Legal · Privacy policy

Privacy policy

Last updated 2026·04·29

This document is a template last updated 2026-04-29. Contact hello@itsmurphy.com — review with legal counsel before relying on it.

01Identity and scope

Murphy is a French software service for influencer agencies. It helps agencies connect creator social accounts, keep media kits current, prepare campaign reports, and check disclosure signals aligned with French influencer marketing rules, including Loi n° 2023-451.

This policy explains how Murphy may process personal data when an agency, team member, creator, or brand contact uses the service. Questions can be sent to hello@itsmurphy.com.

02Data we collect

We collect account details such as name, work email, agency name, role, subscription metadata, support messages, product preferences, device type, browser, IP address, approximate location, logs, and security events.

When a creator connects a social platform, Murphy receives data made available by that platform through official OAuth permissions. This may include profile identifiers, handles, public profile information, audience and demographic metrics, reach, impressions, engagement, watch time, post metadata, campaign content references, and disclosure indicators. Creators never need to share social media passwords.

03How we use data

We use personal data to provide the Murphy workspace, refresh media kits, generate share links, support agency roster management, build campaign recaps, maintain per-creator audit logs, and help agencies identify missing or inconsistent advertising disclosures.

We also use data to secure the service, prevent misuse, debug product issues, answer support requests, improve onboarding, measure product reliability, and comply with legal obligations. Murphy does not sell personal data or use creator social account data to build unrelated advertising profiles.

04Legal bases

For customers and agency users, processing is generally necessary to perform a contract or to take pre-contractual steps. For creators, processing is based on the creator OAuth authorization, the agency relationship, and the legitimate interest of keeping accurate campaign and media kit records.

Some processing may be required to comply with law, including tax, accounting, platform, security, or French influencer marketing obligations. Where consent is required, for example for non-essential cookies or certain communications, Murphy will ask for it and allow withdrawal.

05OAuth connections and platform data

Murphy connects to Meta, TikTok, YouTube, Twitch, and other supported platforms only through official authorization flows. The creator controls the authorization with the platform and can revoke access through Murphy or the platform account settings.

The scope of imported data depends on the permissions granted by the creator and the platform API. Murphy stores access tokens securely, limits internal access, and uses them only to refresh the requested media kit, report, disclosure check, or audit log.

06Retention

Workspace account data is kept while the customer account remains active and for a reasonable period afterward to handle support, billing, audit, and legal requirements. Campaign records, share-link analytics, and per-creator audit logs are retained according to workspace settings and contractual commitments.

OAuth tokens are deleted or invalidated when a creator disconnects the platform, when the customer deletes the creator from the workspace, or when retention is no longer necessary. Backups are overwritten on a rolling schedule and are not used as active records.

07Sharing and sub-processors

Murphy shares data with service providers that host, secure, monitor, support, and operate the product. These providers act under written instructions and confidentiality commitments. Production data is intended to be hosted in the European Union unless a customer contract says otherwise.

We may also disclose data if required by law, to protect the rights and safety of Murphy, customers, creators, or the public, or as part of a corporate transaction where appropriate safeguards continue to apply.

08Your rights and contact

Under the GDPR, individuals can request access, correction, deletion, restriction, portability, or objection to certain processing. They may also lodge a complaint with a supervisory authority such as the CNIL in France. To exercise rights, contact hello@itsmurphy.com.

Murphy may need to verify the requester and coordinate with the agency customer when the customer is the controller of workspace data. We will not discriminate against a user for exercising privacy rights.