Collab Me Now
CollabMeNow – Privacy Notice
Version 3.4 · Set CMN-STAGE0-20261018-R10 · Effective date: 2026-10-21
Who we are
Creator Collaboration Technologies, Inc., a Delaware corporation, is responsible for the information described here. We trade as CollabMeNow.
Creator Collaboration Technologies, Inc. PMB 2274, 3133 Maple Dr., Ste 240, Atlanta, GA 30305, United States
For anything in this notice, including access, correction, deletion and complaints, write to legal@collabmenow.com. For product and early-access questions, write to support@collabmenow.com.
We have not appointed a Data Protection Officer. Requests are handled by named members of our team under the process described in "How we handle your request" below.
Who this notice covers
This notice covers two groups:
- Applicants – creators who submit the early-access form at collabmenow.com.
- Creators we contact about early access – creators we email to invite to this early-access stage, whether or not they apply.
This stage tests interest in a future creator-to-creator collaboration service. It is not an account, a marketplace, a payment service or a live collaboration product. No payment is collected and we do not ask for card details.
This stage is addressed to creators located in the United States. We may extend it to other countries, and we will name them in this notice before we do. Our selection and review may not identify every person's location accurately. This notice also covers information we receive from or hold about a person outside the United States, including an ineligible application or a creator contacted in error.
What we receive from applicants
- Your email address.
- Your Instagram username, stored in a normalized form.
- The verification code we send to your email address, and whether it was confirmed.
- Your eligibility status and a minimal record of our review.
- Opaque campaign and source identifiers, so we can tell which invitation or link brought you to the page.
- An internal submission identifier and outcome.
- The versions of these Terms of Use and of this Privacy Notice shown to you, and the time of your submission.
If you choose to tell us which plan interests you, we record that preference. It is optional and creates no order or payment obligation.
After confirming your application, you may add an optional question, request or suggestion. We use that message to respond and administer your early-access request. Please do not include sensitive information or anyone else's confidential information.
We also keep technical records used for verification, duplicate detection, rate limiting and protection against automated abuse. These are operational records. We do not describe every technical record as anonymous.
Our hosting and security providers also process ordinary network information, such as your IP address and browser details, in order to deliver and protect the page. We do not deliberately send your email address, Instagram username or application identifier into our product analytics.
The form does not ask you for a website. It does not ask for an Instagram password or access token, payment information, private-account content, or unrelated browser data.
What we hold about creators we contact about early access
Before you hear from us, we may already hold a small record about your public creator profile: your Instagram username and display name, public profile information such as your follower count and the country stated on your profile, and professional contact details.
Our team collects those email addresses and that profile information from public Instagram profiles and from websites linked by the creators, manually or with automated tools, and may also obtain them from data providers, when preparing early-access invitations.
We use that record for one purpose: to assess relevance, send you a small number of early-access invitations, and record the outcome. We contact you at most once every seven days, and at most three times in any thirty days.
Each marketing invitation includes an Unsubscribe link. You can use that link, reply to the invitation, or write to legal@collabmenow.com to stop marketing invitations at any time. We apply the refusal across our CollabMeNow marketing sender pool. Unsubscribing does not by itself delete an application or account. You may separately request removal of your outreach profile.
Any clear refusal is enough. You do not have to use a particular word or give a reason. We add your address to our do-not-contact list and stop. If you ask us to remove your outreach profile, we delete that record and keep only the minimum needed to prevent collecting the same address again by mistake.
A request simply to stop invitations does not require you to verify a social account.
A refusal, a complaint or a confirmed undeliverable address stops further messages immediately. It does not wait for any retention period to end.
Why we use this information, and on what basis
| Purpose | Basis |
|---|---|
| Receive and review an early-access request | Our legitimate interest in administering the early-access request you choose to submit and responding to it |
| Send and check the email verification code | Our legitimate interest in confirming control of the submitted email address and protecting the application process |
| Identify duplicate applications | Our legitimate interest in running a fair, bounded test |
| Check the public Instagram profile against the stated 5,000-follower boundary | Our legitimate interest in reviewing eligibility |
| Operate, secure and protect the form | Our legitimate interest in security |
| Measure this bounded test | Our legitimate interest in measuring the test |
| Invite creators to early access, and record opt-outs | Our legitimate interest in offering the service, balanced against your interest in not being contacted, which you can assert at any time |
| Keep a minimal suppression record after an opt-out or deletion | Our legal and legitimate interest in honoring your choice |
We use this information for the purposes described above, including our early-access invitations. We do not use it for third-party advertising or to build advertising profiles across websites. We do not sell applicant or outreach contact information, and we do not share it for anyone else's marketing.
