Privacy Policy

Effective EFFECTIVE_DATE · Last updated LAST_UPDATED

Draft — not yet in force. These documents are a working draft. Company details are not filled in and they have not been reviewed by a lawyer, so they do not yet bind anyone. CreatorBase is invite-only and free during this period. If you need the finalised terms before using it, ask us.

In short

We collect what the product needs to work: your email, the brand and voice details you enter, the content you create, and metrics from platforms you connect. We send some of it to AI providers to generate drafts. We do not sell it, and you can export or delete it at any time.

This summary is for orientation only. The numbered sections below are the actual terms.

1.Who we are

CreatorBase is operated by People In Tech LLC, ENTITY_TYPE ("we", "us"). Our postal address is POSTAL_ADDRESS.

For anything in this policy, including a request to access or delete your data, write to [PRIVACY_EMAIL](mailto:PRIVACY_EMAIL).

For the personal data of people who hold a CreatorBase account, we are the controller. Where you use CreatorBase to process personal data of your own audience or of other creators, see Third-party creator data and our Data Processing Addendum.

2.What we collect, and why

Every category below exists because a specific feature needs it. If a feature is one you do not use, that data is not collected.

What	Why	Legal basis (UK/EU)
Your email address	It is your account identifier. Sign-in is a one-time link sent to it, so there is no password to store or lose.	Performance of a contract
Brand details you enter — niche, content pillars, audience, goals	Drafts are written against them. This is the single biggest driver of output quality.	Performance of a contract
Voice samples — writing of yours that you paste in	So drafts sound like you rather than like a language model.	Performance of a contract
Content you create — drafts, posts, scripts, images, revisions	It is the product. Revisions are kept so you can go back.	Performance of a contract
Your conversations with Friday, including dictated audio and its transcript	So an assistant that remembers last week is possible at all.	Performance of a contract
Metrics from platforms you connect — views, likes, comments, followers	Analytics, and detecting when an old post starts moving again.	Performance of a contract
API keys for services you connect	To publish and fetch analytics on your behalf. Encrypted at rest; never returned to the browser once saved.	Performance of a contract
Usage and cost records — which features you ran, tokens consumed, spend	To keep the service affordable and to stop a runaway job. Also how we work out fair pricing.	Legitimate interests
Waitlist details — email, what you make, where you heard about us, a hashed IP	To decide who to invite and to stop bulk signups.	Consent
Basic server logs — request paths, timestamps, error traces	Security and debugging.	Legitimate interests

We do not run advertising, we do not run third-party analytics or tracking pixels, and we do not sell or rent personal data to anyone. There is no advertising identifier to opt out of because there is no advertising.

3.Audio, dictation and voice

CreatorBase is voice-first, so this deserves its own section.

Dictation. Audio is sent to our transcription provider, turned into text, and the text is kept as part of your conversation. We do not retain the audio file after transcription.
Realtime voice. Your browser connects directly to the voice provider using a short-lived token we issue. During that session the audio stream does not pass through our servers, which also means we cannot see or record it. The provider can — see their terms, linked from our sub-processor list.
Microphone access is requested only when you start a voice session and stops when you end it.

4.AI providers and how your data is used by them

Generating a draft means sending context to a model: your brand details, your voice samples, the relevant content, and your instruction. That is unavoidable — it is what makes the output yours rather than generic.

We use the providers listed in our sub-processor list, under their standard business terms.
We do not consent to your content being used to train third-party models, and we select provider tiers and settings intended to prevent it. We cannot audit a provider's internal practices, so we are telling you what we have contracted for, not what we have verified.
Providers retain inputs and outputs for a limited period for abuse monitoring. Retention windows are theirs, not ours, and are stated in their policies.
We do not use your content to train models of our own.

Do not put anything into CreatorBase that would be damaging if a third-party AI provider held it — client secrets, unreleased financials, personal health information, government identifiers. It is a content marketing tool, and it is not built to be a vault.

5.Third-party creator data

This is the part of the product with the most privacy weight, and we would rather explain it than bury it.

CreatorBase can analyse public posts by other creators — to explain why something performed, and to track accounts you choose to watch. To do that it retrieves publicly visible information from those platforms, sometimes through a third-party data provider, and stores it: the post text, engagement counts, the author's handle and public profile details.

