1. Introduction
CreaScale AI ("we", "us", "our") operates the website creascale.ai and provides AI-powered ad creative generation services (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
By using CreaScale AI, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
- Name, email address
- Password (encrypted, never stored in plain text)
- Onboarding survey responses (role, niche, experience level)
2.2 Payment Information
- Billing information processed securely through Stripe
- We do not store credit card numbers on our servers
- Stripe Connect data for affiliate payouts
2.3 Usage Data
- Landing page URLs and product descriptions you submit
- Generated creatives, ad copies, and campaign data
- Product images you upload
- Pipeline run history and preferences
2.4 Automatically Collected Data
- IP address, browser type, device information
- Pages visited, time spent, referral source
- Cookies and similar tracking technologies
3. How We Use Your Information
- To provide, maintain, and improve the Service
- To process payments and manage subscriptions
- To generate AI-powered ad creatives based on your inputs
- To communicate with you about your account, updates, and support
- To manage the affiliate program and process commissions
- To detect and prevent fraud, abuse, and security threats
- To comply with legal obligations
4. Data Sharing and Third Parties
We do not sell your personal information. We share data only with:
- Supabase — database hosting and authentication
- Stripe — payment processing and affiliate payouts
- Anthropic (Claude AI) — AI processing for creative generation (your data is not used to train models)
- Google (Gemini) — AI image generation (your data is not used to train models)
- Render — application hosting
- Google Analytics & Meta Pixel — anonymized usage analytics
All third-party providers are bound by their own privacy policies and data processing agreements.
5. Data Security
- All data is encrypted in transit (TLS/SSL) and at rest
- Passwords are hashed using industry-standard algorithms
- Row Level Security (RLS) ensures users can only access their own data
- Regular security audits and penetration testing
- Image metadata is stripped from generated creatives before delivery
- API keys and secrets are stored in encrypted vaults
6. Data Retention
We retain your data for as long as your account is active. Upon account deletion:
- Personal data is deleted within 30 days
- Generated creatives and uploads are permanently removed from storage
- Anonymized usage statistics may be retained for analytics
- Financial records are retained as required by law (typically 7 years)
7. Your Rights
You have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Deletion — request deletion of your data
- Portability — export your data in a standard format
- Objection — opt out of certain data processing
- Withdraw consent — at any time, without affecting prior processing
To exercise these rights, contact us at support@creascale.ai.
8. Cookies
We use essential cookies for authentication and session management. We also use analytics cookies (Google Analytics, Meta Pixel) to understand usage patterns. You can disable non-essential cookies in your browser settings.
9. Children's Privacy
CreaScale AI is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.
10. International Data Transfers
Your data may be processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers.
11. Government and Law-Enforcement Requests
We may receive requests from public authorities for personal data. We handle every such request under the following policy:
- Legality review — every request is reviewed for legal validity before any data is disclosed. We require a legally binding instrument that is valid in the requesting jurisdiction and applicable to us.
- Challenge — we challenge, narrow, or refuse requests we consider unlawful, overbroad, or improperly served, including through legal counsel where appropriate.
- Data minimization — where disclosure is legally required, we disclose the minimum information necessary to satisfy the request, and nothing beyond its stated scope.
- Documentation — we log every request, our response, the legal reasoning, and the people involved, and retain that record.
- Notice — we notify the affected user where we are legally permitted to do so.
We have not disclosed personal data to public authorities in response to national-security requests.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Continued use after changes constitutes acceptance.
13. Contact Us
For questions about this Privacy Policy or your personal data: