Creofy Privacy Policy

1. Who We Are

Creofy ("we", "us", or "our") operates the AI creator intelligence platform available at creofy.io. Creofy enables content creators and agencies to generate, schedule, and publish AI-powered content — including synthetic images, videos, avatars, and voice — for social media and marketing campaigns.

Creofy is operated by Creofy Ltd, a company registered in England and Wales under company number 17310018, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Creofy Ltd is the data controller for the personal data described in this policy.

For questions about this policy or your data, contact us at support@creofy.io.

2. Information We Collect

Information you provide

• Account information: Email address, name, and profile data when you sign up via Clerk authentication.
• Social account data: When you connect a social media account (Instagram, TikTok, YouTube, etc.), we store your account ID, username, and encrypted access tokens to enable publishing on your behalf.
• Face reference images: Photographs you upload to create an AI influencer. These are used solely to power your influencer's visual identity across generated content.
• Voice recordings: Audio you provide when using the voice feature. These are used solely to generate a consistent synthetic voice for your influencer's content.
• Brand and campaign content: Scripts, product details, brand assets, and other content you create within the platform.
• Payment information: Billing details processed by Stripe. We do not store card numbers or full payment credentials.
• Support communications: Messages you send to us via email or in-app support.

Information collected automatically

• Usage data: Pages visited, features used, clicks, and interactions with the platform, collected via PostHog analytics.
• Technical data: IP address, browser type, operating system, device identifiers, and session information.
• Error data: Crash reports and error logs collected via Sentry for debugging purposes.
• Cookies and similar technologies: See our Cookie Policy for details.

3. Biometric and AI-Generated Data

Some features of Creofy involve processing data that may be considered biometric or sensitive under applicable law, including:

• Face reference images: Photographs you upload are used solely to power your influencer's AI-generated content. They are not used to identify you or any real person, and are not shared beyond the AI generation providers listed in our sub-processors list.
• Voice recordings: Audio you provide is used solely to generate a synthetic voice for your influencer's content. Voice data is retained for up to 3 years after your last use of the feature, or deleted immediately upon request.
• AI-generated content: Images, videos, and audio generated through Creofy are stored in your account and owned by you, subject to our Terms of Service.

We do not use your uploaded images, voice recordings, or AI-generated content to identify you personally or to build profiles about you beyond the explicit purpose of providing the Creofy service.

Illinois residents: If you are a resident of Illinois and use our face reference or voice cloning features, your data may be subject to the Illinois Biometric Information Privacy Act (BIPA). By using these features, you consent to our collection and storage of biometric identifiers for the purpose of providing the Creofy service. This data will not be sold, leased, or otherwise disclosed except as set out in this policy. You may withdraw this consent by deleting the relevant data from your account or by contacting support@creofy.io.

4. How We Use Your Information

The table below summarises our processing purposes and the lawful basis we rely on (relevant for users in the UK, EU, and similar jurisdictions):

5. AI Model Training

We do not use your personal data, face images, voice recordings, or AI-generated content to train our own AI models. Creofy uses third-party AI providers (listed in Section 6) to process your requests. Each provider's use of data for model training is governed by their own privacy policies and terms, which we recommend you review.

If a third-party provider updates its policies to use customer inputs for training, we will notify you and, where possible, provide an opt-out mechanism.

6. Data Sharing & Sub-processors

We share data only with trusted third-party service providers (“sub-processors”) necessary to operate Creofy — covering infrastructure hosting, AI generation, authentication, payments, analytics, and error monitoring. We do not sell your personal data to any third party.

We will provide at least 14 days' written notice to your registered email address before adding or replacing a material sub-processor. If you have questions or wish to object, email support@creofy.io (subject: Sub-processor objection) within the notice period.

Current sub-processors:

We may also disclose data when required by law, court order, or to protect the rights, property, or safety of Creofy, our users, or the public.

