Your privacy, explained.

Who is responsible

Haggles is operated by COLLAB FOR INFLUENCER MARKETING AND MEDIA, based in Lebanon. Haggles is not a separately registered company. For privacy questions or requests, use our contact form or email care@collabhunts.com.

What we collect and why

• Questions and requests: your name, email address, request category, message and replies, so we can respond and manage your request. Emails sent to a connected Haggles inbox are processed by our email provider and shown to the owner in administration, including sender details, subject, plain-text message and attachment names, types and sizes. Incoming email alone does not verify account ownership.
• Verification and security: expiring link digests, session records, request timestamps and limited attempt counters, to verify inbox access and prevent misuse. We do not store readable passwords or raw email-link tokens in the database.
• Account sign-in: you can use email and password, Google, WhatsApp, or Apple on supported iPhone versions. Google and Apple share a stable account identifier and your selected name and verified email; Apple may supply a private relay address. New WhatsApp accounts must also verify an email before profile setup. These sign-in choices do not give Haggles access to your social posts. We store sign-in identifiers to find your account, short-lived verification records to prevent misuse, and encrypted Apple authorization information to disconnect Apple when you delete your account. Expired sign-in attempts are cleared by scheduled cleanup.
• How you heard about us: you may choose a broad source at signup, such as TikTok, search or a Haggles invitation. Answering is optional. We save only your selected category with your account and summarize it with account progress in our private administration report. It does not enable browsing tracking or advertising sharing, and is not shown on your public profile. We retain the answer with your account under the account deletion rules below.
• Accounts and collaborations: account details, brand and creator profiles, offers, applications, agreements, uploaded content and conversations support your requested collaborations. Other brands cannot browse your workspace. Approved creators can see published offers; conversation content is limited to its participants and authorized support where needed.
• Phone and location: accounts provide an international phone number, city and country. A creator’s exact address and map pin are optional and are not required to apply for deals. Brands provide an address or pin, and in-person deal venues require a map pin. Exact personal location and phone numbers are available to the account holder and authorized Haggles administration; creators’ city and country may appear to brands. When you request a WhatsApp verification code, Meta receives your phone number and a one-time code to deliver an authentication message through WhatsApp. Haggles checks the code securely and records the result and time. We store only a keyed digest of the code while it is valid, never the plaintext code. Codes expire after five minutes and are limited to three attempts. Expired verification records are removed during maintenance. There is no SMS fallback. During private testing, designated test accounts may use an explicitly recorded owner bypass instead of phone verification. Business locations have separate visibility settings. Accepting an in-person collaboration shares its selected visit address and pin with the participants in their saved agreement. Later edits do not alter that agreement. Google Maps receives the viewed area and network information when you open the map, and coordinates or search text for address lookup. Device location is requested only when you choose it, with no background tracking. Manual entry remains available.
• Instagram authorization: You can connect an Instagram Business or Creator account to confirm ownership and follower count. Haggles saves the account identifier, username, display name, profile link, follower-count snapshot and check date. The connection requests read-only basic account access, not posting or messaging. Credentials are used only to retrieve this profile evidence and are not saved for ongoing Instagram access. You confirm the returned account before linking it. Brands see the connected profile and follower count as part of your creator profile and applications. You can update the snapshot or disconnect in Social accounts, and remove Haggles access in Instagram’s Apps and websites settings. Removing or replacing the account used for eligibility requires a new profile review. Instagram connection does not automatically approve your Haggles profile.
• Facebook Page connection: with your authorization, Haggles reads the Pages you manage so you can choose one. We save the selected Page’s identity, profile link, follower-count snapshot and check date to support your creator profile and applications. Temporary authorization tokens are encrypted and removed after selection. This connection does not give Haggles ongoing Facebook analytics or permission to publish on your behalf. You can disconnect in Social accounts and remove access in Facebook’s business integration settings.
• YouTube connection: Haggles uses YouTube API Services. With your permission, we read and save your channel identifier, title, handle, link, subscriber count and check date. Subscriber counts from YouTube are rounded. Read-only access cannot upload or change videos. You confirm the channel before linking it and agree that brands you apply to can see its identity and subscriber count. Connecting does not approve your Haggles profile. Refresh credentials are encrypted on our server. We refresh when the connection is checked and remove evidence when access is lost or it cannot be refreshed within 30 days. Scheduled housekeeping checks expired connections and retries pending provider revocations. Disconnect in Social accounts to remove YouTube details from Haggles and revoke Google access; if Google is temporarily unavailable, we retain only encrypted credentials for revocation retry and block reconnection until it finishes. You may also revoke access in Google account permissions. YouTube data deletion requests are handled as soon as possible and within seven days, separately from the rest of your account request. Removing data from Haggles does not delete your YouTube channel. See the Google Privacy Policy. We do not use Google data for advertising or sell it.
• TikTok authorization: when available, you may authorize TikTok to verify account ownership. Haggles saves the account identifier, username, display name, profile link, follower-count snapshot and verification date. It requests read-only identity, profile and statistics permissions, never posting access. Profile-only verification uses credentials transiently. If you separately authorize post metrics when available, Haggles stores encrypted, renewable read-only credentials on the server and checks approved collaboration post links. Relevant Accelerate brands can see returned views, likes, comments and shares with the last-check date. A separate creator-insights choice, available only where approved or to designated sandbox testers, lets Haggles read up to 20 recent public videos and calculate average views, likes, shares and interactions divided by views. It includes the post-performance access described above. It does not provide audience age, gender, country or unique reach. We record the sharing wording version, time and connected account. Only you and eligible Accelerate brands you apply to can view the report, subject to profile approval and account access checks. Your report refreshes on demand, at most daily, and is hidden when older than seven days; refreshing replaces the saved report. Stop sharing insights in Social accounts removes the creator report and its sharing permission immediately, while preserving your connection and separately authorized collaboration post access. Reconnecting applies your newly selected sharing choices. Changing TikTok accounts removes old-account reports and post metrics. Disconnecting removes all saved TikTok credentials, connections and metrics, stops collection and requests revocation from TikTok. We do not collect posting access or infer sales from these counts. TikTok may require you to reconnect if permission expires. Follower-count verification remains a snapshot. You confirm the returned account before linking it and can disconnect in Account. Pending authorizations expire after ten minutes and are cleared during connection or scheduled housekeeping. Account ownership verification does not itself grant Haggles creator approval.
• Calendar and reminders: we use collaboration dates, your time zone and reminder choices to show your agenda and send service reminders by email and, on supported app versions, push notifications. You can switch reminders off. Downloaded calendar files contain collaboration titles and dates; sharing or importing them is your choice. Exports do not update automatically.
• Owner administration: owner identity, sign-in records and management actions, to restrict access and keep a record of decisions.

We use this information to answer requests, take steps you ask for, operate the service and protect it against abuse. Where applicable data-protection law requires a legal basis, these purposes rely on responding to requested pre-contractual steps, legitimate interests in running and securing the service, or compliance with an applicable legal obligation. Optional marketing requires a separate choice; this form does not request marketing consent.

Who can see it

Requests are available to their verified requester and authorized Haggles staff. Assigned Customer Support staff handle ordinary support and dispute requests and their internal notes. Privacy, deletion and security requests, and legal retention decisions, remain owner-only. Hosting providers process records and files for us; the email provider processes your email address and sign-in message. Haggles currently uses Sites hosting on Cloudflare and Resend for service email. The temporary care mailbox is managed through Collab’s email service.

Information may be processed outside your country. We have not promised storage in a particular country. Contact us for information about service providers and any transfer safeguards applicable to your request.

Saved collaboration history and ratings

Collaboration records include the agreed brief, messages, delivery confirmations, submitted files and links, earlier submission versions, revision requests, approval and completion events. Earlier versions help participants understand what was provided and resolve questions. The collaboration participants and authorized support can access these records. A saved link preserves its address, not a copy of an external website.

Brands need an active Reach or Accelerate plan to submit a creator rating after a completed collaboration. Saved ratings remain after plan changes. Optional ratings contain a score, written feedback, the associated collaboration and the author’s account. Only the author and authorized support can see a rating until both participants rate the completed exchange. Both participants can then see both ratings. Legacy ratings that were not shared remain private. When submitting a new rating, a brand may explicitly allow its score to count toward the creator’s profile rating. The profile summary is shown automatically. It includes the average and count of all eligible shared brand scores from completed exchanges after both participants rate; creators cannot select individual scores. Written feedback and rating authors are not shown on the profile. We record sharing choices with their date and wording version. Creators cannot hide the summary or select which eligible scores appear. You may request access or correction, report a concern or request deletion through Contact & requests.

