Privacy Policy

Note on status: This Policy is in effect as of the date above and reflects how Laumika actually operates today. We are finalizing our policies with legal counsel and may refine this page; the current version is accurate and binding.

1. What this covers

This Policy explains what Laumika collects, what we do with it, who else sees it, and what you can do about it.

Laumika is a creator directory. Brands search it to find creators to work with. We designed it to collect as little as the service needs: no third-party analytics, no advertising trackers, no data sold to anyone, and short retention on almost everything we gather automatically.

Two things about Laumika shape most of the answers below, and we’d rather you know them up front than find them in a footnote:

We build profiles for creators who haven’t signed up. We create them from information that’s already public, so brands can find people before those people have heard of us. If we’ve made one for you, you can claim it, change it, or have it taken down. Section 7 explains how.

Creator contact details are gated. They never appear on a public profile and aren’t in the page source. Apart from the creator and any manager they’ve invited, a signed-in user can get them only through a controlled reveal, and only once the creator has added and confirmed a contact. We record each reveal.

2. What we collect

2.1 What you give us

When you create an account: your role (creator, brand, or agency), your confirmation that you’re 18 or over, and the date you accepted our Terms. Your email address is held by our authentication provider, Supabase Auth. Creators don’t have a password: they sign in with a 6-digit code we email them. Brand and agency accounts sign in with a password and an authenticator app. Their password is held by Supabase Auth; we never store it ourselves, and it passes through our server only to be checked.

Brand and agency accounts also store your company or agency name, your website, and your industry. Brand and agency accounts must also set up an authenticator app; we store one-way hashes of your backup codes, never the codes themselves.

What you post or send on Laumika: opportunities, applications, collab posts and responses, the creators you save or block, reports you file, and the email address of any manager you invite.

When you build or claim a creator profile: your name, handle, headline, bio, profile photo, city and country, website, and whatever professional detail you choose to add — social links and audience figures, audience breakdowns, audience proof, past collaborations, brand experience, portfolio images and video links, testimonials, education, experience, milestones, press, representation, and your rates and working preferences.

Your business contact details, if you add them, so brands can reach you. These are stored separately from the rest of your profile and are never published.

2.2 Profiles we build from public sources

We create creator profiles using information that’s already public — from sources such as the creator’s own social accounts, their website or link page, and press coverage: name, handle, a short bio, and their public social links with follower counts. We also write a short headline and choose the categories they work in, based on their public content; once a creator claims the profile, they can change or remove both. Each of these profiles is labelled as created from public information. We also keep a private note of where that information came from. It’s never shown on the profile or to anyone outside our team, we use it only to show where the information came from, and it’s deleted when the profile is.

We do not record contact details for profiles we create. A profile we create has no email address or other contact until its owner claims it and adds one.

2.3 Other people’s information

A creator’s profile can name people who have no Laumika account — a manager, an agent, a testimonial source, a named contact at a brand they’ve worked with. Those names may appear publicly on the profile.

Where a profile also holds such a person’s contact details, those are stored in gated form, are never displayed, and are never served through the reveal flow.

If your information appears on a Laumika profile and you don’t own that profile, write to contact@laumika.com and we’ll deal with it.

2.4 What we collect automatically

Very little, and we don’t track your browsing.

Your IP address, for rate limits. We use IP addresses to stop abuse of actions that are easy to abuse: creating an account, signing in, password resets, account recovery, claiming a profile, requesting a verification code, choosing a handle, creating a profile, reporting content, requesting a takedown, unlocking a contact, and viewing profiles and the directory while signed out. These are counters, not logs — we record that an address made a number of attempts in a day, not which pages it visited. They’re deleted after about a week.

Sign-in records. When you sign in, our authentication provider records the IP address the sign-in came from and the type of browser and device you used. It keeps that record until you sign out on that device — sign-ins on Laumika don’t expire on their own, so if you never sign out, it stays. For brand, agency and other accounts that use an authenticator app, it also records the IP address each time a code is checked, and keeps those records for as long as your login exists.

Sign-in codes. When anyone asks for a sign-in, sign-up or reset code for an email address, we keep a one-way fingerprint of that address (never the address itself) and of the code, with the times codes were sent and tried. This happens even if the address has no account. It’s deleted two days after the last code.

