Last updated: September 29, 2026 (version 1.4)
This policy explains what personal data we process when you use Usicri, why, on what legal basis, who receives it, how long we keep it and what rights you have (Articles 13 and 14 GDPR).
The controller is Raufi Communications, Monib Raufi, Vom-Stein-Str. 1a, 45894 Gelsenkirchen, Germany. Contact: support@usicri.com or the contact form. More details are in our Legal Notice. We have not appointed a data protection officer because the law does not require it for a business of our size.
Visiting the site. Our servers, run by our hosting provider, record technical data for every request — IP address, date and time, the page requested, the browser’s user-agent and the referring page. We need this to deliver the site and keep it secure and working (Art. 6(1)(f) GDPR, our legitimate interest in a stable and secure service). Logs are kept only as long as needed for that and are then deleted automatically by the hosting provider.
Your account. Name (or brand name), email address, a hashed password, your role (Creator or Brand), when you registered and which version of the Terms and Privacy Policy you accepted, whether your email is confirmed, and the campaign tag of the link you signed up through (for example ?ref=tiktok; it is carried in the link and is not stored in a cookie or on your device). We use it to provide your account and the service (Art. 6(1)(b)); the record of your acceptance to be able to prove what you agreed to, and the campaign tag to understand which channels reach people (Art. 6(1)(f)).
Creators. Videos you upload, their captions, the campaign they are for, when you submitted them and when you ticked the declaration that you filmed them, the status of each video, ratings and notes Brands give you, payout amounts, and your Stripe payout account ID and its status. We use this to run campaigns, show your submissions to the Brand, pay you and keep the platform safe (Art. 6(1)(b), and (f) for safety). Once a video is approved it may be shown publicly, with your display name and caption, in the Discover feed and on campaign pages, to promote Usicri (Art. 6(1)(b) and (f), as agreed in section 5.3 of the Terms); you can ask us to take it down at any time.
Brands. Campaigns you create (title, description, category, payout, number of videos, product arrangement), your Stripe customer ID, whether a payment method is saved (card details are entered at Stripe and never reach our servers), the charges we make (amount, fee, date, Stripe charge ID), any billing details you add for invoices, and the invoices we issue. We use this to run campaigns, charge you and issue invoices (Art. 6(1)(b) and, for invoices and accounting, (c)).
Messages and reports. If you use the contact form or the report form, or ask a Brand a question about a campaign, we process what you send — your name, email address, the link and your message — to answer you or, for reports, to assess them (Art. 6(1)(b) or (f); for reports of illegal content, Art. 6(1)(c) together with Article 16 of the Digital Services Act). A question to a Brand is passed to that Brand with your name, and your email address as reply-to.
Moderation records. When we restrict a video or an account we keep a record of what we did, why, and the statement of reasons we sent (Art. 6(1)(c) together with Article 17 of the Digital Services Act, and (f) for defending legal claims).
Emails. We send service emails only — for example email confirmation, password reset, new submissions and review outcomes, reminders to Brands about videos waiting for review, and notices about your account or payments (Art. 6(1)(b), and (f) for reminders). We do not send marketing emails.
Accounting and tax. Invoices, payment records and related documents are kept because tax and accounting law requires it (Art. 6(1)(c)). Where the law requires us to collect tax information from Creators and report it, as described in section 7.3 of the Terms, we process that information for this purpose only (Art. 6(1)(c)).
People who appear in videos. A Creator is responsible for having the agreement of everyone recognisable in a video. If you appear in a video and want it removed, tell us through the report form; we assess each request individually (Art. 6(1)(f)).
Brands and Creators. A Brand sees the videos submitted to its campaigns, with the Creator’s display name, caption and average rating. Creators see campaign details and payouts, the Brand’s name and average rating, and the note a Brand may add when it rejects a video. Anyone, without an account, can see approved videos with the Creator’s display name and caption on the Discover feed, and the public campaign pages, which show a campaign’s details and its Brand’s average rating (not the Brand’s name).
Stripe. Payments and payouts are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, or another Stripe group company). We share the data needed for that — name, email address, payment and payout details, amounts. Stripe also verifies Creators’ identity and prevents fraud under its own legal obligations and acts as an independent controller for that; see stripe.com/privacy.
Service providers. Our hosting provider and our email-delivery provider process data on our behalf, bound by data-processing agreements under Art. 28 GDPR. We do not sell personal data.
Authorities and courts, where the law requires us to disclose data, or where we need to establish, exercise or defend legal claims.
Stripe is a U.S. company and may process data in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework where Stripe is certified and/or the European Commission’s Standard Contractual Clauses. If another provider we use is located outside the EU/EEA, the transfer is covered by an approved safeguard as well; you can ask us for details at support@usicri.com.
Account, campaigns, videos: while your account exists. When it is closed we delete or anonymise this data within 30 days, except what we must or may keep: videos a Brand has approved and paid for stay available to that Brand under its licence (without your name being linked to your account), and the records below. Server logs: as set out in section 2. Messages, reports and moderation records: until the matter is closed and then for three more years (the regular limitation period) so that we can answer or defend claims. Invoices, payment and tax records: for the period German tax law requires — currently six to eight years after the end of the calendar year (§ 147 Fiscal Code, AO). Proof of acceptance of the Terms: while your account exists and for three years after it is closed.
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20) and to object to processing that is based on our legitimate interests (Art. 21) — in that case we stop unless we can show compelling grounds that override your interests, or need the data for legal claims. Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)); at present we do not rely on consent for any processing. To exercise a right, write to support@usicri.com or use the contact form; we answer within one month, and may need to confirm your identity first. Erasure is limited where we must keep data by law or need it for legal claims.
You also have the right to complain to a data protection supervisory authority. The authority responsible for us is:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Name, email address and password are needed to create an account and use Usicri; without them we cannot provide the service. For payouts, Creators must complete Stripe’s identity verification, and where the law requires tax information (section 2 above) we cannot pay out until it has been provided.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. A simple automated check marks video captions that look like spam so that a person can look at them; it does not decide anything. Approving or rejecting a video is done by the Brand, and restrictions by us are decided by a person.
Usicri only sets the cookies strictly necessary to keep you logged in and your session working. These do not need your consent under § 25(2) No. 2 TDDDG because the service you asked for cannot work without them. We do not use cookies or other device storage for advertising, tracking or analytics, and the site loads no third-party trackers, external fonts or embedded third-party content: fonts, images and videos are served from our own server. If that ever changes, we will ask for your consent first and update this policy.
Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.
Data center: Frankfurt am Main, Germany. Backups: France.
The connection to Usicri is encrypted (HTTPS), passwords are stored only as hashes, and access to administration is restricted.
Usicri is for adults (18 and over) using it in a business or self-employed capacity, and we do not knowingly process children’s data. If we change this policy in a material way we will say so here and, where appropriate, tell you by email.