Brand Privacy Policy

Version 1.1 | 15 October 2026

Concre Pte. Ltd. (UEN 202631448W) operates the Brand web dashboard. This policy concerns personal data about owners, staff, representatives, Creators and other people named in a Brand account. Contact our Data Protection Officer at dpo@concre.app or write to 16 Jalan Kilang Timor, #07-08, Redhill Forum, Singapore 159308.

1. Data we collect

We collect Brand representatives’ names, work email addresses, contact details, login and verification information, team roles and dashboard actions. We receive company registration details, UEN, business address, logo, website and verification submissions. We may compare the UEN with Singapore business-register information and review the account before it can contact Creators. A UEN or business contact detail may also be personal data where it identifies an individual.

We receive briefs, budgets, selected Creators, rights terms, NDA files, messages, storyboards, drafts, approval records, Event attendance, ratings, private roster notes, reports and disputes. These may contain personal data about Creators and other people. We record payments, Concre fees, invoices, refunds, Stripe references, dashboard feature activity and security or error information. Stripe handles payment-method information needed for its service.

2. Why we use it

We use this information to operate and protect the Brand account; verify the business; find and present interested Creators; prepare and administer bookings; deliver Campaign and Event tools; review work; invoice and process payment through Stripe; release or refund Creator amounts; report Campaign results; handle reports and disputes; improve the dashboard; and meet legal, accounting and record obligations. We send essential verification, account, booking, safety and payment messages. Optional promotional communications use their own choices.

3. Creator information and Brand access

The Brand sees Creators shortlisted or booked for it, with relevant profile details, social statistics, exact age but not date of birth, quoted price, work and Campaign results. The Creator’s legal name appears in the booking agreement. Concre does not show the Creator’s private phone number as a Brand contact detail. Authorised Brand team members see only the Campaigns and functions assigned to them. The Brand must remove access when a team member no longer needs it.

The Brand must handle Creator data it receives for the booking, safety, compliance or legitimate relationship management. It must protect the data and may not sell it, bulk export Concre’s database or use it for unrelated marketing. The Brand is responsible for the personal data it enters about its own staff, Event guests and other third parties, including giving any required notice or obtaining any required permission.

4. AI and service providers

Concre uses OpenAI, Google Gemini and ElevenLabs for brief assistance, advisory content checks and transcription. Relevant text, image, video or audio may be sent to them, including confidential Campaign material. The dashboard discloses this processing before an affected feature is used. Concre will send Campaign material only through provider accounts and settings or agreements that prohibit use of Concre submissions to train their general models. They still process material to supply the feature and may retain limited service or abuse-monitoring information under their terms. A Brand must have authority to upload another person’s personal data or confidential material for the disclosed processing. AI suggestions do not replace the Brand’s review or legal responsibilities.

We share relevant information with booked Creators and authorised Brand staff, Stripe, connected social platforms, and providers for hosting, communications, analytics, security and the AI features. We may share information with advisers or authorities where required or permitted by law. Some providers process data outside Singapore. Where the PDPA requires it, we take steps to ensure comparable protection. We do not sell personal data to data brokers.

5. Campaign results and case studies

The Brand receives available results for its Campaign, ordinarily collected for 30 days after a Creator posts. Concre may use properly anonymised or aggregated results for service analysis. Concre will seek separate Brand approval before publicly using its name, logo, identifiable Campaign details, quotation or results in a case study. Identifiable Creator name, image or still-image use also requires the Creator’s permission. Campaign approval alone is not case-study permission.

6. Retention and account closure

We retain personal data while needed for the notified service, a transaction, accounting, security or a specific claim, and review it when that purpose ends. Relevant Singapore business and accounting records generally must be kept for at least five years from the relevant tax year or accounting period, as applicable. We do not apply that period indiscriminately to all chats, drafts or files.

Concre makes each approved paid final deliverable available to the Brand for download at approval. If the Creator later deletes their account, Concre removes ordinary Brand access to that Creator’s Campaign chat and unfinished drafts, and removes those items and ordinarily accessible hosted final files from active systems when deletion is completed. The Brand may keep its downloaded file only within the Campaign Agreement’s rights. Only a particular record legally required for an active claim or legal duty may remain in a restricted case record. Signed agreements, approval and payment records are retained while their documented purpose requires them. A general possibility of a future dispute does not justify retaining every item indefinitely.

Brand team access can be removed by the Brand owner. Contact support@concre.app to close a Brand account. Closure does not automatically erase a specific record still needed for a lawful purpose.

7. Dashboard analytics and privacy rights

The dashboard uses browser storage needed for login and uses PostHog to understand feature use. The separate Cookie and Analytics Notice describes the technologies and choices. The public website has its own Website Privacy Notice.

An individual may contact dpo@concre.app to request access to or correction of their personal data, withdraw consent where applicable, or ask a question or make a complaint. PDPA rights and exceptions apply; a withdrawal may affect the ability to maintain an account or booking. We use reasonable safeguards, assess suspected breaches and give required notifications. We post policy changes and give additional notice where required. Brand accounts are for adults authorised to act for a business.

Privacy: dpo@concre.app. Support: support@concre.app.