HoopyUp
IT·EN

Privacy policy

This policy explains which personal data HoopyUp processes, why, for how long, and what your rights are. It applies to creators using the app, to brands writing to us through the brand form, to visitors of this site, and to anyone who clicks a creator's tracked link.

Last updated: 9 October 2026

1. Who the controller is

The data controller is Hoopygang S.r.l., Via del Tiratoio 1, 50124 Florence, Italy, VAT IT06747140488, REA FI 652961. HoopyUp is a Hoopygang product.

For any question about your data, or to exercise your rights, write to privacy@hoopyup.com.

2. What data we process

It depends on how you come into contact with us.

  • Creators, account: name, email, account identifier and sign-in method (Google, email and password, Facebook, Instagram or TikTok), the social profiles you tell us about and your categories of interest.
  • Creators, tax and payment details: Italian tax code, home address, tax regime (withholding tax or VAT number), IBAN and account holder. We ask for them only to pay you.
  • Creators, activity: the briefs you accept, your tracking code and personal tracked link, the content you submit for review (text, video or photo files, link and identifier of the published post), the review outcome, the conversions attributed to you, wallet entries and payouts.
  • Creators, social data: if you sign in with Facebook, Instagram or TikTok or connect a profile, the data described in section 4.
  • Brands: the data you enter in the form (company, name, email, website, industry, volumes, message, language) and any later correspondence.
  • People who click a tracked link: a fingerprint of the IP address computed with a secret key that changes every day (the plain IP is not stored in the database), the browser type, the referring domain, date and time. We use no cookies and we do not receive the data you enter on the advertiser's site.
  • Site visitors: the technical data of the request (IP address, browser, page visited) that the server logs for security and operation.

3. Why we process it, and on what basis

  • Creating and running your account, assigning briefs, reviewing content, attributing conversions and paying you: performance of our contract with you (Art. 6(1)(b) GDPR).
  • Tax and accounting obligations (withholding tax, annual tax certificates, filings with the Italian Revenue Agency, bookkeeping): legal obligation (Art. 6(1)(c)).
  • Measuring clicks on tracked links, attributing conversions to the right creator and preventing fraud and automated clicks: the legitimate interest of us, of creators and of advertisers in fair compensation (Art. 6(1)(f)). The data is pseudonymised and does not tell us who you are.
  • Answering a brand that writes to us and handling the negotiation: pre-contractual steps at its request (Art. 6(1)(b)).
  • Security of the service, defence in disputes and proof of payouts: legitimate interest (Art. 6(1)(f)).
  • We do not use your data for advertising, we do not sell it, and we take no decision based solely on automated processing: every piece of content is approved or rejected by a member of our staff.

4. Data from Facebook, Instagram and TikTok

In the app you can sign in with Facebook, Instagram or TikTok and connect your Instagram and TikTok profiles. You decide, by authorising HoopyUp on the social network's screen, and we receive only what you authorise. The permissions are read-only: we never post anything on your profiles.

  • Facebook (public_profile, email): account identifier, name, profile picture and email address. Used only to sign you in; the email address is shown to you in the app, under Profile, and is not used to contact you.
  • Instagram (instagram_business_basic): identifier and username, display name, profile picture, follower count and the list of your published content. Used to sign you in, connect the profile, show it to you in the app and pick the post you published for a brief, proving it is yours.
  • TikTok (user.info.basic): identifier, username, display name and profile picture. Used to sign you in and connect the profile.
  • TikTok (video.list): the list of your published videos with their statistics. Used to pick the video published for a brief and read its results.
  • TikTok (user.info.stats, user.info.profile): profile counters (followers, likes, number of videos) and public profile data. Used to show you and verify the results of the connected profile.

The credentials the social network issues to us (tokens) are stored encrypted. Of the profile we keep the identifier, username, display name, picture, the email address (Facebook only) and the permissions granted; of your content, only the identifier and link of the post you deliver for a brief. The content list and statistics are read from the social network when needed.

You can disconnect a profile from the app at any time, and revoke the authorisation from the social network's settings too. Step-by-step instructions are on the Data deletion page. Our use of data received from these services also complies with the Meta and TikTok developer terms.

5. Who we share data with

  • Providers processing data on our behalf, as processors: Google (Google Cloud for servers, database and files, Firebase Authentication for signing in to the app) and the provider of our sales management system, which receives brand enquiries.
  • The campaign's brand: the content you submit for its brief and the link of the published post.
  • Advertisers and affiliate networks: they receive only the tracking code and the click identifier, which contain neither your name nor your email. Only we can link that code to you.
  • To pay you: Stripe, PayPal or the bank handling the transfer, acting as independent controllers for their own obligations, receive the data the payment requires.
  • Public authorities, such as the Italian Revenue Agency, when the law requires it.
  • Meta and TikTok, if you choose to sign in or connect a profile with them, under their own privacy policies.
  • Hoopygang staff access data only as their role requires: tax details are visible only to the people handling payouts and to technical administrators.

6. Where the data is

Database, content files and logs are on Google Cloud, in the European Union (Belgium). Some services may also process data outside the EU, notably in the United States: Firebase Authentication, the technical click queue, and the payment providers Stripe and PayPal. The site loads its typefaces from Google Fonts, which receives your browser's IP address.

These transfers rely on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

7. How long we keep it

  • Creator account and profile: while the account is active. When it is closed we delete them, except the data the law requires us to keep.
  • Wallet entries, paid conversions, payouts and the related tax details: 10 years, like accounting records (Art. 2220 of the Italian Civil Code).
  • Video and photo files submitted for review: 90 days from upload, then deleted automatically. Text, link and identifier of the post stay tied to the brief as proof of the paid work.
  • Tokens and data of a connected social profile: while it stays connected. We delete them when you disconnect it or close your account.
  • Click and conversion data: for the duration of the campaign and then as proof of compensation, for the same period as accounting records.
  • Brand enquiries: for the negotiation and the business relationship, and in any case no longer than 24 months after the last contact if the relationship does not go ahead.
  • Server technical logs: 1 day. Database backups: 7 days.

8. Your rights

At any time you can ask to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. Write to privacy@hoopyup.com: we answer within one month.

Instructions for deleting your account and connected profiles are on the Data deletion page.

If you believe the processing is not lawful, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

9. What is required, and minors

Without the account data you cannot use the app, and without tax and payment details we cannot pay you. Connecting social profiles is optional: without it you can still deliver content by entering the post's link.

HoopyUp is only for people aged 18 or over. We do not knowingly collect data from minors.

10. Cookies

This site uses no cookies and no analytics or profiling tools. The tracked link uses no cookies. The app keeps on your device only what it needs to keep you signed in.

11. Changes

If we change this policy we update the date at the top of the page. If the change materially affects creators' data, we also announce it in the app.