Privacy policy

RIPPLA (“RIPPLA”, “we”, “our” or “us”) is a Portugal company offering SaaS services at its social marketing web platform found at rippla.com (the “Platform”). The Platform connects hospitality businesses (hotels, restaurants, bars, cafes, etc.) with social media influencers for barter-based marketing collaborations (“Services”).

Scope of This Policy

RIPPLA respects your privacy and is committed to protecting your personal data. 

This Privacy Policy (“Policy”) describes how we process your personal information when you:

• use Platform as business or influencer (including if you subscribe to use Platform, or if you sign up for a free trial);

• interact with us through our website, email, or other communications;

• apply for a job at RIPPLA;

• are an influencer whose data we obtain from public sources or third-party analytics platforms, whether or not you have registered on Platform;

are contacted by us as a prospective user;

In this Policy, “Personal Data” means any information relating to an identified or identifiable natural person. We may collect and process Personal Data about you in the ways outlined below. Where applicable, we indicate whether and why you must provide us with your Personal Data, as well as the consequences of failing to do so. If you do not provide Personal Data when requested, you may not be able to benefit from our services if that information is necessary to provide you with them or if we are legally required to collect it.

When we say a “business” we mean an establishment that provides lodging, meals, entertainment, and other services. When we say an “influencer” we mean a person who has an established credibility and audience, and who can persuade others by virtue of their trustworthiness and authenticity.

1. Personal Data We Collect

A. Information you provide directly to us

Platform Registration — Businesses

If you register as business, we collect: business name, location details, authorised representative name(s) and contact details, website, your username and email address. 

Platform Registration — Influencers

If you register as influencer, we collect: your name, email address, and the link to your public Instagram account, your username. We may also collect self-reported social profiles and audience details that you choose to provide.

Contact Forms and Communications

When you contact us by email, contact form, phone, social nets chat-bots or other means, we collect: your name, contact details, the company you work for, and the content and metadata (date, time) of our communications.

Job Applications

If you apply for a position, we collect: educational and professional history, certifications, interests and accomplishments, job and salary preferences, CVs, assessments, and references that you choose to provide.

B. Information collected via automated means

Cookies and Similar Technologies. 

We use cookies and similar technologies (“cookies”) to ensure that our website and Platform function properly, to understand how you use them, to improve our products and to assist with marketing campaigns. For more information on our use of cookies, please refer to our cookie policy. 

Usage Data.

We collect information about how you interact with our Platform, including pages visited, features used, actions taken, timestamps, IP addresses, browser type, device information, and referring URLs.

C. Information We Obtain from Third Parties and Public Sources

This section applies to you if you are a social media influencer, whether or not you have registered on our Platform, or if you are a business that initiated contact with us. We may process your personal data even if you have never visited our Platform or created an account.

Social media public profiles data comes from publicly accessible sources (your social media public profiles). Audience aggregated analytics are derived by third-party platforms from analysis of social media public profiles data.

Sources and Categories of Personal Data Collected from These Sources

We collect and process information and contact details from:

• Public Social Media Profiles (e.g., usernames, display names, bio information, public posts, follower/following counts); 

• Third-Party Analytics Platforms (e.g., social media platforms public profiles data collection, contact information extraction, audience aggregated analytics, engagement metrics, credibility scores);

• Business and Location Intelligence Platforms (e.g., professional contact information, publicly listed business information for business prospecting ad outreach services),

If you sign in using Apple or Google account, we receive your name, email address, language preference, and profile picture.

About you (the influencer or the representative of a business that initiated contact with us):

• Name, username; profile bio, location and description; contact information (email address, phone number if publicly available); profile photo and gender; number of followers and following; engagement rate (likes, comments, shares); content type and posting frequency; verification and credibility status.

About the influencer’s audience (aggregated analytics):

• Age ranges (e.g., “18–24: 45%, 25–34: 30%”); gender split; geographic locations (countries and cities); language preferences; interests and affinities; credibility scores (detection of fake and mass followers).

If You Have NOT Created an Account with RIPPLA

We may still process your information as described above if you are a social media influencer with social media public profiles matching our platform criteria. This processing occurs to allow businesses using our Platform to discover and evaluate potential influencers for collaborations.

Even if you have not registered on RIPPLA, you have the same data protection rights as registered users (see Section 7). To exercise your rights contact us at email: privacy@rippla.com  with subject line: "Data Subject Rights Request - Non-Registered Influencer" and provide your Instagram username and proof of identity.

2. How We Use Your Personal Data

A. Providing the Platform

Purpose: Operate, maintain, and provide our Platform: account creation, login, language settings, subscription management.

Data Used: Account registration data (name, email, business details, social media public profiles link), usage data.