Archiving a conversation only moves it out of your active inbox; it does not delete shared records. Completion closes new messages and uploads but keeps history accessible. Account and collaboration retention schedules remain a public-launch requirement; deletion requests are reviewed for active obligations and specific lawful retention needs.

Brand plans, support and insights

Free brands can view the first three distinct creator applicants per deal. Additional pending creators are represented only by a count until the brand upgrades. Existing accepted collaboration records remain available after a downgrade. We use plan records and a durable per-deal slot ledger to apply these limits consistently.

Authenticated support tickets and paid human-support conversations save your questions, replies, attachments and read status. Authorized team members can assign requests and keep private internal notes. Admin support views require a recorded reason, expire after ten minutes, and cannot act as the customer. Accelerate success contacts open WhatsApp outside Haggles; WhatsApp processes information under its own policies.

Brand-entered costs and attributed revenue are private to that brand account and authorized administration. Collaboration analytics use supported, approved post links. Separate creator reports use available platform data only with the creator’s sharing permission and applicable platform approval, or within the designated private sandbox test. Store purchase verification, when enabled, uses RevenueCat and the relevant Apple or Google store; paid access is shared with the website through the same Haggles account. Website checkout is not available yet. Real purchases remain disabled during private testing.

Problem reports and collaboration feedback

When you send Report a problem, we save your description, optional screenshot or PDF, account and role, current screen, timestamp, coarse browser or app platform, version, connection state and an error reference when available. A collaboration reference is included only if you participate in it. We do not automatically include page content, passwords, browsing history, cookies or console logs. Review your attachment for private information before sending it.

Your report and attachment are visible to you and the authorized Haggles owner. Internal investigation notes and assignment labels remain private to administration. The report status and any team outcome are visible in Your problem reports. Closed or resolved reports and attachments are removed during housekeeping after 180 days without an update. Open reports remain available while investigated.

After a completed collaboration, each participant may optionally send a 1–5 score, improvement topics and a comment to Haggles. This experience feedback is visible only to its author and the authorized owner; it is separate from participant ratings and never contributes to public creator ratings. Dismissing the prompt is remembered for that collaboration. Experience feedback and dismissal records are removed during housekeeping after two years without an update. Access or deletion requests include these records and attachments.

Help assistant conversations

When signed in, you can ask our automated knowledge-base assistant for guidance. We save your questions, the answers shown and helpfulness feedback in your account’s help history. You and the authorized Haggles owner can read these records to provide support and identify product improvements. The assistant retrieves approved articles without sending conversations to an external AI model. Private brand–creator messages are not included in support insights.

You can clear a help conversation in the assistant. Histories inactive for 180 days are deleted during support housekeeping. Do not include passwords, verification codes or payment details. Account access and deletion requests can include these help records.

How long information is kept

Standalone incoming-email records expire after 90 days and are cleared during inbox housekeeping. Unconfirmed form requests expire after 24 hours. Closed support and privacy requests are scheduled for deletion after 180 days; verification links expire after 15 minutes and request sessions after eight hours. Expired records are removed during request-service housekeeping. Open requests remain until resolved. If particular support evidence is needed for a specific legal obligation or claim, the owner records the reason and a dated expiry of no more than 90 days. After account deletion that evidence is isolated in encrypted storage, with private attachments, and erased when its hold expires.

Confirming account deletion starts permanent removal of your account, profile, photos, offers, content, messages and shared collaboration history, including that history from the other participant’s account. You are signed out on all devices. A private progress page remains available without signing in and explains any evidence retained for a specific obligation or claim and its expiry. Completed receipts are retained for 30 days; an opaque account identifier is kept for 35 days to prevent stale writes from restoring the account. The confirmation address and private-link details are encrypted and removed after the email provider accepts delivery, or within 23 hours of the first attempt. Encrypted credentials used only to disconnect social services are removed after success or seven days of retries. Rate-limit counters expire within their short security windows; provider event identifiers used to prevent duplicate processing are removed after 90 days. Old backup copies expire under the infrastructure provider’s retention schedule; email services, infrastructure logs and other providers can retain separate records under their own schedules.

