Legal

Privacy Policy

Effective date: November 2, 2026 · Ultimate Quantum LLC, a Wyoming limited liability company

This Policy is provided by Ultimate Quantum LLC. Please read it fully; it explains what Ultimate Influencer collects, why, who processes it, and the choices you have.

1. Who we are

Ultimate Influencer (ultimateinfluencer.ai) is operated by Ultimate Quantum LLC ("Ultimate Quantum", "we", "us"), a Wyoming limited liability company. We are the controller of the personal data described here. Contact us through the Ultimate Quantum contact page.

2. What we collect

• Account data. Your email address, name if provided, password hash, role, setup and session tokens, workspace invitations, encrypted authenticator secrets, hashed recovery codes and explicitly linked SSO provider/subject identifiers and authorization challenges.
• Organization and influencer data. Workspace identity and memberships; creator niches, topics, purposes, audiences, personas, languages, expertise, rights-approved knowledge, canon, series briefs, reference links, approved pillars and formats; brand and presenter settings; schedules, budgets and publishing authority; and connected publishing accounts and credentials needed for authorized operations.
• Uploads. Logos, fictional presenter portraits, backgrounds, sponsor logos, illustrations, footage, diagrams, music and other media you upload, together with credits, license information and rights attestations.
• Job settings and run outputs. Job schedules, research results and their sources, verification results, storyboards and scripts, your approve/reject decisions, generated audio and video, captions, post copy, publishing results, quality-check results and the public edition page for each run.
• Campaign and attribution data. Campaign names, offer kinds, target URLs, disclosures, currencies, active dates and terms confirmations; frozen per-run campaign records and attribution links; and aggregate redirect counts for those links. Revenue and refund entries submitted by administrators or signed integrations contain a campaign identifier, optional link identifier, external event identifier, amount, currency and event time. Redirect counts do not identify unique visitors; ordinary request logs may still contain IP addresses and request metadata. Do not submit customer names, emails or other unnecessary personal data in event identifiers or URLs.
• Connected commerce. With administrator authorization, connected Stripe account identifiers and canonical Checkout, payment, charge, refund, attribution and dispute records for bound offers, plus agreed sponsor obligations, deliverable evidence and acceptance. Platform subscription payments are not creator revenue.
• Community interactions. For explicitly enabled accounts, comment/DM text, sender and conversation identifiers, timestamps, related post context, generated or edited drafts, replies, opt-outs, local blocks, consent, delivery outcomes and spending records. Do not use this feature to collect unnecessary sensitive information.
• Performance data. Published-post identifiers, delivery status, reported audience/engagement metrics and observation times, learning objectives and experiment assignments. These support bounded comparisons within your approved strategy, not guaranteed revenue or identification of individual viewers.
• Commercial operations. Demand evidence and permission attestations, opportunity decisions, bounded planning policies and execution records; consented contacts and withdrawal history, checkout-journey associations and linked community interactions; counterparty contacts, scoped approval grants and sponsor renewal records; optional pilot scopes, permissioned research notes and technical-defect claims. Business facts and preferences may also accumulate from optional feedback. Do not upload private customer information merely to start basic content operation.
• Usage and billing data. Credit reservations and consumption per run, plan and subscription status, Stripe customer and subscription identifiers, and invoice and payment events sent to us by Stripe. We do not receive or store full card numbers.
• Audit logs. A record of significant actions in the Service (for example sign-ups, sign-ins, approvals, billing changes, member changes) with the acting user, organization, action and time.
• Security data. IP addresses and request metadata used to throttle sign-up, sign-in, password-reset and contact requests and to detect abuse; server logs of requests and errors.
• Custom production and pilot requests. Your name, email, business, request type and message; optional production volume and platforms; and, for a scoped pilot, the existing offer, channel, goal and acknowledgment of service limits. These are sent to the configured operator inbox and used to respond to your enquiry. Email-provider acceptance is not confirmed inbox delivery or service enrollment.
• Notifications. Selected workspace members and operational outcomes, in-app notices, configured operator email/SMS recipients, message content and provider acceptance or failure records.

3. Why we use it

• To provide the Service: maintain original creator identities and approved knowledge; research, produce, check and publish content; respond to authorized community interactions; host edition pages and campaign redirects; reconcile authorized sales/refunds and sponsor evidence; report bounded performance learning; bill you; and send operational notices.
• To keep the Service secure: authenticate you, throttle abusive traffic, investigate incidents and keep audit records.
• To support private operational learning from evidence, feedback and decisions. Optional cross-workspace statistics contain only coarse editorial-acceptance bands for a declared category and prior full calendar month; they exclude raw PII, contact identifiers, private knowledge and message text. At least five opted-in organizations with four labels each are required, with equal organization weighting and at most 20 labels each. Sparse cohorts are suppressed. Withdrawal suppresses affected releases but cannot recall previous downloads. These are not revenue benchmarks, causal findings or model training.
• To respond to requests, including custom production, optional scoped-pilot enquiries and technical-defect reports. A service enquiry is not permission to market to your audience.
• To meet legal obligations, including tax and accounting records.

