Privacy Policy

Cr8tiveHub Digital Studios (Pty) Ltd. (“Cr8tiveHub”, “we”, “us”, “our”) operates the public website at cr8tivehub.com, the Cr8tiveHub mobile application (available on Android), the web account portal at accounts.cr8tivehub.com, and the agency portal at agency.cr8tivehub.com.

We are a South African company registered as a responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is Thokozani Dube, registered with the Information Regulator of South Africa under registration number 2026-011645 in accordance with section 55 of POPIA.

Information Officer contact: admin@cr8tivehub.com.

Cr8tiveHub is a creative talent marketplace that connects creative professionals — including musicians, actors, photographers, DJs, producers, stylists, and other creatives — with individuals and organisations seeking creative talent across Africa.

For any privacy-related enquiries, you may contact us at legal@cr8tivehub.com.

We collect the following categories of personal information when you use our services. For each category, we describe what we collect, why, and the legal basis under POPIA that permits the processing.

Account Data

What: Full name, email address, profile photo, bio, city, country, profession, and hashtags.

Why: To create and maintain your account, enable discovery by other users, and personalise your experience.

Legal basis: Contractual necessity (section 11(1)(b) of POPIA) — this data is required to provide the service you signed up for.

Private Data

What: Phone number, date of birth, and full legal name. This data is held in a restricted, access-controlled store with owner-only access — no other users or staff can view it without explicit authorisation.

Why: For identity verification, age verification (our service is restricted to users aged 18 and older), and account recovery.

Legal basis: Contractual necessity and legal obligation (sections 11(1)(b) and 11(1)(c) of POPIA).

Content Data

What: Portfolio items (images, video, audio), credits, and opportunities posted.

Why: To provide portfolio showcasing, opportunity listing, and talent discovery features — the core of our service.

Legal basis: Contractual necessity (section 11(1)(b) of POPIA).

Usage Data

What: Login timestamps, session data, feature usage, and last active timestamp.

Why: To improve our service, detect security anomalies, and maintain platform integrity.

Legal basis: Legitimate interest (section 11(1)(f) of POPIA) — we have a legitimate interest in understanding how our service is used and ensuring its security.

Device Data

What: Firebase Cloud Messaging (FCM) push notification tokens (Android).

Why: To deliver push notifications about messages, application updates, and platform updates.

Legal basis: Consent (section 11(1)(a) of POPIA) — you may disable push notifications at any time via your device settings.

Financial Data

What: Subscription tier, billing cycle, and transaction records. We do not store credit or debit card numbers — payment card data is handled exclusively by PayFast (Pty) Ltd, our PCI DSS-compliant payment processor.

Why: To manage your subscription, process billing, and maintain financial records as required by law.

Legal basis: Contractual necessity and legal obligation (sections 11(1)(b) and 11(1)(c) of POPIA).

Verification Data

What: Your verification result (verified, not verified, or in review), which of the identity checks below passed, the type and issuing country of the identity document you used, and a record of your consent.

Why: To establish trust and authenticity on the platform, helping talent seekers identify verified professionals.

Legal basis: Consent (section 11(1)(a) of POPIA) — verification is voluntary. You can use Cr8tiveHub without it.

Biometric Data (identity verification only)

What: If you choose to verify your identity, a photograph of your identity document, a live selfie and a liveness check are captured, and the selfie is compared against the photograph on the document (a face match).

How — Didit (our primary method): The check is performed by our identity-verification provider Didit, acting as our operator under section 21 of POPIA. You capture your document, selfie and liveness recording in Didit's verification flow, and Didit performs the document, liveness and face-match checks. We do not receive or store your identity document images, your selfie or the liveness recording. Didit returns to us only the result (verified, not verified, or in review), which checks passed, and the document type and issuing country. If Didit cannot reach a decision automatically, a trained member of the Cr8tiveHub team decides using Didit's result.

