Creator Pass · Season 01
Privacy policy
1. Who we are
Creator Pass is run by NewGen ([legal entity name], [registered address], "NewGen", "we"). NewGen is the data controller for the personal data described here. You can reach us about privacy at [privacy contact address] or through your NewGen contact.
2. What this policy covers
The Creator Pass programme: the Creator Portal where you apply and manage your account, the verification of gameplay from your public live streams, and the collection of your own public posts for social challenges. It applies to creators who apply to or take part in the programme. It is not about visitors to NewGen's other sites.
3. What we collect, why, and on what basis
3.1 Your account and application
Your email address and a password (you register with a link we email you and then set a password; Supabase Auth stores it as a hash and we never see it), your creator name, country, primary platform, content focus, the language you play the game in, the public handles of the channels and accounts you declare, your Activision ID (your in-game name and its number), the clan tag you wear in game, and the version and time of the terms you accepted. We use these to run the programme, to know where to look for your streams and posts, to confirm it is you on the scoreboard, and to contact you. Basis: performing our agreement with you, and the steps you ask us to take before it.
3.2 Gameplay from your public streams
When a channel you declared on Twitch, Kick or YouTube is live in the game's category, our service reads the public stream the same way a viewer would see it, one frame a second, and works out what happened in each match from the on-screen display: kills, deaths, score, medals, mode, result, and the end-of-match scoreboard. We store those match statistics, the image of the end-of-match scoreboard, small gameplay thumbnails, the log of what was read and when, and the automated review of each match. We never store the video. Frames are read in memory and discarded. We use this to verify challenges and settle rewards. Basis: performing our agreement with you.
3.3 Other players on the scoreboard
An end-of-match scoreboard lists everyone in the match, usually twelve players, and only one of them is you. We store the other players' in-game names and statistics as they appear on that scoreboard, because the team totals are how we check that your own figures were read correctly. We do not contact those players, do not build profiles of them, and do not use their data for anything else. Basis: [our legitimate interest in verifying your results accurately, subject to a balancing test to be documented by legal]. A player who wants their row or the scoreboard image removed can ask us (section 8).
3.4 Your public posts
For the Instagram, TikTok and Facebook accounts you declare, once a day we collect your most recent public posts and their public counts (views, likes, number of comments, shares) so that social challenges can be measured. This is done through Bright Data, a processor acting on our instructions, by reading what is publicly visible without signing in. We never collect the text of comments, never collect anyone else's posts, and anything that is not from an account you declared is discarded unstored. Basis: performing our agreement with you.
3.5 Whether you are live, and your profile picture
Every 30 seconds we ask Twitch, Kick and YouTube whether each declared channel is live, with its title, category, start time and viewer count, so a read can start when you go live. Once a day we fetch the public profile picture address of your Twitch and Kick channels to show your picture in the portal and to our team. All of this is public information about a public channel.
3.6 Connected accounts
If you choose to connect a platform account (today, Twitch), we hold an access token for it, encrypted, with no permissions beyond confirming the account is yours. It is deleted the moment you disconnect, and it is never shown to anyone, including you.
3.7 Verification records
Every match is reviewed by an automated model and then decided by a member of the NewGen team, who may approve it, correct a value by reading it off the scoreboard image, or reject it with a note. Those decisions, the person who made them and the time are kept as the record of how a reward was settled.
3.8 Your Pass XP and the leaderboard
Your Pass XP is the sum of the points of the challenges verified for you (by the system's checks, or by the NewGen team where a check could not decide); it is worked out from those decisions each time a page shows it, and nothing more is stored. When the standings are open, other creators in the programme see your display name, your country and your XP beside theirs, and nothing else about you; you see your own place, the size of the field and the XP at the 50th place, for the week and for the season. The standings are off until NewGen opens them for the season. Prizes are decided from those standings by the team outside the system; nothing is claimed or spent in the portal.
If you send us a link to a recording or a post from your hub, we keep the link, when you sent it and what the team decided. We check the link's shape when you send it and do not open it from the portal; a recording the team queues is read exactly as described in section 3.2.
3.9 Emails we send you
We email you the decision on your application, and, while you are in the programme, enrolments, challenge outcomes and the occasional note from the team. Those programme emails stop the moment you ask, from your account page or the link in any of them; the decision on your application and your sign-in links are your account and always come. We keep a record of each message sent (who, what kind, when, and the note a team member wrote for you), not its body.
3.10 Cookies and logs
The portal sets one cookie, the signed session that keeps you signed in. We use no advertising or analytics cookies. Our servers keep ordinary technical logs; tokens and secrets are never written to them.
4. Who we share data with
- Supabase hosts our database, our sign-in system and the scoreboard images, in Frankfurt, Germany.
- Resend delivers our emails: your sign-in link and the programme emails in section 3.9. It receives your email address and each message, and keeps delivery records. [Not yet live; processing location to be confirmed.]
- Railway runs our services, in [Frankfurt, Germany]. Frames are processed in memory there and not kept.
- Google (Gemini API) receives the scoreboard image and the match's statistics twice per match, to re-read the scoreboard and review the result. [Google's data-processing terms, including that inputs are not used for training, and the processing region are being confirmed.]
- Bright Data collects your declared accounts' public posts on our instructions (section 3.4). [Processing location to be confirmed.]
- Twitch, Kick and YouTube receive our requests for your public stream, your live status and your profile picture, as any viewer's browser would.
- The campaign's client [may receive your verified results and progress for the campaigns you are enrolled in, to the extent needed to settle rewards; to be confirmed against the creator agreement].
We do not sell personal data and we do not share it for advertising.
5. Where data is processed
Our database and storage are in the European Union (Frankfurt). [The processing regions of Google's Gemini API and Bright Data, and the transfer safeguards that apply to them, are to be confirmed and stated here.]
6. How long we keep it
We keep your data while you are in the programme and until it is deleted. You can delete your account at any time from your account page. Deletion removes your profile, your declared accounts and any connected-account token, the posts collected from your accounts, your match records and scoreboard images, your challenge progress and your sign-in. We keep one record that a deletion was requested and carried out: the former identifiers, who asked, the reason and the outcome, and nothing else about you. [Legal to confirm retention periods, and whether settlement records for rewards already paid must be kept for a fixed period.]
7. Automated decisions
An automated model reviews every match and gives a verdict with a confidence score. No reward decision is made by the model alone: a member of the NewGen team decides every match. If you disagree with a decision you can ask for it to be looked at again through your NewGen contact.
8. Your rights
You have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable form, within the limits the law sets. You can correct your declared accounts and request a change to your Activision ID on your account page, and delete your account there. For anything else, contact us at [privacy contact address]. You can also complain to your supervisory authority, [the Information Commissioner's Office in the UK, or the authority in your country].
If you are a player who appeared on a creator's scoreboard and want your row or the image removed, contact us with your in-game name and, if you know it, the date and the creator. We will remove it unless we have a reason we must keep it, which we will explain.
9. Age
The programme is for creators aged [18] and over.
10. Changes
We will post any change here with a new version and date, and tell enrolled creators of material changes before they take effect.