Last updated: 27 August 2026. Version 1.0.

This Privacy Policy explains how The Ideas Suite Ltd (“we”, “us”, “our”) collects, uses, shares and protects personal data when you use Social Hub (the “Platform”). We are the data controller for that data, and we process it in accordance with the Data Protection Act 2017 of the Republic of Mauritius.

1. Who we are and how to contact us

• Controller: The Ideas Suite Ltd, 90514, Flic en Flac, Republic of Mauritius.
• Contact for privacy matters: info@theideassuite.com

If you have a question about this policy, or you want to exercise any of the rights in section 8, use the contact address above.

2. The personal data we collect

2.1 Data you give us directly

• Account details: email address, password (stored only as a cryptographic hash, never in readable form), phone number and country code, and the account type you register as.
• Creator profile: display name, phone number, biography, location, content niches, and languages spoken.
• Company profile: company name, website, industry, and tax identification number.
• Agency profile: agency name, website, contact email, contact phone, and business registration number.
• Portfolio and rate cards: sample work you upload and the rates you choose to publish.
• Content you post: community feed posts, comments, likes, and reports you submit about other users’ content.
• Messages: the content of messages you exchange with other users through the Platform.
• Deliverables and dispute evidence: files you upload in connection with a job or a dispute.

2.2 Data from connected social accounts

If you choose to connect a social account (YouTube, Instagram, Facebook or TikTok), we receive from that platform your account handle, an account identifier, and audience metrics — follower count, average views, average likes, average comments, and a calculated engagement rate. We also store access and refresh tokens so we can refresh those metrics; these tokens are held encrypted and are never displayed to other users. You can disconnect a social account at any time.

2.3 Data generated by your use of the Platform

• Transactional records: jobs, applications, offers, subscriptions, billing records and invoices, including amounts, commission and payment references.
• Contract signature records: when you sign a contract electronically we record the name you enter, the date and time, the IP address you signed from, and an integrity hash of the signed text. We keep this as evidence that the contract was agreed.
• Consent records: when you agree to our Terms and this policy we record the policy version, the date and time, your IP address and browser user-agent string. We are required to be able to demonstrate that consent was given, and this is how we do it.
• Verification codes: one-time codes for email or phone verification, stored hashed, with their expiry and the number of attempts made.
• Notifications generated for you by the Platform.

3. Why we process your data, and on what basis

• To provide the service — creating your account, matching Creators with jobs, forming and recording contracts, transferring deliverables, running the messaging system. Basis: performance of a contract with you.
• To verify identity and approve profiles — email and phone verification, and manual review of Creator, Company and Agency profiles before they go live. Basis: performance of a contract, and our legitimate interest in keeping the marketplace trustworthy.
• To bill and collect payment — issuing invoices, applying commission, managing subscriptions and sending payment reminders. Basis: performance of a contract, and compliance with tax and accounting law.
• To resolve disputes — reviewing evidence submitted by both parties. Basis: legitimate interest in the fair operation of the marketplace.
• To keep the Platform safe — moderating reported content, detecting fraudulent or inflated audience metrics, and preventing abuse. Basis: legitimate interest in security and integrity.
• To prove consent — retaining consent records with IP and user-agent. Basis: legal obligation under the Data Protection Act 2017.
• To communicate with you — service emails about your account, jobs, invoices and disputes. Basis: performance of a contract. These are operational messages and you cannot opt out of them while your account is open.

4. Who your data is shared with

4.1 Other users of the Platform

This is a marketplace, so some data is deliberately visible to others:

• An approved Creator profile — display name, biography, location, niches, languages, portfolio, connected platform handles and audience metrics — is visible to Companies and Agencies browsing for Creators.
• Company and Agency profiles are visible to Creators considering their jobs.
• Feed posts, comments and likes are visible to other signed-in users.
• When you enter a job, the counterparty sees your messages, your deliverables, and the contract you sign.
• An Agency linked to a Creator can act on that Creator’s behalf and can see the jobs, applications and deliverables associated with them.

Your email address, phone number, password and tax or business identification numbers are not shown to other users.

4.2 Service providers

• Google LLC — sign-in with Google; Google Maps Places, used for address autocomplete; and Google Firebase / Firestore, which carries real-time chat messages where that feature is enabled.
• Meta Platforms — sign-in with Facebook, and the Facebook and Instagram APIs used to retrieve your audience metrics.
• YouTube and TikTok — where you connect those accounts, for the same purpose.
• Our email delivery provider — to send verification, notification and invoice emails.
• Our hosting provider — which stores the database and uploaded files.

We do not sell your personal data, and we do not share it with advertisers.

4.3 Legal disclosure

We may disclose data where we are required to by law, by a court order, or by a competent authority, and where necessary to establish, exercise or defend legal claims.

5. Transfers outside Mauritius

Some of the service providers named in section 4.2 — in particular Google and Meta — process data on servers located outside the Republic of Mauritius. Where we transfer personal data abroad we do so in accordance with section 36 of the Data Protection Act 2017, relying on the provider’s contractual data protection commitments and, where applicable, on your consent to connect that service. Connecting a social account is always optional.

6. Cookies

We use a small number of essential cookies, which are required for the Platform to function — keeping you signed in, protecting forms against cross-site request forgery, remembering your light or dark theme preference, and recording that you have seen our cookie notice. These cannot be switched off, because without them the Platform does not work.

We do not use analytics, advertising or tracking cookies, and we do not permit third parties to set such cookies through the Platform. Because only essential cookies are set, there is nothing for you to opt into or out of: our cookie notice exists to tell you what is stored, not to ask your permission. If we ever introduce non-essential cookies we will ask for your consent first, and update this policy before doing so.

7. How long we keep data, and how it is protected

• While your account is open, we keep your profile and activity data so the Platform can work.
• If you delete your account, the request is held for a 14-day grace period during which you can cancel it. After that, your account and associated personal data are deleted.
• Data export files that you request are made available on a private download link that expires after 48 hours, after which the file is removed.
• Invoices, contracts and related financial records are retained after account closure for as long as tax, accounting and limitation law requires, even where other data has been deleted. This is a legal obligation we cannot waive.

Security measures. Passwords and one-time verification codes are stored only as hashes. Social platform access tokens are encrypted at rest. Contracts, invoices, deliverables, dispute evidence and export files are stored in server directories configured to refuse direct web access, so they can only be reached through the Platform’s own permission checks. Access to the administrative interface is restricted to authorised staff.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commissioner and, where required, you.

8. Your rights

Under the Data Protection Act 2017 you have the right to:

• Be informed about how your data is used — which is the purpose of this policy;
• Access the personal data we hold about you. You can download a complete copy of your data at any time from your account settings;
• Have inaccurate data corrected — most profile fields you can edit yourself;
• Have your data erased — you can request account deletion from your account settings, subject to the retention obligations in section 7;
• Object to, or request restriction of, processing carried out on the basis of our legitimate interests;
• Data portability — the export described above is provided in a structured, machine-readable format;
• Withdraw consent where processing is based on consent, such as a connected social account, without affecting processing already carried out.

We will respond to a request within the period required by law. We may need to verify your identity first.

9. Complaints

If you believe we have handled your personal data improperly, please contact us first at info@theideassuite.com so we can try to put it right. You also have the right to lodge a complaint with the Data Protection Office of the Republic of Mauritius, the supervisory authority responsible for the Data Protection Act 2017.

10. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.

11. Changes to this policy

We may update this policy. Each version is published with a version number and date, and earlier versions are retained. Where a change materially affects how we use your data, we will notify you on the Platform and, where the law requires it, ask you to agree to the new version before continuing.