Code requests per network. Every code request, and every code entered, is also counted against a one-way fingerprint of your IP address and of the network block it belongs to — never the address itself. These counts are deleted within a few hours.

When you ask for a sign-in code, we keep a one-way fingerprint of the network the request came from (never the address itself), linked to the fingerprint of that email address, for about a day, so that one network can’t use up your codes. When a code is entered correctly, we keep that network’s fingerprint for 30 days, so you can still sign in from it if someone floods your address with code requests.

When you start a claim. When you start a profile claim, we store a one-way fingerprint of your IP address (never the address itself) and the email address you entered with that claim request, along with a record of the claim link we sent you: who issued it, when it was used, and by which account. Claim links work once and expire after 14 days. All of this is deleted when the profile is.

Signed-out profile views are capped. A signed-out visitor can open 30 profiles a day from one IP address before further profiles stop loading for the rest of the day. That’s an anti-scraping measure, and it’s a count — we don’t record which profiles. If an address goes over the limit, we keep a one-way fingerprint of it to block it for the rest of the day, and delete it the next day.

A record of each contact reveal: who revealed, whose profile, what kind of contact, and when. No IP address, no device information, no browser fingerprint.

Apart from the sign-in records above, we do not collect device identifiers, browser fingerprints, or any location beyond what you type into your profile.

2.5 Cookies and third-party requests

Laumika sets one cookie: the session cookie that keeps you signed in (your browser may store it in more than one part). No advertising cookies, no analytics cookies, no third-party trackers.

Our fonts are served from our own site. But a few things on Laumika do cause your browser to contact someone else, and you should know about them:

• The takedown form, and the sign-in, sign-up and password-reset forms after several code requests, load a bot-protection script from Cloudflare. Cloudflare sees your IP address, browser and referrer.
• Images a creator links from another site (rather than uploading them) load from that site, which sees your IP address.
• Payment pages, if and when paid features are switched on, load Stripe’s payment fields.

3. What we use it for

• Running the directory — showing profiles, search, filtering, connecting creators with brands and with each other
• Signing you in and keeping your account secure
• Passing a creator’s business contact to the signed-in user who unlocks it — usually a brand, or another creator whose collab post you responded to
• Stopping fraud, spam and abuse — the IP counters above, and an automatic check of opportunities and collab posts for contact details or links, which we flag for a person to review
• Emailing you, and people you ask us to contact — sign-in, sign-up and password-reset codes, verification codes, contact-change confirmations, notices when your contact is unlocked, reminders to keep your business contact current, manager invitations you send, and account-recovery updates. We also email you about your account: when you delete your profile or close your account, and again when it has been permanently deleted; if your Verified badge, your ownership of a profile, or your manager link is removed; if Laumika hides or removes your profile, account or collab post; and when we approve, decline or take down an opportunity you posted.
• Meeting legal obligations

We do not sell your personal information and we do not use it for advertising.

4. Who else sees it

We share personal information with the companies that run the platform, and only as much as running it takes.

We use no analytics, advertising or data-enrichment services. Sentry, listed above, is our only error-tracking service.

Payment processing is not currently active. Laumika is in early access and doesn’t charge for anything yet, and we do not collect or hold payment information. If we introduce paid features, we will update this Policy to name the payment processor and describe what it receives before anyone is charged.

The reveal is a disclosure too. When a signed-in user reveals a creator’s contact, that contact goes to them. We can record that it happened; we can’t control what they do with it afterwards.

Managers you invite. If you invite a manager, they can see and edit your profile, including your business contact, upload media, post and respond on the collab board, and apply to opportunities for you. You can end their access at any time, and it also ends if they close their account.

We may also disclose information where the law requires it, to enforce our Terms, or to protect the safety of Laumika and the people on it.

5. Deleting your profile

5.1 Creators

You can delete your profile yourself, in Settings. You’ll be asked to type your handle to confirm.

Straight away: your profile comes off Laumika. It leaves the directory and the public page stops loading. You’re signed out everywhere.

For 30 days: you can change your mind. Sign back in and you’ll be offered your profile back, exactly as you left it. Your handle is held for you.

