Privacy Policy

This Privacy Policy explains how Crea8one (crea8.one), a social media scheduling and insights tool, handles personal information. You connect your own social accounts, schedule and publish posts, and can receive insights drawn from comments on accounts you connect.

Crea8one is offered to people in India, the United States, the European Union, the United Kingdom, and the rest of the world.

Who we are

The operator of Crea8one is:

Information we process

• Account information, such as your name and email address.
• Connected-platform OAuth tokens, and profile or page information for the accounts you choose to connect.
• Content you upload or schedule.
• Comments and engagement on your own connected accounts, used to produce insights for you.
• Usage and log data, such as IP address, browser type, device information, and timestamps, used to run and protect the service.
• Cookies: essential cookies that keep the service working, and analytics cookies that help us understand how it is used.
• Payment information is handled by Dodo Payments, which acts as the merchant of record and payment processor. We do not store your card number or full payment card details. Dodo Payments shares limited billing details with us, such as plan and subscription status.

How we use information

We use personal information to:

• Provide, maintain, and secure the service you request.
• Connect the social accounts you authorize, publish content you ask us to publish, and prepare insights from comments on those accounts.
• Provide support and meet legal duties.
• Understand product usage through analytics, and bill subscriptions through the merchant of record.

We use data from connected platforms only to provide the service. We do not sell that data, and we do not use it to train AI models.

Connected platforms

YouTube and Google

If you connect YouTube, Crea8one's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

YouTube features you use through Crea8one are also covered by the YouTube Terms of Service and the Google Privacy Policy. You can revoke Crea8one's access to your Google account at any time at https://security.google.com/settings/security/permissions.

Meta (Facebook, Instagram, and Threads)

If you connect Facebook, Instagram, or Threads, we use the data Meta provides only to provide Crea8one to you, including scheduling, publishing, and insights on accounts you connect. We do not sell this data, and we do not use it to train AI models. How to ask us to delete it is described on the Data Deletion page. You can also remove Crea8one from Facebook under Settings > Apps and Websites.

TikTok, Pinterest, X, and LinkedIn

Data from TikTok, Pinterest, X, and LinkedIn is used only to provide the service. It is never sold and never used to train AI models.

Reddit

If you connect Reddit, you do so through OAuth. The scopes are identity, read, submit, and flair. We store the tokens so we can post, on your behalf, to the subreddits you choose. Disconnecting Reddit removes that access.

Mention monitoring (Stalker) is separate from publishing. When you set a brand or keywords, we retrieve public Reddit posts and comments that match them through Reddit's API. For each match we store the permalink, the author's username, an excerpt of up to 2,000 characters, the score, and the comment count. We send that mention text to an AI provider (the OpenAI API) only to label category, sentiment, and urgency, and to summarize topics, for that customer.

We do not sell or license Reddit data, and we do not share it with third parties except the AI provider named above, which receives mention text only for that labeling and summarization. We do not use Reddit data for ad targeting. We do not train or fine-tune AI models on Reddit data. We do not profile individual Redditors. Mention data is kept for up to 30 days. If content is removed from Reddit, we delete it from our systems. Stored mentions link back to Reddit.

These Reddit features follow Reddit's User Agreement, Developer Terms, Data API Terms, and Responsible Builder Policy. To ask us to remove Reddit data, email support@crea8.one.

India (DPDP Act 2023)

Where India's Digital Personal Data Protection Act, 2023 applies, we process personal data for lawful purposes, including providing the service you request, meeting legal duties, and, where the law requires it, with your consent. You may ask to access, correct, or erase your personal data, and you may nominate another person to exercise your rights, by emailing support@crea8.one. Where processing is based on consent, you may withdraw that consent. You may contact the Grievance Officer named above, and you may complain to the Data Protection Board of India.

European Union and United Kingdom

Where the GDPR or UK GDPR applies, we rely on these lawful bases:

• Contract: to provide the account, scheduling, publishing, and insights you sign up for.
• Legitimate interests: to keep the service secure, prevent abuse, and understand how it is used, where those interests are not overridden by your rights.
• Consent: for analytics cookies where consent is required, and for any other processing that needs consent. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or share information.

You can ask for access, correction, erasure, restriction, or a copy of your personal data, and you can object to processing based on legitimate interests. Insights are prepared for you to review. They are not decisions that produce legal effects about you. You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office if you are in the United Kingdom.

We are based in India. Service providers may process personal data in other countries, including the United States. Where the GDPR or UK GDPR requires a transfer tool, we use Standard Contractual Clauses (and the UK Addendum or the International Data Transfer Agreement where UK GDPR applies).

California (CCPA / CPRA)

This section applies to California residents.

Categories of personal information we collect:

• Identifiers, such as name, email address, and account ID.
• Commercial information, such as subscription status received from the merchant of record.
• Internet or network activity, such as usage and log data.
• Information you choose to give us about a business or organization.
• Content you upload, and insights drawn from comments on your own connected accounts.

We do not sell or share personal information. We do not sell or share personal information of anyone under 16.

You have the right to know, delete, and correct personal information, and the right to opt out of sale or sharing. You will not receive discriminatory treatment for exercising these rights. Email support@crea8.one with the subject "California privacy request". We will verify the request using the email address on your account. An authorized agent may submit a request for you. We may ask for proof that you authorized the agent.

Cookies

Essential cookies keep you signed in and remember basic preferences. Analytics cookies help us see which parts of the service are used. You can control cookies in your browser. Blocking essential cookies may stop the service from working.

Sub-processors

We use service providers that process personal information for us, for example:

• Hosting, such as Railway and Vercel.
• Storage for content you upload.
• Email, such as Resend.
• AI providers (for example, OpenAI) that generate drafts and insights.
• Dodo Payments, the payment processor and merchant of record.
• Analytics providers.

Content processed by Crea8one's AI features, for example Stalker mention classification and AI writing assistance, is sent to OpenAI. OpenAI may use that content to improve and train its models. Avoid putting sensitive personal data into AI features. Questions can be sent to support@crea8.one.

These providers must protect personal information. They may use it only to perform services for us, except for the OpenAI training use described above.

How long we keep information

We keep account and content data while your account is open. After you delete your account, or after we verify a deletion request, we delete or de-identify personal information within 30 days, except where we must keep it longer for legal, security, or accounting reasons. Backups may retain copies for up to 90 days. The merchant of record may keep payment records as tax and accounting law requires. See Data Deletion for how to ask.

Security

We use access controls and encrypted connections that fit the service. No method of storage or transmission is completely secure.

Children

Crea8one is not directed at children under 18, and we do not knowingly collect personal information from children.

Changes

We may update this policy. The "Last updated" date at the top will change. If a change materially affects how we use personal information, we will post the update on this page.

Contact

The Terms of Service explain the rules for using Crea8one.