Privacy Policy

Information we collect

Account data. Your name and email address when you sign up, used to authenticate you and communicate about the service.

Connected social accounts. When you connect a platform (TikTok, Instagram, LinkedIn, or YouTube) via OAuth, we receive and store access and refresh tokens plus your public account identifier, display name, and profile image. These tokens are encrypted at rest and are used only to publish on your behalf and keep the connection healthy.

Content you send. Post captions, media references, and scheduling options you submit through our API or dashboard, in order to publish them to your connected accounts.

Usage & technical data. API request metadata (endpoint, timestamp, status) for rate limiting, abuse prevention, and debugging.

How we use your data

To provide the service (publish your content, refresh tokens, deliver webhooks), enforce plan limits, prevent abuse, and support you. We do not sell your data or use your content to train models.

Sharing

We share data only with the social platforms you connect (to publish your content) and infrastructure providers that run the service (hosting, database, object storage). We do not share your data with advertisers.

Google user data (YouTube)

What we access. If you connect a YouTube channel, Creasion requests the scopes youtube.readonly and youtube.upload. Using them we access only: your channel’s ID, title, and thumbnail image (read once via channels.list), and the OAuth access and refresh tokens Google issues. We do not access your YouTube analytics, subscriber data, comments, watch history, or any other Google user data.

How we use it. The channel ID, title, and thumbnail are used solely to display which channel is connected in your dashboard and to target uploads to the correct channel. The tokens are used solely to upload the videos you explicitly choose to publish (videos.insert). Nothing is uploaded without your explicit action in the app.

How we share it. We do not sell, rent, or transfer Google user data to any third party. It is not shared with advertisers, data brokers, or analytics providers. It is processed only by the infrastructure providers that operate Creasion (hosting, database, object storage) strictly to deliver the features you use.

How we protect it. OAuth tokens are encrypted at rest with AES-256-GCM, transmitted over TLS, and accessible only to the service processes that publish on your behalf. Access to the production environment is restricted.

Retention & deletion. We retain Google user data only while your channel is connected. Disconnecting the channel deletes its stored tokens and channel details immediately. Deleting your Creasion account removes all associated data. You can also revoke Creasion’s access at any time from your Google account permissions page.

Limited Use. Creasion’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, credit or lending decisions, or to develop, improve, or train generalised AI/ML models, and we do not transfer it to third parties for those purposes.

Data retention & deletion

You can disconnect a social account at any time, which removes its stored tokens. You can delete your account to remove your personal data. Request deletion or ask questions at support@creasionapp.com.

Security

Social tokens are encrypted at rest. API access requires a bearer key you can revoke at any time. We take reasonable measures to protect your data, though no method of transmission or storage is 100% secure.

Who is responsible for your data

Creasion is the data controller for the personal data described in this policy. Contact us about anything in it at support@creasionapp.com.

Legal basis for processing (GDPR Art. 6)

If you are in the European Economic Area or the United Kingdom, we process your personal data on these grounds:

Performance of a contract. Your account data, connected social accounts, OAuth tokens and the content you submit are processed because they are necessary to provide the service you signed up for. Without them we cannot publish anything on your behalf.

Legitimate interests. API request metadata is processed to enforce plan limits, prevent abuse, and debug failures. Our interest is keeping the service reliable and available; we balance it by keeping this data minimal and never using it to profile you or to build advertising audiences.

Legal obligation. Billing and transaction records are retained where tax and accounting law requires it.

What Meta receives, and only with your consent. If you accept advertising cookies, we report two events to Meta from our own server: that you created an account, and that you subscribed. Each carries your email address and your account id as irreversible SHA-256 hashes, never in the clear, plus your IP address and browser user agent, which Meta requires to match the event. We send nothing else: no posts, no connected accounts, no usage. If you reject or withdraw, we send nothing at all.

Consent. We rely on consent for one thing only: advertising cookies, which measure whether an ad we ran brought someone here. Nothing is set before you choose, rejecting is a single click, and you can withdraw at any time from the cookie policy. Refusing changes nothing about the service you receive.

Your rights (GDPR Art. 15–22)

If you are in the EEA or UK you have the right to access your data, to have inaccurate data rectified, to request erasure, to restrict or object to processing, and to receive your data in a portable format. Where processing rests on consent, you may withdraw it at any time.

Exercise any of these by emailing support@creasionapp.com. We respond within 30 days, free of charge. Much of it is also immediate and self-service: disconnecting a social account deletes its tokens straight away, and deleting your account removes your personal data.

You also have the right to lodge a complaint with your national data protection supervisory authority. You can find yours through the European Data Protection Board. We would rather you contacted us first, but that is your right, not a requirement.

International transfers

Creasion is operated from Indonesia and runs on infrastructure located in the United States. If you are in the EEA or UK, using the service means your data is transferred outside your country.

These transfers rely on the Standard Contractual Clauses adopted by the European Commission, which our infrastructure providers incorporate into their data processing agreements. We keep the data transferred to the minimum needed to run the service.

Processors we use

These providers process data on our behalf under data processing agreements. They may not use it for their own purposes.

Railway (United States): application hosting and the PostgreSQL database holding your account, connected accounts and posts.

Amazon Web Services (United States): S3 for the media you upload, SES for transactional email such as password resets.

Paddle (United Kingdom / European Union): our reseller and Merchant of Record. Paddle is an independent controller for payment data: your card details are given to Paddle, never to us, and we never see or store them.

The social platforms you connect (TikTok, Instagram, LinkedIn, YouTube, Threads, Facebook) receive the content you choose to publish. Each is an independent controller for what happens on its own service, under its own privacy policy.

How long we keep things

Account data: until you delete your account, then removed.

OAuth tokens: until you disconnect that account or delete yours, then removed immediately.

Posts and media: until you delete them or your account. Note that content already published to a social platform lives on that platform under its own rules; deleting it here does not delete it there.

API request logs: up to 90 days, for abuse prevention and debugging.

Billing records: as long as tax and accounting law requires, typically 7 years.

Cookies

We use only cookies that are strictly necessary for the service plus the theme and language you choose yourself. No analytics, no advertising, no tracking. Every cookie is named and explained on our Cookie Policy page.

Children

Creasion is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, email support@creasionapp.com and we will delete it.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for you.

Changes

We may update this policy; material changes will be reflected by the “Last updated” date above.

Contact

Questions about this policy? Email support@creasionapp.com.