That information can be personal data about a person who has no account with us and has never heard of us.
We only retrieve what is publicly visible without signing in, and only for accounts or posts a user specifically asks about.
We do not build advertising profiles, we do not attempt to find contact details, and we do not resell this data.
We keep it only while it is being used for analysis, and delete it with the account that requested it.
If you are a creator and want material about you removed, write to [PRIVACY_EMAIL](mailto:PRIVACY_EMAIL) and we will delete it. You do not need an account with us to ask, and we will not ask you to justify the request.

Honest limitation: collecting public posts at scale sits in genuinely unsettled legal territory, and platform terms often prohibit it regardless of what privacy law permits. We are deliberately conservative — narrow scope, on request only, deleted on request — and we are actively moving these features onto official platform APIs where they exist.

6.Platforms you connect

When you connect a publishing or analytics account, you authorise us to act on it within the scope you granted.

We store the credential or key encrypted, and use it only for actions you or your schedules trigger.
We read the metrics needed for your analytics. We do not read your direct messages.
Disconnecting a platform stops all access immediately. Content already published stays published — it lives on that platform, not here.
Each platform has its own privacy policy governing what it does with the activity we send it.

7.Automated decision-making

CreatorBase generates drafts, scores content, and produces suggestions automatically. None of it has a legal or similarly significant effect on anyone: nothing publishes without a human action or a schedule you set up, and no automated process decides whether you get access, what you pay, or whether your account continues.

You are never required to accept a suggestion, and you can edit or discard anything the system produces.

8.Email we send you

Service email — sign-in links, and notifications about your own account and scheduled work. These are part of the service and cannot be turned off while you have an account, apart from the optional digests below.
Digests and briefs — the daily or weekly summary of your own content. Configurable in settings, and switchable off.
Product and marketing email — only if you asked for it. Every message carries a one-click unsubscribe, and unsubscribing takes effect immediately and permanently.

Waitlist signup subscribes you to news about the waitlist itself, nothing more. Marketing email is a separate, unticked choice on that form, exactly because bundling them together is not real consent.

9.How long we keep things

Data	Retention
Account and content	While your account is open.
After you delete your account	Deleted within 30 days. The grace period exists so an accidental deletion is recoverable.
Backups	Rolling encrypted backups, overwritten within 30 days.
Usage and billing records	Kept as long as tax and accounting law requires, typically 7 years. Aggregate figures only, no content.
Server logs	90 days.
Third-party creator data	Deleted with the account that requested it, or on request from the creator concerned.
Waitlist entries	Until you are invited or you ask us to remove you; unclaimed entries are cleared after 24 months.
Unsubscribe records	Kept indefinitely. This is the only way to guarantee we never email you again.

10.Your rights

Wherever you live, you can ask us to:

Access a copy of your data, in a portable format.
Correct anything wrong.
Delete your account and its data.
Restrict or object to processing based on legitimate interests.
Withdraw consent where consent is the basis, including for marketing.
Complain to your data protection authority. In the UK that is the ICO; in the EU, your national authority.

Write to [PRIVACY_EMAIL](mailto:PRIVACY_EMAIL). We will respond within 30 days and will not charge you or make you explain why.

If you are in California: we do not sell or share personal information as CCPA/CPRA define those terms, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising any right.

11.Where your data is processed

Our infrastructure and providers are primarily in the United States. If you are outside the US, your data is transferred there.

For transfers out of the UK/EEA we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with each provider. Our sub-processor list names them and their locations.

12.Security

Detail is in our Security Overview. In short: encrypted in transit and at rest, row-level database isolation between accounts, connector keys encrypted with a key held outside the database, and passwordless sign-in so there is no password to breach.

Report a vulnerability to [SECURITY_EMAIL](mailto:SECURITY_EMAIL). We will not pursue you for good-faith research that follows our disclosure terms.

13.Children

CreatorBase is not for anyone under 16. We do not knowingly collect their data, and if we learn we have, we delete it. If you believe a child has an account, tell us at [PRIVACY_EMAIL](mailto:PRIVACY_EMAIL).

14.Changes to this policy

We will update the date at the top when this changes. For a change that materially reduces your privacy we will email account holders at least 30 days beforehand.

This policy takes effect on EFFECTIVE_DATE.