arrow_backBack to home

Privacy Policy

Last updated: July 2026

1. Data Controller & Information Officer

Phakama Digital (Pty) Ltd ("we", "us", "our") operates OutLoud and is the responsible party for personal information processed through the platform in accordance with the Protection of Personal Information Act, 2013 (POPIA), and related South African law.

Our Information Officer can be reached for privacy enquiries, data subject requests, and POPIA-related matters at arnold@phakama.digital.

2. Information We Collect

Depending on how you use OutLoud, we may collect:

  • Account data: name, email address, password (stored hashed), account type (creator or brand), and organisation membership for brand teams.
  • Profile data: display name, bio, niches, province, audience demographics, media kit settings, portfolio items, rate cards, and reliability or completion metrics derived from platform activity.
  • Financial data: payment details provided by creators for invoicing (bank accounts, e-wallets, mobile money, PayPal, etc.; encrypted at rest). We do not store payment card numbers — subscriptions are handled by Paystack.
  • Social connection data: when you connect accounts via OAuth, we store encrypted access and refresh tokens and sync public profile metrics from Meta (Facebook and Instagram), TikTok, and YouTube. We do not receive or store your social platform passwords and we cannot post on your behalf.
  • Content you upload or create: intro videos (stored on AWS S3), campaign briefs, pitches, inbox messages, draft submissions, digital agreements, and invoices generated on the platform.
  • AI interaction data: prompts and context sent to our AI features (such as campaign briefs, creator profiles, alignment scores, and matchmaking inputs) to generate pitches, campaign drafts, and brand recommendations.
  • Usage and technical data: log data, IP address, browser or device type, timestamps, and records of how you interact with platform features.

3. Lawful Basis for Processing

We process personal information only where permitted under POPIA, including:

  • Contract: to create and manage your account, deliver matchmaking, inbox, workflow, and billing features you sign up for.
  • Consent: when you connect social accounts, upload content, accept these policies at registration, or opt into optional features. You may withdraw consent for optional processing by disconnecting integrations or contacting us, subject to legal and contractual limits.
  • Legitimate interest: to secure the platform, prevent fraud, improve features, and maintain service quality — balanced against your rights.
  • Legal obligation: where we must retain records for tax, audit, dispute resolution, or regulatory compliance.

4. How We Use Your Information

We use personal information to:

  • Provide creator–brand discovery, alignment scoring, matchmaking, and campaign workflow tools.
  • Build and display live media kits from connected social metrics and profile information.
  • Power AI-assisted pitches, campaign drafts, and brand recommendation messages.
  • Facilitate messaging, agreements, draft review, invoicing, and post-campaign ratings.
  • Process OutLoud subscriptions and send service-related notifications.
  • Protect users, investigate abuse, and comply with applicable law.

5. Automated Decision-Making & Profiling

OutLoud uses automated processing to calculate alignment scores, rank campaign matches, recommend platforms and deliverables, and surface creator suggestions to brands. These outputs are advisory aids to help you make decisions — they are not binding contracts and should be reviewed by humans before pitches, offers, or collaborations proceed.

You may contact us if you wish to query or challenge a materially significant automated outcome affecting your use of the platform.

6. AI-Assisted Features

OutLoud uses Google Gemini to generate campaign drafts, creator pitches, and brand recommendation text based on information you and other users provide. AI output may be inaccurate, incomplete, or unsuitable for your specific campaign. You are responsible for reviewing and editing AI-generated content before sending pitches, publishing campaigns, or relying on recommendations.

We send only the data necessary to deliver each AI feature. Do not include unnecessary sensitive personal information in free-text fields. See our Terms of Trust for ownership and acceptable use of AI-assisted content.