How — in-app review (fallback): On older versions of the app, or if we temporarily switch away from Didit, the check is done in the Cr8tiveHub app instead: you take a selfie with a short liveness check (you are asked to blink and turn your head), with face detection running on your device, and you upload a photograph of your identity document. The selfie and document image are stored in our Google Cloud Storage (EU region) and reviewed by a trained member of the Cr8tiveHub team.

Why: To confirm that the person creating the profile is the person on the identity document. This is what makes a verified badge mean anything to a casting director, and it is the only purpose we use this data for. We do not use it for surveillance, advertising, or to identify you anywhere else on the platform.

Legal basis: Facial images used to identify you are special personal information under section 26 of POPIA. We process them only with your express written consent under section 27(1)(a), which you give in the app before the check begins. Verification is entirely optional and you may decline or withdraw at any time.

Retention: Under Didit, the images and liveness recording are held by Didit, not by us, for six months, and they are deleted sooner than that if you erase your account — when your account is erased we delete your verification session at Didit as well. Six months is the shortest period that still allows us to reconsider a decision you question, including an objection to an automated decision under section 71, which we answer within 30 days. Under the in-app fallback, the selfie and the identity document image are deleted once a decision has been made, and a storage rule deletes anything left over after 90 days at the latest. In both cases what we keep afterwards is the outcome — the result, which checks passed, the document type and issuing country, and your consent record — not the images themselves. If you delete your account, the verification record is erased with it.

Agency Verification Data

What:When an agency owner verifies their agency, they upload a company registration document issued by the CIPC (for example a CoR 14.3 or a disclosure certificate) and identity documents: if the owner is a listed director, a certified copy of their own ID; if not, a copy of their own ID, a certified copy of the ID of a director who can sign for the company, and a letter of appointment signed by that director. These documents contain personal information about the agency owner and, where applicable, a director — a third party — whose information the owner provides on the director's behalf. As an alternative, we may use Didit's business verification, in which Didit checks the company against the company registry and verifies a director's identity; in that case we receive only the result of those checks, not the company documents or the director's personal data.

Why: To confirm that an agency is a real, registered business and that the person acting for it is authorised to do so. Agencies must be verified before they can publish opportunities to creatives.

Legal basis: Legitimate interest (section 11(1)(f) of POPIA) in protecting creatives from fraudulent or exploitative opportunities, and contractual necessity (section 11(1)(b)) in respect of the agency owner.

Retention: Uploaded documents are reviewed by the Cr8tiveHub team and deleted once a decision has been made. We keep the outcome of the verification. The verification record is erased when the agency owner's account is erased.

Location Data

What: City, country, and latitude/longitude (if provided for discovery).

Why: To enable location-based discovery of creative talent and opportunities.

Legal basis: Consent (section 11(1)(a) of POPIA) — providing precise location is optional and can be withdrawn at any time.

Communications

What: Direct messages, live stream chat, and notification history.

Why: To enable communication between users, deliver notifications, and maintain records for safety and content moderation.

Legal basis: Contractual necessity (section 11(1)(b) of POPIA).

Behavioural Data

What: Follow relationships, portfolio likes/views, opportunity applications, and match scores.

Why: To power our discovery and matching algorithms, improving the quality of recommendations for both creatives and talent seekers.

Legal basis:Legitimate interest (section 11(1)(f) of POPIA) — we have a legitimate interest in improving the relevance of our platform's recommendations.

Website Browsing Data

What: IP address, user-agent string, page URLs visited, time of visit, referrer.

Why: Site security (rate limiting, abuse detection), basic operational logging, troubleshooting.

Legal basis: Legitimate interest (section 11(1)(f) of POPIA).

Retention: Server access logs retained for 90 days, then purged.

Inquiry & Agency Contact Form Data

What: Name, email address, organisation name (optional), message text submitted through enquiry or agency contact forms on cr8tivehub.com.

Why: To respond to your enquiry about partnerships, agency sign-up, press, or general questions.

Legal basis: Consent (section 11(1)(a) of POPIA).

Retention: 24 months after the last interaction relating to that enquiry, then deleted.

Newsletter / Mailing List (if you opt in)

What: Email address, plus (optional) name and area of interest.

Why: To send you product updates, opportunities, or news you have asked to receive.

Legal basis: Consent (section 11(1)(a) and section 69 of POPIA).

Retention: Until you unsubscribe. Every email contains a one-click unsubscribe link.

Cookies and Similar Technologies

Our websites use only strictly necessary cookies and similar technologies — for signing in and bot protection. We do not use analytics or marketing cookies on our websites. See the Cookies section of this policy for details.

We use your personal information for the following purposes:

• Providing and improving the service: Operating the Cr8tiveHub platform, maintaining your account, and developing new features.
• Matching creatives with opportunities: Using our automated matching algorithm to connect creative professionals with relevant opportunities and talent seekers.
• Enabling live streaming and portfolio features: Hosting and delivering your portfolio content and live streams to other users.
• Processing subscription payments: Managing billing, subscriptions, and transaction records through our payment processor PayFast.
• Sending push notifications and emails: Delivering important account notifications, application updates, messages, and (where you have opted in) marketing communications.
• Responding to enquiries: Responding to enquiries, agency sign-up requests, and contact-form messages submitted through our website.
• Sending newsletters and updates: Sending you newsletters and updates where you have opted in.
• Content moderation and safety: Automatically scanning uploaded media to detect and prevent illegal or harmful content, and reviewing flagged content to maintain community safety.
• Fraud prevention and security: Detecting and preventing fraudulent activity, unauthorised access, and abuse of the platform, including bot traffic and spam.
• Legal compliance: Fulfilling our obligations under South African law, including POPIA, the Companies Act 71 of 2008, and tax legislation administered by SARS.
• Analytics and product improvement: Understanding usage patterns to improve the user experience and develop features that better serve our community.

We do not sell your personal information. We do not share it with third parties for their own marketing.

We use the following third-party service providers to operate Cr8tiveHub. Where data is transferred outside of South Africa, we ensure appropriate safeguards are in place as required by section 72 of POPIA.

We retain your personal information only for as long as is necessary for the purposes described in this policy, or as required by applicable law. The following table summarises our retention periods:

When data is deleted, anonymised transaction records may be retained for up to 7 years as required for financial compliance under the Companies Act 71 of 2008 and SARS tax legislation.

As a data subject under the Protection of Personal Information Act, you have the following rights:

• Right of access (section 23): You have the right to request confirmation of whether we hold personal information about you, and to request a copy of that information. Submit your request to support@cr8tivehub.com.
• Right to correction (section 24): You have the right to request correction of inaccurate, incomplete, or misleading personal information. You can update most information directly through the Cr8tiveHub app or the web account portal at accounts.cr8tivehub.com/settings.
• Right to deletion (section 24): You have the right to request deletion of your personal information. You can delete your account through the app or by contacting support. Upon deletion, your account is deactivated immediately and your data is permanently erased after 30 days, subject to the retention periods described above. Within those 30 days you can ask support to restore your account. Erasure includes deleting your identity-verification session held by Didit.
• Right to object (section 11(3)): You have the right to object to processing of your personal information for direct marketing purposes. You can opt out of marketing communications at any time via your notification settings or by contacting us.
• Right to object to automated processing (section 71): You have the right to object to decisions made solely by automated means, including our opportunity matching algorithm and automated identity-verification decisions, and to ask for a human review. See the Content Moderation & Automated Processing section below for details.
• Right to lodge a complaint: If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa.

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include:

• Access controls restricting database and storage access to authorised users only.
• HTTP-only session cookies that cannot be accessed by client-side JavaScript, reducing the risk of cross-site scripting (XSS) attacks.
• Encryption in transit using TLS 1.2 or higher for all data transmitted between your device and our servers.
• Encrypted backups ensuring data at rest is protected.
• Automated content moderation to detect and remove harmful content.
• Rate limiting and fraud detection on authentication and sensitive API endpoints.
• CSRF protection on all mutating API endpoints.

While we implement robust security measures, no system can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by section 22 of POPIA as soon as reasonably possible after discovery of the breach.

