GDPR Compliance

Effective Date: September 26, 2026

1. Our Commitment to GDPR

CreatoRain (operated by Midwest AI Solution Inc.) is committed to complying with the European Union's General Data Protection Regulation (GDPR) and protecting the privacy and rights of individuals in the European Economic Area (EEA), the United Kingdom, and Switzerland. This page describes how we meet our obligations under the GDPR in connection with our restaurant influencer marketing platform.

We process personal data of restaurant owners, influencers, and other users who interact with our platform, and of people who have never used it: creators whose public social media profiles we collect through Bright Data and influencers.club, and restaurant owners and managers whose business contact details we collect from their businesses' websites and from business contact lists we obtain. Whether we act as a data controller or data processor depends on the context of the processing activity. In most cases, CreatoRain acts as a data controller for personal data collected directly from users of our platform, and as a data processor when processing data on behalf of our business customers (restaurant partners). We are also the data controller for the creator profiles and business contact details we collect ourselves, and for the creator details we add to our creator search when a restaurant imports a creator or adds a creator's email address.

2. Lawful Bases for Processing

Under the GDPR, we must have a valid lawful basis for processing personal data. CreatoRain relies on the following lawful bases depending on the type of data and the purpose of processing:

Consent

Where we rely on your consent, we ask for it first. We ask for your consent before sending you marketing communications, or sharing your data with third parties, where the law requires it. You may withdraw your consent at any time by contacting us at privacy@creatorain.com, or, for marketing emails, by using the unsubscribe link in any of them.

Performance of a Contract

We process personal data when it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes creating and managing your CreatoRain account, facilitating influencer-restaurant matching and campaign management, processing payments and managing subscriptions, and providing customer support related to our services.

Legitimate Interest

We process personal data when it is in our legitimate interests to do so, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include improving and optimizing our platform and services, detecting and preventing fraud, abuse, and security incidents, conducting analytics to understand how our platform is used, enforcing our agreements and our Acceptable Use Policy, contacting restaurant owners, managers, and creators about our Services and restaurant campaigns, and collecting creators' public social media profiles for our creator search.

Legal Obligation

We process personal data when necessary to comply with legal obligations, including tax and financial reporting requirements, responding to lawful requests from regulatory authorities, and retaining records as required by applicable laws.

3. Data Subject Rights

Under the GDPR and the equivalent laws of the United Kingdom and Switzerland, individuals in the EEA, the UK, and Switzerland have the following rights regarding their personal data:

Right of Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide the information in a commonly used, machine-readable format.

Right to Rectification

You have the right to request that we correct any inaccurate personal data or complete any incomplete personal data we hold about you. You may also update certain information directly through your account settings.

Right to Erasure

You have the right to request the deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when the data has been unlawfully processed.

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you have objected to processing based on legitimate interests.

Right to Data Portability

You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance, where the processing is based on consent or a contract and is carried out by automated means.

Right to Object

You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes. When you object to processing for direct marketing, we will cease processing your data for that purpose immediately.

Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. CreatoRain's influencer matching algorithms involve automated processing, but final decisions regarding campaign participation are always subject to human review.

4. How to Exercise Your Rights

To exercise any of your data subject rights, email us, or use your account for the changes it supports:

  • Email: privacy@creatorain.com — include "GDPR Request" in the subject line along with a description of the right you wish to exercise
  • Your Account: You can correct your account details in your account settings, and download the creator list of any campaign from its campaign page. For a full copy of your data, email privacy@creatorain.com

We will verify your identity before processing your request. We aim to respond to all legitimate requests within one month. In exceptional circumstances, where requests are particularly complex or numerous, we may extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for the delay.

We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

5. Privacy Contact

Questions about how CreatoRain handles personal data under the GDPR, and requests from individuals or supervisory authorities, go to:

6. International Data Transfers

CreatoRain is headquartered in the United States, and our production systems run there, on Amazon Web Services. Some of our service providers process personal data in other countries; our Privacy Policy and Subprocessors page say where. Section 5 of our Subprocessors page describes the checks we make before adding a provider, including how any cross-border transfer is covered. When we transfer personal data from the EEA, UK, or Switzerland, we also take these measures:

  • Supplementary Measures: Connections to our website, app and API are encrypted with TLS 1.2 or later, and our production database, its backups and the files we store are encrypted at rest, as described on our Security page
  • Transfer Impact Assessments: Where the GDPR requires one, we assess the law of the recipient country and add supplementary measures if they are needed

7. Data Breach Notification

In the event of a personal data breach:

  • We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to the rights and freedoms of individuals
  • If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay
  • Our notification will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences of the breach, and the measures taken or proposed to address and mitigate the breach
  • We record every personal data breach, whether or not it must be reported, with its facts, its effects, and the remedial action taken

8. Privacy by Design and by Default

CreatoRain integrates data protection principles into the design and development of our platform from the outset. Our approach to privacy by design and by default includes:

  • Assessing the data protection impact of new features and processing activities that are likely to result in a high risk to individuals, as Article 35 of the GDPR requires
  • Implementing data minimization principles — we collect only the personal data that is necessary for the specified purpose
  • Encrypting personal data in transit, and at rest in our production database and file storage

9. Children's Data

CreatoRain's restaurant influencer marketing platform is not directed at individuals under the age of 16. We do not knowingly collect or process personal data from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16, we will take immediate steps to delete that data.

If you believe that we have collected personal data from a child under 16, please contact us immediately at privacy@creatorain.com so that we can take appropriate action.

10. Complaints

If you believe that CreatoRain has not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority. You may file a complaint with the supervisory authority in the EU member state where you reside, where you work, or where the alleged infringement occurred. In the United Kingdom, the authority is the Information Commissioner's Office (ICO); in Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC).

Before filing a complaint with a supervisory authority, we encourage you to contact us first at privacy@creatorain.com so that we can attempt to resolve your concern directly. We take all complaints seriously and will work to address your concerns promptly and thoroughly.

A list of EU data protection supervisory authorities and their contact details can be found on the European Data Protection Board's website at edpb.europa.eu.