Verify the contracting party before committing a creator media kit to any vendor

What to take away

Settle the exit position before you commit

Exit terms decide whether your kit survives a change of supplier, so read them before the trial. Ask what a paying customer can retrieve, in which format, and which event ends access.

A media kit usually sits on a public address that brands have bookmarked. Ask whether leaving the service breaks that address or invalidates links already sent. Cancellation does not reliably delete hosted files, and it does not reliably preserve them either.

Read the cancellation and renewal terms beside the quotation, since notice periods, refunds and VAT sit in different documents. Ambiguous wording goes to a commercial reviewer, not a sales chat.

Confirm the contracting entity with Companies House

The name on the invoice, the name in the terms and the trading name on the website are often three different things. Record which legal entity will contract with you before any payment leaves.

For a company registered in England, search the register and read the company number, registered office and filing history. GOV.UK sets out which company details you can obtain from Companies House, including filed accounts and confirmation statements. A dormant entity with no filings is a question to raise, not automatically a fault.

If the counterparty sits overseas, ask for the equivalent register entry for that country. British spelling on a page tells you nothing about where the contract sits.

Match feature promises to a demonstration

Ask for the official service description and the exact plan quoted, rather than a general features page. Suppliers often run one product for solo creators and another for multi-creator management, and a function on one plan does not transfer.

Then test the functions your kit depends on: template export, custom domain, embedded video or download tracking. Keep the vendor statement, its date and the observed result as separate rows.

A documented export option may justify a demonstration, but it does not prove the export keeps your captions, links and editability. Read what to inspect in the exported file so the test covers structure rather than file size alone.

Check UK GDPR roles and the processor contract

Where a supplier stores brand contacts or audience data, the relationship can fall inside the UK GDPR. The ICO guidance for controllers using processors covers the duty to choose a processor offering sufficient guarantees and to put a written contract in place.

Ask what personal data the service receives, where processing happens and which sub-processors are involved. Uploaded contact lists, audience samples and connected account data count if you put them in.

The ICO keeps a public register of fee payers, so check whether the supplier appears there under the same legal name as the invoice.

Your privacy reviewer decides the roles before anyone calls the supplier a processor. This is general procurement information, not legal advice on a particular upload.

Test access control and account recovery

NCSC guidance on secure user management covers managing access and removing permissions that are no longer needed. Ask how the account supports the people who edit, approve and own the kit.

Request evidence of recovery arrangements without sharing passwords or live credentials during a sales call. In a trial, check whether an editor can fix a caption without administrative rights. If nobody can demonstrate the access control you need, log it as an unresolved condition.

The route you publish through sets who can open the kit, so compare controlled HTML, accessible downloads and direct delivery before you approve the account.

Example: two register checks before a trial

Common questions

Which legal entity will actually contract with me?

A named person for commercial terms, plus your privacy reviewer for data roles. Anything they cannot answer stays open as a condition of commitment.

How do I test a feature promise without committing?

Ask for the official plan description, then run one export and one permission test in a trial. Keep the claim and the observed result in separate columns.

What must an exit answer cover?

What you can retrieve, in what format, and which event ends access. Ask separately about the public address, stored assets and links already sent to brands.