This includes processing associated with tracked links and conversions even where the person has no Growth Engine account. Our general website privacy policy separately describes ordinary marketing-website interactions. For processing specifically associated with Growth Engine, this Policy provides the more specific explanation. Advertisers and Publishers also have their own privacy responsibilities and notices.

For our own account administration, security, payments and purposes we determine, we act as the responsible organisation under the applicable privacy law. For campaign data processed solely on an Advertiser's documented instructions, we may act as its processor or service provider. The actual purpose and arrangement determine the role; a contractual label does not by itself decide it. Trackier supplies technology used to provide the service and process information on our behalf, subject to the applicable arrangement.

Privacy and data-protection queries should be sent to growth-engine@creativecuddle.com. Our business contact details appear at the end of this Policy.

Depending on the account and features used, we process business and contact information such as representative names, business names, work email addresses, phone numbers, country or location, websites, social profiles, traffic sources, account roles and application details. This information may identify a person even when provided for a business purpose.

Account operation also involves login and authentication information, account identifiers, permissions, communications, support requests and activity records. Payment administration may require billing addresses, invoices, bank or payout details, transaction records and tax or business-verification information. We request documents only where relevant to onboarding, compliance or payment requirements.

The fact that we do not request customer contact details in conversion integrations does not mean that we collect no personal information from our own business users. Do not send passwords, bank-login credentials or unnecessary identity documents through support messages or tracking fields.

Advertiser conversion integrations are intended to send only tracking and transaction information. This can include click and conversion identifiers; campaign, Publisher and permitted sub-Publisher identifiers; order references; event dates and times; sale amounts and currency; commission or payout amounts; approved coupon references; and order, payment, return, cancellation or validation status.

Depending on the approved tracking method and configuration, requests to the tracking service may also generate technical information such as IP addresses, browser or device information, approximate location derived from an IP address, referring-page information and cookie, session or similar online identifiers. We use only fields needed for an approved purpose; an available platform field is not permission to collect it.

We do not request customer names, email addresses, phone numbers, delivery addresses, payment-card details or customer contact lists through these conversion integrations. Advertisers and Publishers must not insert these details into URLs, postbacks or free-text tracking parameters. An order reference or pseudonymous identifier can still be personal information where it relates to an identifiable person; it is not automatically anonymous.

We do not seek health, biometric or similarly sensitive consumer information for campaign tracking. Where a product or event description could reveal sensitive information, participants must minimise or omit that description and obtain a specific privacy review before any such processing. Unexpected or excessive information should be reported so that collection can be stopped and the data appropriately removed, restricted or otherwise handled.

We receive account information from applicants, account users and their organisations; campaign information from participating Advertisers and Publishers; and tracking, technical and service records through Trackier and the integrations approved for the relevant program. We also receive information when you communicate with us or provide billing and compliance documents.

Where you provide information about colleagues or other people, you must have the authority to do so and make this Policy available to them. We do not treat your agreement to these Terms as consent on behalf of every consumer whose activity may be measured.

We use relevant information to review applications, administer accounts and program access, communicate about services, support integrations, attribute eligible actions, validate transactions, reconcile discrepancies, prepare reports and calculate and process payments.

We also use it to protect account and service security, detect invalid traffic or suspected fraud, investigate complaints, keep necessary financial and audit records, meet applicable legal obligations and establish or defend legal claims.

For approved cross-channel marketing, we use campaign information to plan, run, coordinate, measure and optimise activity across channels such as affiliate, creator, search, social and other agreed media. This may include comparing channel performance, coordinating offers and creative, and improving campaign placement or budget allocation using aggregate reporting or permitted pseudonymous signals.

Cross-channel use is limited by the relevant Advertiser instructions, lawful purposes, required notices and permissions. It does not automatically authorise combining identifiable customer activity across unrelated Advertisers or disclosing one Advertiser's customer information to another. Any user-level audience activation, personalised retargeting or new marketing-platform disclosure must be specifically assessed, authorised and appropriately disclosed, with required consent and choice mechanisms in place before activation.

Account and program service messages are distinct from optional promotional communications. Any optional direct marketing must follow applicable communications rules and allow the relevant opt-out. We do not use conversion feeds to build customer contact lists for unsolicited email, SMS or calling.

We identify the legal basis required in the relevant jurisdiction for each processing purpose. Where European or UK data-protection law applies, relevant bases may include performance of a contract with the individual for their account; legitimate interests in administering business relationships, measuring authorised programs and securing services where those interests are not overridden by individual rights; compliance with legal obligations; and consent where required for tracking or marketing.

A business contract with an Advertiser is not, by itself, a contractual legal basis for processing every consumer's personal information. For India and other jurisdictions, we apply the consent, permitted-use and other requirements of the laws actually applicable to the processing and in force at the relevant time. We do not assume that a legitimate-interest basis available in one jurisdiction exists in all others.

Where processing depends on consent, you may withdraw it through the relevant consent controls or by contacting us. Withdrawal does not affect earlier lawful processing and does not automatically require removal of records that must lawfully be retained for a different purpose. We do not treat continued use of the panel or acceptance of this Policy as blanket consent to every tracking or marketing activity.

Depending on the service and integration used, Growth Engine may use necessary login or security storage, tracked links, cookies or similar identifiers, pixels, APIs and server-to-server conversion messages. A server-to-server integration does not by itself remove privacy obligations or establish that no cookie or device access occurs elsewhere in the journey.