Your choices and requests

You can request access, a copy, correction or deletion of your information using the contact form. For account deletion, use Account → Privacy & safety → Delete account and confirm your password or a code sent to your verified email, then confirm permanent removal. If you cannot sign in, use the account deletion page to request help by email. We verify ownership before acting on an email request and may need proportionate additional information if ownership is unclear. We explain any refusal or limitation; sending the email request alone does not erase the account. Deletion does not cancel Apple or Google Play subscriptions, delete your social accounts, or remove records held separately by their providers. Rights and response deadlines depend on the law applicable to you. You may also contact the competent data-protection authority where available.

The request portal lets you read replies without joining Haggles. Do not send identity documents unless the team explains why they are necessary and provides a suitable channel.

AI-assisted setup writing

AI writing is on by default on the website unless you have saved a different choice. You can turn it off in Account → Privacy & safety. When enabled, selected setup answers intended for your public introduction are sent to OpenAI to prepare a profile or brand/deal draft. When AI writing is off, your own answers form an editable preview without an AI request. These can include your display or brand name, topics, background, proposed offer and content brief. Phone numbers, exact addresses and photos are not included in this writing request. You can review and edit the draft before submitting it. We request that OpenAI not store the generated response as retrievable API history; this does not promise that the provider keeps no separate safety or operational records.

Content screening and safety reports

Automatic safety checks are on by default on the website unless you have saved a different choice. You can turn them off in Account → Privacy & safety. When enabled, we send profile introductions, offer descriptions, application pitches, collaboration messages, submission feedback, written reviews, uploaded photos and their filenames to OpenAI’s moderation service to help identify unsafe content. When automatic checks are off, this content stays private in the manual safety-review queue. This does not inspect the content of external links. Flagged content and content that cannot be checked automatically stay private until our team reviews them. Videos and documents require manual review. Automated checks can make mistakes; you can request another review in Account → Privacy & safety.

We retain submitted review text, restricted files, safety reports, decisions and appeals to operate this process. Authorized administrators can inspect relevant reported material, hide content and suspend abusive accounts. Reports and private support evidence are not sent to the automatic screening service. Screening is separate from malware protection and does not guarantee every file or message is safe. You can change writing and screening preferences independently in Account → Privacy & safety. We keep choices you explicitly save, their wording version and date separately from your profile, and erase them with your account. A website default does not create a record of permission. Earlier saved opt-outs remain in effect. Switching a feature off stops future requests for that feature; it cannot recall requests already sent or remove provider records governed by OpenAI’s own retention policies.

Optional search and referral measurement

On eligible public pages, you can separately allow Haggles to measure how visitors find the website and progress through account setup. This choice is off until you accept, is independent of the TikTok campaign choices, and is not required to use the website or register.

After acceptance, a random first-party HttpOnly cookie remembers your choice for up to seven days. We record a fixed broad source category, a recognized source provider where available, a fixed public landing-page category and the consent time. If you create a new account in that window, we link the record to the account so our private report can count account creation, email verification, completed setup and team approval for brands and creators. These stages are separate: registration is not approval or a completed collaboration.

We do not store search queries, full referrer URLs, typed form values, advertising click identifiers, IP addresses or device fingerprints in these measurement records. The page classifies the source in your browser before sending only the limited categories. No records are shared with advertising platforms through this feature. A recognized referral indicates where the browser says the visit came from; direct or missing referrals cannot prove that a visit came from an AI service.

Measurement records are removed after 90 days during housekeeping. Use the search and referral choice on a public page or Cookies to withdraw and remove records linked to the current browser cookie. Account deletion removes linked registration records. Browser Global Privacy Control and Do Not Track signals disable this measurement.

Aggregate website and business statistics

We count requests for a fixed set of public pages to understand overall website use. These server counters store only the UTC date, a public page category and a total. They do not set a visitor cookie or store IP addresses, browser details, full URLs, query strings, referrers, account identifiers or a record of individual requests. We do not join these counters to accounts or share them with advertising platforms. Counts can include repeat requests and automated traffic; they are not a count of people or an individual browsing journey.