Legal Basis: Performance of the contract: Processing is strictly necessary to perform the service you have requested.

B. Provide Matching Service Between Businesses and Influencers

Purpose: Match influencers with businesses based on audience demographics, location, engagement metrics, and business requirements.
Data Used: Influencers: name, email, social accounts, self-reported audience details.
Businesses: name, location, social media public profiles, website, google places data, authorized representative details

Legal Basis: 

Performance of the contract: Processing is strictly necessary to provide our matching service. We cannot connect you with potential collaboration partners without this information. 

C. Analysing Influencer Audience Data to Provide Insights to Businesses

Purpose: Analyse influencer audience demographics, engagement metrics, and credibility to deliver quality matching insights to businesses.

Data Used: Audience demographics (age ranges, gender split, locations), engagement metrics, follower counts, interests, credibility scores — obtained from public Instagram accounts and third-party analytics platforms.

Legal Basis: Legitimate interest in providing quality matching insights. 

You have the right to object to this processing at any time by contacting us at privacy@rippla.com. If you object, we will delete your profile from our database unless we have compelling legitimate grounds that override your interests.

D. Marketing and Promotional Communications

Purpose: Develop and provide promotional materials, events, newsletters, and marketing communications relevant to you.

Data Used: Name, email address, usage patterns, subscription details.

Legal Basis: Legitimate interest in ensuring our marketing is relevant to your interests and in developing our services.

You have an absolute right to object to direct marketing processing at any time. You may write to email: privacy@rippla.com or unsubscribe through the link in our emails.

E. Marketing Data Uploads to Advertising Platforms

Purpose: We upload email addresses of registered users to advertising platforms to: (i) create “look-alike audiences” to find new users similar to existing users; (ii) exclude current users from ads to optimise marketing spend; (iii) target specific businesses through account-based marketing. See Section 4(B) for details.

Data Used: Email addresses.

Legal Basis: Legitimate interest in marketing our Platform to acquire new users and optimise our advertising.

You have an absolute right to object to processing of your personal data for direct marketing purposes. You may write to email: privacy@rippla.com or unsubscribe through the link in our emails.

F. Lead Generation and Outreach to Prospective Users

Purpose: To grow our platform, we proactively identify and contact potential users (businesses and influencers) who may benefit from our services but have not yet registered.

Data Used:

• For prospective businesses: business names, addresses, and publicly listed contact information from Google Maps business listings; email addresses and phone numbers from other publicly available sources.

• For prospective influencers: usernames and contact information from social media public profiles matching our platform criteria.

Legal Basis: Legitimate interest in reaching prospective users.

Your Right to Object
You have right to object using an opt-out mechanism included in every outreach message. You may also contact us at privacy@rippla.com to request removal from our outreach lists. 

G. Social Proof and Testimonials

Purpose: Display customer testimonials, logos, and business names on our website and social media to demonstrate our Platform’s value

Data Displayed: Business names, business logos, photos of business owners or managers (when provided), named testimonial quotes

Legal Basis: Consent - we request explicit written consent (of identifiable individuals) via email or our Platform.

You may withdraw consent at any time by contacting us at privacy@rippla.com. 

H. Support, Communications, and Security

Purpose: Provide technical support and diagnose issues, respond to inquiries and feedback, send administrative communications.

Data Used: Name, email, aggregated usage data, feature interaction patterns, communication content and metadata.

Legal Basis: Legitimate interest for support; Performance of the contract for administrative communications necessary for service delivery.

I. Analytics and Product Development

Purpose: Analyse usage trends and preferences to improve our Platform and develop new products, services, features, and functionalities.

Data Used: Usage data, session information, feature interaction patterns.

Legal Basis: Legitimate interest in improving our services.

J. Security, Fraud Prevention and Legal Compliance

Purpose: Keep our services secure, prevent fraud, comply with legal obligations, enforce our terms, and defend our legal rights. 

Data Used: IP addresses, login attempts, usage patterns, account data, communications, transaction records. 

Legal Basis: Legitimate interest in platform security and administration; Legal obligation where required by law.

K. Recruitment

Purpose: Assess your suitability for employment at RIPPLA.

Data Used: Educational/professional history, certifications, CVs, assessments, references.

Legal Basis: Pre-contractual measures at the applicant’s request; Legitimate interest for maintaining applicant records for future opportunities.

Where we rely on legitimate interest as the legal basis for processing, we have conducted a legitimate interest assessment to evaluate whether our interests are overridden by your rights and freedoms. You may request information about the relevant assessment by contacting us at privacy@rippla.com. 

3. Automated Decision-Making And Profiling

We use automated processing, including profiling, as part of our matching service. This section explains what automated processing we use, how it affects you, and your rights. 

