Privacy Policy

and Creator Application Privacy Notice

Website: Hashtag Bio Inc. / hashtag.bio

Version: v1.0

Effective date: 28 July 2026

Last updated: 28 July 2026

Document owner: Hashtag Bio Inc. / hashtag.bio

1. About this Privacy Policy

This Privacy Policy and Creator Application Privacy Notice explain how personal information is collected, used, disclosed, retained and protected when a person visits Hashtag Bio Inc. / hashtag.bio or submits the creator application form.

It applies to the current creator application process shown on Hashtag Bio Inc. It does not by itself authorize future identity verification, biometric processing, AI scoring, payments, public creator profiles or connected-platform analytics. Those activities must not begin until the related data practices, notices and safeguards have been separately confirmed.

Hashtag Bio Inc. / hashtag.bio operates Hashtag Bio Inc. and is the controller of the general creator-network application. Miss Denmark branding identifies a campaign collaboration; Miss Denmark does not receive the general application unless the applicant is informed about a specific Miss Denmark opportunity before sharing occurs.

2. Who is responsible for your information

The controller is:

Legal name: Hashtag Bio Inc. / hashtag.bio

United States office: 2021 Guadalupe Street, Suite 260, Austin, Texas 78705, USA

Privacy and DPO contact: legal@hashtag.bio

Support and security contact: support@hashtag.bio

Telephone: +1 888-246-0148

Hashtag Bio Inc. receives and reviews the general creator-network application. Miss Denmark does not receive the application merely because its branding appears on the page. If an applicant is considered for a separately identified Miss Denmark programme or event, Hashtag Bio Inc. will provide a just-in-time notice before disclosing information. That notice will identify the recipient, purpose, information shared and applicable privacy terms.

Miss Denmark is responsible for information it collects directly through its own website, communications or selection processes. Its public contact channel is kontakt@missdanmark.dk.

3. Scope and who this policy applies to

This policy applies to visitors to Hashtag Bio Inc. and individuals who submit or begin a creator application, communicate about an application, or ask to receive future creator opportunities.

The website and application are not intended for children under 13. Applicants aged 13 to 17 may apply only where lawful in their country. Before acceptance, identity verification, public-profile activation, campaign participation, payment or another binding commitment, Hashtag Bio Inc. may require verifiable authorization from a parent or legal guardian.

4. Information we collect

4.1 Information provided in the application

Full name.
Telephone number and country calling code.
Email address.
Country.
Primary social-media platform.
Social-media handle and public profile link.
Follower range.
Creator category.
Description of the content created and why the audience engages with it.
Goals and types of opportunities sought.
Accuracy confirmation, terms acceptance, privacy acknowledgement, age confirmation and optional marketing choices.
Any additional information voluntarily included in free-text fields or later communications.

4.2 Information created during review

Application date, status and workflow history.
Internal review notes, eligibility checks and selection decisions.
Records of communications with the applicant.
Records showing the wording, date, time and method of consents and acknowledgements.
Fraud-prevention, duplicate-application or impersonation indicators.

4.3 Information collected automatically

The website collects IP address, device and browser information, referral source, timestamps, security logs, cookie identifiers and website-usage information. Webflow supports website hosting and page delivery; Typeform supports the application form; Attio supports application and relationship management; Brevo supports email communications; and Google Analytics supports consent-based website measurement. Non-essential analytics is not activated for users in jurisdictions requiring prior consent until a valid choice has been recorded.

4.4 Information from public and third-party sources

The application provides a social-media handle and profile link. Reviewers may examine information the applicant has made publicly available to assess authenticity, content category, audience presentation and suitability for opportunities. Review must be proportionate, relevant to the application and must not be used to collect unrelated sensitive information.

No private social-platform data should be accessed through account connections or third-party APIs unless the applicant receives a separate notice and any required authorization.

5. Sensitive information, identity verification and biometrics

The current form does not request government identification, facial geometry, liveness data, precise location, payment credentials, health information or other special-category or sensitive information. Applicants should not include such information in free-text fields.

The initial application does not use identity-document review, liveness checks, facial matching or biometric processing. If an applicant advances to an opportunity that requires identity verification, Hashtag Bio Inc. may use Sumsub or another provider identified in an advance notice. Any identity or biometric processing requires a separate notice describing the provider, purpose, legal basis, retention, countries of processing and applicable consent or rights.

6. Why we process information and our EU/EEA legal bases

The table below describes the principal purposes and the legal bases used for applicants in the EU/EEA.

Where legitimate interests are relied upon, the responsible controller must document an assessment balancing the stated business need against the applicant's rights and reasonable expectations.

7. Creator application review and verification

Application information may be reviewed to determine whether the applicant appears eligible and suitable for creator opportunities, brand campaigns, events, partnerships, ambassador programmes or participation in the Hashtag Bio Inc. network.