Where applicable law requires a lawful basis, we rely on the interests identified above only where the processing is necessary and those interests are not overridden by your rights and interests. Acknowledging this notice is not blanket consent to processing or marketing. Where a particular use requires consent, we obtain it before that use.
Eligibility review
Every application starts as eligibility pending. Receiving an application is not approval. Eligibility is checked against public Instagram profile information, with a person reviewing unclear cases. We do not make a decision about you by automated means alone that has a legal or similarly significant effect.
Analytics
We use a self-hosted Umami instance for analytics. Its configuration does not use advertising profiles, cross-site tracking, a persistent visitor identifier, session replay, or any personal data in analytics events.
Analytics is limited to page views, source diagnostics and a short list of events: landing_viewed, cta_clicked, plan_intent_selected, client_validation_failed and waitlist_form_submitted. The submission event is recorded only after your application has been saved. If analytics fails, your application is still saved.
If your browser sends a Do Not Track signal, the page does not send analytics. Search terms and the part of the address after # are excluded before anything is sent, and analytics is restricted to the collabmenow.com domain.
Analytics data is held separately from your application. The operational records described above are a separate flow and are not part of analytics.
Cookies and browser storage
The legal pages of this site – this notice, the Terms of Use and the Contact page – load no third-party code at all and store nothing in your browser.
The early-access application uses the following technical browser storage:
| Item | Purpose | Lifetime |
|---|---|---|
collab_funnel_session cookie | Associate steps in the application process | Two hours |
collab_application_anti_bot cookie | Protect the application form against automated abuse | Ten minutes |
collab_application_verification cookie | Hold encrypted application details while you confirm your email code; set after the verification email request succeeds | Ten minutes; cleared when verification completes, including an already-received application, or when a verification attempt finds the code expired or unusable. Incorrect-code retries and temporary errors do not clear it immediately. |
ic_stage0_landing_viewed in session storage | Avoid repeating the landing-view event in the same browser session | Browser session |
Who else receives this information
We use the following service providers, each limited to the role described:
- Vercel Inc. (United States) hosts and delivers the website and our self-hosted analytics service. To deliver and protect the site, Vercel processes network information such as your IP address and browser details, and keeps short-lived request logs.
- Cloudflare, Inc. (United States) provides Turnstile, the human-verification check that loads with the early-access form. It receives signals including your IP address and browser/device information. Cloudflare processes these signals on our behalf to protect the form and as an independent controller to improve Turnstile's bot detection, as explained in its Turnstile Privacy Addendum.
- Supabase provides the database that holds applications, and a separate database for analytics.
- Postmark sends the email verification code and any necessary service email.
- Forward Email routes and stores our legal and product-support correspondence and replies to invitations in the mailboxes we use to handle those requests.
- For the invitations described above we use Outboundry and Mailboundry, or Salesforge, to send email and to hold our do-not-contact list. Replies are received through Forward Email as described above.
- We also use Mailforge for email infrastructure and Warmforge to warm up sending mailboxes and monitor deliverability. These services process information associated with the connected sending mailboxes for those functions.
We do not use Stripe or any other payment provider at this stage, because no payment is collected.
Our application database is hosted in the United States, in North Virginia. Authorized members of our company team work in the United States and Serbia and have restricted operational access to information to run and support this stage. Hosting, security and email providers also process information in connection with their respective services; the location of our application database does not describe every provider's processing location.
How long we keep it
A shorter mandatory limit always takes precedence over the periods below.
