) related to your games, stored on Cloudflare R2.

3.3 Creator Information

If you register as a Creator, we collect your bio, content niches, audience size estimates, and links to your public social media profiles (YouTube, Twitch, TikTok, Instagram, X).

3.4 OAuth & Third-Party Platform Data

Creators may connect their social media accounts via OAuth. When you do, we access and store:

• YouTube (Google): channel information, video metadata, audience geographic data via YouTube Analytics API.
• Twitch: channel information, stream metadata, follower counts.
• TikTok: profile information, video metadata.
• Instagram / Facebook (Meta): profile information, content metadata.
• Steam: game metadata via Steamworks and the public Steam Store API (used for Studios to link their games).

We store OAuth access and refresh tokens, encrypted using industry-standard encryption, to fetch this data on your behalf. These tokens are used solely to perform actions explicitly authorized by you (such as verifying content submissions or updating account analytics). You may revoke access at any time through your account settings or through the respective platform's permissions page.

3.5 Payment Information

Payments are processed through Stripe Connect. We do not store your full credit card or bank account details. Stripe may collect identity verification documents (KYC) from Creators receiving payouts, as required by financial regulations. Stripe's Privacy Policy applies to that data.

3.6 Messages & Communications

We store private messages exchanged between Studios and Creators within the platform. We use Novu (self-hosted on our own infrastructure, utilizing our own database and Redis cache) for in-app and email notifications — notification data never leaves our servers. Message content is stored on our servers.

3.7 Game Analytics Data

For Studios, we collect and store aggregated analytics about their games from public and authorized APIs, including Steam concurrent players, follower counts, review scores, and Twitch viewership statistics. This data is associated with the game, not with individual users.

3.8 Security & Audit Logs

We collect security-related audit logs including login history, User-Agent strings, browser specifications, device identifiers, IP addresses, failed authentication attempts, multi-factor authentication (MFA) events, OAuth events, and API request logs. This information is processed for fraud prevention, abuse detection, account security, and legal compliance.

3.9 Communication Preferences

We process your email address to send transactional and operational notifications (e.g., email verification, password resets, team invitations, NDAs, payments, and messaging alerts) as well as marketing newsletter communications (where authorized by you). You can manage your notification preferences at any time in your account settings.

4. How We Use Your Information

• To provide, operate, and maintain the Service.
• To match Creators with relevant Studio campaigns.
• To display Creator profiles and analytics to Studios for campaign selection.
• To process payments through Stripe Connect.
• To send transactional notifications via Novu (self-hosted).
• To provide Studios with game performance analytics.
• To detect and prevent fraud, abuse, and security incidents.
• To use automated systems and artificial intelligence (AI) tools for moderation, fraud detection, campaign matching, spam detection, and analytics.
• To comply with legal obligations.

5. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contractual necessity: to provide the Service you have requested (account, campaigns, payments).
• Legitimate interests: to improve the platform, prevent fraud, secure our servers, and provide Studios with relevant Creator data to make informed campaign decisions.
• Consent: for OAuth connections to third-party platforms, you explicitly authorize each connection. You may withdraw consent by disconnecting the platform in your settings.
• Legal obligation: to comply with applicable laws, tax regulations, and law enforcement requests.

6. How We Share Your Information

6.1 Between Platform Users

When a Creator applies to a Studio's campaign, the Studio can view the Creator's profile, connected social accounts, portfolio, and aggregated analytics. Studios do not have access to your email address or private messages with other Studios. When a Studio creates a campaign, Creators can view the campaign brief, requirements, and the Studio's public profile.

6.2 Service Providers & Data Processors

We engage third-party service providers who act as data processors to perform tasks on our behalf:

6.3 Legal Disclosures

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

7. International Data Transfers

Ripple is based in Canada. Your data is stored and processed in Canada, the United States, and other jurisdictions depending on our service providers' processing locations (such as Stripe's global processing centers). If you are located in the EEA, UK, or other regions with data protection laws, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where applicable, for any transfer of your personal data outside your region.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 90 days (unless backups require additional time to expire), except where we are required to retain it for legal, tax, fraud prevention, accounting, chargeback disputes, or active legal disputes (e.g., transaction records are kept for 7 years under Canadian tax law).

Personal data may remain in encrypted backups for a limited period until such backups are overwritten or expired in accordance with our disaster recovery policies. Archived campaigns, anonymized analytics, and aggregated statistics may be retained indefinitely.

9. Your Rights

9.1 GDPR Rights (EEA/UK Users)

You have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: request limited processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: withdraw OAuth connections at any time.

9.2 Canadian Rights (PIPEDA & Quebec Law 25)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25, you have the right to access your personal information, challenge its accuracy, and request corrections. You may also withdraw consent to collection, use, or disclosure, subject to legal or contractual restrictions.

9.3 CCPA Rights (California Residents)

Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to know what personal information we collect, request deletion, and opt out of the sale or sharing of personal information. We do not sell personal information, or share it for cross-context behavioral advertising.

9.4 Automated Decision Making

We do not make decisions producing legal or similarly significant effects solely through automated processing or profiling.

9.5 Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Cookies

We use essential cookies for authentication, CSRF protection, session integrity, and user preferences such as language or visual theme. We do not use advertising cookies or cross-site advertising tracking.

On public marketing pages, Ripple uses a self-hosted, privacy-focused Umami analytics service to understand aggregate page visits, traffic sources and UTM campaigns, technical browser and device context, and non-sensitive conversion events such as CTA clicks and successful contact or beta requests. We do not send contact form contents, email addresses, names, or account identifiers to Umami, and Ripple does not use analytics tracking in the signed-in product workspace.

Currently, we do not respond to browser Do Not Track (DNT) signals.

11. Data Security & Breach Notification

We implement industry-standard security measures including strict access controls, encryption at rest and in transit, and regular security reviews. All administrative access to servers requires authentication (such as Tailscale VPN locks) and is limited strictly to authorized personnel only. Passwords are hashed using modern cryptographic algorithms. OAuth tokens are stored encrypted using industry-standard encryption. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

In the event of a data breach, we will notify affected users and regulatory authorities within the timeframes required by applicable laws if the breach is likely to result in a high risk to your rights and freedoms.

12. Children's Privacy

The Service is not intended for individuals under the age of 16 (or the minimum legal age required by the laws of your jurisdiction, whichever is higher). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the platform. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions or notices regarding this Privacy Policy, you may reach out to the appropriate department:

• Privacy & Data: [email protected]
• General Legal: [email protected]
• Copyright / DMCA Notices: [email protected]

Address: Montreal, Quebec, Canada

For complaints, EEA/UK users may contact their local data protection authority. Canadian users may contact the Office of the Privacy Commissioner of Canada.