Privacy Policy

1. Data We Collect

We collect information that you provide directly to us, information collected automatically, and information from third-party sources. This includes:

• Account Information: Name, email address, password, profile photo, and account preferences.
• Content Data: Images, videos, text, designs, brand kits, and other creative assets you upload or create on the Platform.
• Usage Data: Log data, device information, IP address, browser type, operating system, and pages visited.
• Communication Data: Messages, support tickets, and feedback you send to us.
• Payment Information: Billing address and payment method details (processed securely by our payment providers).

2. Authentication Data

CreatorFlow AI uses Supabase Auth for user authentication. When you create an account or sign in:

• We collect your email address and, if applicable, your name and profile photo from OAuth providers (Google, etc.).
• Your password is hashed and encrypted using industry-standard bcrypt algorithms. We never store plain-text passwords.
• Authentication sessions are managed using secure JSON Web Tokens (JWT) with automatic rotation for enhanced security.
• We may collect and store device and session identifiers to detect suspicious activity and prevent unauthorized access.

3. Cookies & Tracking Technologies

CreatorFlow AI and our third-party partners use cookies and similar technologies to recognize you, remember your preferences, and analyze how you use the Platform.

Types of cookies we use:

• Essential Cookies: Required for the Platform to function, such as authentication and security cookies.
• Preference Cookies: Remember your settings and preferences (e.g., dark mode, language).
• Analytics Cookies: Help us understand how visitors interact with the Platform.

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform.

4. Analytics

We use analytics tools to measure traffic, usage trends, and engagement on the Platform. This helps us improve features, identify issues, and optimize performance.

Analytics data is collected in aggregate and anonymized forms where possible. We do not use analytics data to personally identify you or track your activity across other websites.

5. Social Media Account Connections

When you connect social media accounts (Facebook, Instagram, TikTok, YouTube) to CreatorFlow AI:

• We receive profile information such as your account name, profile picture, page/channel names, and follower counts.
• We store encrypted access tokens that allow us to publish content and retrieve analytics on your behalf.
• We do not post content without your explicit action (e.g., clicking “Publish” or “Schedule”).
• Disconnecting an account immediately revokes our access tokens and removes associated data from our active systems.

Each social platform has its own privacy policy governing how they handle your data. We encourage you to review those policies before connecting your accounts.

6. Third-Party APIs & Services

CreatorFlow AI integrates with third-party services to deliver core functionality. These include:

• Meta (Facebook/Instagram): For publishing content and retrieving page insights. Governed by Meta’s Platform Terms and Data Policy.
• TikTok: For account connection and video publishing. Governed by TikTok’s Developer Terms and Privacy Policy.
• Google (YouTube): For channel connection, video uploads, and analytics. Governed by Google’s APIs Terms of Service and Privacy Policy.
• AI/ML Services: For content generation, image creation, and text assistance. Inputs may be processed by AI providers under their own privacy terms.
• Cloud Infrastructure: Data is hosted on secure cloud infrastructure providers with enterprise-grade security certifications.

We only share the minimum data necessary with these providers to enable the specific features you use. We do not sell your data to third parties.

7. How We Use Your Data

We use the information we collect to:

• Provide, maintain, and improve the Platform and its features.
• Authenticate your identity and secure your account.
• Schedule, publish, and manage content across your connected social channels.
• Generate analytics and performance reports.
• Communicate with you about updates, security alerts, and support requests.
• Comply with legal obligations and enforce our Terms of Service.

8. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share data in the following circumstances:

• With Service Providers: Trusted third parties who perform services on our behalf (e.g., cloud hosting, payment processing, analytics).
• For Legal Reasons: When required by law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.
• With Your Consent: When you explicitly authorize us to share information.

9. Your Rights

Depending on your location, you may have certain rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request a machine-readable copy of your data for transfer to another service.
• Objection: Object to certain types of data processing, such as direct marketing.
• Withdraw Consent: Withdraw consent for data processing where consent is the legal basis.

To exercise any of these rights, please contact us at privacy@creatorflowai.com. We will respond within the timeframe required by applicable law.

10. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Row-Level Security (RLS) on all database tables to ensure users can only access their own data.
• Encrypted storage of social media access tokens using AES-256-GCM.
• Regular security audits and vulnerability assessments.
• Role-based access controls for internal systems.

While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

When you delete your account, we will remove or anonymize your personal data within 30 days, except where we are required to retain it by law or for legitimate business purposes (such as fraud prevention).

12. Children's Privacy

CreatorFlow AI is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verification of parental consent, we will delete that information as quickly as possible.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform at least 30 days before the changes take effect.

Your continued use of the Platform after any changes indicates your acceptance of the revised Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@creatorflowai.com
Address: CreatorFlow AI, 123 Innovation Drive, Suite 400, San Francisco, CA 94105, USA