7. Connected Social Platform Data

Creofy lets you connect your own social media accounts so you can publish content and view its performance from one place. We only request the minimum permissions needed, we act only on your explicit instruction, and we store the access and refresh tokens each platform issues encrypted at rest, used solely to operate the features below. We do not sell social platform data to third parties. You can disconnect any account at any time from Settings → Connections, which deactivates it and stops further access.

TikTok

When you connect TikTok, Creofy requests these scopes via TikTok Login Kit, and uses the data only as described:

• user.info.basic: Read your open ID, display name, and avatar to identify and display the connected account in Creofy.
• user.info.profile: Read your TikTok username to display the connected account.
• user.info.stats: Read your follower count, shown in your Creofy dashboard.
• video.list: Read the list and public statistics (views, likes, comments, shares) of videos you have published, to show performance analytics for content posted through Creofy.
• video.upload and video.publish: Upload and publish videos to your TikTok account, only when you explicitly choose to publish or schedule a post. Published videos default to private (visible only to you) unless you explicitly choose wider distribution when publishing.

Creofy's use and transfer of information received from TikTok APIs adheres to the TikTok Developer Terms of Service and applicable TikTok policies. We retain TikTok tokens only while your account stays connected; disconnecting from Settings → Connections, or revoking access from within TikTok itself, immediately and permanently deletes the stored access and refresh tokens from our database. Deleting your Creofy account removes all remaining TikTok account data. See our TikTok Data Deletion page for full details.

Instagram & Facebook (Meta)

When you connect Instagram or a Facebook Page, we request:

• instagram_business_basic / pages_show_list, pages_read_engagement: Read your profile/Page info (username, account ID, follower count) and post engagement.
• instagram_business_content_publish / pages_manage_posts: Publish photos and videos to your account or Page on your behalf, only when you choose to.

For data deletion requests received from Meta, see our Instagram Data Deletion page.

YouTube (Google)

When you connect YouTube, we request:

• youtube.readonly: Read your channel info and video statistics to show performance analytics.
• youtube.upload: Upload videos to your channel on your behalf, only when you choose to publish.

Creofy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. International Data Transfers

Most of our sub-processors are based in the United States. If you are located in the UK, European Economic Area (EEA), or another jurisdiction with data transfer restrictions, your data may be transferred to and processed in the United States or other countries.

For such transfers, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office and the European Commission, or the provider's certification under an applicable adequacy framework (such as the EU-US Data Privacy Framework where applicable).

9. Data Retention

10. Security

We implement industry-standard security measures including encryption of sensitive credentials at rest, encrypted communication for all API traffic, signed and time-limited access to stored media, access controls, and regular security reviews. In the event of a data breach that affects your rights or freedoms, we will notify you and relevant authorities as required by applicable law.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Portability: Receive your data in a portable, machine-readable format.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where we process data based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• No automated decisions: We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

To exercise any of these rights, email us at support@creofy.io with the subject line "Privacy Request". We will respond within 30 days (extendable by a further 30 days for complex requests, with notice).

UK & EU residents

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU, you may contact your national supervisory authority.

California residents (CCPA / CPRA)

California residents have additional rights including the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of the "sale" or "sharing" of personal information.

We do not sell your personal information. We may share certain technical identifiers (such as anonymised usage data) with analytics providers for platform improvement purposes. To opt out of analytics data sharing, email us at support@creofy.io with the subject line "CCPA Opt-Out".

To submit a verifiable consumer request, contact us at support@creofy.io. We will not discriminate against you for exercising your CCPA rights.

12. Children

Creofy is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, contact us at support@creofy.io.

13. Cookies

We use cookies and similar tracking technologies for authentication, analytics, and platform functionality. For full details of the cookies we use and your choices, see our Cookie Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via an in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of Creofy after the effective date of changes constitutes acceptance of the revised policy.

15. Contact Us

For any privacy-related questions, requests, or complaints, contact us at:

Email: support@creofy.io
Subject line for privacy requests: "Privacy Request"

We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days.