Privacy Policy

Apex Inc (apexinc.com.au) and Creator Hub (creatorhub.com.au) Operated by APEX CREATORS PTY LTD (ABN 95 672 091 655, ACN 672 091 655)

Effective date: 10 November 2026

1. Who we are

APEX CREATORS PTY LTD (ABN 95 672 091 655, ACN 672 091 655) (“we”, “us”, “our”) owns and operates:

Apex Inc, a creator talent agency, at https://www.apexinc.com.au; and
Creator Hub, an open marketplace where creators sign up and apply for influencer and user-generated content (UGC) jobs from brands, at https://www.creatorhub.com.au. Creator Hub does not manage or represent creators, and creators are free to work with anyone else,

together with the Creator Hub app and tools that connect to Meta (Instagram and Facebook) and TikTok (the “Services”).

Our address is 2/13-15 Wentworth Ave, Darlinghurst NSW 2010, Australia.

Privacy contact: The Privacy Officer, APEX CREATORS PTY LTD Email: hello@apexinc.com.au Phone: 02 9931 2606 Post: 2/13-15 Wentworth Ave, Darlinghurst NSW 2010, Australia

2. What this policy covers

This policy explains how we collect, hold, use and share personal information, including information we receive through the Meta Platform (Instagram and Facebook) and the TikTok for Developers platform. It also explains your choices and how to ask us to delete your data.

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We do this voluntarily, even if the small business exemption in the Privacy Act applies to us.

Our Services are aimed at users in Australia. Section 13 explains what that means for people outside Australia.

3. The information we collect

3.1 Information you give us

Creators and talent: name, stage or business name, email, phone, location, date of birth or age confirmation, social media handles, portfolio links, rate cards, product-shipping address, ABN and GST status, bank account details for payment, tax invoices, and the content and posts you create for campaigns.
Brands and agencies: company name, ABN, contact person’s name, email and phone, billing details, campaign briefs and budgets.
Enquiries and support: anything you put in a form, email, chat or phone call.
Accounts: a username, a password for your account on our own site (stored in hashed form by our website provider) and profile details if you register through our site. This is separate from your social media passwords, which we never receive.

3.2 Information from Meta (Instagram and Facebook)

If you connect an Instagram professional account (Business or Creator) or a Facebook Page to Creator Hub, you authorise us to access the following through the Instagram Graph API and related Meta APIs, limited to the permissions you approve:

Permission or API

What we receive

Why we use it

instagram_basic

Your Instagram account ID, username, profile name, profile picture, bio, follower and media counts, and your posts’ basic details (such as caption, media type, link and timestamp).

To identify your account, show your profile in your Creator Hub portfolio, and confirm you own the account.

instagram_manage_insights

Performance data for your account and posts: reach, impressions, views, likes, comments, saves, shares, profile visits, and aggregated audience insights (for example follower age ranges, gender split, top countries and cities).

To report your audience, engagement and performance to you, and (with your agreement) to brands considering or running a campaign with you.

business_discovery

Public profile details and public performance metrics (such as follower count, media count, likes and comments counts) of other Instagram Business or Creator accounts, looked up by username. This does not need those account holders to log in to our app.

To vet creators we are considering for partnerships, and to check a creator’s public engagement against what they tell us. We do not collect their private information.

instagram_creator_marketplace_discovery (Instagram Creator Marketplace Discovery)

Information Meta makes available about creators who opted in to the Instagram Creator Marketplace, such as public profile details, categories, audience and performance summaries. Our access to this permission is subject to Meta’s approval.

To find and shortlist creators who suit a brand’s brief.

pages_show_list, pages_read_engagement, business_management

The list of Facebook Pages and business assets you manage, the Page linked to your Instagram account, and Page engagement data.

To find the Page that your Instagram professional account is linked to, which Meta requires before we can read Instagram data, and to confirm you have authority to connect it.

We do not collect or store your Instagram, Facebook or TikTok passwords. We do not access your direct messages or other private messages. We do not collect or store payment card numbers. We do not collect the names, usernames or other identities of your individual followers. Audience information is aggregated data supplied by Meta.

3.3 Information from TikTok

If you choose “Log in with TikTok” (TikTok Login Kit), we receive through the TikTok Display API, limited to the scopes you approve:

Scope

What we receive

Why we use it

user.info.basic

Your TikTok open ID, display name and avatar.

To identify your TikTok account, show your profile in your Creator Hub portfolio, and confirm you own the account.

video.list

A list of your public videos with details such as title, cover image, share link, duration, and view, like, comment and share counts.

To show your content and report its performance to you, and (with your agreement) to brands considering or running a campaign with you.

We store the access and refresh tokens TikTok gives us securely and use them only to provide these features. We use TikTok data only for reporting to you (and, with your agreement, to brands) and for vetting creators. We never use TikTok data to build advertising or tracking profiles, and we do not use it to build profiles of people who have not connected their own account.

3.4 Information we collect automatically

When you use our websites we collect technical information such as your IP address, browser type and version, device, operating system, language, pages viewed, time and date of visits and the website that referred you. We collect it through cookies and similar technologies (see section 11) and through our website host, Wix.com, and our analytics tools.

