Privacy Policy

1. Who we are

CM Media is a trading name operated by Arshad Patel, a sole trader based in the United Kingdom. Arshad Patel is the data controller responsible for personal data collected through this website, creator outreach, and the free audience audit process.

• Name: Arshad Patel, trading as CM Media
• Email: ash@cmmedia.io
• Address: 124 City Road, London, EC1V 2NX
• Website: cmmedia.io
• ICO Registration Number: ZC215074

CM Media has not yet been incorporated as a limited company. All references to CM Media in this policy refer to Arshad Patel, the sole trader operating under that name.

2. What data we collect

Information collected through creator outreach

Before contacting a creator, CM Media reviews publicly available Instagram profile information — including follower count, niche, content, and engagement levels — to assess whether a creator may be a suitable fit for the free audience audit. This initial review is based on our legitimate interest in identifying suitable creator partners. If we contact you and you do not wish to be contacted again, you can tell us at any time and we will stop.

Information collected through the free audience audit

When a creator submits their details through the free audience audit form on the website, the following information is collected:

• Email address — to respond to the audit request and communicate next steps.
• Instagram handle — to review the creator's profile, audience size, content positioning, and engagement as part of the audit.

Additional information may be collected if a creator chooses to share it voluntarily through follow-up correspondence — for example, niche details, follower count, current monetisation activity, or context about their audience and goals.

Information collected when entering a partnership — If a creator and CM Media agree to work together, additional information is collected to prepare and sign the partnership agreement, including full legal name, identity or registration number, and address. This information is used solely for contract administration and legal compliance.

No payment information or sensitive personal data is knowingly collected. The free audience audit and any resulting partnership are available only to individuals aged 18 or over.

Cookies

This site uses cookies for analytics purposes via Google Analytics, to help us understand site traffic and visitor behaviour. Non-essential cookies (including analytics cookies) are only set after you provide consent through the cookie banner shown on your first visit. You can withdraw or change your consent at any time via your cookie preferences.

Children's privacy — This website is not intended for use by anyone under the age of 18. CM Media does not knowingly collect personal data from individuals under 18. If you believe we hold data about a minor, please contact ash@cmmedia.io and we will delete it promptly.

3. Lawful basis and how we use your data

CM Media processes personal data on the following lawful bases:

• Legitimate interests — for reviewing publicly available creator profiles ahead of outreach, and for following up with creators who have submitted an audit request.
• Consent — for submissions made through the free audience audit form, and for any non-essential cookies set via the cookie banner.

Personal data submitted through the audit form is used to produce and deliver the audience audit; respond to enquiries; and, where relevant, discuss a potential partnership. Where consent is relied on, this will be made clear at the point of collection.

4. How data is stored

Application data submitted through the CM Media website is stored using Supabase, a cloud infrastructure provider that applies industry-standard encryption and security measures.

Access to creator data is limited to Arshad Patel, and to any trusted service providers acting on his behalf. No broad or unnecessary access to personal data is permitted.

Reasonable technical and organisational measures are in place to protect personal information against unauthorised access, disclosure, alteration, or loss. No system is entirely without risk, but the responsibility to protect creator data is taken seriously.

In the event of a data breach that poses a high risk to your rights and freedoms, affected individuals will be notified without undue delay, in addition to any required notification to the Information Commissioner's Office (ICO).

5. Who data is shared with

Personal data is not sold to third parties under any circumstances.

A small number of trusted third-party tools are used to operate CM Media. These providers may process personal data as data processors, and appropriate data protection standards are required of them. These tools currently include:

• Website and form infrastructure — the website is built and hosted using Lovable, which processes form submissions. Lovable uses Supabase as a sub-processor to provide backend data storage as part of its “Lovable Cloud” service.
• Email communication tools — 123 Reg email hosting (powered by Titan Email) is used to respond to audit submissions and manage creator correspondence.
• Website analytics — Google Analytics is used to understand site traffic and visitor behaviour, with analytics cookies only set following your consent via the cookie banner.
• Payment and revenue platform — Whop (whop.com) is used to process product sales and manage revenue-share payouts for creator partnerships. CM Media accesses aggregate revenue and payout figures for verification purposes only, and does not collect or store individual customer payment details.
• Contract execution — Adobe Sign is used to prepare and execute creator partnership agreements electronically. It processes the legal names, addresses, and signatures of both parties to a signed agreement.
• CRM and pipeline management — Flozy is used to manage creator prospect data, outreach history, and partnership pipeline. It stores publicly sourced creator information and outreach notes used in the partnership development process.

Personal data is not shared with advertising networks, data brokers, or any party for the purpose of targeted advertising or resale.

6. How long we keep data

Personal data is retained only for as long as necessary for the purposes described in this policy.

• Outreach data — where a creator is identified for outreach but does not respond or engage, publicly reviewed profile information is not retained beyond a reasonable initial contact period.
• Audit submissions — retained for up to 12 months from the date of submission, to allow for follow-up conversations and to keep a record of past applications.
• Active creator partnerships — retained for the duration of the working relationship and for a reasonable period thereafter for record-keeping purposes.
• Creators not accepted immediately — contact details may be retained for up to 12 months in case a creator becomes a strong fit at a later stage.

Change of purpose — Personal data will only be used for the purposes for which it was originally collected. If CM Media ever needs to use data for a materially different purpose, the individual concerned will be notified and, where required, their consent will be sought.

After the relevant retention period, personal data is deleted or anonymised. If you would like your data deleted sooner, you can request this at any time by contacting ash@cmmedia.io.

7. Your rights

If you are based in the United Kingdom, you have the following rights under the UK GDPR and the Data Protection Act 2018:

• Right of access — you can request a copy of the personal data held about you.
• Right to rectification — you can ask for inaccurate or incomplete information to be corrected.
• Right to erasure — you can request deletion of your personal data, subject to any legal obligations to retain it.
• Right to restrict processing — you can ask for processing to be paused in certain circumstances.
• Right to object — you can object to the use of your data where legitimate interests is the legal basis, including outreach or marketing contact.
• Right to withdraw consent — where consent is relied on, you can withdraw it at any time.

You can also ask us to stop contacting you for outreach or marketing purposes at any time, without needing to request full deletion of your data.

These rights are described under UK data protection law, as CM Media is based in the United Kingdom. If you are based outside the UK, we extend the same rights to you as a matter of practice, and you may also have additional rights under the data protection laws of your own country, which we will respect where applicable.

To exercise any of these rights, contact ash@cmmedia.io.

8. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes in our practices, tools, or legal obligations. The date at the top of this page will be updated when changes are made. Continued use of the website following any update constitutes acknowledgement of the revised policy. Where changes affect how we process your personal data in a material way, we will take steps to notify you directly.

9. Third-party websites and services

This Privacy Policy applies only to cmmedia.io and CM Media's own processes. Links to third-party websites or platforms (including Whop) are provided for convenience only. CM Media is not responsible for the privacy practices of those sites, and your interactions with them are governed by their own privacy policies.