Privacy policy for brands

1. Who is responsible for your data

Devign LLC, a limited liability company registered in Wyoming, USA, at 5830 E 2nd St, Ste 7000 #23016, Casper, WY 82609, United States, is responsible for (controls) the data described here. Our team works from Beirut, Lebanon. For any privacy question or request, write to support@devignlb.com.

2. What we collect

Account and company details, which you give us:

• your email address;
• your password, which we store only as an argon2id hash (we never store the password itself);
• your company name and your contact name;
• if you add them: a phone number, your website, your country, your industry and an "about" text;
• your logo, if you upload one (we convert it to a new image file and do not keep the file you uploaded);
• your language choice.

Deal data, which you create on the site:

• your deals: title, brief, requirements, product link, format, regions, topics, number of creators, budget and dates;
• the messages you add to invitations;
• your invitations, the applications you receive, your bookings and their status.

Sign-in and security data, which the site records:

• sign-in sessions: when each started and was last used, and your browser's user agent (so you can see and end your sessions in Account settings);
• your IP address, stored in sessions and in the audit log only as a keyed hash, not as the address itself;
• an audit log of important actions, such as sign-ups, sign-ins and failed sign-ins, password and two-step sign-in changes, deal changes, invitations, bookings and account deletion;
• counts of failed sign-ins and temporary account locks;
• if you turn on two-step sign-in: your authenticator secret, stored encrypted, and your recovery codes, stored only as hashes;
• links we email you to confirm your address or reset your password, stored only as hashes;
• server logs: our web server records each request (IP address, time, page and browser), and a separate log records the IP address of each failed sign-in so that we can block attacks. These logs hold the full IP address.

Messages you send us by email, for example to support.

We do not collect payment card data on this site. Invoices and payments are handled with you directly by Devign's team.

3. Cookies

The site uses only its own cookies, and only ones it needs to work. They are all Secure, HttpOnly (scripts on the page cannot read them) and SameSite=Lax, and are sent only to brands.devignlb.com.

• __Host-bd_sid: keeps you signed in. It lasts until you sign out, after 2 hours without activity, or 14 days at most.
• __Host-bd_csrf: protects forms from being sent by other sites while you are not signed in. It lasts until you close your browser.
• __Host-bd_lang: remembers the language you picked. It is set only when you pick one, and lasts 1 year.
• __Host-bd_flash: shows a one-time message after an action, such as "Saved". It lasts 2 minutes at most.

We use no analytics, advertising or social media cookies, no tracking pixels and no third-party scripts. Fonts, scripts and images load from our own server. Because we use only these cookies, the site does not show a cookie banner.

4. Why we use your data, and our legal bases

• To run your account and the site: create your account, sign you in, show your deals to creators, handle invitations, applications and bookings, and send the emails described below. Legal basis: performing our contract with you (these terms).
• To confirm and deliver bookings: contact you about the details, the final price, the contract and the invoice, and brief the creator. Legal basis: performing our contract with you.
• To keep the site and creators safe: check deals against our content rules, prevent fraud, spam and account takeover, limit how often actions can be tried, keep the audit log, and protect creators' data from harvesting. Legal basis: our legitimate interests in security and in protecting creators.
• To keep records for contracts, invoices, tax and disputes, and to answer lawful requests. Legal basis: legal obligations, and our legitimate interest in defending legal claims.

We do not use your data for advertising, we do not send marketing emails and we do not sell your data. Deals are checked automatically before creators see them (section 6). If a deal is not accepted, you can ask a person at Devign to look at it again.

5. What creators see about you

Creators in the Devign Creator App can see your company name, your logo, your website's domain name, your country, whether your business is verified, your live deals (translated into the creator's language, with the original text) and the messages you add to invitations.

Creators do not see your contact name, email address or phone number. Devign passes on to a booked creator only what they need to do the deal.

Your logo is published at a public web address on the site so that the app can show it. It is removed when you remove the logo or delete your account.

6. Who we share data with

• Devign staff, who need it to review deals, run bookings, prepare contracts and invoices, and support you. Staff alerts about a new booking show your company name, the deal title and the budget.
• Creators, only as described in section 5.
• An AI service for checking and translating deals. To check a deal against our content rules and to translate it for creators, we send the deal text and your public company details (company name, industry, website domain and "about" text) to an AI model provider, at present DeepSeek. We do not send your contact name, email address, phone number or logo.
• Push notification services. When we tell creators about a deal, the notification (with your company name and the deal title) is delivered through the app's push services: Expo, Google Firebase Cloud Messaging and Apple Push Notification service.
• Our hosting provider, Contabo, whose servers in the European Union run the site, the database and our backups. Our emails are sent from our own mail server.
• Authorities or courts, when the law requires it, or to protect creators, users or Devign from fraud or harm.
• A buyer or successor, if Devign or the site is sold or merged, under the same protections.

We do not sell or rent your data, and we do not share it with advertisers or data brokers.

7. Creator data you see, and your duties

The site shows you only Devign creators who opted in to brand deals in the Devign Creator App. When they opt in, the app shows them what brands will see. They can opt out at any time, and then their card is hidden from the site (except inside your own invitations, applications and bookings with them).

