Last updated: 6 September 2026.
This notice explains personal information handling for the CreatorCraft website and platform at creatorcraft.app. CreatorCraft is our trading name, not a claim of limited-company incorporation. For privacy questions or requests, email creatorcraftapp@creatorcraft.app or write to CreatorCraft, 61 Bridge Street, Kington, HR5 3DJ, United Kingdom.
CreatorCraft manages information needed to operate its platform and customer relationship. Where a workspace owner uses the platform to manage information about their own customers or audience, that owner also determines how that information is used. Check the relevant storefront or business privacy notice for those activities; this notice does not replace it.
Depending on the features you use, the platform processes account and contact information; login and security records; workspace membership and permissions; brands, sites and campaign settings; support messages; content, files, prompts and generated output; and usage, credit and workflow records.
Connected services may provide authorised account identifiers, profile information, publishing permissions, posts, media, comments, messages and performance information, according to the service and scopes you approve. Not every connection provides every category. OAuth tokens and API credentials are used to authenticate the permitted connection.
Commerce and billing features may process order details, billing or delivery information, transaction references, payment status, refunds and fulfilment information. Payment providers such as Stripe process card payments. Do not send full card details through support messages.
Technical information can include IP addresses, browser or device information, request logs and security events. Information may come from you, your authorised team, connected providers or people who interact with your published content and stores.
We use information to supply requested accounts and services, process orders, maintain connections and answer service requests. Where necessary to fulfil an agreement with you, the basis is performance of that contract. Information required for those functions must be provided for the function to work.
Security, fraud prevention, troubleshooting and proportionate service administration rely on legitimate interests in maintaining a safe and reliable platform, where those interests are not overridden by your rights. Accounting, legally required records and responding to binding legal requests rely on legal obligations.
Where consent is required, including for applicable optional tracking or marketing, it must be obtained for that activity and can be withdrawn. Revoking provider access stops our ability to make new authorised requests through that connection, but does not itself erase records already lawfully held.
When you select an AI or media feature, the relevant prompts, content, files and context may be sent to the provider needed to perform that task. Avoid including sensitive personal information that the task does not require. Provider processing and retention depend on the selected service and its terms; contact us if you need the provider details for a particular feature.
When you authorise publishing, approved content and associated metadata are sent to the selected destination. Public posts and sites may be accessible worldwide and copied by others. Scheduled workflows and agents may act on your configured instructions and permissions. Review those settings before enabling them. You can contact support about an automated action or request human assistance with an account decision.
Information is shared where needed with hosting and storage services, payment processors, email and support services, AI and media providers, authorised social or advertising platforms, and fulfilment suppliers selected for an order. Authorised team members can access information within their workspace permissions. Professional advisers or authorities may receive information where necessary for a legal obligation or claim.
Some providers process information outside the United Kingdom. The destination and applicable protection depend on the connection and service. Where a restricted transfer takes place, an appropriate legal transfer mechanism is required. Contact us for the recipients, countries and safeguards relevant to your account or a proposed integration before supplying data for which you need a specific location restriction.
Session, authentication, security and preference technologies support the website and signed-in workspace. Optional analytics or advertising technologies may be used where configured and subject to any required choice or consent. You can manage cookies in your browser; blocking essential cookies can prevent login or checkout. Individual storefronts may have separate cookie choices and notices.
Retention depends on the purpose and record type. Relevant factors include whether your account or connection is active, whether content is still needed to provide the service, configured retention settings, payment or fulfilment obligations, unresolved complaints or disputes, and legal record-keeping requirements. Logs and backup copies may remain for their applicable retention period after information is removed from the active interface.
Access controls, authentication and other technical measures help protect information, but no online service is risk-free. Keep credentials secure, limit team permissions and disconnect services you no longer need. Report suspected exposure promptly to our support email.
Depending on the law and circumstances, you may request access, correction, erasure, restriction or a portable copy of your personal information, or object to certain uses. You may withdraw consent where processing relies on it, without changing the lawfulness of earlier processing. Some records cannot be erased immediately because they are needed for a legal obligation, dispute or another applicable exception.
Email us to make a request, specifying the account or activity concerned. We may need proportionate identity or authority checks before disclosing or deleting information. Do not send passwords or full payment-card details. If the information belongs to a separate workspace owner's customer relationship, we may direct your request to that owner or assist them in responding.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to the relevant data protection authority where you live. Please contact us as well so we can investigate your concern.
We will revise this notice when platform practices change and update the date above. Material changes will be communicated where appropriate. For questions about a feature not covered clearly here, contact us before submitting personal information.