Privacy Policy

This policy explains what personal data North Bay Opco I, Inc. ("Transformer", "we", "us") collects when you use transformer.gg, the Transformer API, MCP server and command-line tool, and the dashboard (the "Service"), why, and what choices you have.

North Bay Opco I, Inc. is the controller of the personal data described here. Contact: support@transformer.gg, or write to North Bay Opco I, Inc., 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131.

What we collect

Category	What	Where it comes from
Account	Name, email address (if you give one), the identities you sign in with (X, Google, GitHub or email), and your workspaces and roles	You, X, Google, GitHub
Connected X account	Your X user id, @handle, display name, avatar, bio, verified status, follower, following, like and post counts, and your recent posts with their public metrics (views, likes, replies, reposts). We do not keep X access tokens	X, with your permission
Offers and deliverables	Offers you send or receive, their terms, messages in them, the posts you submit and our verification results	You, the other party, X
Payments	Amounts paid and received, Brand balances, payment requests, payout requests and their references. Brands enter card and bank payment details with Stripe, not with us; we receive the payment's status, amount and reference. For a wire, the sender's name and the transfer reference. For Creator payouts, your Garna account connection: the email you use with Garna, your Garna wallet number and region, your Garna user id and whether Garna has verified your identity. Garna collects your identity documents and bank details for its own verification (KYC); we don't receive them. Payout details you gave us for an earlier payout method stay encrypted until you remove them or close your account. Payout details are stored encrypted, shown to our staff only when sending a payout, and each viewing is logged	You, Stripe, Garna, your bank
Tax forms	The W-9 or W-8BEN you sign: name, address, country, date of birth (W-8BEN), taxpayer ID number and your typed signature. Stored encrypted and used only for tax reporting and withholding	You
Tracked-link clicks	For each click on a tracked link: time, a one-way hash of the IP address (not the address itself), browser user agent and referring page	People who click the link
Sales reported by Brands	Order id, amount and the click id it came from	Brands
Security and logs	IP address and user agent of signed-in sessions, an audit log of actions in your workspaces, and server request logs	Your devices, the Service
Support	What you send us by email	You

We use cookies to keep you signed in and secure, and Google Analytics cookies to count visits and see which pages are used (site usage statistics). We remove search terms, sign-in codes, tokens and invite links from the page addresses we send to Google Analytics, and we don't use it on admin, sign-in or payout pages. We don't use advertising cookies, and tracked links don't set cookies on the people who click them.

How we use it

• To run the marketplace: create your account, show your profile and reach to Brands, deliver offers, verify deliverables, attribute clicks and sales, and handle payments. Legal basis: performance of our contract with you.
• To show Creators to Brands: your X profile, stats and recent public posts are shown to Brands on the Service and through the API, so they can decide whether to send you an offer. You choose whether to appear in the public creator directory. Contract and legitimate interests.
• To communicate with you: sign-in links, offer notifications and receipts. Contract.
• To keep the Service safe: prevent fraud, fake engagement and abuse, and investigate incidents. Legitimate interests.
• To improve the Service, using aggregated data. Legitimate interests.
• To meet legal obligations, such as tax, accounting and lawful requests. Legal obligation.

We do not sell personal data or share it for targeted advertising, and we do not use your content or data to train machine-learning models.

What X data we use, and how

When you sign in with or connect X, we request read-only permission to see your profile and posts (users.read, tweet.read) and, if X provides it, your email address (users.email). We use that permission once, to read your profile at sign-in, and then revoke it; we do not store X access tokens. We cannot post, send messages or change anything on your X account; you publish your posts yourself and give us the link to verify. We may refresh your public profile, stats and recent posts from X's public data about once a day, and we check the posts you submit using X's public data. We use X data only to provide the Service as described here and in line with X's developer terms. You can disconnect at any time; we then stop syncing your profile.

Who sees what

• Brands see Creators' public X profile, stats, recent posts and, for offers they're part of, the deliverables, clicks and attributed sales. Brands don't see a Creator's email address or payout details.
• Creators see the offers they receive and the Brand's name and link.
• Service providers that help us run the Service, under contracts that protect the data:

Provider	Purpose	Location
Latitude.sh	Servers and database	US
Cloudflare	DNS and network security	Global
Resend	Email delivery	US
X	Sign-in, public profile data and post verification	US
Google, GitHub	Sign-in you choose	US
Google (Analytics)	Site usage statistics: pages visited, device and approximate location	US
Stripe	Brand payments by card or bank	US / global
Garna (Mediacube)	Creator payouts and identity verification (KYC)	Cyprus (EU) / global

We may also disclose data when the law requires it, to protect rights and safety, or as part of a merger or acquisition (where the acquirer takes on this policy).

How long we keep it

• Account and workspace data: while your account is open; deleted within 30 days after you ask us to close it, except as below.
• X data: we don't keep X access tokens. Imported profile stats and posts are deleted when you disconnect X or close your account.
• Offers, deliverables, payments and the ledger: kept after an account closes, for accounting, tax, dispute and fraud-prevention purposes, for as long as the law requires.
• Payout connections and methods: until you remove them or close your account; the details used for a payout already sent are kept with that payout's record.
• Tax forms: for at least four years after the last payout they cover, as US tax rules require.
• Tracked-link clicks: kept with the offer they belong to.
• Audit log and request logs: kept for security and troubleshooting.

Your rights

Depending on where you live, you can ask to access, correct, delete or get a copy of your personal data, object to or restrict some processing, or withdraw consent. Write to support@transformer.gg; we answer within one month. If you're in the EU or UK you can also complain to your data-protection authority. California residents have rights under the CCPA/CPRA; we don't sell or share personal information as those laws define it and won't treat you differently for using your rights.

International transfers

We're based in the US and our servers are in the US. Where data comes from the EU, UK or Switzerland, we rely on the Standard Contractual Clauses (and the UK addendum) or the EU–US Data Privacy Framework where a provider is certified.

Security

Secrets are encrypted at rest, API keys are stored as hashes, IP addresses of people who click tracked links are stored only as one-way hashes, and traffic is encrypted in transit. No system is perfectly secure; we will notify you and the authorities of a personal-data breach as the law requires.

Children

The Service is not directed to children, and you must be 18 or older to use it.

Changes

We'll post changes here and update the date above. For material changes we'll tell you by email or in the dashboard first.