3.5 Information from other sources

We may collect information about creators from public sources (such as a public social media profile or website), from brands or agencies who refer or brief you, and from payment and invoicing providers. We tell you when we do this where we reasonably can.

3.6 Sensitive information

We do not ask for sensitive information (such as health, racial or ethnic origin, political or religious views, or sexual orientation). Aggregated audience insights from Meta can include broad demographic splits of followers. These are not information about identifiable individuals, and we use them only as aggregated data. Please do not send us sensitive information. If you do, we will treat it as sensitive information under the Privacy Act.

4. Why we collect and use your information

We use personal information to:

provide the Services, including creator onboarding, campaign matching, briefs, content delivery and approval, and payments;
verify that you own or are authorised to manage a connected account;
produce reports on audience, engagement and content performance, and share them as set out in section 6;
vet creators for partnerships (see section 5);
send you service messages and, with your consent where required, marketing messages (you can unsubscribe at any time);
issue invoices, pay creators, keep financial and tax records and meet our legal obligations;
secure our systems, prevent fraud and misuse, and enforce our Terms of Service;
improve our Services and our understanding of how they are used; and
comply with the law and the rules of Meta, TikTok and other platforms.

We use Meta and TikTok data only for the purposes in sections 3.2 and 3.3, which are described to you before you connect an account. We will not use it for a new purpose without asking you first, unless the law requires or permits it. We do not sell personal information. We do not use Meta or TikTok data to make decisions about eligibility for credit, insurance, employment, housing or similar. We do not use it for surveillance.

5. Creator vetting and automated analysis

Our vetting is software-assisted shortlisting. We look at engagement and performance data (for example engagement rate, audience location and consistency of results) to judge whether a creator is a good fit for a campaign, and to check that follower and engagement figures are genuine. We use software, calculations and AI tools to help us match creators to briefs, prepare reports and build a shortlist. A staff member at Apex or Creator Hub always makes the final decision about whether to engage or recommend a creator. A decision not to work with a creator is never made solely by software.

From 10 December 2026, the Privacy Act requires us to tell you about decisions made or substantially informed by computer programs where those decisions could significantly affect your rights or interests. The kinds of personal information used are the account and performance data described in sections 3.1 to 3.3. The kinds of decisions involved are creator shortlisting and campaign matching. These decisions are informed by software but are not made solely by it, because a staff member always reviews the shortlist and makes the final decision.

You can ask us to explain how your data was used and to have a staff member review a decision about you. See section 10.

6. Who we share information with

We share personal information only where needed for the purposes in section 4.

Brands and agencies. If you are a creator, we share your profile, portfolio and, where you have agreed, performance and audience reports from your connected Instagram or TikTok account with a brand or agency that is considering or running a campaign with you. We do not share your connected-account data with a brand unless you have connected the account for that purpose and agreed to the sharing, or you have asked us to. We do not share your bank details, tax details or login tokens with brands. Brands only ever see a creator’s own connected-account data, and only with that creator’s agreement. Creator Hub is a marketplace. We share a creator’s details with a brand only for jobs the creator applies for or is offered.
Public creator data from business_discovery and the Creator Marketplace API is used only internally for our own vetting and shortlisting. It is not shown or given to brands.
Service providers who help us run the Services. They may only use information to provide services to us. They include: Wix.com (website hosting, forms, members area, invoices and payments); Supabase, hosted on Amazon Web Services (AWS) in the Sydney region (database and storage for Creator Hub data, including Meta and TikTok data and access tokens); Wix Analytics and Google Analytics (website analytics, see section 11); our email and communications providers; our payment, invoicing and accounting providers; and AI tools that help with creator matching and reporting. A staff member always reviews the output of those AI tools.
Meta and TikTok, when you connect your account, log in, or revoke access.
Professional advisers such as lawyers, accountants and insurers.
Authorities and others where the law requires or allows, or to protect rights, safety or property.
A buyer or successor, if our business is sold or restructured. We would require the buyer to honour this policy for existing data.

7. Sending information overseas

Wix.com stores our website and contact data (such as form submissions, member accounts and site visitor data) outside Australia, mainly in the United States. Meta, TikTok and Google also process information in the United States and other countries where they operate. Your information may be disclosed to recipients in those places.

Before we disclose personal information overseas, we take reasonable steps with the provider to make sure it handles the information in a way that is consistent with the APPs (for example, through contract terms or because the provider is subject to comparable privacy laws). We also rely on your consent. By connecting a Meta or TikTok account, using our websites or otherwise giving us your information, you consent to the disclosure of your information to overseas recipients, and you acknowledge that those recipients may not be bound by the Australian Privacy Principles.

Meta and TikTok data and access tokens that we store are held in Australia (see section 8).

8. Storage, security and retention

Where it is stored. Information is held electronically on systems run by us and our service providers. Meta and TikTok data and access tokens are stored in Supabase, hosted on AWS in the Sydney region, and are encrypted. Our website and contact data is held by Wix.com, mainly in the United States (see section 7).

