Data controller
Creatail (individual operator). Country of establishment: European Union.
Privacy contact: privacy@creatail.ai
This policy applies to creatail.ai and the Creatail web application.
Data we collect
- Account & identity: email, display name, company (optional), profile image from Google OAuth, password hash (if you register with email/password)
- Authentication: OAuth provider identifiers and tokens stored in linked accounts; session tokens in an HttpOnly cookie
- Billing: Stripe customer and subscription identifiers (we do not store full card numbers)
- Workspace & usage: workspace ID, plan tier, generation quota, generation event metadata
- Creative content: brand kits, campaign projects, content plans, gallery items, uploaded product images, generated creatives, prompts and scene settings
- Device & browser (local): workspace drafts, image previews, UI locale, cookie consent choice, and-only after you accept analytics-a pseudonymous site session ID in localStorage
- Analytics (with consent): approximate country/region from hosting edge headers (not your full IP), timezone, referrer, pages visited, and product funnel steps
- Support & security: emails you send us, logs needed to operate and protect the service
How we use data
We do not sell your personal data.
- Provide, maintain, and secure the Creatail service
- Authenticate you and sync your workspace across devices
- Run AI generation and brand analysis on content you submit
- Process subscriptions and one-time purchases
- Enforce plan quotas and prevent abuse
- Measure product usage and improve features (only with analytics consent)
- Comply with legal, tax, and accounting obligations
Legal basis (GDPR)
- Contract (Art. 6(1)(b)): account, workspace, generation, and billing needed to deliver the service you request
- Consent (Art. 6(1)(a)): optional analytics and non-essential cookies-you can withdraw consent anytime via browser storage or by contacting us
- Legitimate interests (Art. 6(1)(f)): security, fraud prevention, service reliability, and aggregated product improvement where balanced against your rights
- Legal obligation (Art. 6(1)(c)): retaining billing and tax records where required by law
Processors & recipients
Processors act on our instructions under data-processing terms. We do not share your data with advertisers.
- Secure cloud database - account, workspace, and project data (EU-capable regions)
- Cloud hosting provider - application hosting and approximate location signals
- Cloud file storage - uploads and generated images
- Stripe - payments, subscriptions, and customer portal
- Google - OAuth sign-in where you choose that option
- AI service providers - image generation and analysis (content you submit is sent as needed for your request)
- Email delivery provider - account and transactional messages
International transfers
Some processors are located outside the European Economic Area (e.g. United States). Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, provider certifications under the EU–US Data Privacy Framework. You may request more information about safeguards via privacy@creatail.ai.
Storage & retention
Your account data, creative projects, and uploaded files are stored on secure cloud infrastructure in the EU or regions with equivalent protections. Some draft images may remain in your browser until you clear site data.
- Account and creative content: until you delete items, delete your account, or ask us to remove data
- Analytics sessions: up to 24 months, then deleted or aggregated
- Billing records: as required by applicable tax and commercial law (typically up to 7 years)
- Server logs: short operational retention, then rotated or deleted
AI processing
When you generate or analyze creatives, we send the images, prompts, and related settings needed for that workflow to specialized third-party AI services. These providers process data only to return results to you. We do not use your private workspace content to train our own public models. Third-party terms may apply to outputs-review applicable terms for commercial use.
Your rights (GDPR & UK GDPR)
- Access and portability - Account → Export data (JSON) or email privacy@creatail.ai
- Rectification - update your profile in Account settings
- Erasure - Account → Delete account (anonymizes your profile and removes sessions; email privacy@creatail.ai for full workspace purge if needed)
- Restriction and objection - contact privacy@creatail.ai
- Withdraw consent - clear localStorage for this site or use cookie controls; analytics stops immediately
- Complaint - you may lodge a complaint with your local data protection supervisory authority
California privacy rights (CCPA/CPRA)
- Categories collected (last 12 months): identifiers (email, name), commercial information (plan, purchases), internet activity (pages, funnel steps with consent), and user-generated content (uploads, projects)
- We do not sell or share personal information for cross-context behavioral advertising
- Right to know, delete, and correct - use Account tools or privacy@creatail.ai
- We will not discriminate against you for exercising privacy rights
- Authorized agents may submit verified requests on your behalf
Children
Creatail is a business service not directed at children. You must be at least 16 (or the minimum age in your country) to create an account. We do not knowingly collect data from children; contact us to request deletion if you believe a child provided data.
Security
We use encryption in transit (HTTPS), hashed passwords, HttpOnly session cookies, and access controls on production infrastructure. No online service is 100% secure-use a strong unique password and keep credentials private.
Cookies
Essential session cookies and optional analytics identifiers are described in our Cookie Policy. Analytics runs only after you click Accept in the cookie banner.
Changes
We may update this policy when our practices or legal requirements change. The date at the top shows the latest version. Material changes will be highlighted on the site where practical.
Contact
privacy@creatail.ai