1.Who we are#
- Company
- WISHNOTE Inc. (주식회사 위시노트)
- CEO
- Yoonseok Jang
- Business registration no.
- 685-88-00546
- Address
- 3F, 50 Toegye-ro 56-gil, Jung-gu, Seoul, Republic of Korea
- Service
- BrandMuse — https://brandmuse.me
- Privacy contact
- [email protected]
We decide how and why personal information is processed in BrandMuse, so we are the "personal information controller" under Korea's Personal Information Protection Act (PIPA) and the "controller" under the EU and UK GDPR. When a brand uses BrandMuse to manage its own business data (for example, its TikTok Shop orders), we process that data on the brand's instructions.
2.Information we collect and where it comes from#
Account information (from you)
- Name, email address, password (we store only a one-way hash), preferred language, time zone and account type (brand or creator).
- If you sign in with Google: your name, email address and Google account ID.
- Sign-in records, such as the time of your last sign-in.
Brand workspace information (from brands)
- Workspace and brand details: brand name, website, description, categories, products, target markets and other profile information. When you enter a website address, we read the public pages of that site to suggest profile details.
- Brand verification details, such as a company email address, a meta tag or a DNS record.
- Team members, their roles and invitations.
- Campaign briefs, offers, contract terms, messages with creators, product shipments, content reviews and files you upload.
Creator information
- From creators who use BrandMuse: profile details, contact email, rates, preferred markets, the social accounts you add or connect, media kit content, collaboration messages and submitted content. When you set up payouts or receive products, we also collect payout details (such as bank or PayPal details), tax form information and a shipping address.
- Public creator profile data: information that creators have made public on social platforms — handle, display name, bio, profile image, links, follower and view counts, public posts and their engagement metrics, and a contact email that the creator has published (for example, in a bio or link-in-bio page). We obtain it from public web pages, official platform APIs (such as the YouTube Data API) and creator data providers. Some values, such as audience estimates and authenticity scores, are estimates derived from this public data.
- Email addresses entered by brands: when there is no other way to reach a creator, a brand can enter the creator's email address on an offer. We use it only to send that offer and receive replies, and we do not show it to other brands. If the owner of the address asks, the brand or WISHNOTE removes it from the offer. Sending records for mail already sent are kept.
Payment records
BrandMuse does not process payments, and it does not hold or send money. Brands pay creators directly, and BrandMuse keeps only the amount, date and status that brands record. If we add a way to pay for plans, we will update this policy and tell you before it takes effect.
Pilot applications (from brands)
- Brand name, contact name, work email, website, Instagram account, target markets, what you write in the application form, the traffic source from an ad or link (a campaign-level value), and the time you agreed.
- We read the traffic source only from the address of the application page, and we do not use advertising cookies, pixels or per-person click IDs.
Usage information
- Log data: IP address, browser and device type, pages requested and the time of each request. We use it for security, abuse prevention (for example, limits on sign-in attempts) and troubleshooting.
- Email records: emails sent through BrandMuse and their delivery events (delivered, opened, bounced, complained), and replies sent to BrandMuse addresses.
- Tracking link clicks: time, country, browser and referring page. We store the IP address only as a one-way hash.
- Cookies needed to run the service (see "Cookies").
Information from connected platforms
If you connect TikTok, Instagram or YouTube, we receive the data described in the sections below, only within the permissions you grant.
3.TikTok data#
This section applies if you connect a TikTok Shop seller account, a TikTok advertiser account or a TikTok account to BrandMuse. Connections are optional. We access TikTok data only after you authorize BrandMuse through TikTok's official authorization flow, and only within the permissions (scopes) you approve. We use TikTok's official APIs and do not ask for your TikTok password.
TikTok Shop (sellers)
If you connect your TikTok Shop, we may access, depending on the permissions you grant:
- Shop and product information: shop name and ID, product listings, prices and stock status.
- Orders: order items, amounts, status and dates, used to calculate sales (GMV) and attribute sales to affiliate creators.