Where the GDPR or similar law applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, improvement, business communications), legal obligation, and consent where we ask for it.

For audience contacts that a workspace supplies or collects, the workspace is responsible for the lawful basis, clear purpose and required notices; we process those records to provide its authorized workflow. A public social interaction does not establish permission for unrelated marketing. Contact consent, journey eligibility, opt-outs and limited channel permissions are enforced locally. Exporting eligible contacts transfers data to the administrator for authorized external use; it does not connect an email CRM or confirm that any external campaign was delivered.

4. Processors and other recipients

We use the following providers to run the Service. Each receives only what its function requires.

Publishing platforms you connect (for example YouTube, TikTok, Instagram, Facebook, X, LinkedIn) receive the editions and copy you publish under their own privacy policies. We may also disclose data to professional advisers, to a successor in a merger or sale, or where required by law or to protect rights and safety. Some providers process data in the United States and other countries; where required we rely on standard contractual clauses or equivalent safeguards.

Campaign links redirect to the approved offer destination, whose operator receives the visit and target URL information under its own policy. Administrators and signed integrations may submit recorded outcomes. Separately authorized Stripe Connect reads verify bound one-time payment/refund receipts; explicit attribution consent permits a run-link reference in the checkout URL. The Service does not itself collect the buyer's card payment for these offers.

Permissioned journey links use opaque references rather than putting raw email addresses into checkout URLs. A valid canonical receipt may be associated with a locally consented journey; attributed revenue is not proof of causal influence or profit. Sponsor counterparties using scoped links see only the granted review material, and their review decisions are retained with the scope. Grants are not general workspace access. Raw audience text and contact PII are not published as cross-workspace learning statistics.

5. Public content

Editions you publish and their public edition pages (title, narration, topic explanations, sources, media credits, AI and commercial disclosures, campaign links and links to published posts) are public by design. Do not include personal data in influencer profiles, presets, brand names, media credits or campaign material that you do not intend to publish.

6. Cookies

We use session cookies and short-lived authorization-state cookies for optional account connection and SSO. Security cookies are HttpOnly and use Secure in production and SameSite restrictions appropriate to the flow. Workspace choices and resumable setup drafts also use browser storage; clear browser data on shared devices. We do not use advertising or third-party analytics cookies. Campaign redirect counts do not require a tracking cookie. Legal-page Google Fonts requests remain subject to Google's privacy policy.

7. Retention

• Account and organization data: for as long as the account exists, then deleted within 90 days of account deletion, except as noted below.
• Workspace administrators may export records and files, set 7–3650-day retention for settled terminal-run content, or request local content erasure in Workspace & security. Retention preserves reusable uploads and referenced parent media. Erasure blocks new content work and waits for safe settlement; it removes online content but retains workspace identity, audits, rights attestations, financial and paid-request evidence, publication records and approved commercial/attribution obligations. These exclusions remain subject to the applicable record-retention obligations below. Already-admitted exports may finish; downloaded copies and external posts/accounts/subscriptions are not removed. Backups follow their separate operator-managed retention policy.
• Billing records and audit logs: up to seven years where required for tax, accounting and dispute purposes.
• Security logs and IP addresses used for throttling: up to 90 days.
• Custom production and pilot requests: until the enquiry is closed and for up to two years afterwards for follow-up. Accepted service records and remediation ledger entries follow applicable contractual, audit and financial retention. Audience withdrawals suppress future locally authorized messaging; external providers and downloaded exports have separate retention and deletion processes.

8. Security

We use HTTPS, hashed passwords, expiring tokens, tenant access checks, persistent throttling, restricted administration and audit logs. Optional MFA encrypts authenticator secrets and hashes one-use recovery codes; linked SSO validates trusted identity assertions and preserves organization boundaries. Credentials are retained only as needed for authorized operations. No system is perfectly secure; breach notification follows applicable law.

9. Your rights and requests

Depending on where you live, you may have rights to access, correct, export, restrict or delete personal data, object to processing, and withdraw consent. Administrators can manage membership, download a private workspace export and request scoped local erasure in Workspace & security; billing cancellation remains separate. For account deletion, retained-record requests or other assistance, use the Ultimate Quantum contact page with your account email. We will respond within 30 days. You may also complain to your local data-protection authority.

We do not sell or share personal data for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights.

10. Children

The Service is for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy. For material changes we will notify administrators by email or in the Service at least 14 days before they take effect. The effective date at the top shows the current version.

12. Contact

Ultimate Quantum LLC · ultimatequantum.ai · Contact Ultimate Quantum