Privacy Policy

Last updated: June 5, 2026

This Privacy Policy explains what information Above Average Agency collects, how we use and share it, and the choices you have.

1. Who we are and what this covers

This policy is provided by Kota LLC, an Alabama limited liability company doing business as "Above Average Agency" ("Above Average," "we," "us," or "our"). It covers our website, our creator application form, our brand waitlist application, our creator onboarding portal, and the deal-management services we provide to creators we represent (together, the "Services").

2. Information we collect

2.1 Information creators and applicants provide

When you apply or onboard, you give us information such as your name, email address, phone number, social-media handles (for example TikTok and Instagram), primary platform, follower counts, content style and notes, sales figures including gross merchandise value ("GMV") for the last 30 days and lifetime, TikTok Shop categories, how many videos you can post per month, portfolio links, and your general location. Later in the relationship we may collect payment and payout details needed to pay you.

2.2 Information about brands

Brands can apply to our waitlist directly through the Site, in which case we collect the information provided on the form — for example company name, work email, phone number, and website. Separately, when a brand contacts a creator's managed inbox, we process information about that brand and its representatives — for example company name, contact name, email, phone number, social-media handles, website, industry and product type, budget range, proposed deal terms, and the content of their messages.

2.3 Email content (Gmail)

With a creator's explicit authorization through Google, we connect to a designated Gmail inbox to read brand-related messages and help manage deals. We do not send email from a connected inbox without the creator's team approving the message first. When you connect Gmail, Google shows you the specific permissions ("scopes") we request; we request only the scopes needed to read brand-related mail and to manage those communications, and we use that access only to provide the Services. See Section 6 for our Google API Limited Use commitments.

2.4 Information collected automatically

Our servers log basic technical information such as your IP address, browser and device type, the pages you request, and timestamps. The portal uses a single essential cookie, lockd_session, to keep you signed in. We do not use third-party analytics, advertising, or tracking cookies. Our pages load the "Inter" web font from a third-party content-delivery network (rsms.me); that provider receives your IP address as part of delivering the font.

2.5 Communications

We send operational alerts to our team using Telegram, and we send transactional emails (such as onboarding invitations and password resets) using an email-delivery provider (Resend, or SMTP as a fallback).

3. How we use information

• To provide, operate, and maintain the Services;
• To source, negotiate, and manage brand deals on a represented creator's behalf;
• To communicate with you, including service messages and the application and onboarding process;
• To detect, investigate, and prevent fraud, scams, and abuse — including assessing the risk level of brands and handling suspected scams;
• To maintain the security and integrity of the Services;
• To comply with legal obligations and enforce our terms; and
• To analyze and improve the Services.

4. Automated processing and AI

We use Anthropic's Claude API to help draft negotiation responses and to classify inbound messages. To do this, message content and related deal context are sent to Anthropic. A person on the Above Average team reviews and approves every AI-drafted message before it is sent — nothing is sent automatically. Anthropic processes this data as our service provider under its commercial terms; under those terms, API inputs and outputs are not used to train Anthropic's models.

5. How we share information

• Service providers / subprocessors. We share information with vendors who help us run the Services, each only to the extent needed: Anthropic (AI drafting and classification), Google / Gmail (inbox access under the creator's authorization), Telegram (operational alerts), our email-delivery provider (transactional email), Railway (hosting), and our database provider.
• With brands during a deal. We share only the information needed to negotiate and execute a deal. We do not share a creator's personal information (such as legal name or contact details) with a brand until the deal has been approved.
• Legal and safety. We may disclose information to comply with law, legal process, or lawful requests; to enforce our agreements; or to protect the rights, safety, and property of Above Average, our creators, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your consent. We share information in other ways with your consent or at your direction.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising.

6. Google API Services — Limited Use disclosure

Above Average's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We request only the Gmail scopes needed to read and manage brand-related email on the creator's behalf.
• We use Google user data only to provide and improve those user-facing features.
• We do not use Google user data for advertising.
• We do not transfer Google user data to others except as necessary to provide or improve the Services, with the creator's consent, for security purposes, or to comply with applicable law.
• We do not allow humans to read Gmail data unless: the creator gives consent (for example, during support or onboarding the creator initiates), it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymized.

A creator can revoke our access at any time (see Section 9).

7. Data retention

We keep deal records and creator and brand profile information for as long as the relationship is active and for as long as needed for legitimate business, legal, accounting, and dispute-resolution purposes. Revoking Gmail authorization stops further collection from that inbox. We delete or anonymize information when it is no longer needed, subject to any legal hold. You can ask us to delete information we hold about you (see Section 9).

8. Security

We take reasonable measures to protect information. Gmail OAuth credentials are encrypted at rest, access to deal and inbox data is limited to people who need it, and data is transmitted over encrypted connections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights and choices

• Access, correction, deletion. You can ask us to access, correct, or delete personal information we hold about you by emailing the address in Section 13.
• Revoke Gmail access. You can disconnect a connected Gmail inbox at any time through your Google Account's third-party access settings, or by contacting us; this stops further access to that inbox.
• Communications. You can opt out of non-essential communications.

9.1 California residents (CCPA / CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect about you and the purposes for collecting it; to delete personal information; to correct inaccurate personal information; to opt out of the "sale" or "sharing" of personal information (we do neither); and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. To exercise a right, email the address in Section 13; we will verify your request, and you may use an authorized agent. The categories of personal information we collect are described in Section 2; we collect them for the purposes in Section 3 and share them with the categories of recipients in Section 5.

9.2 EEA / UK residents (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, our legal bases for processing are: performance of a contract (providing the Services); our legitimate interests (operating, securing, and improving the Services and preventing fraud); your consent (for example, connecting a Gmail inbox); and compliance with legal obligations. You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority. Note that we are based in the United States and process data there.

10. Children

The Site and Services are not directed to anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us and we will delete it.

11. International users

We are based in the United States and process information there. By using the Site or Services, you understand that your information will be processed in the United States, which may have different data-protection laws than your country.

12. Third-party links

The Site may link to third-party websites and services. We are not responsible for their privacy practices, and this policy does not apply to them.

13. Changes and contact

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date, and for material changes we will provide reasonable notice. For privacy questions or to exercise a right, contact:

Kota LLC d/b/a Above Average Agency
Email: kotamota569@gmail.com