For each creator we show: their TikTok handle and display name, profile photo, region, topics, the formats they accept, a short pitch they wrote, whether they are verified on TikTok, and their LIVE activity for one month (LIVE days, LIVE hours, new followers and average watch time), taken from the agency's own records.

We never show creators' phone numbers, email addresses or other contact details. All contact goes through Devign. Until your business is verified, handles and names are shown in part only. A creator who applied to your deal or accepted your invitation is shown in full.

You may use creator data only to choose creators and to work with them through Devign. You must:

• keep it confidential and not share, sell or publish it;
• not copy, scrape, export or store it in bulk, or build a list or database of creators;
• not use it to contact creators outside Devign, or to find their contact details;
• delete any notes or copies once you no longer need them for a deal, or when we ask;
• follow the data protection laws that apply to you, and keep any copies secure;
• tell us at once at support@devignlb.com if creator data leaks from your business.

The Terms for brands set out these duties in full.

8. Emails we send

We send only emails about your account and your deals:

• a link to confirm your email address, and a password reset link when you ask for one;
• a notice if someone tries to sign up with your email address;
• security notices, for example when your password, two-step sign-in or recovery codes change, or when your account is deleted;
• the result of each deal check (live or not accepted, with the reason);
• a summary of new applications and creator replies, at most one every 30 minutes;
• a confirmation for each booking;
• emails from Devign's team about your bookings, contracts and invoices.

We send no marketing emails.

9. How long we keep data

• Account and company details: while your account is open.
• When you delete your account, at once: your email address is replaced; your company name, contact name, phone number, website, country, industry, "about" text and logo are removed; your two-step sign-in secret, recovery codes, sessions and email links are deleted; and your password can no longer be used. Your drafts are deleted and your other deals are closed.
• Sign-in sessions: deleted when you sign out, after 2 hours without activity, or after 14 days at most.
• Email confirmation and password reset links: they work for 48 hours and 60 minutes. Their records are deleted 7 days after they expire.
• Rate limit counters: deleted within 2 days.
• Web server logs: about 6 weeks. Failed sign-in and error logs: about 9 weeks.
• Backups of our database: daily backups are kept for 14 days, weekly backups for 8 weeks and monthly backups for 12 months. So a copy of deleted data can remain in a backup for up to 12 months, until that backup is deleted. We do not restore deleted data from backups except to recover from a failure.
• Deals, invitation messages, booking records and the audit log: we keep these after a deal ends and after an account is deleted, because we may need them for contracts, invoices, tax, disputes and security. After an account is deleted they are no longer linked to your email address, names, phone number, website or logo, but deal texts still contain what you wrote. At present we do not delete them after a fixed time. When we set a fixed period, we will add it to this policy. You can ask us to delete specific deal texts or messages, and we will do so unless we must keep them for a booking, a legal obligation or a dispute.
• Contracts and invoices: as long as tax and accounting law requires.

10. How we protect data

• All traffic to the site uses HTTPS.
• Passwords are hashed with argon2id. Session tokens, email links, recovery codes and IP addresses in our records are stored only as hashes. Two-step sign-in secrets are encrypted.
• We limit how often sign-in and other actions can be tried, and we lock sign-in for a while after repeated failures.
• Each business can reach only its own deals, invitations and bookings. The site's database accounts have only the rights they need, and our staff have access only to what their work needs.
• We check every uploaded logo and convert it to a new image, and we block contact details in the texts creators see.
• We keep an audit log of important actions and watch for attacks.

No system is completely secure. If you think your account or data is at risk, tell us at once at support@devignlb.com.

11. Where your data is stored and international transfers

The site, its database and our backups run on Contabo servers in the European Union. Devign is a US company and our team works from Lebanon, so our staff access the data from Lebanon. The AI provider we use for deal checks and translation processes the data described in section 6 outside the European Union (DeepSeek is based in China). Creators who see your deals are in the 8 regions the site serves.

So your data may be processed in countries whose data protection laws differ from yours. Where the law requires it, we use recognised legal transfer mechanisms and protect the data as this policy describes.

12. Your rights

Depending on where you are, you may have the right to:

• see the data we hold about you and get a copy of it, in a common machine-readable format where the law gives you that right;
• correct data that is wrong;
• have your data deleted;
• limit or object to how we use your data, including uses based on our legitimate interests;
• complain to the data protection authority where you live or work.

How to use them. You can change most of your details, and delete your account, yourself in Account settings. For anything else, email support@devignlb.com from the email address on your account. We may ask you to confirm your identity before we act. We reply within 30 days. We may keep some data where the law requires it or where we need it for a legal claim, and we tell you when we do.

13. Children

Devign Brands is for businesses and is not for anyone under 18. We do not knowingly collect data from children. If you believe a child gave us data, write to support@devignlb.com and we will delete it.

14. Changes to this policy

We may change this policy. When we do, we change the date at the top of this page. If a change matters, we tell you by email or on the site before it takes effect.

15. Contact

Devign LLC, 5830 E 2nd St, Ste 7000 #23016, Casper, WY 82609, United States. Team in Beirut, Lebanon.
Email: support@devignlb.com