How we protect it. We use measures such as encryption in transit and at rest, restricted access on a need-to-know basis, strong authentication for staff accounts, and keeping API tokens on the server only. No system is perfectly secure. We will tell you and the Office of the Australian Information Commissioner (OAIC) about an eligible data breach as the Notifiable Data Breaches scheme requires.

How long we keep it. We keep information only as long as we need it for the purpose it was collected, or as the law requires.

Type of information

Retention

Meta and TikTok access tokens

Deleted when you disconnect your account, when the token expires without renewal, or when you ask us to delete your data.

Account data, including Meta and TikTok profile and performance data you connected

For the life of your account, then deleted within 30 days of the account being closed. Deleted sooner if you disconnect and ask us to delete it (see section 9).

Public data about other creators from business_discovery or Creator Marketplace

Refreshed regularly and deleted when no longer needed for vetting, and no later than 12 months after last use.

Financial, invoicing, business and tax records

7 years, as tax and corporate law requires.

Website analytics and logs

Up to 14 months.

Enquiries and support emails

2 years.

Backups

Kept for 30 days, then overwritten or deleted.

When information is no longer needed, we delete it or de-identify it, unless the law requires us to keep it.

9. Deleting your data and disconnecting your accounts

You can ask us to delete your data at any time, whether you are a creator, a brand contact, or someone whose public Instagram data we have looked up.

Disconnect: you can remove Creator Hub from your Instagram, Facebook or TikTok account at any time through that platform’s settings. This stops us receiving new data.
Ask us to delete: follow the steps on our Data Deletion Instructions page, https://www.apexinc.com.au/data-deletion (the same page is also published on creatorhub.com.au). In summary, email hello@apexinc.com.au with the subject “Data deletion request” and your Instagram or TikTok username.
Meta users: if you remove our app in your Facebook “Apps and websites” settings and ask for your data to be deleted, we will delete the Meta data we hold about you in line with Meta’s requirements.

We will confirm your request within 5 business days and delete Meta and TikTok data within 30 days. Backups are kept for up to 30 days after that. We may keep information we are legally required to keep (such as tax records), and we will tell you if we do.

If you ask us to delete your information or not to contact you, we keep a scrambled (one-way) copy of your email address only so we can make sure we never contact you again. We don't use it for anything else.

10. Your rights: access, correction and complaints

Under the Privacy Act you can:

ask for access to the personal information we hold about you (APP 12);
ask us to correct it if it is inaccurate, out of date, incomplete or misleading (APP 13);
ask us to delete it (see section 9);
withdraw consent to marketing or to data collection you agreed to;
ask us to explain how software was used in a decision about you, and to have a person review it; and
opt out of direct marketing at any time using the unsubscribe link or by contacting us.

Contact the privacy contact in section 1. We will respond within 30 days. We may need to verify your identity first. We do not charge for making a request. We may charge a reasonable fee for the cost of giving access, and we will tell you before we do. If we refuse, we will explain why in writing and how you can complain.

Complaints. Email or write to us first. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001.

11. Cookies and similar technologies

Our websites are built on Wix. Wix and we use cookies and similar technologies to run the sites, keep you logged in, remember preferences, protect against fraud, and see how the sites are used. A cookie consent banner is shown on our sites so you can choose which non-essential cookies to accept. Cookies fall into these groups:

Essential cookies keep the website working (for example security and members-area login). These cannot be turned off.
Functional cookies remember your settings.
Analytics cookies help us understand traffic and improve the site. We use Wix Analytics, and we use Google Analytics from the time we switch it on on our sites. Google Analytics is planned but may not be running yet. This section applies to it from the day it is turned on. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.
Advertising and marketing cookies or pixels. We do not currently use any advertising pixels (such as the Meta Pixel or TikTok Pixel). We will update this policy before we add any.

You can also control cookies in your browser settings, and you can delete existing ones. Blocking some cookies may stop parts of the site working.

12. Links, children and changes

Links to other sites. Our websites link to other sites, including Instagram, TikTok and brand sites. We are not responsible for their privacy practices.

Children. You must be at least 18 to use the Services. Anyone under 18 can only take part through a parent or guardian who accepts our terms on their behalf, and we collect a minor’s information only with that parent or guardian’s involvement. If you think someone under 18 has given us information without a parent or guardian, contact us and we will delete it.

Changes. We may update this policy. We will post the new version here with a new effective date. If the changes are significant, we will tell you by email or on our site before they take effect. If we change how we use Meta or TikTok data, we will ask for your consent again where required.

13. Users outside Australia

Our Services are aimed at users in Australia, and we do not offer them to people in other regions. If you use our Services from outside Australia, your information is handled under this policy and Australian law, and it is sent to and stored in the places described in section 7.

14. Contact us

APEX CREATORS PTY LTD (ABN 95 672 091 655, ACN 672 091 655) Trading as Apex Inc and Creator Hub 2/13-15 Wentworth Ave, Darlinghurst NSW 2010, Australia Email: hello@apexinc.com.au Phone: 02 9931 2606

Contact