- Settlement and finance data: statements, payouts, fees and adjustments.
- Affiliate data: affiliate creators you work with, collaborations and their terms (such as commission rates), affiliate orders and the GMV attributed to each creator.
- Sample requests: requests from creators, their status and shipping status.
- Creator messages: messages you send to and receive from affiliate creators through TikTok Shop messaging.
Orders may contain buyers' personal information. We use order data only to calculate and show your sales and affiliate performance. We do not use buyers' personal information to contact buyers, for advertising or for any other purpose.
TikTok ads (TikTok for Business)
If you connect a TikTok advertiser account, we may access advertiser account information (account ID, name, currency and time zone); campaigns, ad groups and ads, including GMV Max campaigns; performance data such as spend, impressions, clicks, conversions, GMV and return on ad spend; and Spark Ads authorization codes that creators give you so you can promote their posts, together with information about those posts.
TikTok account (creators)
We receive TikTok account data only when creators connect their own account. A brand cannot connect a creator's TikTok account or collect this data for them. If you connect your TikTok account as a creator, we may access your basic profile (TikTok user ID, display name and avatar), profile information (bio, profile link and verification status), account statistics (follower, following, likes and video counts) and your video list (video ID, title or description, cover image, link, and view, like, comment and share counts).
How we use TikTok data
- To show dashboards and analytics in your workspace: sales and GMV, product performance, affiliate creator performance and ad performance (including GMV Max and Spark Ads).
- To help you manage relationships with affiliate creators (CRM): creator lists, notes, collaboration history and sample requests.
- To send messages to creators that you write or approve. We send a message only when you instruct us to, or when you have turned on an automation that you configured.
- For creators: to confirm that you own the account and to show your verified statistics and videos on your profile and media kit. You choose which of them are shown to brands.
- To produce summaries and analysis with our AI service provider, acting on our behalf. We do not use TikTok data to train AI models, and our AI provider does not use it to train its models.
- To keep the connection secure and to fix problems with it.
What we do not do
- We do not sell TikTok data.
- We do not share TikTok data with third parties for advertising, marketing or data brokering, or use it to target ads.
- We do not build a database of individual TikTok creators from TikTok data to sell, and we do not give TikTok data to third parties as creator rankings, scores or reputation data.
- TikTok Shop data and TikTok ads data (from the TikTok Marketing API) are used only inside the workspace of the seller or advertiser who connected them. We never combine them with another workspace's data.
- We do not use TikTok data for any purpose other than the features described above.
- We share TikTok data only with the service providers we need to run BrandMuse (see "How we share information"), or when the law requires it.
Storage, retention and deletion
- Access tokens are stored encrypted (AES-256-GCM), and only the systems that run your connection can use them.
- We keep TikTok data while the connection is active and refresh it regularly so that it stays current.
- When you disconnect TikTok in BrandMuse, revoke access on TikTok or delete your BrandMuse account, we immediately revoke and delete the access and refresh tokens and stop collecting data. We delete the data we received through that account within 30 days, except records that the law requires us to keep.
How to revoke access on TikTok
- TikTok account: in the TikTok app, go to Profile → Menu (☰) → Settings and privacy → Security and permissions → Apps and services permissions, choose BrandMuse and remove access.
- TikTok Shop: in TikTok Shop Seller Center, open the list of apps and services authorized for your shop and deauthorize BrandMuse.
- TikTok ads: in TikTok Ads Manager or Business Center, remove BrandMuse from the apps that can access your advertiser account.
- You can also email [email protected] and we will disconnect it for you. See Data deletion for details.
Your use of TikTok is also governed by TikTok's own terms and Privacy Policy.
4.Instagram and Facebook data (Meta)#
The first list in this section applies if you, as a creator, connect an Instagram professional account or a Facebook Page to BrandMuse through Meta's official login. Connections are optional and work only within the permissions you approve.
- What we may access: account ID, username, name, profile picture, bio, follower and media counts, your posts and reels with their metrics, and the account and content insights you authorize (such as reach and aggregated audience country, age and gender).
