Last updated: 16 October 2026.
1. Who this notice covers
This notice explains personal information handling for the CreatorCraft website and platform at creatorcraft.app. CreatorCraft is the trading name used to provide this service. Contact creatorcraftapp@creatorcraft.app for privacy questions, access requests, deletion requests or details of a connection.
We determine how information is used to operate CreatorCraft and manage our customer relationship. When a workspace owner uses the platform for its own customers, audience or store, that owner determines the purposes of those activities and may have separate controller obligations. Check the relevant business or storefront notice too; this platform notice does not replace it.
2. Information the platform handles
Depending on the features used, information can include:
- Account and contact details, login and security records, team membership and permissions.
- Brand and business settings, websites, storefronts, campaigns, calendar entries and workflow instructions.
- Prompts, conversations, uploaded files, media, generated content and the context supplied for a task.
- Support messages, usage records, credit reservations and transactions, workflow activity, approvals and provider receipts.
- Billing, order, delivery, refund and fulfilment details for a purchase, and transaction references or payment status from a payment processor.
- IP addresses, browser or device information, request logs and security events needed to operate and protect the service.
Information may come from you, your authorised team, a connected provider, a customer making a purchase, or someone interacting with your published content or site. Payment providers such as Stripe handle card payments. Do not send full card details through support messages.
3. TikTok and other connected accounts
When you authorise a connection, the provider may supply account identifiers, profile information, available permissions and the data needed for the features and scopes you approve. Depending on the platform, that can include posts, media, publishing status, public performance readings, comments or messages. Not every platform or connection provides every category.
For TikTok publishing, relevant information includes your authorised account identity, current creator publishing permissions, approved media and caption, visibility and interaction choices, disclosures, publish identifiers and processing results. OAuth tokens or API credentials authenticate authorised requests. Information available for a connection is limited by the permission actually granted and the provider's approval and availability.
We use connection information to supply the requested feature, associate its result with your workspace and troubleshoot failures. Authorising publishing is not permission to buy unrelated services or use an account for unrelated collection. Public research or discovery features are separate activities and remain subject to the source's rules and applicable law.
4. Purposes and legal bases
We use information to provide requested accounts and features, process orders, maintain connections and respond to service requests. Where necessary to perform an agreement with you, processing relies on that contract. Information required for a function must be supplied for that function to work.
Security, fraud prevention, troubleshooting and proportionate service administration rely on legitimate interests in operating a safe and reliable service, where those interests are not overridden by your rights. Accounting, legally required records and binding legal requests rely on legal obligations.
Where consent is required for an activity, including applicable optional tracking or marketing, that consent must be obtained and can be withdrawn. The lawful basis and rights available depend on the particular purpose; connecting a service is not blanket consent to every use of information.
5. AI, agents, publishing and public content
A selected AI or media task may send relevant prompts, files, content and context to the provider needed to perform it. Provider processing and retention depend on the selected service and its terms. Ask us for provider details before supplying information that needs a specific processing restriction. Do not include sensitive personal information that the task does not need.
When you authorise publishing, approved content and associated metadata are sent to the selected destination. Public posts, websites and storefronts can be viewed worldwide, indexed or copied by others. Removing content from CreatorCraft does not necessarily remove a published copy from another service.
Agents and workflows may process information or act on a schedule within your configured instructions, permissions and budgets. Review those controls before enabling work. Contact us for human assistance with an automated action or an account decision.
6. Recipients and international processing
Information is shared where needed with hosting and storage services, payment processors, email and support services, AI and media providers, authorised social or advertising platforms, and fulfilment suppliers selected for an order. Team members can access information within their workspace permissions. Professional advisers or authorities may receive information where necessary for a legal obligation or claim.
Some providers process information outside the United Kingdom. The countries and applicable protections depend on the selected service. Restricted transfers require an appropriate legal mechanism under applicable data protection law. Contact us for the recipients, locations and safeguards relevant to your account or proposed integration, including how to obtain applicable safeguard information, before supplying data for which you require a particular location restriction.
7. Cookies and similar technologies
Session, authentication, security and preference technologies support the website and signed-in workspace. Optional analytics or advertising technologies may be used where configured and subject to any required choice or consent. Manage cookies through the available choices and your browser; blocking essential cookies can prevent login or checkout. Independently operated storefronts may have their own cookie notices and choices.
8. Retention and security
Retention depends on the purpose and record type. Criteria include whether an account or connection is active, whether content is needed to provide a requested service, configured retention settings, financial or fulfilment obligations, unresolved complaints or disputes, and legal record-keeping duties. Logs and backup copies may remain for their applicable retention period after removal from the active interface. Contact us about a particular category or deletion request.
Access controls, authentication and other technical measures help protect information, but no online service is risk-free. Protect credentials, limit team access and disconnect services no longer needed. Report suspected exposure promptly through our contact email.
9. Disconnecting services and requesting deletion
You can revoke an authorisation through the connected provider's settings and ask us to disconnect the stored connection. Revoking access stops new authorised requests through that permission; it does not itself erase records already lawfully held or remove posts from the provider.
To request removal of a connection, stored provider information, content or an account, email creatorcraftapp@creatorcraft.app and identify the account and information concerned. We may need proportionate checks of identity or authority. Do not send passwords, access tokens or full payment-card details. Some information may need to be retained for legal, security, transaction or dispute purposes, and a separate provider may need a separate deletion request.
10. Your rights and complaints
Depending on applicable law and circumstances, you may request access, correction, erasure, restriction or a portable copy of personal information. You may withdraw consent where processing relies on it without changing the lawfulness of earlier processing.
Your right to object: where applicable, you can object to processing based on legitimate interests and to direct marketing. Contact our email above to exercise that right or another privacy right. Rights can be subject to legal exceptions. If a request concerns a separate workspace owner's customer relationship, we may direct it to that owner or assist them in responding.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or the relevant data protection authority where you live. Please also contact us so we can investigate your concern.
11. Changes and related terms
We will revise this notice when practices change and update the date above. Material changes will be communicated where appropriate. Our Terms and Conditions explain use of the platform. Contact us before submitting information if a feature's handling is unclear.