Automated Content Moderation

We use automated content moderation to scan uploaded media for illegal or harmful content. This includes detection of nudity, violence, and other content that violates our Acceptable Use Policy. Content may be removed and users notified without prior notice if a violation is detected.

Opportunity Matching Algorithm

Our platform uses an automated matching algorithm that analyses your profile data, skills, location, and behavioural data (such as portfolio engagement and application history) to recommend relevant opportunities and surface your profile to talent seekers. This is an automated decision-making process as defined by section 71 of POPIA.

Automated Identity Verification

When you verify your identity through Didit, Didit's systems automatically check your identity document, liveness and face match and may approve or decline the verification without a person reviewing it. A decline means you do not receive the Identity Verified badge, so this is an automated decision that can significantly affect you under section 71 of POPIA. Where Didit cannot decide automatically, a trained member of the Cr8tiveHub team makes the decision using Didit's result.

If your verification is declined automatically and you believe the decision is wrong, you can ask for it to be reviewed by a person by contacting support@cr8tivehub.com. You can also make your representations about the decision to us in the same way. You may also simply try again — retries are included in the one-off verification payment.

Your Right to Object

You have the right to object to decisions made solely by automated means that significantly affect you. If you wish to object to automated processing or request human review of an automated decision, please contact us at legal@cr8tivehub.com. We will review your request and respond within 30 days.

Cr8tiveHub is strictly intended for users aged 18 years and older. We do not knowingly collect, process, or store personal information from anyone under the age of 18.

Signing up requires a date of birth, and an account that gives a date of birth under 18 cannot be created.

If an account is nevertheless found to belong to a person under 18, it is removed from public view and from discovery. The public profile is taken down, the account is removed from search and from every public listing, other people cannot browse or contact it, and it cannot host a live stream. Where the account's own details show the person is under 18 — or simply do not establish that they are an adult — this happens automatically, without waiting for anyone to review it.

A member of our team then deals with the account and deletes the personal information held for it. We do not destroy a suspected minor's account automatically on a timer: an account that is the subject of a child-safety concern may hold the only record of what happened to that child, and erasing it the moment it is flagged would erase that record too. Deletion is therefore a deliberate, recorded step taken by a person.

You do not have to wait for us to find it. Anyone — a parent, a guardian, or the young person themselves — can ask us directly to remove an account and delete the information held for it, and we will act on that request.

If you believe a minor has created an account on Cr8tiveHub, please notify us immediately at legal@cr8tivehub.com.

We use Firebase Cloud Messaging (FCM) to deliver push notifications to your Android device. Notifications may include:

• New direct messages from other users
• Opportunity recommendations matching your profile
• Subscription and billing updates
• Platform announcements and feature updates
• Security alerts (e.g., new device sign-in)

You can disable push notifications at any time through your device's notification settings or within the Cr8tiveHub app settings. When you disable notifications or uninstall the app, your FCM push token is deleted from our systems.

Our websites use only strictly necessary cookies and similar technologies:

• cr8tivehub.com sets no cookies of its own. Its report and enquiry forms load Google reCAPTCHA to block bots, which may set Google's reCAPTCHA cookies.
• accounts.cr8tivehub.com sets one HttpOnly sign-in cookie (__session) that keeps you signed in.
• accounts.cr8tivehub.com and agency.cr8tivehub.com use Google reCAPTCHA (through Firebase App Check) for bot protection, which may set Google's reCAPTCHA cookies such as _GRECAPTCHA.

We do not use analytics or marketing cookies on our websites, so there is no cookie banner or preferences setting — there is nothing optional to switch on or off. You can block or delete cookies in your browser, although signing in may then stop working. See our Cookie Policy for details.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by:

• Sending a notification to your registered email address
• Displaying an in-app notification within the Cr8tiveHub app
• Posting the updated policy on this page

Your continued use of Cr8tiveHub after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should discontinue use of the service and delete your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

Cr8tiveHub Digital Studios (Pty) Ltd. Registered in South Africa.