Privacy Policy

1. Introduction

With Lore, Inc. ("Lore," "we," "us," or "our") operates a travel marketplace that connects content creators, travelers, and experience operators. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have.

By using the Lore platform and services (the "Services"), you agree to the collection, use, and disclosure of personal information as described in this policy. If you do not agree, please do not use the Services.

We never sell your personal information.

2. Information We Collect

2.1 Account Information

When you create a Creator account, we collect your email address, password, display name, and a public profile slug. You may optionally provide a bio and social media handles. Operator accounts may include business name, contact information, and experience listing details.

2.2 Connected Social Accounts

When you connect a social media account (YouTube, TikTok, or Instagram), we receive an OAuth access token and basic profile information (such as channel or account name and ID) from that platform. We use these solely to fetch your public video library so you can link videos to travel experiences on Lore.

We do not store raw video files. We store only video metadata: title, platform video ID, view count, and destination tags.

Access tokens are encrypted at rest using AES-256-GCM encryption. Disconnecting a social account immediately and permanently deletes the stored token.

2.3 Platform-Specific Scopes

• YouTube: We request read-only access to your public video library and channel information via YouTube API Services. We filter for public videos only and retrieve real view counts. We do not access private videos, comments, or subscribers lists.
• TikTok: We request the user.info.basic and video.list scopes. We read your public video list and display name only. We never post, comment, like, or take any write action on your TikTok account.
• Instagram: We request access to your media library for VIDEO and REEL content types from Business or Creator accounts only. We do not access your direct messages, stories, or follower data.

2.4 Usage and Analytics Data

We collect standard request data including IP addresses, browser/device type, pages visited, and timestamps for security monitoring, debugging, and platform improvement. We also track link click counts and booking referrals to calculate Creator earnings.

2.5 Traveler Interactions

Travelers browsing Lore without an account are anonymous. Features such as saving collections or following Creators are currently stored in your browser's local storage only and are not transmitted to our servers.

2.6 Payment Information

If we integrate payment processing in the future, payment card details will be collected and processed directly by our third-party payment processor. We will not store payment card numbers on our servers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To operate, display, and improve your Creator or Operator profile and linked experiences
• To track bookings and calculate commissions
• To authenticate your account and maintain security
• To send transactional communications (account creation, password resets, payment notifications)
• To detect and prevent fraud, abuse, and platform manipulation
• To debug technical issues and improve the Services
• To comply with legal obligations and law enforcement requests

We do not use your data to train AI or machine learning models. We do not sell your data to advertisers or share it with third parties for their own marketing purposes.

4. How We Share Your Information

We share your personal information only with the following categories of recipients:

• Infrastructure providers: Supabase (database and authentication) and Vercel (hosting and application delivery) process your data as part of operating the Services.
• Operators: When a booking is made through a Creator link, the Operator receives the booking details needed to fulfill the experience. Operators do not receive your social media credentials or access tokens.
• Payment processors: If and when payment processing is integrated, your payment information will be handled by PCI-DSS compliant third-party processors.
• Law enforcement: We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe disclosure is necessary to protect the rights, safety, or property of Lore, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

5. Social Platform Data

Data we receive from connected social platforms is subject to both this Privacy Policy and the respective platform's terms:

• We use social platform data solely to display your content within Lore and link it to bookable travel experiences.
• Access tokens are encrypted at rest and stored only as long as your connection is active. Disconnecting deletes the token immediately.
• We do not share data from one connected platform with another connected platform.

YouTube API Services

Our use of YouTube data is subject to the YouTube Terms of Service and the Google Privacy Policy. Our use of YouTube API data adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Only use YouTube data to provide and improve the Services
• Do not transfer YouTube data to third parties except as necessary to provide the Services, as required by law, or in connection with a merger or acquisition with notice to users
• Do not use YouTube data for advertising or sell it to any party
• Do not allow anyone other than intended recipients to read YouTube data, except with your consent, for security purposes, to comply with law, or for aggregated/anonymized internal operations

You can revoke Lore's access to your YouTube data at any time through your Google Security Settings.

TikTok Data

Our use of TikTok data complies with the TikTok Developer Terms of Service. We request only the minimum scopes needed and do not share TikTok user data with other platforms or third parties.

6. Cookies and Tracking

We use a minimal set of cookies, limited to what is necessary to operate the platform:

We do not use advertising cookies, third-party trackers, analytics pixels, or behavioral targeting cookies. We do not participate in cross-context behavioral advertising.

7. Data Retention

We retain your account data for as long as your account is active. If you close your account, we will delete your personal information within 30 days, except for records we are required to retain for legal, financial, or compliance purposes (such as commission payout history, which may be retained for up to 7 years).

8. Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• AES-256-GCM encryption for all stored OAuth access tokens
• HTTPS encryption for all data in transit
• Row-level security policies in our database (Supabase) to restrict data access
• Server-side session validation for all authenticated requests (we do not trust cookies alone)
• PKCE (Proof Key for Code Exchange) protection for all OAuth flows

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@golore.co.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information, subject to legal retention requirements
• Portability: Request a copy of your data in a portable, machine-readable format
• Disconnection: Disconnect any linked social account at any time from your account settings, which immediately deletes the stored token
• Objection: Object to our processing of your personal information for certain purposes
• Withdraw consent: Where processing is based on your consent, withdraw that consent at any time

To exercise any of these rights, email privacy@golore.co. We will respond within 30 days and may request identity verification before processing your request. We will not discriminate against you for exercising your privacy rights.

10. California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights. Specifically:

• We do not sell your personal information, as defined by the CCPA
• We do not share your personal information for cross-context behavioral advertising
• We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Services
• You have the right to know what personal information we collect, request deletion, and opt out of any future sale or sharing

To exercise your CCPA rights, contact us at privacy@golore.co.

11. Children's Privacy

The Services are not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@golore.co and we will take commercially reasonable steps to delete it promptly.

12. International Users

Lore is based in the United States. If you access the Services from outside the United States, you understand and consent to the transfer, processing, and storage of your personal information in the United States, where data protection laws may differ from those of your country of residence. We take appropriate measures to ensure international transfers comply with applicable law.

13. Do Not Track Signals

Because we do not use third-party tracking cookies or engage in cross-context behavioral advertising, our Services respond consistently regardless of your browser's "Do Not Track" setting.

14. Third-Party Links

The Services may contain links to third-party websites, including Operator booking pages and social media platforms. These sites operate independently and have their own privacy policies. We are not responsible for their content, practices, or privacy policies. We encourage you to review the privacy policy of any third-party site you visit.

15. Changes to This Policy

We may update this Privacy Policy as the platform evolves. When we make changes, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or through an in-app notice before the changes take effect.

16. Contact Us

If you have questions about this Privacy Policy, your personal information, or wish to exercise any of your privacy rights, contact us at: