Privacy Policy

Account data: email, name, password hash (bcrypt), locale cookie, theme preference.

Brand operational data: ad events (spend, impressions, clicks, ROAS), order events (value, status, refusal, delivery), product financials (COGS, packaging, return cost), reviews, the public comments on your ads when a Facebook Page is connected, Friday conversations.

Derived data: embeddings, AI Tags, the transcripts of the speech in your own video ads, Performance Memory verdicts, anomaly traces.

Not collected: we do not collect end-customer payment details, government IDs, or device fingerprints.

What we collect: your ad account identifiers, ad and creative metadata, your ads' video files (stored in our Supabase EU storage so you can play them in your workspace), and ad performance metrics (spend, impressions, clicks, conversions, their split by placement, age and gender, and how long your videos are watched) via ads_read; and which ad accounts you can choose to sync via business_management (read-only — we never modify your Business Manager settings, pages, or any other asset).

What we collect from a Facebook Page: the Page's id and name, the Instagram account linked to it, and the public comments people leave on your ads on Facebook and Instagram — the commenter's name (or Instagram username), their Facebook profile id, the comment text, when it was posted and its like count — via pages_show_list, pages_read_engagement and pages_read_user_content, and via instagram_basic and instagram_manage_comments for Instagram. instagram_manage_comments is the permission Meta requires to read comments on Instagram; we use it only to read. A commenter's profile id is never shown to anyone.

Why: to compute and display your own advertising analytics, and what people say about your ads, back to you, inside your own workspace, and, when you connect an AI assistant to the workspace, the comments' text without who wrote them, at your direction (see AI assistants you connect). This data is never shown to other Creativity customers, never used to advertise to you, and never sold.

How it's deleted: disconnect at any time from Settings → Workspace → Data sources. Disconnecting the Facebook Page removes the commenters' names, profile ids and comment text at once; revoking only the Instagram permissions removes the Instagram comments. See Data Deletion Instructions for the full process.

Primary data store: Supabase (PostgreSQL + Storage), EU region. Row-Level Security scopes every read and write by `brand_id`.

AI processor — Google Gemini API (paid tier):creative tagging and transcription. Your own ads' video (with its audio), image and copy are sent to Gemini, which proposes tags (our vocabulary validates them) and transcribes the speech. A video is uploaded for the call and deleted right after it; Google deletes any upload within 48 hours regardless. Under Google's paid-tier terms your prompts, files and responses are not used to improve Google's products; they are logged for a limited period only to detect abuse, may be processed in any country where Google operates, and are covered by Google's data processing terms and the EU Standard Contractual Clauses. Google is listed from 25 September 2026. From 6 October 2026, the creatives that spent in the last 90 days are tagged for every workspace on Standard or in its free trial with a connected Meta ad account. An owner who objects writes to support@creativity.run, and AI tagging stays off for that workspace.

AI processor — Anthropic Claude: reserved for Friday, the in-product assistant, which is not live yet. No creative of yours is sent to Claude: the tagger that used it is retired. Anthropic does not offer an EU inference region on our account, so we do not claim one: Claude calls run in Anthropic's default routing under the EU Standard Contractual Clauses, and Anthropic's commercial API terms mean your prompts and completions are not used to train their models. This is Creativity's own use of Claude. A Claude you connect to Creativity yourself is different: see AI assistants you connect.

Observability: LangSmith EU workspace for LLM call traces and evals; Sentry (EU region) for error monitoring.

Hosting: Vercel for the web app, Render (EU region) for the agent service.

Creativity does not train models on customer data. We use two third-party AI providers, strictly via paid API tiers whose terms prohibit using inputs and outputs to train or improve their models:

Google Gemini: paid tier of the Gemini API — prompts, files and responses are not used to improve Google's products.

Anthropic Claude: Commercial API — no training on customer prompts or completions.

One workspace, at your direction: each connection reads one workspace, the one you pick on the consent screen among those you are an owner or admin of, on a plan that includes AI assistants (you can change it later in Settings → Account → Connect AI; changing it turns that connection's edits off). When you ask the assistant something, Creativity sends it the data it requests to answer: ad performance, your creatives' names, ad copy, AI tags, transcripts and links to their images and videos, your saved reports, orders, confirmation and delivery from a connected store, the competitors and Inspo boards you follow, ads, shops and products from the shared competitor library, and this help center's articles.

Images of your ads: when the assistant asks to look at one of your own ads, Creativity sends it an image: the ad's still image, a video's poster, or a storyboard, a grid of frames that Creativity makes from its own stored copy of the video. These are sent as image data, not as links.

Comments on your ads: with a Facebook Page connected, the assistant can read the comments under your own Facebook and Instagram ads, as text only, with the date, the platform and the ad. Phone numbers, email addresses and @mentions in the text are masked. The commenter's name, profile id and picture are never sent. One limit: when someone tags a Facebook friend in a comment, Facebook puts the friend's name into the text as plain words, so that name can reach the assistant inside the comment.

Edits to your saved reports: only when “Allow edits” is on for that connection (it is off until you turn it on), and only when you ask, the assistant can create, change, delete and restore that workspace's saved reports. A deleted report is kept and can be restored. The assistant never shares or publishes a report, never invites anyone, never changes anything else in Creativity, and never changes anything in Meta: Creativity's access to Meta is read-only.

Your provider, not ours: what the assistant does with that data, including whether your conversations are used to train its models and how long they are kept, follows your own account and settings with Anthropic, OpenAI or the provider you chose. Creativity does not choose that provider and it is not a sub-processor of ours, so the 30 days' notice the DPA gives for sub-processors does not apply to it.

What is never sent: who wrote a comment (their name, id and picture), other workspaces' data, and your connection tokens. Links to images and videos are public, so anyone holding one can open it.

Revoking: Settings → Account → Connect AI → Connected clients → Revoke. The connection stops working from the assistant's next request, and its workspace and edit setting are reset. Removing the connector in the assistant stops it asking but keeps the connection's settings.

What we log: for each request an assistant makes, the user, the assistant's connection, the workspace, which read, edit or prompt it was, when, how long it took, how many rows it returned, whether it succeeded, and for an edit, which saved report it touched. Never your question, the request's details or the answer. We use this to measure usage, to stop abuse and as the record of what you asked us to share or change; it is kept with your account's other operational data (see Retention).

Access: request a JSON export of every row tied to your brand from Settings → Privacy. Delivered within 7 days.

Erasure: deleting a brand soft-deletes all rows (`is_deleted = true`); a hard purge runs 30 days later unless you reactivate.

Portability: exports include connector tokens (encrypted at rest), brand knowledge, performance memory, and raw events.

Objection / withdrawal of consent: email support@creativity.run. We respond within 30 days.

Account emails: invitations, plan requests, payment receipts, system notices and booking reminders. Receipts, system notices and booking reminders can be turned off in Settings → Notifications.

Onboarding emails during the trial: sent to the owner of the trial workspace on some days of the 14-day trial. They end with the trial, or as soon as a plan is chosen.

Stopping them: use the “Stop these emails” link at the foot of any of them, or your email app's unsubscribe button. No sign-in is needed, it takes effect at once, and it stops the whole sequence.

Marketing emails: only if you opt in, in Settings → Notifications. Every one carries an unsubscribe link.

Operational data: retained for the lifetime of the active subscription. On cancellation, you have 60 days to export before soft-deletion.

LangSmith traces: auto-deleted after 90 days per workspace policy.

Backups: Supabase keeps a daily backup of the database for 7 days. Deleted data leaves the backups 7 days after it is purged.

Full sub-processor list with purpose and data category:

• Supabase — primary database + storage (EU region).
• Vercel — web app hosting + edge middleware (EU).
• Render — agent service hosting (EU).
• Google — Gemini API, paid tier: tagging and transcribing your own ad creatives (their video with its audio, image and copy); the video is deleted after each call. Listed from 25 September 2026; tagging runs from 6 October 2026, except for a workspace whose owner objects.
• Anthropic — Claude API: reserved for Friday, the in-product assistant (not live yet). It receives no creative: the tagger that used it is retired. A Claude you connect to Creativity yourself is not this: it is your own provider (see AI assistants you connect).
• LangSmith — LLM trace observability (EU workspace).
• Resend — transactional email.
• PostHog — product analytics (EU cloud): cookieless, hash-based visit counting before cookie consent; cookies, account linking and a session replay of the app (form inputs masked) only after it.
• Sentry — error monitoring (EU region): error reports from the app and the agent service. A report can carry an identifier such as an ad account or post id; never a token, a name or a comment's text. Sentry has been part of the service since launch and was missing from this list until 2026-09-22.
• Notion — our own record of who signed up (US-hosted): your account email and name, your workspace's name, your onboarding answers, your trial and plan state, which sources are connected (never a token), counts of what you use, the calls you booked and any feedback you send us. None of your ad, creative or store data. Synced once a day. Listed from 12 October 2026.

Mollie (NL) is a planned payment processor. It is not yet engaged and receives no data today; we will add it to this list before it does.

The Data Processing Addendum (DPA) on /legal/dpa reflects this list verbatim, except Notion: it joins the DPA's list once the 30-day notice the DPA promises has run.