CMX / LEGAL

Privacy Policy

Your information helps CMX run a creator marketplace. This policy explains what we collect, why we use it, who may receive it, and how you can exercise your privacy choices.

Last updated 21 October 2026

This Privacy Policy applies to CMX, including our website, creator and brand accounts, public creator profiles, creator inventory, campaign and booking workflows, communications, payment and payout workflows, and integrations with third-party platforms (together, the “Service”). It should be read with our Terms of Service.

1. Who is responsible for your information?

CMX is operated by Destiny Kelechi with its contact address at N/A (“CMX”, “we”, “us”, or “our”). For privacy questions, access or correction requests, or requests to delete information, contact privacy@joincmx.com. The entity identified above is intended to be the controller responsible for deciding why and how personal information is processed, except where applicable law or a separate notice identifies another controller.

2. Information we collect

The information we handle depends on how you use CMX and which features you choose to use. It may include:

  • Account and sign-in information: name, email address, account identifiers, authentication and session information, and basic account preferences. When you choose Google Sign-In, Google shares the account information described on its consent or sign-in screen and in its applicable terms and privacy notices.
  • Creator profile and marketplace information: username, biography, profile image, location or service area, creator categories, social links, audience or channel information, listed content or placements, rates, availability, and other details you choose to publish or submit during onboarding.
  • Brand, campaign, and booking information: business or contact details, campaign briefs, creative requirements, requested placements, messages, booking terms, booking status, deadlines, cancellation or dispute information, and records of activity relating to a collaboration.
  • Content and evidence: links, files, media, delivery submissions, proof of publication or completion, feedback, reviews, and other materials submitted through a booking or profile workflow.
  • Payment and payout information: transaction identifiers and status, amounts, currency, fees, refunds or reversals, payout status, and payout details needed to route a creator payment. Payment partners may collect and process card, bank, identity, or other payment information directly under their own notices.
  • Verification information: information and documents you submit in a creator identity or account verification flow, together with the outcome and related fraud-prevention records, where that flow is used.
  • Communications and support: messages, support requests, notification preferences, and records needed to answer enquiries or resolve a reported problem.
  • Technical and security information: information that may be included in service, authentication, diagnostic, and security logs, such as timestamps, device or browser details, IP address, and actions needed to maintain the security and reliability of the Service.
  • Connected-platform information: information made available to CMX when you connect a third-party account, including the YouTube API Data described below. We receive only the information the relevant service makes available under the permissions you approve and the features you use.

You can choose not to provide some information. However, certain profile, identity, payment, or booking features may not work without the information needed to provide them.

3. How we collect information

We may collect information:

  • directly from you when you register, create a profile, publish a listing, submit a brief, book a placement, upload content, or contact support;
  • from a service you choose to connect, such as Google or YouTube, after you authorize the connection;
  • from payment, payout, authentication, hosting, storage, and other service providers that support a feature you use;
  • from other CMX users when they interact with you through a campaign, booking, review, or dispute; and
  • automatically through essential session, operational, and security technologies used to run and protect the Service.

4. How and why we use information

Depending on the feature and applicable law, we use information to:

  • create and administer accounts, authenticate users, and protect account access;
  • publish creator profiles and inventory and allow brands to discover relevant creators;
  • create, manage, document, and complete bookings, campaigns, deliverables, and related communications;
  • process or coordinate payments, refunds, payout instructions, transaction records, and fraud checks;
  • verify information you submit, detect abuse, enforce our terms, and resolve support requests or disputes;
  • operate connected-platform features, retrieve or refresh authorized information, and show relevant metrics in the context you approve;
  • maintain, secure, troubleshoot, and improve the Service; and
  • meet legal, tax, accounting, regulatory, and lawful-authority requirements.

Where required, our legal basis may be performance of a contract with you, steps you ask us to take before a contract, compliance with a legal obligation, your consent, or a legitimate interest that does not override your rights. Where processing relies on consent, you may withdraw it. Withdrawal does not make earlier lawful processing unlawful and may mean a feature can no longer operate.

5. Google Sign-In and YouTube API Services

CMX uses Google authentication services and YouTube API Services for features that you choose to use. You can review Google's privacy practices at Google Privacy Policy, and YouTube's terms at YouTube Terms of Service.

Information that may come from YouTube

If you connect a YouTube account, and subject to the scopes and permissions shown during authorization, CMX may access information such as your YouTube channel identifier, channel name or handle, available channel or video details, thumbnails or links, public statistics, and analytics or performance metrics that the authorized API permits. The exact information depends on the permissions you grant, the endpoints used by the feature, and what YouTube makes available. CMX does not ask you to provide your Google password.

Why CMX uses YouTube information

We use authorized YouTube information only for disclosed CMX features, which may include:

  • connecting and maintaining the YouTube account you choose to link;
  • helping you populate or substantiate relevant creator profile and inventory information;
  • displaying permitted channel or content metrics to you and, where you have chosen or authorized the relevant marketplace display, to users considering a collaboration;
  • supporting creator discovery, booking decisions, and the verification or integrity of information presented on CMX; and
  • keeping retrieved information current as required by YouTube policy.

CMX does not use YouTube API Data for purposes inconsistent with the authorization and disclosures that apply to the feature. We do not sell YouTube API Data, and we do not make it available for unrelated third parties to use independently. Access by a CMX user is limited to the information that the feature is designed to show and that the authorizing user has chosen or authorized to share, consistent with YouTube policy.

Tokens, access, and security

The connection may require CMX to store authorization tokens issued by Google so that the server-side integration can carry out the requested feature. These tokens are credentials, not public profile data. CMX must protect them with appropriate safeguards, limit access to systems and people that need them to operate the integration, and never ask for or store your Google account password. The production implementation must be checked to confirm the actual token storage, encryption, access controls, refresh process, and revocation behavior before this statement is treated as verified.

Disconnecting YouTube and deleting YouTube data

You can request that CMX disconnect your YouTube account and delete YouTube API Data held by CMX by using the instructions on our Data Deletion page or contacting privacy@joincmx.com. You can also review or revoke Google's access through Google security settings.

When a user requests deletion of YouTube API Data or revokes authorization through a CMX-controlled mechanism, CMX will delete the relevant data as soon as possible and within seven calendar days, and revoke the associated token promptly where applicable. When access is revoked through Google's security settings, CMX will delete the relevant YouTube API Data as soon as possible and within 30 calendar days, in line with YouTube's requirements. CMX will also follow applicable refresh and deletion timelines for stored YouTube API Data: data not eligible for longer retention will be refreshed or deleted within 30 calendar days; certain authorized analytics, reporting, or statistical data may be retained longer only where YouTube policy permits it and authorization is re-confirmed at least every 30 days.

Deleting information from CMX does not delete videos, channel information, or other data held by YouTube. To remove content from YouTube itself, use YouTube or a YouTube-authorized tool that supports that action. The deletion commitments in this section are production requirements and must be verified against CMX's actual disconnect, token-revocation, authorization-recheck, and data-deletion implementation before launch.

6. How we share information

We share information only as needed for the purposes described in this policy, including with:

  • Other CMX users: public creator profile and listing information may be visible to visitors. A brand and creator may each receive the profile, brief, booking, deliverable, message, or proof information needed to consider, perform, or resolve their collaboration. Keep this in mind before publishing or submitting content.
  • Service providers: providers that support authentication, databases, storage, hosting, communications, security, verification, payments, or payouts. CMX's codebase includes integrations with Supabase, Google/YouTube, and Flutterwave; the production provider list and data flows should be confirmed against the deployed environment.
  • Professional advisers and authorities: where reasonably necessary for legal advice, accounting, fraud prevention, legal claims, compliance, or a valid lawful request.
  • Business transfers: if CMX is involved in a merger, restructuring, financing, acquisition, or sale, information may be transferred subject to appropriate confidentiality and legal protections.
  • With your direction: when you choose to connect a service, publish a profile, share content, or authorize a specific disclosure.

We do not allow service providers to use personal information for their own unrelated purposes where they act on CMX's behalf. Providers may separately process information under their own terms when you interact directly with their services, such as Google authentication or a payment provider's checkout.