Counting skips requests with Global Privacy Control or Do Not Track and requests carrying a saved refusal for campaign, search or TikTok measurement. It also skips signed-in browser sessions and administrative pages. Daily totals are kept for up to 90 days and removed during report or counter maintenance. Since a total contains no visitor identifier, we cannot identify or remove an individual contribution after it is added.

Our owner dashboard separately summarizes existing account and collaboration records to operate Haggles. It may display aggregate reports obtained from TikTok Ads Manager, labelled with their source and dates. An ad view or click is not proof of account creation or a completed collaboration. Optional account-linked journey tracking and sharing registration events with TikTok remain separate choices.

Optional campaign measurement

On our TikTok brand campaign page, you may separately allow first-party measurement. It is off until you choose to allow it; registration works without it. A random HttpOnly cookie remembers your choice and links the campaign to signup for seven days. We record the fixed campaign label, consent version and time, one registration-button click marker, and a completed-registration event only when a new brand account is saved. With the expanded choice introduced on 10 October 2026, we also record fixed, broad milestones: 10 seconds of visible-page time, reaching halfway down the landing page, seeing the setup steps, opening a question, opening the campaign signup page, choosing a signup method, attempting account creation and encountering a form-validation or request error. We count each milestone once per consent window. An earlier measurement choice does not authorize these new milestones; you must accept the updated choice first. The private registration record references your account to prevent duplicate counts and support deletion. It does not mean your email is verified, setup is finished, or a collaboration has happened.

We do not record field contents, passwords, verification codes, error-message text, screenshots, session recordings, raw page URLs, referral URLs, advertising click IDs, URL parameters, names, email addresses, phone numbers or device fingerprints in these campaign records. The milestones show observed actions, not why someone left or whether they read the page. This first-party choice does not send campaign data to TikTok. TikTok advertising measurement is a separate choice described below; no advertising pixel is loaded. Browser Global Privacy Control and Do Not Track signals disable this measurement. Return to Cookies or the campaign measurement choices linked from the landing-page footer to change your choice. Withdrawing removes campaign records linked to the current browser cookie; account deletion removes its linked registration event. Visit, registration and behavior records are removed during housekeeping after 90 days. Account deletion also removes behavior records linked through its current campaign attribution. Earlier records from other devices can be included in a privacy request.

Optional TikTok advertising measurement

Where enabled on our brand campaign page, you can separately allow Haggles to share a completed brand-registration event with TikTok to measure and improve our ads. It is off until you allow it, independently of first-party campaign measurement. You can register without either choice. The event means a new brand account was saved; it does not mean email verification, setup or approval is complete.

After your permission, we save the TikTok ad click identifier from your campaign link for up to seven days. Without permission, our website keeps it only temporarily in memory and removes it from the visible page URL. If you allow measurement and we have a valid ad click identifier when you create a brand account, our server sends TikTok that identifier, a random event identifier, the event time and a fixed page URL without query parameters. We do not include your name, email, phone number, Haggles account identifier, IP address, browser details or collaboration content in the event. No TikTok advertising script or pixel runs in your browser. TikTok processes received events under its own policies; see the TikTok Privacy Policy.

The separate haggles_tiktok_ads HttpOnly cookie remembers this choice for up to seven days. A returning ad click is recorded only while your TikTok permission is still valid. Consent, click identifiers and delivery records are removed from Haggles within seven days during housekeeping. Browser Global Privacy Control and Do Not Track signals disable this measurement. Change your choice in Cookies or the campaign footer. Withdrawal deletes this browser’s consent and queued or receipt records; account deletion removes linked registration-delivery records. Events already sent to TikTok cannot be recalled by withdrawing here. TikTok’s retention and privacy choices apply to its copies.

Your collaborations

Accounts, social usernames, company profiles, offers, applications, messages and files support the exchange journey. Public offer images and private collaboration material have different visibility rules. The account deletion and retention rules above also apply to this information. We do not sell personal information. Optional advertising measurement is limited to the separate choice described above.

Changes

We update this notice when the service or its processing changes and display the update date. Material changes affecting existing users will be communicated through the service or an appropriate contact channel.