Privacy Policy

Last Updated: December 15, 2025

1. Introduction

Creava ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Key Points:

• You control your data and can delete it anytime
• We use AI to analyze your content and provide personalized insights
• We never sell your personal data to third parties
• Your creative work remains yours

2. Information We Collect

2.1 Information You Provide

Account Information:

• Email address (for magic link authentication)
• Display name (optional)
• OAuth profile data (if you sign in with Twitter, LinkedIn, or GitHub)

Creative Content:

• Ideas and project descriptions you submit
• Assessment responses (CAP quiz answers)
• Notes, tasks, and goals you create
• Comments and feedback

Social Profile Data (with your consent):

• Public profile information (username, bio, profile picture)
• Public posts and activity (for creative analysis)
• Follower/following counts and engagement metrics

2.2 Automatically Collected Information

Usage Data:

• Pages viewed and features used
• Time spent on the platform
• Click patterns and interaction data
• Mission completions and XP earned

Technical Data:

• IP address (anonymized)
• Browser type and version
• Device information (type, operating system)
• Referring URL and exit pages
• Timestamp of visits

Cookies and Tracking:

• Authentication cookies (session management)
• Preference cookies (theme, language)
• Analytics cookies (aggregated usage patterns)

3. How We Use Your Information

3.1 Core Service Delivery

• Account Management: Authentication, account settings, password reset
• Creative Analysis: AI-powered insights on your ideas and projects
• Personalization: Customized recommendations based on your creative type
• Knowledge Graph: Build connections between your ideas, notes, and goals

3.2 AI Processing

We use AI to:

• Analyze your creative ideas and provide feedback
• Generate suggestions and recommendations
• Detect patterns in your creative work
• Create personalized insights from social profiles
• Suggest relevant content and connections

Note: Your data is processed by industry-leading AI providers under strict data processing agreements. We do not use your data to train publicly available AI models.

3.3 Service Improvement

• Analyze aggregated usage patterns (anonymized)
• Fix bugs and improve performance
• Develop new features
• Conduct research on creativity and productivity

3.4 Communication

• Send magic link authentication emails
• Notify you of waitlist status updates
• Share product updates and new features
• Respond to support inquiries
• Send important service announcements

4. How We Share Your Information

4.1 We DO NOT Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Service Providers

We share data with trusted third-party services:

• Infrastructure: Cloud hosting, database, and storage providers
• AI Providers: Industry-leading AI services for content analysis and insights
• Analytics: Privacy-focused analytics and error monitoring services
• Email: Transactional email delivery services

These providers are carefully selected for security and privacy standards. They are bound by data processing agreements and can only use your data as directed by us.

4.3 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations or court orders
• Protect our rights, property, or safety
• Prevent fraud or abuse
• Cooperate with law enforcement

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership or data control.

5. Data Storage and Security

5.1 Where We Store Data

• Primary database: Secure cloud infrastructure (US region)
• Knowledge graph: Enterprise-grade graph database (cloud hosted)
• File storage: Encrypted cloud storage
• Backups: Encrypted, geographically distributed across multiple regions

5.2 Security Measures

• Encryption: Data encrypted in transit (TLS) and at rest (AES-256)
• Authentication: Magic link (passwordless) and OAuth 2.0
• Access Control: Row-Level Security (RLS) policies on all database tables
• Monitoring: Continuous security monitoring and logging
• Updates: Regular security patches and dependency updates

5.3 Data Retention

• Active Accounts: Data retained while account is active
• Inactive Accounts: After 24 months of inactivity, we may notify you before deletion
• Deleted Accounts: Data permanently deleted within 30 days
• Backups: Deleted from backups within 90 days
• Legal Hold: Some data may be retained longer if required by law

6. Your Rights and Choices

6.1 Access and Portability

• Access: View all your data in your account settings
• Export: Download your data in JSON format (coming soon)
• Portability: Transfer your data to another service

6.2 Correction and Deletion

• Update: Edit your profile, name, and email anytime
• Delete Content: Remove ideas, notes, and other content individually
• Delete Account: Permanently delete your account and all data from Settings

