Privacy Policy

Account details. Your email address, and your name if you sign in with Google. When you sign in with Google we receive only your basic profile (name, email and profile picture) and a unique account ID. We do not receive your Google password or access to your Gmail, Drive or other Google data.

What you create. The messages you send the assistant, your site drafts and settings, post drafts, domains you connect, and your approval decisions.

Connected tools. If you connect a platform such as Webflow, we store an access token for it, encrypted, and use it only to act on your sites at your request.

Payments. Purchases are processed by our payment provider. We receive the pack you bought, the amount and the payment method type. Card numbers never reach our servers.

Usage and technical data. Credit usage, basic logs (such as request times and errors) and security events, used to run, bill and protect the service.

To provide the service: generating and editing your site, connecting domains, drafting content, and carrying out actions you approve. To bill credits and process purchases. To keep accounts secure and prevent abuse. To send service emails such as sign-in codes, receipts, invitations and approval notices. To improve reliability. We do not use your content to train AI models, and we do not sell or rent personal information.

Your messages and site content are sent to our AI providers (Anthropic, and Meta where that model is in use) to generate replies and changes. Descriptions of images for your posts are sent to Hugging Face and its hosting partners to create those images. This happens only to serve your request. Results can be wrong, so nothing is published, posted or charged without your approval.

We share data only with service providers that process it on our behalf, under their own security and privacy commitments:

• Anthropic — AI model processing
• Meta — AI model processing (Meta Model API), where enabled
• Hugging Face and its inference partners (such as fal) — image generation
• Railway — application hosting and databases
• Stripe — payment processing
• Resend — transactional email
• Google — sign-in (when you choose it)
• Webflow and other platforms you connect — to make the changes you ask for
• Postiz (run by Creai) and the social networks you connect — to publish the posts you approve
• Railway (storage on Tigris) — photos, videos and PDFs you upload, encrypted at rest; you can delete them any time under Files
• Cloudflare — DNS for domains you connect, and registration of domains you buy (your registrant name, address, email and phone go to the registry, with WHOIS privacy where the domain ending allows it)
• Google Fonts and esm.sh — fonts and open-source code libraries loaded by site and app previews (they see the viewer's IP address, as any website font or library host does)

We may also disclose information if required by law, or to protect the rights, safety or security of our users or the service.

Creai's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to create and secure your account.

We use a small number of first-party cookies and browser storage entries: one to keep an unsaved draft for up to 30 days, one to keep you signed in, and preferences such as your theme. We do not use advertising or cross-site tracking cookies.

Unclaimed drafts expire after 30 days. Account data and your content are kept while your account is active. Connected-tool tokens are deleted when you disconnect. Billing records are kept as long as the law requires. When you delete your account, we delete or anonymise your data within 30 days, except where we must keep it for legal reasons.

Data is encrypted in transit. Access tokens for connected tools are encrypted at rest. Each workspace is isolated from every other, and access by our staff is limited and logged. No system is perfectly secure, and we will notify you of a breach affecting your data as the law requires.

You can access, correct, export or delete your information, disconnect any connected tool at any time, and ask us questions about how your data is used. Depending on where you live (for example California, the EEA or the UK), you may have additional rights, including to object to or restrict processing. Email contact@creai.dev and we will respond within the time the law requires.

Creai is not directed to children under 16, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Creai is operated from the United States, and our providers process data in the United States and other countries. If you are in the EEA or the UK, this means your information is transferred outside your country; we rely on the transfer safeguards our providers offer, such as the European Commission's standard contractual clauses, and we only use providers that commit to protecting it.

Creai drafts sites, apps and posts automatically, and reviews its own work before showing it to you. These are suggestions, not decisions about you: nothing is registered, published, posted or charged without your approval, and no automated profiling affects your legal rights.

If we change this policy in a meaningful way, we will update the effective date and let account holders know before the change takes effect.