Privacy Policy

Draft: this policy has not been reviewed by a lawyer yet and may change.

Effective date: October 20, 2026

1. Who we are

This Privacy Policy explains how Create ("Create," "we," "us," or "our") collects, uses and shares information about you when you use the Create website and web app (the "Service"). For the information described here, we are the "controller" (the company that decides why and how it is used).

Privacy questions and requests: use the contact form.

This Policy goes with our Terms of Service, Acceptable Use Policy and Refund and Cancellation Policy. "Your Content" and "Output" mean the same as in the Terms.

2. What we collect

Information you give us

Account details: your email address, and your name and profile picture if you sign in with Google. We use Supabase to handle sign-in. If you sign up with a password, Supabase stores it in hashed form and we cannot read it.
Prompts and instructions you type or speak into the tools.
Files you upload: images, video, audio and other files you add so a tool can work with them.
Notes and documents: text you write in Notes and Write, and recordings or transcripts you add to Notes, plus summaries we generate from them.
Messages and forms: support requests and feedback sent through the contact form, and details you give on the waitlist, press, careers and affiliate forms (such as your name, email and message). The contact form also keeps your browser type.

Information created when you use the Service

Generation history: for every generation, the tool and model used, your prompt, the files going in and coming out, the credit cost, whether it worked, and the time. This is what shows in your Library.
Usage records: the date, tool, model and credits for each generation, kept so you can see your usage at /account/usage.
Output: the images, video and text the tools make for you, which we store for you in private storage.
Plan and billing status: your plan, your credit balance, your Stripe customer ID and your subscription status. We do not see or store your full card number. Stripe collects and handles your payment details, billing address and receipts.
Usage limits: counts of your requests and uploads, so we can apply fair-use limits and stop abuse.

Information collected automatically

Device and log data: IP address, browser, device, operating system, pages and features used, and error reports. Our hosting and database providers also keep ordinary server logs.
Cookies and similar technologies, described in section 7.

Voice input

The optional voice input feature (hold Right Control to dictate) uses speech recognition built into your browser. In some browsers, such as Chrome, your browser sends the audio to its maker, such as Google, to turn it into text. We only receive the resulting text. Check your browser's privacy settings for how it handles audio. You can choose not to use voice input.

3. Photos, faces and voices

Some tools, such as Edit and Image, can work from a photo of a real person. When you upload one, we send it to the AI provider that runs the tool so it can make your result. Those providers may analyze faces and voices as part of making the Output. Under some laws, such as Illinois' Biometric Information Privacy Act and the GDPR, face and voice data can be treated as biometric or special category data.

Create does not build a database of face or voice templates, and we do not use faces or voices to identify people or to recognize you across uploads. We store the files you upload and the Output you create as part of your account, until you delete them.

Only upload a photo or recording of someone else if you have their permission. You are responsible for that, as the Terms say.

Each AI provider handles face and voice data under its own terms and privacy policy, not ours. Read them if this matters to you.

4. Why we use your information

To run the Service: create and secure your account, produce Output, save your Library, notes and documents, and apply your plan and credits.
To take payments and manage your subscription through Stripe.
To keep the Service safe: detect fraud and abuse, enforce the Acceptable Use Policy, run the automatic safety filter that checks generations before they run, apply limits, and investigate reports.
To fix and improve the Service: measure what is used, find errors and slow spots, and test features, mostly with aggregated or de-identified data.
To talk to you: reply to support requests, send service and billing notices, and send product updates if you choose to receive them.
To follow the law and protect our rights.

We do not use Your Content or your Output to train our own models, or any model shared with other users. We do not sell your information, and we do not use Your Content or your account details for advertising. If marketing is on (you accept it in the EU, UK, EEA and Switzerland, or leave it on elsewhere), advertising platforms may measure visits to our own site, as described in section 7.