A. What Automated Processing We Use

Matching Algorithm: When businesses search for influencers, our system automatically evaluates whether your profile matches their criteria based on:

• Your location and your audience's location

• Your audience demographics (age ranges, gender percentages)

• Your verification status on  third-party analytics platforms

• Your audience size and engagement metrics

Effect:
If your profile does not match a business's search criteria, you will not appear in their search results for that particular search or you will appear with information that your profile does not meet (fully meet) the criteria set by the business.

Rippla Score: We assign a quality score to each influencer profile based on:

• Influencer’s Profile and Audience authenticity indicators

• Engagement rate patterns

• Demographic data quality

• Content quality

• Historical collaboration performance (if applicable)

Effect: Your Rippla Score affects how prominently you appear in search rankings. Lower scores may result in reduced visibility to businesses.

B. How This Affects You

This automated processing significantly affects your professional opportunities on our Platform because it determines which businesses can discover your profile. It also influences your ranking in search results and impacts the volume of collaboration requests you may receive. These decisions can affect your ability to generate income through collaborations facilitated by our Platform.

C. Legal Basis and Your Rights

Legal Basis for Matching Algorithm: Performance of the contract, because this automated processing is necessary to provide our matching service to you. We cannot efficiently connect thousands of influencers with businesses without automated evaluation of match criteria.

Legal Basis for Rippla Score: Explicit consent: we obtain your explicit consent by checking the box during registration. You may withdraw this consent at any time by contacting us at privacy@rippla.com. It means that your profile will not receive a score and may have reduced visibility, but the basic matching service continues.

D. Your Rights Under Article 22 GDPR

Regardless of which legal basis applies, you have the right to: obtain human review of any automated decision affecting you; express your point of view about the decision and contest the decision and request reconsideration. If you believe an automated decision has unfairly affected you, you can request human review by email: privacy@rippla.com with a subject line: "Request for Human Review".

We will respond within one month of receiving your request with: confirmation of the decision made, explanation of factors considered, opportunity for you to provide additional context, human review of your case by DPO, and final determination.

E. Meaningful Information About the Logic

Under GDPR we provide meaningful information about the logic involved in our automated decision-making. Here's how our systems work:

Basic Matching Algorithm:

Our system evaluates your profile against business search criteria using the factors listed in Section 3(A) (location, audience demographics, verification status, audience size and engagement). Profiles meeting the criteria appear in results; partial matches may appear with an indicator; non-matching profiles are excluded from that search.

Rippla Score Algorithm 

The system generates a composite score (0–100) based on the factors listed in Section 3(A). Higher scores result in greater visibility in search rankings.

4. How We Share Your Personal Data

A. Service Providers (Processors)

We share your personal data with the following third-party service providers who process data on our behalf for:

• Infrastructure & Hosting

• Payments & Billing

• Marketing and Communications

• Data Analytics and Enrichment

• AI Process Automation

• Content Management

These service providers are contractually obligated to process your data only on our instructions and to protect it in accordance with GDPR requirements. For a complete list of our current service providers, including their names and locations, please contact us at privacy@rippla.com. 

B. Legal Requirements

We may disclose your personal data where required or permitted by applicable law, including to comply with legal obligations, respond to lawful requests from public authorities, or protect our rights, safety, or property.

C. Business Transfers

We may disclose or transfer personal data to an acquirer, investor, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of insolvency or bankruptcy, or receivership where information is transferred as one of our business assets.

D. With Your Consent

We may also share your personal data with your specific consent for purposes not otherwise described in this Policy.

5. International Data Transfers

Some of our service providers and joint controllers are located outside the European Economic Area (EEA). We transfer your personal data to the following countries:

United States. These transfers are protected by the EU-US Data Privacy Framework, an adequacy decision adopted by the European Commission on July 10, 2023 (Commission Implementing Decision (EU) 2023/1795). 

UAE. Transfers to the UAE are protected by Standard Contractual Clauses (SCCs) that are approved by the EU Commission. These clauses serve as appropriate safeguards for protecting your data during and after transmission.

For information about the specific service providers involved in international transfers and the applicable safeguards, please contact us at privacy@rippla.com.You may also request copies of the relevant transfer instruments, including Standard Contractual Clauses where applicable.

6. Your Rights And How To Exercise Them

A. Right of Access

You can request a copy of all personal data we hold about you, including what data we process, why, who we share it with, how long we keep it, and where it came from (if not collected directly from you).

B. Right to Rectification

You can request correction of inaccurate or incomplete personal data.

C. Right to Erasure / “Right to Be Forgotten”

You can request deletion of your personal data when it is no longer necessary, you withdraw consent (where consent is the legal basis), you successfully object to processing, or we processed it unlawfully. We may refuse deletion where we need the data to comply with legal obligations (e.g., 10-year invoicing retention), to establish, exercise, or defend legal claims, or where we have compelling legitimate grounds.