Submission does not guarantee acceptance, a campaign, payment, employment, representation or any commercial relationship. Reviewers may request clarification, confirm the accuracy of contact information, inspect the supplied public social profile and investigate reasonable fraud or impersonation concerns.

Hashtag Bio Inc. makes decisions on general creator-network applications using authorized team members. Relevant criteria include completeness, authenticity, content category, public profile, audience information, geography, opportunity fit, professional conduct and fraud or impersonation risk. Applicants receive a separate agreement before taking part in a campaign, receiving payment or having a public profile created.

8. Automated decision-making, profiling and AI-assisted matching

Authorized team members make acceptance and rejection decisions. Workflow automation may route submissions, identify duplicate records or suggest opportunity matches, but Hashtag Bio Inc. does not make an acceptance or rejection decision based solely on automated processing that produces legal or similarly significant effects.

If materially different AI scoring or automated decision-making is introduced, this policy will be updated before use to explain the information used, purpose, material factors, consequences, human involvement and applicable rights to obtain human review, express a view and contest a decision.

9. Application communications and optional marketing

Operational communications may be sent to acknowledge, assess, clarify or respond to the current application. These messages are distinct from advertising and future-opportunity marketing.

Future creator opportunities, newsletters and promotional communications should be sent only where permitted by applicable law. Where consent is required, it must be optional, specific and recorded. Refusing marketing consent must not prevent submission or review of the current application.

Applicants may withdraw marketing consent or unsubscribe at any time using the method in the message or by contacting legal@hashtag.bio. Withdrawal does not affect processing already lawfully completed.

The current optional future-opportunity channel is email, delivered through Brevo. Promotional SMS, telephone or WhatsApp messages will not be sent unless the applicant has made a separate channel-specific choice where required.

10. Cookies and similar technologies

Hashtag Bio Inc. uses technologies required for security, network management, form operation and user preferences. Google Analytics is used for website measurement only after consent where required. Advertising cookies and cross-context behavioural advertising are not part of the current application-page configuration.

Users can reject non-essential technologies as easily as accepting them and can change their preferences through Cookie Settings. The separate Cookie Policy identifies cookie names, providers, purposes and durations.

11. When information is shared

Personal information may be disclosed only as necessary and subject to appropriate safeguards to:

Hashtag Bio Inc. personnel authorized to administer and decide creator-network applications.
Miss Denmark only after a specific opportunity notice identifies the purpose and lawful basis for sharing.
Hosting, form, CRM, email, communications, analytics, security and professional-service providers acting under appropriate terms.
Brands, agencies or event partners only after an additional lawful basis, notice and any required applicant choice have been established.
Courts, regulators, law-enforcement bodies or other authorities where disclosure is required or legally justified.
Professional advisers and insurers where necessary to establish, exercise or defend legal claims.
A successor in a merger, acquisition, restructuring or asset transfer, subject to applicable notice and protection requirements.

The principal service providers for this application workflow are Webflow for website hosting and page delivery, Typeform for form collection, Attio for application and relationship management, Brevo for email communications and Google Analytics for consent-based website measurement. Application information is not made public or added to a public creator profile without a separate, clearly communicated basis.

12. Data sharing between Miss Denmark and Hashtag Bio Inc.

Miss Denmark does not receive or review the general Hashtag Bio Inc. creator-network application merely because its branding appears on the page.

If an applicant is considered for a specifically identified Miss Denmark opportunity, Hashtag Bio Inc. will provide a notice before sharing information. Miss Denmark will be responsible for any independent selection or programme use described in that notice, and the parties will allocate security, rights-request, incident-response, retention and transparency responsibilities in writing.

13. International data transfers

Hashtag Bio Inc. is headquartered in Austin, Texas, United States. Your personal information may be collected, processed, stored, or accessed in the United States and in other countries where our affiliates, service providers, cloud infrastructure providers, payment processors, or business partners operate.

If you access our Services from outside the United States, your information may be transferred to and processed in countries whose data protection laws differ from those in your country of residence.

Where personal information is transferred from the European Economic Area (EEA), the United Kingdom (UK), or Switzerland to countries that have not received an adequacy decision from the applicable regulatory authority, Hashtag Bio Inc. implements appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum where applicable, or other legally recognized transfer mechanisms.

We take reasonable technical, administrative, and organizational measures to protect personal information during international transfers and require our service providers to maintain appropriate privacy and security standards consistent with applicable law.

If you would like more information about the safeguards used for international data transfers, please contact us at legal@hashtag.bio.

14. Retention

Personal information is kept only for as long as reasonably necessary for the stated purposes, legal obligations, dispute management and documented business needs.

At the end of the applicable period, records are deleted or anonymised unless a longer period is required by law, a live dispute, fraud prevention or an active creator relationship.

15. Security

The responsible organization must maintain administrative, technical and organizational measures appropriate to the nature and risk of the information. These should include access controls, authentication, encryption where appropriate, secure transmission, logging, vendor controls, staff confidentiality, backup and incident-response measures.

No method of storage or transmission is completely secure. This policy does not promise absolute security. Suspected privacy or security incidents may be reported to support@hashtag.bio or legal@hashtag.bio.

16. Information about other people

Applicants should provide information only about themselves. If an applicant provides information about another person, the applicant must have lawful authority to do so and must direct that person to this policy where appropriate.

17. Privacy rights in Denmark and the EU/EEA

Subject to applicable conditions and exceptions, individuals in Denmark and the EU/EEA may have rights to:

Receive information about processing and obtain access to personal data.
Correct inaccurate or incomplete personal data.
Request deletion.
Request restriction of processing.
Object to processing based on legitimate interests or direct marketing.
Receive certain information in a portable format.
Withdraw consent at any time.
Obtain safeguards information for certain international transfers.
Not be subject to certain solely automated decisions and request human intervention where applicable.
Complain to a competent data-protection supervisory authority.

A complaint concerning Danish processing may be submitted through the Danish Data Protection Agency website. Individuals may also complain to the supervisory authority in the EU/EEA country where they live or work or where the alleged infringement occurred.

18. United States privacy disclosures and rights

United States privacy rights depend on the applicant's state, Hashtag Bio Inc.'s activities and applicable statutory thresholds. Hashtag Bio Inc. extends the core request methods described below to U.S. applicants even where a particular comprehensive state privacy law does not apply.

18.1 Categories and purposes

The application may involve identifiers, contact information, internet or network activity, social-media and professional information, application content, inferences created during review and consent records. These categories are used for the purposes described in Sections 6–9.

18.2 Potential state rights

Where an applicable state law grants the right, a resident may request access, confirmation, correction, deletion or portability; opt out of regulated sale, sharing, targeted advertising or certain profiling; limit specified uses of sensitive information; use an authorized agent; appeal a denied request; and receive service without unlawful discrimination.

18.3 Sale, sharing and targeted advertising

Hashtag Bio Inc. does not sell applicant personal information. The current application page does not use personal information for cross-context behavioural advertising. Google Analytics is configured as consent-based measurement; users may reject analytics through Cookie Settings, and legally recognized browser opt-out signals such as Global Privacy Control are honored where applicable.

18.4 California Notice at Collection

At or before submission, Hashtag Bio Inc. collects identifiers and contact details; internet or electronic-network activity; social-media and professional information; application and correspondence content; and inferences created during review. The business purposes and retention periods are described in Sections 6 and 14. Hashtag Bio Inc. does not sell applicant information and does not use it for cross-context behavioural advertising.

18.5 Exercising U.S. rights

Requests and appeals may be submitted to legal@hashtag.bio. Reasonable information may be requested to verify the identity and authority of the requester. Where required, an authorized agent may submit a request. Hashtag Bio Inc. will not unlawfully discriminate against a person for exercising a privacy right.

19. Your Privacy Rights

Depending on your country, state, or region of residence, you may have certain privacy rights under applicable data protection laws, including the right to:

Request access to the personal information we hold about you.

Request correction of inaccurate or incomplete personal information.

Request deletion of your personal information, subject to legal and contractual obligations.

Request a copy of your personal information in a portable format where required by law.

Object to or restrict certain types of processing where permitted by law.

Withdraw your consent at any time where we rely on your consent for processing.

Opt out of certain marketing communications or targeted advertising where applicable.

Exercising these rights will not affect the lawfulness of any processing carried out before your request or any processing that is required or permitted by applicable law.

Hashtag Bio Inc. will respond to verified privacy requests within the timeframes required by applicable law. We may request additional information to verify your identity before processing your request.

To exercise your privacy rights or ask questions about how we process your personal information, please contact us at:

Email: legal@hashtag.bio

Hashtag Bio Inc. maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

20. How to exercise privacy rights

Submit a privacy request to legal@hashtag.bio. The request should identify the applicant, the right being exercised, the country or U.S. state of residence and sufficient information to locate the application.

The organization may take proportionate steps to verify identity and authority. It will respond within the period required by applicable law. If a request is denied, the response should explain the reason and any available complaint or appeal route.

21. Withdrawal, marketing opt-out and application withdrawal

Marketing consent may be withdrawn at any time through the unsubscribe method provided in the communication or by contacting legal@hashtag.bio. Application-related messages necessary to process an active application may continue unless the application is withdrawn.

An applicant may withdraw an application by contacting support@hashtag.bio. Withdrawal may not require immediate deletion where information must be retained for legal compliance, security, dispute management or proof of the request.

22. Third-party websites and social-media platforms

Hashtag Bio Inc. may link to social-media platforms or other external services. Those organizations process information under their own terms and privacy notices. This policy does not control their independent practices.

23. Changes to this policy

This policy may be updated to reflect legal, operational or technical changes. The revised version and effective date will be posted on Hashtag Bio Inc.. Where required, material changes will be communicated directly or will be subject to a new choice or consent.

24. Contact and complaints

Controller: Hashtag Bio Inc. / hashtag.bio