7. Public profiles, campaigns, and content

CMX is a marketplace, so some information is intended to be public or shared with a collaboration partner. A creator profile may include the details, links, inventory, and permitted metrics you choose to publish. A booking may expose campaign requirements and delivery evidence to the relevant parties. Do not upload confidential, personal, or copyrighted material unless you have the right to share it for that purpose. Information already seen, copied, or independently saved by another user may not be retractable from that user's own systems when you later remove it from CMX.

8. Retention

We keep personal information for no longer than reasonably necessary for the purposes for which it was collected, including operating your account, maintaining booking and payment records, handling disputes, enforcing agreements, meeting legal obligations, and protecting the Service. Retention periods vary by data type and circumstance.

  • Account and profile data is retained while the account is active and for a reasonable period needed to process account closure, resolve outstanding matters, and meet legal obligations.
  • Booking, transaction, tax, payout, and dispute records may need to be retained for longer where laws, accounting rules, chargeback windows, or legal claims require it.
  • Support messages and security records are retained for the time reasonably needed to respond, investigate, secure the Service, and document resolution.
  • YouTube API Data follows the specific refresh, re-authorization, and deletion requirements described in Section 5 and applicable YouTube policies; it is not retained indefinitely.

Where information must be retained for a lawful reason after account closure, we restrict its use to that reason and delete or anonymize it when the retention need ends, subject to technical backup cycles and applicable law.

9. Security

CMX uses technical and organizational safeguards designed to protect information from unauthorized access, loss, misuse, alteration, or disclosure. Safeguards should be appropriate to the sensitivity of the information and may include access controls, secure transmission, protected secrets, monitoring, backups, and restricted administrative access. No internet service or storage system can be guaranteed completely secure. The actual production controls, including encryption of YouTube tokens and sensitive payout or verification data, must be verified against the deployed implementation rather than inferred from this statement.

10. International processing

CMX and its providers may process information in countries other than the country where you live. Privacy laws in those countries may differ. Where applicable law requires it, CMX will use an appropriate legal basis and safeguards for cross-border transfers and will provide further information about those safeguards on request.

11. Your privacy choices and rights

Depending on the laws that apply to you, you may have rights to request access to your personal information, correct inaccurate information, request deletion, restrict or object to certain processing, receive a portable copy, or withdraw consent where processing relies on consent. You may also have the right to complain to your local data protection authority. These rights are subject to legal exceptions and identity-verification requirements.

To make a request, contact privacy@joincmx.com and explain what you need. We may ask for reasonable information to verify that you control the account, but we will never ask you to send your password. You can also use our Data Deletion page for account or connected-platform deletion requests. If you are in Nigeria, information about the Nigeria Data Protection Commission is available at ndpc.gov.ng.

12. Deletion requests

You may request deletion of your CMX account or personal information by emailing privacy@joincmx.com. Tell us the email address associated with your CMX account, what you want deleted, and (for a YouTube request) the connected channel or account identifier if you know it. Do not include passwords, access tokens, full bank credentials, or unnecessary identity documents in an email. We may need to retain limited information to meet legal obligations, complete a pending transaction, resolve a dispute, or protect against fraud, but we will explain any applicable exception when responding.

For YouTube API Data, CMX will follow the deletion deadlines in Section 5. Deleting your CMX account or data does not remove content stored on YouTube or information another CMX user has independently retained. If you want to remove a video or other content from YouTube, use YouTube's own tools.

13. Children

CMX is designed for people who are at least 18 years old and able to enter into binding agreements. We do not knowingly offer accounts to children under 18. If you believe a child has provided personal information to CMX, contact our privacy address so we can review and take appropriate action.

14. Third-party websites and services

CMX may link to external websites or allow you to connect third-party services. Their privacy practices are governed by their own policies, not this one. Review those policies before connecting an account or leaving CMX.

15. Changes to this policy

We may update this policy as CMX's features, providers, or legal obligations change. We will update the date at the top of this page and, where required, give notice or obtain fresh consent before materially changing how we access or use Google or YouTube data. Continued use of CMX after a change takes effect is subject to the updated policy to the extent permitted by applicable law.

16. Contact

For privacy questions, access or correction requests, complaints, or deletion requests, contact privacy@joincmx.com. For general product support, use the support contact published in the CMX footer. Please do not send passwords or authentication tokens in a support message.