🚧 DRAFT — PENDING LAWYER REVIEW. Not legal advice. Last updated: 2026-05-10.
KOL Look Up (“we”, “us”, “our”) provides a SaaS platform that produces brand-safety risk reports on Key Opinion Leaders (KOLs) using public digital footprint data. This Privacy Policy explains what data we collect, why, how we store it, and your rights.
This draft is written to comply with Taiwan Personal Data Protection Act (個人資料保護法 / PDPA), Mainland China Personal Information Protection Law (PIPL), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA / CPRA) at the visitor-data layer. A licensed attorney in Taiwan and Mainland China will review this document before paying-customer launch.
KOL Look Up is operated by [Legal Entity — TBD at Phase 2 GO]. Operating jurisdiction will be locked at the Phase 2 → 3 gate (current candidates: Taiwan, Hong Kong, Singapore).
Contact: privacy@kollookup.com (placeholder).
We treat visitors/customers and KOLs under different lawful bases.
People who land on our website, sign up, submit a lead form, book an interview, or pay for a report.
We collect, with your consent (account creation) or based on contractual necessity (delivering a paid report):
People our customers ask us to produce a risk report about. KOLs do not sign up. We rely on legitimate interest as the lawful basis for processing their public information for the purpose of brand-safety analysis (analogous to journalism, due diligence, and background-check use cases).
For V0.1 we restrict ourselves to:
We do not, in V0.1:
| Subject | Purpose | Lawful Basis (PDPA / PIPL / GDPR / CCPA) |
|---|---|---|
| Visitors | Account creation, communications | Consent + contract (Art. 6(1)(a)/(b) GDPR; PDPA §19/20; PIPL §13(1)(2)) |
| Paying customers | Service delivery, billing, support | Contract (Art. 6(1)(b) GDPR) |
| Visitors | Anti-fraud, security | Legitimate interest (Art. 6(1)(f) GDPR) |
| KOLs | Brand-safety analysis on publicly available data | Legitimate interest (Art. 6(1)(f) GDPR; PDPA §19 specific-purpose; PIPL §13(1)(6) “publicly disclosed”) |
| Visitors / KOLs | Legal compliance (subpoena, takedown response) | Legal obligation (Art. 6(1)(c) GDPR) |
We perform a documented Legitimate Interest Assessment (LIA) for the KOL processing layer and re-review it at every phase gate.
| Data | Retention |
|---|---|
| Visitor account data | 24 months from last login, then anonymized or deleted |
| Lead form submissions (no account) | 12 months |
| Paid-report metadata (customer) | 24 months from delivery |
| KOL scan raw data | 90 days from scan completion, then auto-purged |
| Generated reports | 90 days in customer dashboard, then archived for the customer’s records only (not used to train future scans) |
| Audit logs (legal compliance) | 5 years (Taiwan tax + commercial-record requirements) |
| Stripe payment records | per Stripe retention policy + 7 years (TW tax law) |
After 90 days, KOL scan raw data is hard-deleted from primary storage and from backups within 60 additional days (backup-rotation cycle).
Even though KOLs are not our customers, we recognize their rights as data subjects under PDPA, PIPL, GDPR, and CCPA.
A KOL (or their authorized representative) can:
How:
/kol-takedown (live at landing page launch).takedown@kollookup.com.We will purge reports unless a paying buyer has already legitimately purchased and downloaded the report — in which case the report leaves our active systems but the customer’s local copy is outside our control. We notify the KOL of this status and add the KOL to a do-not-scan list going forward.
We do not run third-party advertising trackers.
We share visitor / customer data only with:
We have or will have a Data Processing Agreement (DPA) with each processor. We do not sell personal data.
Operating from Asia, we may transfer data across:
This service is not for users under 18, and we do not knowingly produce reports about KOLs who are minors (under 18 in any operating jurisdiction). All visitor accounts must affirm 18+ at signup. KOL handles flagged as belonging to minors are blocked from scanning.
Every report scan logs: source URLs, timestamp of fetch, AI model + version used, reviewer ID (FND in V0.1), and decision rationale. This audit trail is retained for 5 years for legal-compliance reasons and is available to legitimate data-subject access requests.
Subject to local law, you have the right to:
Email privacy@kollookup.com to exercise any of these. We respond within 30 days (GDPR / PDPA standard).
We will post material changes 30 days before they take effect. Continued use after the effective date constitutes acceptance.
🚧 This draft has not been reviewed by legal counsel. It is a Phase 0 placeholder authored by PM-A based on the spec in Development Plan v3 §14. A licensed attorney in Taiwan (PDPA + 個資法), Mainland China (PIPL), and an EU/UK practitioner (GDPR) will review and rewrite as needed before Phase 4 commercial launch.