If we erase your account data, your account will be permanently closed. We will notify relevant recipients to delete your data in accordance with our retention policy.

D. Right to Restriction of Processing

You can request that we temporarily stop processing your data (but not delete it) when: you contest data accuracy, processing is unlawful but you prefer restriction over deletion, we no longer need the data but you need it for legal claims, or you have objected to processing pending the balancing test.

E. Right to Data Portability

You can receive your personal data in a portable format and transmit it to another service.
Applies only to data you provided to us and processed based on consent or contract (not legitimate interest).

F. Right to Object 

You can object to processing based on legitimate interest or for scientific/historical research. For non-marketing processing based on legitimate interest (e.g., audience analytics), you can object but we may continue processing if we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

G. Right to Withdraw Consent

If we process your data based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

H. Rights Related to Automated Decisions

See Section 3 for detailed information about automated decision-making and your right to human review, to express your point of view, and to contest automated decisions.

I. Right to Lodge a Complaint 

You can lodge a complaint with a data protection authority if you believe we have violated GDPR. Portuguese Data Protection Authority (CNPD - Comissão Nacional de Proteção de Dados), website. You may also complain to the DPA in your country of residence or workplace. We would appreciate the opportunity to address your concerns first, so please consider contacting us at privacy@rippla.com. 

J. General Information on Exercising Rights

Identity Verification: To protect your privacy, we may ask for proof of identity (government-issued ID) before processing rights requests. If a third party exercises one of these rights on your behalf, we may need to ask for proof that they’ve been authorised to act on your behalf.

Free of Charge: We do not charge fees for rights requests unless they are manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse the request, with explanation).

Response Timeframe: We will respond to all rights requests within one month of receiving your request. For complex requests, we may extend this to three months (we will notify you within the first month if this is necessary).

 7. Data Retention

We retain your personal data only for as long as necessary for the purposes for which we collected it and in line with applicable laws. Below are our specific retention periods:

Account Data

Active accounts are retained for duration of active use. Closed accounts are deleted 3 years after account closure.

Billing, Payment and Tax reporting Data

10 years.

Backups

Active accounts: Backups retained for duration of active use. Closed accounts: Backups deleted 3 years after account closure

Scraped Influencer and Audience Data

Influencers who register: Converted to account data retention (above). Influencers who do NOT register: Deleted 12 months after initial collection, OR immediately upon objection.

Marketing Data Uploads (Ad Platforms)

Uploaded emails until you opt out, or when we refresh our audience lists (typically quarterly), or if you delete your RIPPLA account (deleted within one month).

Cold Outreach Contact Lists

Prospective users who do NOT register deleted 12 months after last outreach attempt, OR immediately upon opt-out request. Prospective users who DO register converted to account data retention

Social Proof / Testimonials

Retained for duration of consent, deleted within one month of consent withdrawal.

Analytics Data

For up to 36 months

Communications (Support, Inquiries)

Support emails and chat logs are retained for 3 years after last interaction

Recruitment Data

Unsuccessful applicants: deleted 12 months after application. Successful applicants: converted to employee records.

General Criteria:

For any processing not listed above, we retain data only as long as necessary for its purpose or as required by law. You may request early deletion (see Section 6), unless we have a legal obligation or legitimate grounds to retain it.

8. Third Parties

Our Platform may link to third-party websites or services. This Policy does not cover those services, and we encourage you to review their privacy policies.

9. Security

We make reasonable efforts to protect your Personal Data by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we cannot guarantee absolute security.

10. Children’s Privacy

We do not knowingly collect, maintain, or use Personal Data from children under 13 years of age, and no part of our Platform is directed to children. If you learn that a child has provided us with Personal Data in violation of this Policy, then you may alert us by contacting us using the contact details at the end of this Policy.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our privacy practices, legal requirements, or operational needs. If we make material changes, we will notify you by:

• Posting the updated Policy on our website with the revised “Effective Date” at the top

• Sending an email notification to registered users at the email address associated with your account

We encourage you to review this Policy periodically.

12. Contact Us

RIPPLA acts as the data controller for the Personal Data we process through our Platform.

If you have any questions about this Privacy Policy, about how we process your personal data, or if you wish to exercise your data protection rights, you can contact us at:

Data Controller: RIPPLA, Rua dos Murças, n.º 15, 2.º Andar, Sala H, Funchal, Madeira, Portugal

For all rights requests and general queries: privacy@rippla.com DPO Alexandra Lisina.

Supervisory Authority:

Comissão Nacional de Proteção de Dados (CNPD), website.