Privacy policy

Creatorby
Owner: Sawen Salar Sardar Sedqi
Valeppstrasse 4, 81539 Munich, Germany
Email: support@creatorby.com

When you access our sites, technically necessary connection data such as IP address, time, requested URL, browser/device information and server status is processed to deliver the sites securely, troubleshoot errors and prevent abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the service.

If you contact us, we process your contact details, message and voluntary attachments to handle the request and, where applicable, to take steps before entering into a contract under Article 6(1)(b) or (f) GDPR. The contact form may use hCaptcha to prevent abuse. Security and server logs and contact requests are kept only for as long as required for operation, handling the request, abuse prevention and statutory evidence obligations.

For registration, sign-in and operation of the Creatorby account, we process in particular your email address, display name, profile image, internal user, workspace and Channel Hub IDs, authentication and session data, language and settings. In Hub, we process the ideas, drafts, text, media, publishing plans, dates and other workspace content you create.

This data is required to provide your account and selected features (Article 6(1)(b) GDPR). We also process security-related data on the basis of our legitimate interest in providing a secure service (Article 6(1)(f) GDPR). Without the data required for registration and the relevant feature, we cannot provide the account or that feature.

Execution Planner stores the planner state assigned to your account, including tasks, subtasks, appointments, routines, goals, categories, skills, brain-dump entries, notes, progress, reminder rules and planner settings, so this data can be synchronised across your devices. The legal basis is Article 6(1)(b) GDPR.

For offline use, quick recovery and preferences you select, necessary data is also stored locally in your browser. This may include the latest planner state, synchronisation status, language, appearance and - if you select “Remember email” - your email address. A service worker stores the app shell in the browser cache. This local storage is necessary for the offline and convenience features you expressly request; you can clear it in your browser or app settings.

Login Vault entries are encrypted in your browser before synchronisation. Only the encrypted vault content and cryptographic data required for decryption and recovery are stored. The master password is not stored or transmitted to Creatorby. Without the master password or a valid Recovery Kit, Creatorby cannot recover the vault content.

A platform is connected only after you approve access in that platform's OAuth consent screen. Depending on the platform, Creatorby stores: platform and account ID, display name, username, profile-image URL, granted permissions, expiry time, and encrypted access and refresh tokens. For the features you select, we may also process post IDs and permalinks, publishing status and times, public profile and content metadata, reach, follower and engagement metrics and, for Instagram, comments, conversation participant names and message content.

The data is used only to provide the publishing, planning, analytics, comment or messaging features you select. Creatorby does not sell this data, use it for third-party advertising or use it to train general-purpose AI models. The legal basis is Article 6(1)(b) GDPR and, where platform consent is required, Article 6(1)(a) GDPR. You can disconnect a platform at any time.

• YouTube/Google: basic channel data, uploads and read access to channel data.
• Instagram: business profile, publishing, insights, comments and - where enabled - messages.
• Facebook: managed Pages, Page engagement and publishing Page posts.
• Threads: profile, publishing, insights and replies.
• TikTok: basic profile and video upload; only permissions shown in TikTok's consent screen.
• Pinterest: profile, boards and Pins for reading and Pins for publishing.

Creatorby requests only permissions required for active features. The exact selection is shown in the platform's consent screen. Use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Use of YouTube features is also subject to the YouTube Terms of Service. Information about Google's processing is available in the Google Privacy Policy.

If you voluntarily connect a Google or Microsoft calendar in Execution Planner, we process the provider, account ID, email address, granted permissions, encrypted access and refresh tokens, expiry time and last synchronisation time. For enabled synchronisation, Creatorby sends the appointment data you select, such as title, description, date, time, time zone and location, to your calendar and stores the external event ID in your planner state.

Google is connected with permission for calendar events you own; Microsoft with the calendar permissions shown in its consent screen. The connection is used to provide the synchronisation you select under Article 6(1)(b) GDPR and can be revoked at any time.

Browser reminders are enabled only after you grant permission. For push notifications, we store your browser's encrypted push subscription, a hash of its endpoint, language, time zone, delivery status and technical delivery records. To identify reminders that are due, the server processes due dates and reminder rules stored in your planner state. The message sent deliberately contains no task or appointment title, only a general notice that you have a reminder in the planner.

The legal basis is Article 6(1)(b) GDPR and the permission you grant in your browser. You can disable notifications at any time in the planner or browser settings.

If you purchase a paid plan, Stripe processes the payment. Creatorby stores the Stripe customer and subscription ID, plan, status, billing period, cancellation status and required invoice or payment records. Full card or bank-account details are not stored by Creatorby. The legal basis is Article 6(1)(b) GDPR; records required by accounting and tax law are processed under Article 6(1)(c) GDPR.

Creatorby uses authentication and session information and local storage and caching technologies where strictly necessary for sign-in, security, language, appearance, offline use, synchronisation and other features you expressly request. The legal bases are Section 25(2)(2) TDDDG and, where personal data is processed, Article 6(1)(b) or (f) GDPR.

Creatorby currently does not use non-essential advertising or tracking cookies. If analytics, marketing or other non-essential technologies are introduced in the future, they will be enabled only after obtaining any required consent.

We use Vercel for hosting and delivery and Supabase for database, authentication and file storage. Depending on enabled features, Stripe may process payments, Resend may send transactional emails, hCaptcha may provide abuse prevention, browser push services may deliver notifications, and Google, Microsoft and connected social-media platforms may be used. These recipients receive data only to the extent required for the feature you use.

Required data-processing agreements are concluded with processors. Where data is processed outside the European Economic Area, transfers are based - depending on the recipient - on an adequacy decision, in particular the EU-US Data Privacy Framework, or appropriate safeguards such as EU Standard Contractual Clauses.

We generally store account data and content you create for the duration of the contract and use of the service. Data belonging to a social-media connection is deleted or rendered unusable when that connection is disconnected, unless it is independently required for a feature you have saved. Calendar connection data is removed when the connection is deleted, upon a deletion request or, at the latest, when the account is deleted. Expired OAuth transition states are stored only briefly for the connection flow. Push subscriptions are disabled or deleted when you disable them or they become technically invalid. Local data remains on your device until you remove it in the browser or app.

YouTube API data is deleted as soon as possible and no later than seven calendar days after revocation. Contract, payment or tax records subject to statutory retention duties may remain stored for the legally required period independently of account or connection deletion. Details and step-by-step instructions are available on the data deletion page.

Subject to applicable law, you have rights of access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time with effect for the future. Where we process data on the basis of legitimate interests, you may object for reasons arising from your particular situation. Creatorby does not make decisions based solely on automated processing that produce legal or similarly significant effects.

You can export planner data yourself and delete your shared Creatorby account in Execution Planner under Settings → Creatorby account → Delete account. Alternatively, you can contact us. You may also lodge a complaint with a data protection authority; the Bavarian Data Protection Authority is the competent German authority in particular. Send requests to support@creatorby.com or use our contact form.

We update this policy when features, service providers or legal requirements change. We will provide reasonable notice of material changes. The current version is always publicly available on this page.