Privacy notice (draft)

This notice explains what personal data Creativital (creativital.space) collects, why, who processes it for us and what you can do about it. It describes the product as it works today.

Who is responsible

The controller is Rostyslav Chonka, Karpatské námestie 7770/10A, 831 06 Bratislava, Slovakia, company ID 56336047. Contact for any privacy question or request: support@creativital.space.

What the product does

You set up topics (a few keywords, reference channels and optional voice sample). We look up public YouTube videos and Shorts for those topics, compare each video with its channel's usual views, and show the strongest ones on a board. You can see why a video worked, keep openings in My openings and draft scripts. Ready topics can also follow public Instagram business and creator accounts through the official Instagram API. TikTok is not supported.

What we store

• Account data: name, email, a hash of your password (never the password itself), sessions and sign-in records.
• Profile and settings: the roles, topics, markets and languages you choose, and your voice sample if you add one.
• Your work: topics, saved and dismissed videos, video analyses, openings, scripts, notes, collections and feedback.
• Public video data we fetch for your topics from the YouTube API: titles, descriptions, channel names, view, like and comment counts, subscriber counts, publish dates and thumbnail links. This is public data about videos, cached for at most 30 days and shared between users following the same topic. See YouTube data.
• Transcripts you paste. They are private to you and are never shared with other users.
• Subscription status from Stripe. We never see or store card numbers.
• Usage records for plan limits: counts, model name and a cost estimate. These records do not contain your prompts or scripts.
• Server logs with error messages. We do not log request bodies.

YouTube data

Creativital uses YouTube API Services. When you use Creativital you also agree to the YouTube Terms of Service, and Google handles the requests we send to YouTube under the Google Privacy Policy.

• What we read: public data about videos and channels (titles, descriptions, thumbnails, publish dates, view, like, comment and subscriber counts) found with your topic keywords and the channels you add. We use only the official YouTube API. We do not download videos and we do not fetch transcripts of YouTube videos from other services; you paste them if you want.
• What we calculate: the view multiplier and views per day. These are Creativital estimates based on public view counts, not YouTube metrics.
• How long we keep it: at most 30 days. At least once a day we delete or refresh YouTube data, so nothing is kept for more than 30 days. The same goes for the estimates based on it. Videos you saved, explained or kept as an opening are read again from the YouTube API before they turn 30 days old; your own notes, analyses and scripts stay until you delete them.
• How to delete it: deleting a topic removes its board. Deleting your account in Settings, then Privacy & data, removes everything you saved, including analyses, openings, scripts and pasted transcripts. Cached public video data is not linked to you and expires on its own after 30 days. You can also write to support@creativital.space and we will delete what we hold within 7 days.
• Creativital does not currently ask for access to your Google or YouTube account. If we add that later, you will be able to remove our access at any time on the Google security settings page, and we will delete the data we got through that access.

Instagram data

Ready topics such as Social media trends follow public Instagram business and creator accounts. Creativital reads them only through the official Instagram Graph API from Meta (Business Discovery), never by scraping. Meta handles these requests under the Meta Privacy Policy.

• What we read: for each followed account, its username and its follower and post counts; for its recent posts, the caption, like and comment counts (when the owner shows them), post type, link and date. We do not store or show images, videos or profile pictures, and we cannot read personal or private accounts.
• What we calculate: how many times more likes and comments a post got than that creator usually gets. This is a Creativital estimate based on public likes and comments, not an Instagram metric, and it is not based on views.
• How long we keep it: at most 30 days. Every day we read the followed accounts again and delete posts and accounts older than 28 days, as well as accounts that no topic follows any more. Your own analyses, openings, scripts and the words you paste stay until you delete them.
• This is data about public business and creator accounts. It is shared between users of the same topic and is not linked to you. We do not sell it and do not use it to build profiles of people. Account owners can ask us to remove their data at support@creativital.space.
• Creativital does not ask for access to your Instagram or Facebook account.

Waitlist (pre-registration)

If you join the waitlist we store your email, the role you optionally pick, a short tag for where you came from (for example a campaign name or the referring site, never the full address) and when you agreed. We use double opt-in: we send one email asking you to confirm your address, and we only send launch emails after you confirm. We use the list to tell you when your spot opens and for occasional launch updates. Every email has an unsubscribe link. Unconfirmed sign-ups are deleted after 12 months, and you can ask us to remove your address at any time.

Who processes data for us

• Google (YouTube API Services): we send your topic keywords and channel IDs to search and read public video data. See YouTube data.
• Meta (Instagram Graph API): we send the usernames of the creators a ready topic follows, to read their public posts. See Instagram data.
• Anthropic: to explain why videos worked and to draft scripts we send video metadata and transcripts, your topic settings, your script topic and your voice sample. We do not send your email, billing data or wellbeing data. Under Anthropic's commercial terms this data is not used to train their models.
• Stripe (only once payments are switched on): payments, invoices, tax calculation and subscription management. Stripe receives your email and payment details directly.
• Resend (only once emails are switched on): sends account and waitlist emails. It receives your email address and the content of the email.
• Hetzner Online GmbH: hosting of the website, the app and its Postgres database on a server we rent, region EU (Nuremberg, Germany). The data stays in the EU.

Some of these providers are outside the EU. Where they are, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

Analytics and cookies

Strictly necessary cookies keep you signed in, remember your consent choice and, if you pick one, your language. Optional tools, namely Google Tag Manager, Google Analytics 4 and the Meta pixel, load only after you agree in the cookie banner. You can change your choice at any time with the Cookie settings link in the footer. Details are on the cookie page.

Optional wellbeing check-ins

The Focus page offers optional check-ins (for example energy, stress and a short note). They are off by default, stored only after your separate explicit consent, visible only to you, excluded from analytics and never sent to AI providers. You can switch the feature off and delete all check-ins at any time.

Why we process data (legal bases)

• To provide the service you signed up for: contract.
• Waitlist and launch emails, optional analytics and wellbeing check-ins: your consent, which you can withdraw at any time.
• Invoices and tax records: legal obligation.
• Security, abuse prevention and rate limiting: legitimate interest.

How long we keep data

• Account data and your work: while your account exists. Deleting the account removes it.
• Waitlist entries: until you sign up, unsubscribe or ask us to remove them. Unconfirmed entries are deleted after 12 months.
• Beta accounts: until you delete the account, and at the latest 12 months after the beta ends.
• Feedback and other emails you send to support@creativital.space: up to 12 months.
• Server logs: 30 days.
• Cached public YouTube data and the estimates based on it: at most 30 days, then deleted or read again from the YouTube API. It is not linked to you.
• Cached public Instagram data and the estimates based on it: at most 30 days, then deleted or read again through the Instagram API. It is not linked to you.
• Invoices and payment records: kept by Stripe and by us for as long as tax law requires.

Your rights and controls

• Export all your data as JSON from Settings, then Privacy & data. Saved items can also be exported as Markdown or CSV.
• Delete your account and all your content from the same page. An active subscription is cancelled first.
• You can ask for access, correction, deletion, restriction or portability, and object to processing, by writing to support@creativital.space.
• You can complain to your local data protection authority.

Changes

If we change how we use your data, we update this page and, for significant changes, tell signed-in users by email.