6.3 Privacy Controls

• Social Connections: Connect/disconnect social accounts anytime
• Email Preferences: Opt out of marketing emails (not service emails)
• Analytics: Opt out of analytics tracking (coming soon)

6.4 Rights Under GDPR (EU Users)

If you are in the EU, you have additional rights:

• Right to access your personal data
• Right to rectification (correction)
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

6.5 Rights Under CCPA (California Users)

If you are a California resident, you have the right to:

• Know what personal information we collect
• Know whether we sell or disclose your personal information
• Say no to the sale of your personal information (we don't sell data)
• Access your personal information
• Delete your personal information
• Equal service and price (no discrimination)

7. Social Media Integration

7.1 What We Collect

When you connect a social account:

• Twitter/X: Public profile, tweets, engagement metrics
• LinkedIn: Public profile, posts, connections (aggregated)
• GitHub: Public profile, repositories, activity

7.2 How We Use It

• Analyze your creative interests and themes
• Generate personalized insights
• Suggest relevant content and connections
• Build your knowledge graph

7.3 Your Control

• You can disconnect any account at any time
• Disconnecting removes access but keeps historical analysis
• You can request deletion of social-derived data

8. Children's Privacy

Creava is not intended for users under 13 years of age. We do not knowingly collect personal information from children. If we discover that we have collected data from a child under 13, we will delete it immediately.

Parents who believe their child has provided information to us should contact us at contact@creava.ai.

9. International Data Transfers

Creava operates globally. Your data may be transferred to and processed in countries other than your own. We ensure adequate safeguards are in place through:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements with providers
• Encryption and security measures

10. Cookie Policy

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide you with a better experience by remembering your preferences and understanding how you use our service.

10.2 Types of Cookies We Use

10.3 Third-Party Cookies

We use cookies from trusted third-party services for:

• Authentication: Secure login and session management
• Hosting: Performance optimization and content delivery
• Analytics: Privacy-first, anonymized usage analytics
• Monitoring: Error detection and service reliability

All third-party services are carefully vetted for privacy and security compliance.

10.4 How We Use Cookies

• Authentication: Keep you logged in securely
• Personalization: Remember your preferences and settings
• Analytics: Understand usage patterns to improve the service
• Performance: Optimize load times and user experience
• Security: Detect and prevent fraudulent activity

10.5 Managing Your Cookie Preferences

Browser Controls:

• Most browsers allow you to view, manage, and delete cookies
• You can block all cookies, but this may affect functionality
• Browser settings: Chrome → Settings → Privacy → Cookies
• Private/Incognito mode prevents cookies from being saved

Opt-Out Options:

• Analytics: Disable analytics tracking in your account settings (coming soon)
• Do Not Track: We respect browser Do Not Track (DNT) signals
• Essential Cookies: Cannot be disabled as they're required for core functionality

Note: Blocking or deleting cookies may impact your experience. Some features may not work properly, and you may need to re-enter preferences each time you visit.

10.6 Cookie Lifespan

• Session Cookies: Deleted when you close your browser
• Persistent Cookies: Remain until expiration date or manual deletion
• Authentication: 30 days (extends with each login)
• Preferences: 1 year
• Analytics: 1 year

10.7 Updates to Cookie Usage

We may update our cookie usage from time to time. Any changes will be reflected in this policy with an updated "Last Updated" date. We encourage you to review this section periodically.

11. Third-Party Links

Our Service may contain links to third-party websites (Twitter, LinkedIn, GitHub, etc.). We are not responsible for the privacy practices of these sites. Please review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be effective when posted. For material changes, we will:

• Notify you via email (to your registered email address)
• Display a prominent notice in the app
• Provide 30 days notice before changes take effect

13. Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

• Notify you within 72 hours of discovery
• Explain what happened and what data was affected
• Describe the steps we're taking to address it
• Provide guidance on how to protect yourself
• Notify relevant authorities as required by law

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: contact@creava.ai

Exercise Your Rights

To exercise your privacy rights (access, deletion, correction), email us at contact@creava.ai with:

• Subject line: "Privacy Rights Request"
• Your registered email address
• Specific request (access, delete, correct, etc.)
• Verification information (we'll confirm your identity)

We will respond within 30 days.