Privacy Policy

We collect only what we need to run Bagged for you.

• Account details: your name, email address, phone number, password (stored only as a secure hash) and, if you sign in with Google, your Google name, email and profile photo.
• Profile and Creator Page: your handle, bio, niches, profile photo, cover image, rates, and the platform links and follower counts you add.
• Business records you create: brands, deals, brand messages you paste in, contracts, campaigns, invoices, payout details, content drafts, captions and media you upload.
• Billing: your plan, billing period and payment records. Card payments are handled by Paystack; we never receive or store your full card number.
• Security and usage: sign-in sessions, IP address and device or browser type, two-factor settings, and security events such as failed sign-ins, used to keep your account safe and to limit abuse.
• Information from connected platforms: described in section 2.

You can choose to connect accounts on Instagram, Facebook, TikTok, YouTube, X and LinkedIn. Connecting always happens through the platform's own sign-in and permission screen. We never ask for, see or store your social media passwords.

Depending on the platform and the permissions you approve, we may access:

• Basic profile information such as your account ID, username, display name and profile picture.
• Audience and performance data such as follower counts, views, reach, likes, comments and engagement for your own account and your own posts.
• Your own posts and media, so we can show your top content and confirm when a scheduled post has gone live.
• The ability to publish or schedule posts to your account, only when you ask Bagged to publish something.

We use this information only to:

• show you your own analytics and top content inside Bagged;
• publish or schedule content you have created and chosen to publish;
• show your audience size on your Creator Page if you choose to display it.

We do not sell platform data, use it for advertising, share it with data brokers, or use it to build profiles of people other than you. We only request the permissions a feature needs, and we store access tokens encrypted on our servers. They are never exposed in your browser.

You can disconnect a platform at any time in Settings → Connected accounts, and you can also remove Bagged from the platform's own settings. When you disconnect, we delete the tokens for that platform and stop collecting its data. Data we previously collected from that platform is deleted within 30 days, or immediately when you delete your account.

YouTube and Google. Bagged uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Bagged's access at any time from your Google security settings. Bagged's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta, TikTok, X and LinkedIn. We handle data from these platforms in line with their developer terms and policies, and only for the purposes above. You can remove Bagged from Instagram or Facebook under Settings → Apps and websites, from TikTok under Settings → Security → Manage app permissions, from X under Settings → Security and account access → Apps and sessions, and from LinkedIn under Settings → Data privacy → Permitted services.

• To provide Bagged: your dashboard, deals, contracts, invoices, content tools, analytics and Creator Page.
• To run the AI features you use, such as Deal Read, caption, hook and script tools.
• To process subscriptions and send receipts, reminders and account emails.
• To keep accounts secure, prevent fraud and abuse, and enforce our Terms.
• To answer your messages and provide support.
• To comply with legal obligations.

When you use an AI feature, the text you submit (for example a brand message or a caption draft) and the context needed for that request are sent to Google's Gemini API to generate the result. We do not send your social media passwords, payment details or access tokens to AI providers. AI results are suggestions, and you decide what to use.

We do not sell your personal information. We share it only with service providers that help us run Bagged, under agreements that protect it:

• Vercel (hosting and file storage) and Neon (database)
• Paystack (payments)
• Resend (email delivery)
• Google (Gemini API for AI features, and Google sign-in if you use it)
• Upstash (rate limiting) and Cloudflare Turnstile (bot protection at sign-up)
• Logo.dev (brand logos, which receives only a brand's name or website)

Information on your Creator Page is public when you share its link. We may also disclose information if required by law or to protect the rights, safety and security of our users and Bagged.

We use only essential cookies: one keeps you signed in and one remembers your display currency. We don't use advertising or third-party tracking cookies.

We keep your information while your account is active. When you delete your account, your profile, Creator Page, business records, content and connected-platform data are deleted. Payment records may be kept for as long as the law requires for tax and accounting. Backups roll over within 30 days.

We protect your information with encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, and encryption of sensitive data such as payout details and platform access tokens. No system is perfectly secure, so please use a strong password and turn on two-factor authentication.

Depending on where you live, including under Kenya's Data Protection Act, the GDPR and US state privacy laws, you can:

• access and update your information in Settings;
• ask for a copy of your data;
• disconnect any social platform;
• delete your account yourself in Settings → Security (see our data deletion instructions);
• object to or restrict certain processing, and withdraw consent.

To make a request, email hello@baggedcash.com. We respond within 30 days. You can also complain to your local data protection authority, which in Kenya is the Office of the Data Protection Commissioner.

Bagged is operated from Kenya and our providers may process data in other countries, including the United States and the European Union. We rely on appropriate safeguards for these transfers.

Bagged is not for children under 13, or under the minimum age required in your country. We do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.

If we make material changes, we will update the date above and let you know by email or in the app before the changes take effect.

Bagged is operated from Kenya. For privacy questions or requests, email hello@baggedcash.com.