Legal bases (EEA, UK and Switzerland)

Contract: running your account, producing Output and billing you.
Legitimate interests: security, fraud and abuse prevention, basic analytics and improving the Service, where these are not outweighed by your rights.
Consent: analytics and advertising cookies that need it, optional marketing emails, and any special consent we ask for. You can withdraw consent at any time.
Legal obligation: tax, accounting and responding to lawful requests.

5. AI providers and other companies that process your data

To make Output we send your prompts and any files a tool needs to the company that runs the model behind that tool. These are our AI providers. They include OpenAI, Google, Black Forest Labs, ByteDance, xAI, Kuaishou (Kling) and Alibaba, and others as models are enabled, through the Vercel AI Gateway. Which providers see your data depends on which tool and model you choose. The list changes as we add or remove models.

We send only what is needed to complete your request. Providers process your data on their own systems under their own terms and privacy policies. We do not control what a provider keeps or for how long beyond our agreements with it.

We also use other service providers ("processors") who handle data for us under contract. The current list is on our Subprocessors page. Main ones:

Vercel: hosting, and the AI Gateway that routes requests to most AI providers.
Supabase: sign-in, database and file storage.
Stripe: payments and the billing portal.
Sentry: error monitoring, always on, without session replay.
PostHog: product analytics, only after you accept analytics in the cookie banner.
Statsig: feature flags and experiments, including session replay, only after you accept analytics in the cookie banner.
Google Analytics: traffic analytics, only after you accept analytics in the cookie banner.
Marketing pixels from advertising platforms (such as Meta, TikTok, Pinterest, LinkedIn, Reddit, X, Snapchat, Microsoft and Google Ads), only if we have switched them on. In the EU, UK, EEA and Switzerland they load only after you accept marketing in the cookie banner. Elsewhere they run by default and you can turn them off with the Cookie settings link.

6. Who else sees your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only:

with the AI providers and processors above, to run the Service;
if the law, a court or a government authority requires it, or to protect people from harm, including reporting child sexual abuse material to the National Center for Missing and Exploited Children and law enforcement;
in a merger, sale, financing or similar deal, with the new owners, who must respect this Policy;
with your permission, or when you tell us to; and
on a Business or Enterprise plan, with your organization's administrators, if the plan includes that.

7. Cookies, analytics and error tracking

We use our own cookie banner. It stores your choice in your browser only, not on our servers. In the EU, UK, EEA and Switzerland, analytics and marketing tools do not run until you accept. Elsewhere, marketing pixels run by default and you can turn them off at any time with the Cookie settings link, and analytics still waits until you accept. If you say no, they stay off. We use cookies and similar technologies (such as local storage) in three groups:

Necessary: keep you signed in and make the Service work, and remember your cookie choice and settings such as theme. These cannot be turned off.
Analytics: help us understand how the site and app are used. Google Analytics, Google Tag Manager, Microsoft Clarity (which makes session recordings), PostHog, Statsig (including session replay on the website) and Vercel analytics load only after you accept analytics in the cookie banner, and only the ones we have switched on. PostHog, Google Analytics and Statsig are in both the app and the website (the app has no session replay); the other tools are on the website only.
Marketing: advertising and measurement pixels from ad platforms. They load only if we run ads. In the EU, UK, EEA and Switzerland that is only after you accept marketing in the cookie banner. Elsewhere they run by default until you turn them off in Cookie settings.

8. How long we keep information

Account details, generation history, usage records, Output, uploads, notes and documents: until you delete them or your account is deleted.
After you delete your account at /account: we remove your files and your sign-in. Backup copies can stay for up to 30 days, until they cycle out.
Billing records: kept for 7 years, because tax and accounting law requires it. Stripe keeps its own records under its own policy.
Server and error logs: up to 90 days.
Analytics data: up to 14 months.
Support emails: for as long as needed to help you and to handle follow-up questions.
Abuse and safety records: we may keep the content, account details and logs related to a violation or report for longer, where needed to protect people, enforce our rules, handle disputes or follow the law.