| What | Counted from | How long |
|---|---|---|
| Contact data of pending and eligible applicants | the application | 12 months |
| Applications excluded, private or impossible to verify | completion of review | 90 days |
| Optional message attached to an application | the same starting event as the associated application | the same period as that application: 12 months from submission for pending or eligible applications, or 90 days after review for excluded, private or unverifiable applications; removed sooner with the application after an accepted deletion request |
| Contact record and sending history of an invited creator | the last contact with that creator | 12 months |
| Public creator profile and professional contact record we collected but have not yet contacted | initial collection | 12 months; after first contact, the last-contact rule above applies |
| Minimal do-not-contact record | the refusal, complaint, confirmed undeliverable address, or deletion requiring protection against re-import | the life of the service plus 12 months, and only an identifier, the reason and the date |
| Support correspondence | closing the request | 24 months |
| Attachments received in support correspondence | the last support reply | 30 days |
| Correspondence about a privacy request | completing the request | 3 years |
| Minimal record that a deletion was carried out | completing the deletion | 6 years, and only the request identifier, dates, systems and outcome, never a copy of what was deleted |
| Accepted document versions and material consent records | the end of the corresponding relationship | 6 years |
| Security and access logs | the event | 180 days |
| Rate-limit, retry, duplicate-protection and queue-delivery traces | completion of the event | 30 days |
| Delivery, bounce and complaint metadata for service email | the event | 180 days |
| Event-level analytics data | the event | 180 days, then aggregated, anonymized or deleted |
| Temporary copies, caches and working exports | finishing the work | no more than 30 days |
| An export prepared in answer to your request, and its download link | creating the export | no more than 7 days |
| Sanitized security-incident records | closing the incident | 3 years |
| Backup copies under our control | deletion from active systems | no more than 30 days |
| Provider-managed backups | applicable provider deletion and backup-rotation processes | residual copies are removed under those processes, subject to applicable legal requirements |
| Genuinely anonymous aggregates | irreversible aggregation | no fixed period; if a person could be identified again, the data does not belong in this row |
We complete accepted, verified deletion requests in our active systems within 30 days, subject to applicable legal requirements. Backup copies under our control are removed within 30 days after deletion from active systems. Residual copies in provider-managed backups are removed through the relevant provider's deletion and backup-rotation processes. Until removed, they remain protected and are not used for ordinary operations. If a backup is restored, we reapply recorded deletions before returning the restored data to ordinary use. Applicable legal requirements take precedence over provider retention schedules. We keep minimal suppression information where necessary to honor an opt-out or prevent your record being collected again.
The service-email metadata period above describes records we retain. Postmark's standard retention for message content and activity is 45 days; its separate suppression records follow their own purpose. Provider email records are distinct from our database backups.
If we ever have to put a legal hold on records, we record why, which records it covers, who owns it, and we review it at least every six months.
Adding an optional message does not restart the application's retention period.
Your choices and rights
You can ask us to:
- tell you whether we hold information about you, and give you a copy of it;
- correct it;
- delete it;
- restrict or stop a particular use;
- give you your information in a portable form;
- stop contacting you about the product.
Write to legal@collabmenow.com. Which rights apply, and any exceptions to them, depend on applicable law, including relevant law where you reside. If an exception prevents us from deleting everything, we tell you which one and what remains.
How we handle your request
Where applicable data-protection law provides these rights, you may object to processing based on legitimate interests, withdraw consent for processing that relies on consent without affecting its prior lawfulness, and complain to the competent supervisory authority. You may object to direct marketing at any time. Public availability of contact details does not itself constitute consent to receive marketing; where applicable law requires consent, our stated interests do not replace it.
We answer a rights request without undue delay and within the time applicable law allows. Our operational deletion target does not replace that deadline.
We handle requests from both applicants and creators we have contacted. For access to personal information or deletion of a record, we verify the request using the email address associated with that record, or confirmation from the associated Instagram account where appropriate. You do not need to have submitted an application to make a request. We do not disclose or delete another person's record based only on an unverified third-party claim. A request simply to stop invitations requires no additional identity check.
One of us tracks your request and the deadline for answering it; another carries out the deletion in the database. Where necessary to honor your opt-out or prevent re-import, we retain only a minimal suppression record under the retention rules above.
If you are not satisfied, you may complain to the competent data-protection or consumer-protection authority where applicable, including a state Attorney General in the United States. Our internal process does not prevent you from exercising that right.
Children
This stage is not directed to children and is open only to people aged 18 or over. We do not knowingly collect information from anyone under 18. If we reliably determine that an application belongs to someone under 18, we delete it. We do not require that person to provide additional identity documents to carry out that removal. An unverified third-party claim alone does not establish that another person's application belongs to a minor.
Security
Application data is reachable only through restricted operational access. Applicant contact details are held separately from analytics. Visitors cannot list applications, export records or see our eligibility review. No technical measure can guarantee absolute security.
Changes to this notice
When this notice changes, we publish the updated version and its effective date, and the version shown to you at the moment of your submission is kept with your application record. A new purpose, or a materially broader use of your information, requires a new version of this notice before it takes effect.
Contact
Creator Collaboration Technologies, Inc. PMB 2274, 3133 Maple Dr., Ste 240, Atlanta, GA 30305, United States Privacy and rights requests: legal@collabmenow.com Product and early access: support@collabmenow.com