Privacy Policy

1. Who we are

SORAA is operated by Soraa LLC ("Soraa," "we," "us"), a marketplace connecting brands with micro-influencer creators. This policy explains what information we collect, how we use it, and the choices you have.

2. Information we collect

We collect information you give us directly, and a small amount generated by using the Service:

• Account info: your email address, and password or Google sign-in credentials, used to authenticate you.
• Profile info: what you enter as a brand (company name, campaign details) or creator (bio, niches, content style, rates, portfolio links, follower counts you self-report).
• Connected social account data: if you choose to connect an Instagram or TikTok account, we receive your handle, follower/following counts, and media count from that platform, plus an access token we use to keep that data in sync. The token is stored in a locked database table that no user — including you — can read directly through the app; it's used only server-side to refresh your stats.
• Messages: content you send to a matched brand or creator through SORAA's messaging.
• Reviews: ratings and feedback submitted after a completed collaboration.
• Basic usage data: standard technical logs (e.g. request metadata) used for security and debugging.

3. How we use this information

We use the information above to:

• Match brands and creators and power campaign discovery.
• Display your profile to the other side of the marketplace.
• Enable messaging between matched users.
• Compute reputation from submitted reviews.
• Send you notifications about matches, messages, and collaboration activity — in-app, and by email if you've enabled it.

4. How information is shared

• Your profile info and connected social stats are visible to other authenticated users of the marketplace — that visibility is the point of the platform, the same way a public creator or brand profile works anywhere else.
• Messages are visible only to you and the person you're messaging.
• We do not sell your personal data.
• We share data with the service providers that run SORAA: Supabase (database, authentication, hosting), Vercel (application hosting), Resend (transactional email), and — only after you explicitly connect an account — the Instagram and TikTok APIs, solely to read your own connected account's public stats.

5. Data security

Access to your data is enforced at the database level, not just in the app — other users can only read what these Terms describe as visible to them. Access tokens for connected social accounts are kept in a separate table with no client-facing access at all.

6. Your choices

• Disconnect a connected Instagram or TikTok account at any time from your profile.
• Edit or remove profile information at any time.
• Request deletion of your account and associated data by emailing joinsoraa@gmail.com.

7. Data retention

We retain your information while your account is active. If you request deletion, we remove your data except where we're required to retain it by law.

8. Children's privacy

SORAA is not directed at, and is not intended for use by, anyone under 18.

9. Changes to this policy

We may update this policy from time to time. We'll update the effective date above when we do.

10. Contact

Questions about this policy, or want to exercise a privacy choice? Reach us at joinsoraa@gmail.com.