Our AI providers and other processors keep data for the time set in their own terms.

9. Your rights and how to use them

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy,
correct information that is wrong,
delete your information,
get your information in a portable format,
object to or ask us to limit some uses of it,
withdraw consent you gave us, and
complain to a regulator.

To use any of these rights, including deletion, use the contact form and give the email address on your account. Start your message with something like "Delete my account" or "Send me my data." We will check that the request really comes from you, then reply within one month (45 days for California, with an extension if needed). There is no fee unless a request is clearly excessive. You can change your name and sign-in details yourself in your Account. You can cancel your plan yourself in your Account, through the Stripe customer portal.

How deletion works: you can delete your account yourself on your Account page (/account). That removes your files and your sign-in. We may keep limited records we must keep by law, such as billing records, or that we need to deal with abuse or a dispute. Backup copies can stay for a short time, as set out in section 8. For other deletion requests, use the contact form.

If a request is refused we will tell you why. Where the law gives you an appeal right, such as in some US states, reply to our message and ask for an appeal.

You can ask an authorized agent to make a request for you. We may ask for proof that they can act for you.

California (CCPA and CPRA)

In the last 12 months we have collected these kinds of personal information: identifiers (email, name, IP address); commercial information (plan and subscription status); internet and device activity; audio, visual and similar information (files you upload and Output); and inferences drawn from usage for product analytics. We collect these from you, from your device and from our providers, for the purposes in section 4. We disclose them to the processors and AI providers in section 5 for business purposes.

We do not sell personal information, and we do not use Your Content for advertising. Marketing pixels load only if you accept marketing, and if you do, California law may treat that as "sharing" for advertising. You can switch them off in Cookie settings. We do not use sensitive personal information to infer characteristics about you. California residents may use the rights in this section, and we will not treat you worse for using them. We have not knowingly sold or shared the information of anyone under 16.

Other US states

Residents of states with their own privacy laws, such as Colorado, Connecticut, Virginia, Utah and Texas, have similar rights to access, correct, delete and port their data and to opt out of targeted advertising, sales and profiling. We do not sell your data or profile you. Marketing pixels are off unless you accept them, and you can turn them off in Cookie settings. Use the contact above for any request.

EEA, UK and Switzerland

You have the rights above under the GDPR and the UK GDPR, including the right to object to processing based on legitimate interests. You may complain to your local data protection authority, for example the Information Commissioner's Office in the UK, or the authority in the country where you live or work.

EU representative: none appointed. UK representative: none appointed. Data protection officer: none appointed.

10. Moving data across borders

We and our providers are mostly based in the United States, and your information will be processed there and in other countries, which may have different data protection laws from yours. Our database region is North Virginia, United States. When we send personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on approved safeguards such as the Standard Contractual Clauses and the UK addendum, and on the EU-US Data Privacy Framework where a provider is certified.

11. Security

We protect your information with measures such as encryption in transit, private file storage, access controls that limit each account to its own data, and limits on abuse. No system is perfectly secure, so we cannot promise absolute security. Choose a strong password and keep it private. If a breach affects your personal information, we will tell you and regulators as the law requires.

12. Automated decisions

We do not make decisions about you that have legal or similarly significant effects by automated means alone. An automatic safety filter checks each generation before it runs, and prompts that clearly break our Acceptable Use Policy are refused. Our providers' filters may also block a request. Refused and failed generations are not charged. If you think a block was a mistake, contact us.

13. Children

The Service is not for anyone under 18, and we do not knowingly collect personal information from anyone under 18, or from anyone under 13 in any case. If you believe a child has given us information, use the contact form and we will delete it.

14. Links to other sites

The Service may link to sites and tools run by others, such as Google sign-in. This Policy does not cover them. Read their privacy policies.

15. Changes to this Policy

We may update this Policy. For material changes we will give notice in the app or by email before they apply. The date at the top shows when it last changed.

16. Contact

For privacy requests and all other questions, use the contact form.