Privacy policy

This portal is run by WellPrepped Education (WellPrepped LLP), registered in Singapore at 6 Bishan St 25, 33-13 Clover by the Park, Singapore 573975. We are the data controller for the information described here.

Questions about this policy, or about your data, go to creators@wellprepped.org.

This policy covers creators invited to the WellPrepped Creators portal — the people who make short-form video content for us and are paid for it. It does not cover WellPrepped students or tutors, whose data is handled separately and is not accessible from this portal.

The portal is invite-only. You cannot create an account here without an invitation from us, and signing in requires a link sent to the email address we invited.

Information you give us directly when you join and while you work with us:

Connecting an account is optional. It saves you sending screenshots, and nothing else about your work or your pay changes if you decline. If you do connect, you are taken to TikTok or Instagram to log in — we never see your password — and you grant a specific, listed set of permissions that you can withdraw at any time.

TikTok. We request the scopes user.info.basic and video.list, which give us:

Instagram. We request instagram_business_basic and instagram_business_manage_insights, which give us:

What we never do with a connected account. This list is exhaustive, and the permissions we request do not technically allow any of it:

• We never post, comment, reply, delete or edit anything as you.
• We never read, send or access your direct messages.
• We never access your follower or following lists, or your private contacts.
• We never access posts other than your own, and we never access anyone else's account.
• We never use your data for advertising, ad targeting or audience building, and we never sell it or share it with data brokers.

We refresh the figures on a schedule — currently every six hours — and only while your connection is active. Disconnecting stops it immediately.

• To perform our contract with you. Briefing you, reviewing your videos, counting views, producing your monthly report and paying you are all things the Creator Agreement obliges us to do.
• Your consent. Connecting a TikTok or Instagram account is consent-based and separate from the agreement. You can withdraw it without affecting anything else.
• Our legal obligations. Tax, accounting and company-law record-keeping in Singapore.
• Our legitimate interests. Keeping the portal secure, preventing fraudulent payment claims, and understanding which content performs — balanced against your privacy, which is why we take view counts and not audience data.

We do not sell your data and we do not share it for anyone else's marketing. We use a small number of service providers who process it on our instructions:

• Supabase — the database and sign-in system that stores your profile, videos and invoices.
• Vercel — hosts the portal and runs the scheduled jobs that refresh view counts and build invoices.
• Resend — sends your sign-in links, invoices and signed-agreement copies.

Beyond those, we share data only where we must: with our accountants and tax authorities, with our payment provider to actually pay you, with a professional adviser where we need advice, or where the law requires it.

We are based in Singapore and our creators are worldwide, so your data crosses borders — from wherever you are, to our providers' servers, to us. Where you are in a country with transfer rules of its own, such as the UK or an EU member state, we rely on the standard contractual clauses in our agreements with the providers listed above.

• Everything travels over encrypted connections (HTTPS).
• Access tokens from TikTok and Instagram are encrypted before they are stored, with AES-256-GCM, using a key held outside the database. Someone who obtained a copy of the database alone could not use the tokens in it.
• The database enforces, row by row, that you can read your own records and no one else's. That is a database rule rather than a screen that hides a button.
• Access by our own staff is limited to the people running the creator programme.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant regulator as quickly as the law requires.

• Platform access tokens — deleted as soon as you disconnect, or when they expire and are not renewed.
• Your profile and content records — for as long as you are an active creator, and then deleted on request.
• Invoices, payments and the figures behind them — at least five years, as Singapore tax and company law requires. We cannot delete these on request, because we are required to keep them.
• Your signed agreement and its audit trail — six years after the agreement ends, so that either of us can rely on it if a dispute arises.

To disconnect TikTok or Instagram, go to Account in the portal and disconnect the platform there. You can also revoke our access from the platform's own settings — on TikTok under Settings and privacy → Security and permissions → Apps and services, and on Instagram under Settings → Website permissions → Apps and websites. Either way we stop collecting new data immediately and delete the stored access tokens.

To delete your data, email creators@wellprepped.org from the address your account uses, with the subject line “Delete my data”. You do not need to give a reason. We will confirm within 7 days and complete the deletion within 30 days.

That removes your profile, your social connections and tokens, your video records, the performance figures we hold about them, and any screenshots you sent. The exception is the financial and signature records in section 9, which we are legally required to keep — we will tell you exactly what was retained and why.

Depending on where you live, you have some or all of the following rights. We honour them for every creator regardless of location, because running two standards is how one of them gets forgotten.

• Ask for a copy of what we hold about you.
• Ask us to correct anything wrong.
• Ask us to delete it — see section 10.
• Withdraw your consent to a connected account at any time.
• Ask for your data in a portable format.
• Object to, or ask us to restrict, a particular use.
• Complain to your local data protection authority if you think we have got this wrong.

Write to creators@wellprepped.org and we will respond within 30 days.

Many of our creators are IB Diploma students, and some are under 18. If you are, your parent or legal guardian must countersign your Creator Agreement before you can start, and that countersignature covers this policy too — they are agreeing to how we handle your data as well as to the work.

We only ever collect a guardian's name and email address, we use them solely to obtain that countersignature, and we do not market to them.

You need to meet TikTok's and Instagram's own minimum age requirements to have an account there at all. If we learn that a creator is below the minimum age for the platforms they are posting on, we will close their account and delete their data.

The portal sets cookies for one purpose: keeping you signed in. There is no advertising, no analytics and no third-party tracking on this site, so there is no consent banner to click through — we are not doing the thing the banner would be asking about.

If we change this policy we will update the date at the top. Where a change materially affects you — new data collected, or a new reason for using it — we will email you before it takes effect rather than relying on you noticing.

WellPrepped LLP, 6 Bishan St 25, 33-13 Clover by the Park, Singapore 573975.

creators@wellprepped.org