1. Introduction
CreaScale AI ("we", "us", "our") operates the website creascale.ai and provides AI-powered ad creative generation services (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
By using CreaScale AI, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
- Name, email address
- Password (encrypted, never stored in plain text)
- Onboarding survey responses (role, niche, experience level)
2.2 Payment Information
- Billing information processed securely through Stripe
- We do not store credit card numbers on our servers
- Stripe Connect data for affiliate payouts
2.3 Usage Data
- Landing page URLs and product descriptions you submit
- Generated creatives, ad copies, and campaign data
- Product images you upload
- Pipeline run history and preferences
2.4 Automatically Collected Data
- IP address, browser type, device information
- Pages visited, time spent, referral source
- Cookies and similar tracking technologies
2.5 Advertising Data From Meta (Meta Ads tab, Enterprise plan)
When you connect your Meta advertising assets in the Meta Ads tab — either through "Continue with Facebook" (Facebook Login for Business) or by pasting a system-user access token of your own business portfolio — we receive and store:
- The identifiers and names of the business portfolio, ad accounts, Facebook Pages, Instagram professional accounts and pixels/datasets you choose to share, plus each ad account's currency, time zone and status
- A long-lived access token for those assets. It is kept only in an encrypted secret vault, referenced by id, and is never displayed, logged or returned by our API
- Aggregated performance data of your own campaigns (spend, impressions, clicks, purchases, conversations), synchronized from the Meta Marketing API
- If you use our Conversions API relay: the purchase events your website sends us (order reference, value, currency, page URL), with the customer's email, phone number, IP address and browser identifiers hashed with SHA-256 before they are forwarded to your pixel
We use this data only to display and operate your own advertising on your behalf: reading the results of your campaigns and creating or managing the campaigns you explicitly ask for. We never use it to advertise for anyone else and never sell it. You can remove a connection at any time from the Meta Ads tab or through the CreaScale API; removing it deletes the token from the vault together with the stored assets and statistics. We also implement Meta's Deauthorize and Data Deletion callbacks: when you remove CreaScale from your business portfolio, the matching connection is revoked and its token purged immediately.
3. How We Use Your Information
- To provide, maintain, and improve the Service
- To process payments and manage subscriptions
- To generate AI-powered ad creatives based on your inputs
- To communicate with you about your account, updates, and support
- To manage the affiliate program and process commissions
- To detect and prevent fraud, abuse, and security threats
- To comply with legal obligations
4. Data Sharing and Third Parties
We do not sell your personal information. We share data only with:
- Supabase — database hosting and authentication
- Stripe — payment processing and affiliate payouts
- Anthropic (Claude AI) — AI processing for creative generation (your data is not used to train models)
- Google (Gemini) — AI image generation (your data is not used to train models)
- Render and Hetzner Online GmbH — application hosting (United States and Germany)
- Meta Platforms Ireland Limited — recipient of the Conversions API events you route through our relay and of the campaign instructions you ask us to execute on your ad accounts (Marketing API); Meta processes them under its own terms
- Google Analytics & Meta Pixel — anonymized usage analytics
- Microsoft Clarity — session recordings and heatmaps of how our website and dashboard are used, to find what is confusing and fix it. Form fields, and the names, messages and orders of your own customers shown in the dashboard, are masked and never sent. Microsoft processes this data under its privacy statement (privacy.microsoft.com).
All third-party providers are bound by their own privacy policies and data processing agreements.
5. Data Security
- All data is encrypted in transit (TLS/SSL) and at rest
- Passwords are hashed using industry-standard algorithms
- Row Level Security (RLS) ensures users can only access their own data
- Regular internal security audits of the codebase and database access rules
- Image metadata is stripped from generated creatives before delivery
- API keys and secrets are stored in encrypted vaults
6. Data Retention
We retain your data for as long as your account is active. Upon account deletion:
- Personal data is deleted within 30 days
- Generated creatives and uploads are permanently removed from storage
- Anonymized usage statistics may be retained for analytics
- Financial records are retained as required by law (typically 7 years)
- Meta advertising connections (Meta Ads tab): the access token, the stored asset identifiers and the synchronized statistics are deleted as soon as you remove the connection, when Meta notifies us that you removed our app from your business portfolio, or on request
Shopify protected customer data. When you connect a Shopify store, we process your customers' personal data (name, phone, address) only to run your assistant. A scheduled purge enforces these limits automatically:
- Conversations, messages and stored customer facts are deleted after 90 days
- Orders and message logs are kept for reporting, but the customer's name, phone and address are erased after 90 days
- Raw webhook payloads are deleted after 30 days
- Consent records are kept for 365 days; an opt-out (STOP) is kept for as long as we operate your assistant, so that we can keep honouring it
- Our internal log of who accessed customer data is kept for 365 days
7. Your Rights
You have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Deletion — request deletion of your data
- Portability — export your data in a standard format
- Objection — opt out of certain data processing
- Withdraw consent — at any time, without affecting prior processing
To exercise these rights, contact us at support@creascale.ai. Meta advertising connections can also be removed directly from the Meta Ads tab or with the CreaScale API, without contacting us.
8. Cookies
We use essential cookies for authentication and session management. We also use analytics cookies (Google Analytics, Meta Pixel, Microsoft Clarity) to understand usage patterns. You can disable non-essential cookies in your browser settings.
9. Children's Privacy
CreaScale AI is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.
10. International Data Transfers
Your data may be processed in the United States, in the European Union (Ireland, Germany) and other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers.
11. Government and Law-Enforcement Requests
We may receive requests from public authorities for personal data. We handle every such request under the following policy:
- Legality review — every request is reviewed for legal validity before any data is disclosed. We require a legally binding instrument that is valid in the requesting jurisdiction and applicable to us.
- Challenge — we challenge, narrow, or refuse requests we consider unlawful, overbroad, or improperly served, including through legal counsel where appropriate.
- Data minimization — where disclosure is legally required, we disclose the minimum information necessary to satisfy the request, and nothing beyond its stated scope.
- Documentation — we log every request, our response, the legal reasoning, and the people involved, and retain that record.
- Notice — we notify the affected user where we are legally permitted to do so.
We have not disclosed personal data to public authorities in response to national-security requests.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Continued use after changes constitutes acceptance.
13. Contact Us
For questions about this Privacy Policy or your personal data: