Map who may collect, access, use, share, retain and delete creator-campaign customer data across platforms, forms, agencies and CRMs, with clear controls.
Short answer: answer: There is no universal owner. Determine, for every data field and transfer, who collected it, who decides purpose and means, what notice and legal basis apply, who can access or activate it, and when each copy must be deleted. Put those decisions in contracts and system controls; the phrase “the brand owns the leads” does not override platform terms, privacy law or the individual's rights.
The commercial answer is often “the party paying for the campaign.” Privacy regimes do not generally allocate obligations through that slogan. A platform, brand, creator, agency and CRM vendor may have different roles for different processing activities.
The technical answer—who can download the CSV—is equally incomplete. Access may be broad even when use is restricted, or a platform may independently process information. CDM's position is that custody and permitted processing matter more operationally than abstract ownership; map verbs and purposes, not possession.
The Campaign Data Custody Map
The Campaign Data Custody Map follows a data element across eight stations: collection, notice, role, transfer, access, activation, retention and deletion. It makes each party's permitted action visible and testable.
Station 1: inventory the actual data and source
List fields, not just datasets. Email, phone, shipping address, quiz answer, platform handle, click ID, purchase, commission record, audience segment and inferred interest carry different risks. Identify whether the person typed the field, the platform appended it, the creator collected it in direct messages or the brand inferred it later.
Do not let creators copy lead details into personal notes or messaging apps simply because a follower asks a product question. Define an approved intake route. If the campaign does not need a field, do not collect it. FTC security guidance starts with taking stock and scaling down; minimization also reduces privacy and breach exposure.
Station 2: preserve the notice and choice shown at collection
Capture the form version, privacy-policy link, disclaimer, consent language, timestamp, locale and campaign. A generic corporate privacy policy may not explain creator involvement, profiling, text messages or a data transfer to another entity.
Notice and legal basis vary by jurisdiction and purpose. Marketing consent, contractual necessity and legitimate interests are not interchangeable labels. Obtain privacy counsel for the target markets and regulated data. The custody map records the approved basis and evidence; it does not invent one after collection.
Station 3: determine roles by actual function
For GDPR analysis, the European Data Protection Board treats controller and processor as functional concepts based on actual activities; labels in a contract are relevant but not decisive. A party deciding why and essential means of processing may be a controller, while a processor acts on documented instructions. Joint decisions can create joint-controller questions.
Map each purpose separately. A platform might process a lead-ad submission for the advertiser and also use limited information for its own stated purposes. TikTok's help documentation says that for its lead ads under GDPR, TikTok and the advertiser are controllers, and explains that it may use specified information independently under its terms. That statement describes that product, not every creator campaign or jurisdiction.
Station 4: document every transfer
Draw arrows from collection surface to platform store, agency account, download, integration service, CRM, email provider, sales team and analytics warehouse. For each arrow, record fields, purpose, transfer mechanism, geography, encryption, recipient role and contract.
A CSV emailed to a creator manager is a new copy and risk surface. Prefer managed API or controlled export into the brand's environment. TikTok says lead data can be accessed through Ads Manager, Leads Center, a connected CRM and its Marketing API, with administrative permissions affecting downloads. Verify the current settings in the real account.
Station 5: grant purpose-bound access
Use named accounts, minimum roles, multifactor authentication and time limits. Creators may need aggregate conversion or commission reporting without customer contact details. An agency may need campaign operations but not unrestricted export. Separate viewing, downloading, deleting and audience activation.
Run access reports during the campaign and after personnel changes. “Creator partner” is not an access role. If a platform exposes leads only to administrators, avoid making an external operator an administrator merely for convenience; transfer or integrate the data through a narrower approved path when the product supports it.
Station 6: control activation and secondary use
List allowed purposes: fulfil the requested contact, attribute commission, provide a quote, send marketing, create a custom audience, measure performance or train a model. Approval for one does not automatically allow another. A user who asks for a sample through a creator link has not necessarily agreed to indefinite cross-channel marketing.
Contract terms should name specific business purposes and prohibit unapproved use. California's 2026-effective CCPA materials include detailed contract requirements for service providers and contractors, including specific business purposes and limitations. Whether a party qualifies for those roles is fact-specific; do not paste the label into a contract without the required substance and conduct.
Station 7: align retention clocks
Record platform availability, brand business need, legal obligation, consent withdrawal and deletion-request requirements. TikTok documentation for certain lead products says lead data becomes unavailable after 90 days. That is a platform availability window, not permission for the brand to retain a downloaded copy for 90 days—or a requirement to delete a lawful copy at exactly that moment.
Set field- and purpose-specific periods. Preserve limited transaction evidence when law requires it, but separate it from active marketing. Automatically expire agency and creator access earlier when their role ends.
Station 8: prove deletion and rights handling
Define who receives access, correction, deletion, objection or opt-out requests and how identity is verified. Route a request across platform, brand, agency, CRM and downstream processors as applicable. Track receipt, decision, completion and exceptions.
Deletion evidence can include job logs, platform confirmations and downstream attestations, but be honest about backups and legal holds. The FTC recommends secure disposal once information is no longer needed. “Deleted from the campaign spreadsheet” is not proof that CRM, email and downloaded copies are gone.
Reader asset: lead custody map
| Element/purpose | Collector | Decision-maker/role review | Storage and access | Recipient/transfer | Retention | Deletion owner |
|---|---|---|---|---|---|---|
| email for sample request | platform form | platform + brand assessment | platform admin; brand CRM | API to brand CRM | platform window; brand approved period | brand privacy ops + platform route |
| click/creator code for commission | platform/brand | per attribution purpose | analytics; finance aggregate | agency and creator receive aggregate | accounting schedule | analytics owner |
| phone for marketing texts | brand form | brand; consent required review | CRM restricted list | messaging processor | until withdrawal/approved limit | lifecycle owner |
Add jurisdiction, notice version, legal basis, contract, security classification, international-transfer mechanism and rights-request route. This example is deliberately nonconclusive: role labels and periods must be reviewed for the real flow.
Reproduce the map from evidence
Interview campaign, platform, CRM, sales, agency and privacy owners; inspect configurations and sample records. Then test one synthetic lead with clearly marked dummy data. Trace where it appears, who can export it, which automation fires and whether deletion propagates. Do not submit real personal data merely to test without an approved protocol.
Reconcile the observed flow with contracts and notice. Any unexpected destination, personal download or purpose is a control gap. Repeat after integration, agency or form changes.
Related guides
Frequently asked questions
Does the brand own leads collected through a creator campaign?
Not as a universal legal rule. The brand may have contractual rights to receive and use lead information for specified purposes, while the platform and individuals retain rights and obligations under terms and privacy law. Identify the product, notice, actual decisions, transfers and jurisdiction.
Under GDPR, role analysis is functional; a contract label alone does not settle it. Commercial teams can call leads an asset, but operations should record permitted actions. The caveat is that property, database, confidentiality and contract concepts may also apply, requiring local advice.
Can a creator receive the email addresses of people who buy through their link?
Only if the approved data flow, notice, legal basis, platform terms and contract allow that disclosure. Most commission reporting can use order IDs, totals or aggregated results without revealing direct identifiers. Data minimization argues against giving creators customer emails merely to prove attribution.
If a creator independently operates the storefront, the role analysis may differ and notices must accurately describe it. The caveat is that tax, fraud or customer-service needs can justify limited information, but access should remain purpose-bound, secure and time-limited.
Is a platform a processor for creator-campaign lead data?
Sometimes, but not always and not for every purpose. Determine roles from the product terms and actual processing. TikTok's lead-data guidance states that TikTok and the advertiser are controllers under GDPR for that lead-ads product and describes independent platform use; other tools and platforms may allocate roles differently.
Even one provider can be a processor for one activity and controller for another. The caveat is that jurisdiction-specific terms evolve, so use current contracts and qualified privacy review rather than generalizing a help-page statement.
How long can the brand keep creator-campaign leads?
Keep them only for an approved, disclosed purpose and a period supported by applicable law and policy. Set separate clocks for fulfilment, active marketing, attribution, disputes and required accounting. A platform's 90-day availability window is not the brand's legal retention rule.
FTC security guidance recommends keeping sensitive information only as long as there is a legitimate business need and disposing of it securely. The caveat is that legal holds and statutory records can require restricted retention after marketing use ends; document the exception and limit access.
Can we upload creator-campaign leads to a custom audience?
Only after the custody map confirms notice, legal basis, platform terms, contractual authority and any required choice for that secondary use. A lead submitted for one response does not automatically authorize behavioral targeting. Record which fields are uploaded, hashing or transfer method, platform role, suppression handling and deletion. Test that opted-out people remain suppressed during later audience refreshes.
Use the current jurisdiction-specific advertising-tool terms. The caveat is that hashing identifiers changes transmission risk but does not necessarily remove personal-data status or cure an unauthorized purpose.
What should happen to lead data when the agency or creator relationship ends?
Remove access, stop integrations, inventory exports, return or securely delete data as contracts and law require, and obtain verifiable completion evidence. Preserve only approved records needed for payment, disputes, legal hold or compliance, isolated from active marketing. Reassign rights-request and incident contacts so individuals are not routed to a former partner.
The caveat is that a former party may have independent controller obligations for data it lawfully collected; the brand cannot simply order deletion that conflicts with law, so closure must reflect the reviewed role map.
Next decision: Offboard the creator partnership without residual access or content
Related reading: Grant and revoke creator ad access safely · Translate creator contracts into workflow fields · Track every derivative creator asset
Sources and research notes
- EDPB, Guidelines 07/2020 on controller and processor concepts — checked 26 September 2026. Final EU guidance emphasizing functional role analysis.
- TikTok Ads Help, About Leads Data Security — checked 26 September 2026. Platform-specific access, independent-use and GDPR-role statements, last updated February 2025.
- TikTok for Business, Manage and download collected leads — checked 26 September 2026. Describes 90-day availability for the documented product.
- California Privacy Protection Agency, CCPA statute and regulations effective 1 January 2026 — checked 26 September 2026. Official California text; role and applicability require counsel.
- FTC, Protecting Personal Information: A Guide for Business — checked 26 September 2026. U.S. security and minimization guidance.
Research limitation: the worked custody map is illustrative, not a determination of controller, processor, ownership or legal basis. Platform contracts, integration settings and privacy law must be reviewed for each real campaign and market.
This article is editorial guidance. Apply the principles in proportion to your market, evidence, and responsibilities.