7. Third-Party Processors

We share limited personal information with trusted service providers only as needed to operate OutLoud:

  • MongoDB Atlas — primary database hosting in the South Africa (af-south-1) region for account, profile, campaign, and workflow data.
  • Amazon Web Services (S3) — intro video storage (af-south-1 region where configured).
  • Google Gemini — AI text generation for pitches, campaign drafts, and match recommendations.
  • Paystack — subscription payment processing.
  • Meta, TikTok, and Google/YouTube — OAuth authentication and read-only social metrics via their respective APIs.
  • Email providers — transactional notifications, where configured.

Each processor is engaged under contractual terms requiring appropriate security and confidentiality. Their own privacy policies also apply when you authenticate directly with them.

8. Cross-Border Transfers

Hosting your core OutLoud account data in MongoDB Atlas's South African regionmeans your primary database records are stored within South Africa. This supports POPIA's objective of accountable local processing.

Some features necessarily involve processors that may handle data outside South Africa — for example Google (Gemini, YouTube OAuth), Meta, TikTok, or Paystack infrastructure. Where personal information is transferred cross-border, we take reasonable steps under POPIA section 72 to ensure the recipient is subject to adequate protection through contractual safeguards, the processor's security standards, and limiting what we share to what is required for the service.

9. Data Retention & Security

We retain account and campaign records while your account is active and for a reasonable period thereafter where required for legal, tax, audit, fraud prevention, or dispute resolution purposes. Signed agreements, invoices, and payment-related records may be kept longer where law requires.

Sensitive fields such as payment identifiers, bank account numbers, and OAuth tokens are encrypted at rest. Access is restricted to authorised systems and personnel. No method of transmission or storage is completely secure; we continuously work to maintain appropriate technical and organisational safeguards.

10. Your Rights under POPIA

As a data subject, you have the right to:

  • Be notified that your personal information is being collected and the purpose of collection.
  • Request access to personal information we hold about you.
  • Request correction of inaccurate, incomplete, or misleading information.
  • Request deletion or destruction of personal information where it is no longer needed for the purpose collected, you withdraw consent (where consent was the basis), or processing is unlawful — subject to lawful exceptions.
  • Object to processing in certain circumstances.
  • Submit a complaint to the Information Regulator of South Africa.

11. Deletion & Right to Be Forgotten

You may request deletion of your OutLoud account and associated personal information by emailing arnold@phakama.digital from your registered email address with the subject line "Data deletion request". We will verify your identity and respond within a reasonable period, typically within 30 days.

Upon approved deletion we will:

  • Close your account and remove or anonymise profile, media kit, and social connection data.
  • Revoke stored OAuth tokens and delete uploaded intro videos from our storage.
  • Disconnect your public media kit URL from active display.

We may retain certain records where required by law or legitimate business need, including signed agreements, invoices, tax records, fraud-prevention logs, and messages already delivered to other users as part of an active collaboration. Where full deletion is not possible, we will explain why and limit further use of retained data to the permitted purpose.

12. Public Media Kits

Creators who complete onboarding receive a public media kit URL displaying reach, engagement, niches, connected platforms, portfolio highlights, and optional rate card information. Payment details, OAuth tokens, and encrypted credentials are never shown publicly. You can manage visibility through profile and media kit settings.

13. Cookies & Similar Technologies

OutLoud uses essential cookies and local storage to keep you signed in and remember session preferences. We do not currently use third-party advertising cookies. If we introduce analytics or marketing cookies in future, we will update this policy and, where required, request your consent.

14. Children

OutLoud is intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a minor has registered, contact us and we will take steps to delete the account.

15. Security Incidents

If we become aware of a compromise of personal information that poses a real risk of harm, we will take reasonable steps to contain the incident, notify affected users and the Information Regulator where required under POPIA, and document remedial action taken.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date above. Continued use of OutLoud after changes take effect constitutes acceptance of the updated policy, subject to your rights under POPIA.

17. Contact & Information Regulator

Privacy enquiries and data subject requests: arnold@phakama.digital

Information Regulator (South Africa): inforegulator.org.za