After 30 days: your profile and everything on it is permanently deleted — photos, rates, contact details, social links, collab posts, and the applications you sent to brands. Your handle is released and someone else can take it.

Your sign-in survives. Deleting your profile doesn’t delete your login or your email address. You can build a new profile with the same account, or write to us to close the account entirely.

5.2 Brands and agencies

You can close your account in Settings. Closing is not deletion — your sign-in, the opportunities you posted and the applications you received are all kept. Closing deactivates your company or agency record, takes any of your open opportunities off the board (they’re kept, closed, along with the applications you received), signs you out, and after about 30 days deletes the company or agency record. You can restore it yourself during those 30 days. Restoring doesn’t reopen closed opportunities.

For an agency, closing also ends all of its management links straight away and withdraws any requests a creator hasn’t answered yet. Those creators’ profiles are untouched. Restoring the agency doesn’t bring the links back; a creator would need to invite you again.

To have your account removed rather than closed, write to contact@laumika.com.

5.3 What we keep, and for how long

Some records survive a deletion. Here is all of them.

Kept indefinitely, with your identity attached:

• If an administrator removed your profile (rather than you deleting it), we keep a record of it: your name, the business contact and login email that were on it, your social links, your former handle, and the reason. We keep this so we recognise you if you come back, and so we can answer questions about what happened. This does not apply when you delete your own profile — that keeps nothing of the kind.
• If an administrator removed your brand or agency account (rather than you closing it), we keep a record of it: your login email, your company or agency name, your website, an internal payment reference, the titles and number of opportunities you posted, the number of applications you received, and the reason. The opportunities themselves are also kept, closed and no longer linked to your account, including their descriptions, budgets and timelines, together with the applications creators sent to them.
• If someone reported you or you reported someone, we keep the report: the reporter’s email, what was reported, the text of the report, and any note an administrator added. If you report something that doesn’t exist, we keep a record that you did — your account and the handle or link you reported — until your account is deleted.
• Administrative and moderation actions — who did what, when, to which profile, and why. No account on Laumika, including an administrator’s, can delete an entry from this log.
• If you filed an account-recovery request, we keep a record of it, including a masked version of the email involved and a one-way fingerprint of the IP it came from. While the request is open we also keep the full email address, so we can send the code to it and tell you the outcome; it’s deleted when the request is settled, or within a day if the code is never entered.

Kept indefinitely, without your identity:

• Records that a contact reveal happened. The link to your profile is removed when your profile is deleted; the link to the viewer is removed when their account is deleted.
• A record that a deletion completed — an internal reference and a date, with nothing identifying attached.
• A one-way fingerprint of your public social links, so that our seeding doesn’t recreate your profile from public sources later. It can’t be reversed to recover the original. When you delete your own profile, this is the only fingerprint we write — we do not fingerprint your email address, so your email is not blocked if you return. When an administrator removes a profile, claimed or not, we fingerprint its public social links only, never an email address, and keep the removal record described above. If you deleted your profile, or an administrator removed it, and you want to come back, write to us and we’ll clear its fingerprint.

Kept until you sign out, or for as long as your login exists:

• Sign-in records. The IP address and browser type of each sign-in, until you sign out on that device; and the IP address recorded each time an authenticator code is checked, for as long as your login exists.

Kept for up to 30 days:

• A one-way fingerprint of a network a sign-in code was entered correctly from, linked to the fingerprint of the email address — so you can still sign in from it if your address is flooded with code requests.

Kept for about a week:

• IP addresses used for rate limiting.
• Database backups. Our database is backed up daily and those backups are kept for seven days, so a copy of your profile details can outlast the permanent deletion by up to a week. Your photos aren’t in those backups at all.

Kept for up to two days:

• Sign-in code records. A one-way fingerprint of the email address a sign-in, sign-up or reset code was requested for (never the address itself) and of the code, with the times codes were sent and tried. It’s deleted two days after the last code.
• Code requests per network. Counts kept against a one-way fingerprint of the IP address and of the network block it belongs to — never the address itself. These counts are deleted within a few hours.

Kept for about a day:

• A one-way fingerprint of each network that asked for a sign-in code for an email address.