- Partnership ads: if you work with a brand on partnership ads, the settings and permissions you grant to that brand.
- How we use it: to confirm account ownership, show verified statistics on your profile and media kit and to the brands you work with or apply to, check that agreed posts were published with the right ad disclosure, and report on campaign performance.
- What we do not do: we do not sell Meta data, share it for advertising or data brokering, or use it to train AI models.
- Deletion: when you disconnect in BrandMuse or remove Kagit for Business on Meta, we immediately delete the tokens, and we delete the data received through the connection within 30 days, except records the law requires us to keep.
- How to revoke access: in the Instagram app, go to Settings and activity → Website permissions → Apps and websites; on Facebook, go to Settings and privacy → Settings → Business integrations. Then remove Kagit for Business.
Instagram business accounts connected by brands
Brands connect an Instagram business account to BrandMuse through Kagit for Business (business.kagit.kr). Kagit for Business is another service run by WISHNOTE Inc. It is not a third party.
- How you connect: on a Kagit page, you log in with Facebook and choose your Page. Kagit keeps the Meta access token. BrandMuse never receives it.
- What we receive: what Kagit receives from Meta and passes to us when you use a feature: the connected account's name and ID, the connection status and permissions you granted, account and post insights, Creator Marketplace information, public metrics, hashtag search results, partnership messages, tag approval and ad permission status, posts you can use as ads, and ads and their results.
- How we use it: only for the features your brand uses in BrandMuse, and only on your brand's instructions.
- Kept apart: each brand's data stays in that brand's workspace. We do not combine it with other brands' data.
- What we do not do: we do not sell or license this data, give it to other customers, use it to target ads or build custom audiences, or use it to train AI models.
- How long we keep it: while the account is connected. Data that Kagit keeps only for a short time, such as Marketplace search results, we keep for the same period (for example, 7 days).
- Deletion: when you disconnect in BrandMuse or remove the app in Facebook, we stop receiving new data right away and delete the data we received within 30 days. If you ask Meta to delete your data, we delete it within 24 hours after Kagit tells us.
- What is not Meta data: information your brand enters or tracks itself, such as creator usernames you type in, tracking links, discount codes and orders. It is not deleted when you disconnect. We keep it as workspace data.
- How to revoke access: on Facebook, go to Settings and privacy → Settings → Business integrations and remove "Kagit for Business".
5.Google sign-in and YouTube#
BrandMuse uses YouTube API Services to read public channel and video information when brands look for creators and when we check that agreed videos were published. If you sign in with Google or connect a YouTube channel, we use the information Google shares with us only for the features described in this policy.
By using these features you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke BrandMuse's access at any time from your Google Account permissions page.
6.How we use information#
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide the service | Accounts, workspaces, campaigns, offers, contracts, content review, reports | Performance of a contract |
| Find and match creators | Search public creator data, score how well creators fit a brief | Legitimate interests of brands and of BrandMuse |
| Send offers and messages | Emails and messages that brands write or approve, follow-ups, replies | Legitimate interests; contract |
| Payment records | Amounts, dates and status that brands record (brands pay creators directly) | Contract; legal obligation |
| Handle pilot applications | Reviewing an application, contacting the applicant, sending a receipt email, counting which ad or link applications came from | Steps before a contract; consent |
| Safety and security | Sign-in limits, fraud and abuse prevention, audit records | Legitimate interests; legal obligation |
| Service messages | Email verification, password resets, notifications, weekly reports | Contract |
| Improve the service | Fixing errors and understanding how features are used | Legitimate interests |
| Meet legal obligations | Tax and accounting records, responding to lawful requests | Legal obligation |
AI and automated steps
We use AI models to review briefs, estimate how well a creator fits a campaign, draft offers and messages in each person's language, sort replies and check ad disclosures. Brands choose manual, assisted or automatic mode for each step, and every automatic decision is recorded with its reasons. If an automated decision significantly affects you, you can ask us to explain it or to have a person review it.