Where law requires consent for non-essential storage, access or marketing technologies, the responsible operator must obtain it before those technologies operate and provide an appropriate withdrawal mechanism. Creative Cuddle, Advertisers and Publishers must each meet the obligations applicable to their own activities. The specific technologies, providers, purposes and durations should be disclosed in the relevant collection-point or cookie notice.

Use the consent controls on the website or app where an interaction takes place, and any relevant browser or device privacy settings. Blocking or clearing browser storage may affect login or attribution, but may not stop server-side processing or delete information already lawfully recorded. You can also contact us about information or tracking under our control. This Policy does not claim that one email request or browser setting can disable every independent Advertiser's or Publisher's technology.

We share necessary information with Trackier and authorised providers supporting hosting, security, communications, reporting, payment processing and administration, within the scope of their services and appropriate contractual restrictions. Banks and payment providers may also have independent legal and regulatory responsibilities.
‍
Participating Advertisers receive information needed for their own program, including relevant partner details, attribution and transaction reports. Publishers receive information needed to understand their own referred activity, validation, commissions and payments. We do not grant general access to other participants' unrelated account data or Advertisers' customer information.

Where an approved cross-channel integration requires a marketing or measurement recipient, sharing is limited to the documented purpose, permitted fields and applicable permissions. This is not a general licence for a recipient to reuse information for unrelated advertising. A new recipient or materially different purpose requires a privacy review and any updated notice or consent required before the change.

We may disclose information to professional advisers, authorities or other parties where reasonably necessary and lawfully permitted for compliance, disputes, fraud prevention or protection of rights. A genuine business transfer may involve protected due-diligence access and transfer to a successor, with notice and safeguards where required.

We do not sell consumer contact lists. Some laws use broader definitions of "sale", "sharing" or "targeted advertising" that can cover advertising disclosures without a cash payment. Where such rules apply to an approved activity, we provide the required disclosures and honour the applicable opt-out and consent requirements. We do not make a blanket claim that all possible cross-channel advertising falls outside those definitions.

Creative Cuddle operates from India. Service providers and authorised participants may process information in other countries, depending on the services and program involved. We do not promise that all Growth Engine data remains in India.
‍
Where a transfer is restricted by applicable law, it must use the required safeguards or lawful transfer mechanism, which may include appropriate contractual protections. The appropriate mechanism depends on the actual origin, destination and roles. Contact us for information about safeguards relevant to your information; the use of a provider does not itself prove that every possible transfer is authorised.

We retain information only for as long as reasonably necessary for its permitted purpose or a legal requirement. Relevant criteria include whether the account or program remains active; attribution and validation periods; returns, payment and reconciliation cycles; fraud investigations; outstanding disputes; applicable accounting or tax duties; and limitation periods for legal claims.
‍
When information is no longer needed, we arrange its secure deletion, anonymisation or other appropriate disposal. Records retained solely for legal, dispute or compliance purposes must not continue to be used for unrelated marketing. Closing an account does not necessarily erase financial records or other information that must be retained. Contact us for the retention criteria applicable to a particular category.

We use reasonable organisational and technical safeguards appropriate to the information and risks, including limiting access to authorised purposes and protecting credentials and integrations. No service can promise absolute security. We will assess suspected incidents and notify affected parties or competent authorities where applicable law requires.

Depending on the applicable law, you may have rights to request information about processing; access, correct or delete personal information; receive a portable copy; restrict or object to certain processing; withdraw consent; or opt out of relevant marketing, sale, sharing or targeted advertising. Where provided by law, you may also appeal a decision, appoint an authorised representative or nominee, or complain to a competent regulator.
‍
Email growth-engine@creativecuddle.com with a description of your request and enough information to locate the relevant account or activity. For tracked activity, useful details may include the Advertiser, approximate date and an order or click reference already available to you. Do not send passwords or complete payment-card details. We may request proportionate identity or authority verification through an appropriate channel.
‍
We will respond within the applicable legal timeframe, explain any lawful refusal or limitation, and identify the available escalation route where required. Where we act solely on an Advertiser's instructions, we will coordinate with or direct the request to the appropriate responsible party rather than promise access to information we do not control.
‍
You may decline optional information and object to relevant marketing. Where information is necessary for an account, payment or compliance obligation, not providing it may prevent that particular service. Exercising a privacy right does not permit unlawful discrimination. Where applicable law requires recognition of a valid browser or universal opt-out signal, that signal must be respected for covered processing.

Growth Engine accounts are intended for adult business users aged 18 or over. Our campaign service is not intended for knowingly profiling or targeting children. Participants must not knowingly route children's personal information into a campaign without a separately approved lawful arrangement. Contact us if you believe information about a child has been collected improperly so that we can investigate and take appropriate action.
‍
Advertisers, Publishers and other websites or apps operate independently for their own activities. Their notices describe their processing. Their independence does not remove Creative Cuddle's responsibilities for information we process.

We may update this Policy to reflect changes in practices, technology or applicable law. The updated date will identify the current version, and material changes will be brought to the attention of affected people as required. A new publication does not retrospectively authorise an incompatible use or replace any consent required before that use begins.

Creative Cuddle - Growth Engine
Have questions? Need support?
Reach us anytime at growth-engine@creativecuddle.com