We do not retain payment or financial records, because Laumika does not currently process payments.

5.4 If we remove your ownership of a profile

If we find that a profile was claimed by someone who isn’t the creator, we can remove that person’s ownership. We record why. The profile is hidden straight away, the business contact they added is deleted, and any manager’s access is put on hold. We email them at their sign-in address, and at the business contact too if it was different. Their login isn’t affected. Everything else they added stays on the profile, hidden, until the profile is deleted. If that was you and you think we got it wrong, write to contact@laumika.com.

5.5 What we can’t take back

Deleting your profile does not reach these, and nothing we do can:

• A contact already revealed to a brand or another user. They have your email address. It’s in their inbox and their systems. We can’t recall it.
• A link preview already copied by another service. When your profile link is shared in Slack, iMessage, WhatsApp, LinkedIn or an email, that service fetches a preview card and stores its own copy on its own servers. Search engines do the same. We can’t expire, invalidate or ask for those back.
• A page someone saved, screenshotted or copied. Your profile is public by design, and public means copyable.
• For up to an hour after you delete an image, copies already held in caches can still be served while they age out.
• For up to two hours after you delete an image, an upload link already issued for it can still place a copy back.

We’d rather say this plainly than promise an erasure we can’t perform.

6. Your rights

Depending on where you live, you may have the right to see what we hold about you, correct it, delete it, limit how we use it, or object to some uses.

To exercise any of these, write to contact@laumika.com. This includes people who aren’t Laumika users but whose information appears on a profile — a manager, an agent, a testimonial source, a named brand contact.

7. If we made a profile for you

If Laumika built a profile for you from public sources, you have three options:

Claim it. Message @laumikadotcom from the Instagram or TikTok account listed on the profile. We’ll reply with a one-time claim link; on the claim page, enter an email address and confirm it with the code we send you. The profile is then yours to edit, publish or unpublish. To get the Verified badge, you can later ask us to confirm one of your social accounts. When you ask, we give you a one-time phrase to send us by direct message from that account. The phrase is not a password — it only lets us match your message to your request. We keep a record of the request (which account, the phrase, and when it was made and settled) for 90 days after it is settled.

Claims start with a direct message to @laumikadotcom on Instagram or TikTok. That conversation stays in our inbox on that platform (Meta or TikTok handles it under their own privacy policy). We don’t copy it into Laumika.

Have it removed. There’s a “Request removal” link at the bottom of every profile we made that hasn’t been claimed. It doesn’t require an account and it doesn’t require talking to us — the profile normally comes down immediately (if our abuse protections are active, the request is recorded and a person handles it shortly) and is permanently deleted after our team reviews it. This route is for profiles you haven’t claimed; if you have claimed your profile, delete it from Settings as described in section 5.1. You can also email contact@laumika.com.

Leave it. It stays as it is, showing information that’s already public plus the headline and categories we wrote for it, with no contact details reachable by anyone.

When a profile is removed this way, we add a one-way fingerprint of its public social links to a suppression list so our seeding doesn’t recreate it. If it was removed through the “Request removal” link, that can’t be undone. If we removed it after you wrote to us, write to us again if you want to come back and we’ll clear it.

8. Security

Contact details sit behind a database-level wall that no public query can cross. Profile photos are stored privately and served through short-lived links. Administrative actions are written to a log no account can edit. Sign-in codes are issued and checked by Laumika and stored only as a one-way fingerprint. Passwords and sessions are handled by our authentication provider. Most of the data we collect automatically is deleted on a schedule; sign-in records last as long as the sign-in does.

No system is perfectly secure. What we can control is how little we hold and how quickly we let go of it.

9. Age

Laumika is for people 18 and over, and everything on it must be safe for work. We don’t knowingly collect information from anyone under 18, and we don’t knowingly create seeded profiles for anyone under 18. If one comes to our attention we remove it.

10. Where your information is processed

Laumika is operated from the United States. If you use it from elsewhere, your information is processed in the U.S. and in other countries where our providers operate.

11. Changes

We may update this Policy. We’ll post the new version with a new effective date, and give reasonable notice of material changes.

12. Contact

Questions or requests: contact@laumika.com