Privacy Policy

Account details. Your email address, and your name if you sign in with Google. When you sign in with Google we receive only your basic profile (name, email and profile picture) and a unique account ID. We do not receive your Google password or access to your Gmail, Drive or other Google data.

What you create. The messages you send the assistant, your site drafts and settings, post drafts, domains you connect, and your approval decisions.

Connected tools. If you connect a platform such as Webflow, we store an access token for it, encrypted, and use it only to act on your sites at your request.

Payments. Purchases are processed by our payment provider. We receive the pack you bought, the amount and the payment method type. Card numbers never reach our servers.

Usage and technical data. Credit usage, basic logs (such as request times and errors) and security events, used to run, bill and protect the service.

To provide the service: generating and editing your site, connecting domains, drafting content, and carrying out actions you approve. To bill credits and process purchases. To keep accounts secure and prevent abuse. To send service emails such as sign-in codes, receipts, invitations and approval notices. To improve reliability. We do not use your content to train AI models, and we do not sell or rent personal information.

Your messages and site content are sent to our AI provider, Anthropic, to generate replies and changes. This happens only to serve your request. Results can be wrong, so nothing is published, posted or charged without your approval.

We share data only with service providers that process it on our behalf, under their own security and privacy commitments:

• Anthropic — AI model processing
• Railway — application hosting and databases
• Stripe — payment processing
• Resend — transactional email
• Google — sign-in (when you choose it)
• Webflow and other platforms you connect — to make the changes you ask for
• Cloudflare — DNS for domains you connect

We may also disclose information if required by law, or to protect the rights, safety or security of our users or the service.

CreAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to create and secure your account.

We use a small number of first-party cookies and browser storage entries: one to keep an unsaved draft for up to 30 days, one to keep you signed in, and preferences such as your theme. We do not use advertising or cross-site tracking cookies.

Unclaimed drafts expire after 30 days. Account data and your content are kept while your account is active. Connected-tool tokens are deleted when you disconnect. Billing records are kept as long as the law requires. When you delete your account, we delete or anonymise your data within 30 days, except where we must keep it for legal reasons.

Data is encrypted in transit. Access tokens for connected tools are encrypted at rest. Each workspace is isolated from every other, and access by our staff is limited and logged. No system is perfectly secure, and we will notify you of a breach affecting your data as the law requires.

You can access, correct, export or delete your information, disconnect any connected tool at any time, and ask us questions about how your data is used. Depending on where you live (for example California, the EEA or the UK), you may have additional rights, including to object to or restrict processing. Email contact@creai.dev and we will respond within the time the law requires.

CreAI is not directed to children under 16, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

If we change this policy in a meaningful way, we will update the effective date and let account holders know before the change takes effect.