Creators who have not signed up
Brands may contact creators found through public data. Every outreach email says which brand is writing and includes a way to opt out. We limit how many offers one creator can receive, and once you opt out we stop all offers to that address.
8.International transfers#
Our main servers are in the Republic of Korea. Some providers listed above process data in other countries, mainly the United States. Data is sent over encrypted connections when you use the related feature, and each provider keeps it only as long as needed to provide its service to us or as its contract with us allows.
Where the law requires it, we use appropriate safeguards such as standard contractual clauses. These transfers are necessary to provide BrandMuse; if you do not want your data transferred, you can stop using the service and ask us to delete your account.
9.How long we keep information#
| Information | How long |
|---|---|
| Account and workspace data | Until you delete your account or workspace, then deleted within 30 days |
| Data from connected platforms | While connected; deleted within 30 days after you disconnect (tokens are deleted immediately) |
| Instagram business account data (through Kagit) | While connected; deleted within 30 days after you disconnect. After a deletion request through Meta, deleted within 24 hours after Kagit tells us |
| Deletion a creator requests through Kagit | Within 24 hours after Kagit tells us, we delete the data or remove the name. For payment and settlement records, we keep amounts and dates for the period the law requires, but remove the name and Instagram account details |
| Pilot applications | 1 year after the application was last handled; deleted sooner on request |
| Public creator profile data | While it is used in the service; deleted on request |
| Opt-out records | Only the email address and opt-out date, kept so that we do not contact you again |
| Contracts, payments and payouts | 5 years (Korean Act on Consumer Protection in Electronic Commerce, tax laws) |
| Complaints and disputes | 3 years (Korean Act on Consumer Protection in Electronic Commerce) |
| Sign-in and access logs | 3 months (Korean Protection of Communications Secrets Act) |
Records that the law requires us to keep are stored separately and used only for that legal purpose.
10.How we delete information#
When information is no longer needed for its purpose, or its retention period ends, we delete it without delay. Electronic files are deleted so that they cannot be restored, and any paper records are shredded. Copies in backups are removed when those backups expire.
11.Your rights and choices#
Depending on where you live, you have the right to:
- Access your personal information and get a copy of it.
- Correct inaccurate information.
- Delete your information.
- Stop or object to processing, including processing based on legitimate interests.
- Withdraw consent at any time, where we rely on consent.
- Ask for an explanation of, or a human review of, an automated decision.
- Receive your data in a portable format.
- Not be treated differently for exercising these rights.
You can update your name, language and password on your account page. For anything else, email [email protected] from the address on your account, or ask someone to act for you with written authorization. We may ask you to confirm your identity. We reply within 10 days, or sooner if the law where you live requires it.
If you are in the EU or UK, you can also complain to your local data protection authority. In Korea, you can contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (spo.go.kr, 1301) or the Korean National Police Agency (ecrm.police.go.kr, 182).
13.Children#
BrandMuse is not for children. You must be at least 14 years old to create an account. If we learn that a child under 14 has given us personal information, we delete it.
14.How we protect information#
- All traffic is encrypted in transit (HTTPS).
- Passwords are stored as one-way hashes. Bank and tax details, shipping addresses and platform access tokens are encrypted with AES-256-GCM.
- Access is limited by workspace and by role, and only authorized staff can reach production systems.
- Sign-in, sign-up and password reset attempts are rate-limited, and incoming webhooks are signature-checked.
- Important actions and automated decisions are recorded in audit logs.
- Servers run in Google Cloud data centers with physical access controls.
15.Privacy officer#
- Name
- Yoonseok Jang (CEO)
- [email protected]
Contact our privacy officer for questions, complaints or requests about personal information. We will answer without delay.
16.Changes to this policy#
If we change this policy, we will post the new version on this page at least 7 days before it takes effect, or at least 30 days before for changes that significantly affect your rights. We will also notify account holders by email or in the app.
Effective date: November 2, 2026.