Privacy Policy

Kreatoai is the controller of your personal data within the meaning of the GDPR.

For any question about your data: contact@kreatoai.com

We collect the following categories of data:

Identification data

• First name, last name, email address
• Profile picture (if provided when signing in with Google or another provider)
• Sign-in credentials (hashed and encrypted)

Usage data

• Content you create or upload (images, videos, posts)
• Scheduling and publishing history
• Engagement statistics from your social media accounts
• App preferences and settings

Platform connection data

• Facebook, Instagram, TikTok, LinkedIn, YouTube and Google Business access tokens, and the Bluesky app password (encrypted)
• Identifiers of your connected pages and accounts
• Page statistics (followers, views, engagement)

Technical data

• IP address and the approximate country derived from it, browser type, operating system
• Pages visited, session length

Your data is used to:

• Provide the service: schedule and publish on your accounts, answer your messages, create texts and images with AI
• Personalize your experience: adapt the AI's suggestions to your tone, your brand and your audience
• Manage your account: sign-in, billing, technical support
• Improve the platform: aggregated and anonymized analysis to improve our services
• Communicate with you: service notifications, important updates (never marketing messages without your consent)

• Performance of the contract: processing needed to provide the Kreatoai service
• Consent: for non-essential cookies and marketing messages
• Legitimate interest: improving the platform, preventing fraud, security
• Legal obligation: keeping billing records as required by applicable law

We never sell your personal data. We only share data with:

• Meta (Facebook, Instagram): to publish content on your Facebook Pages and Instagram Business accounts, receive and send messages through Messenger and Instagram DM, read the comments under your posts and reply to or hide them at your request, and retrieve your accounts' statistics, through the official Meta Graph API
• TikTok: to publish videos and access your creator account information
• LinkedIn: to publish on your professional profile through the official LinkedIn API
• Google (YouTube): to upload to your channel the video you chose to publish, to show the name and avatar of the connected channel, and to read the views, likes and comments of videos published with Kreatoai, through YouTube API Services
• Bluesky: to publish on your account, with the app password you create in Bluesky and can revoke at any time from its settings
• Google (Google Business Profile): to read the business listings you manage and post the updates you chose to send there, through the official Google Business Profile API
• ChatGPT (OpenAI), Claude (Anthropic) or any other AI you connect: only if you connect it to your account yourself, and only what is described in the ChatGPT, Claude and other AI section
• OpenAI: to write your texts and your agent's replies
• AI model providers: to create your images
• Dodo Payments: sells our subscriptions, collects payments, holds payment card details and issues invoices
• Microsoft (Clarity): anonymous recording of how the site is used, only if you accepted audience measurement cookies
• Supabase: database hosting and sign-in to your account (Europe region)
• Cloudflare R2: storage of your images and videos
• Hostinger (Coolify): hosting of the site and the server (Europe region)

Each processor is contractually bound to keep your data confidential and secure.

Kreatoai uses YouTube API Services. This section describes separately what we do with data obtained from Google, because that data follows its own rules.

What we access

Only after you have connected your channel, and only for these three purposes:

• Uploading a video: the video you created and chose to publish, with the title, description and privacy status you set. An upload never happens without an action on your part.
• Reading the channel's identity: its name and avatar, to show them to you in the dashboard and let you pick the right channel if you have several.
• Tracking videos published with Kreatoai: the number of views, likes and comments of only the videos uploaded from Kreatoai, read once a day to show them to you in Analytics.

We do not read, change or delete any other data in your YouTube account: not your other videos, not your channel statistics, not the content of comments, not your subscribers.

What we keep

The access token issued by Google is encrypted (AES-256) before it is stored, and it is only used for the three purposes above. We keep the channel's name and avatar, along with your videos' numbers and their day-by-day changes, for as long as the channel stays connected. We do not share this data with anyone, we do not sell it, and we do not use it for advertising or to train an artificial intelligence model.

How to remove our access

Disconnect the channel from the Connected accounts page of the dashboard: the token and your videos' numbers are erased immediately, and Kreatoai also asks Google to revoke its authorization. Separately from this, you can revoke Kreatoai's access to your data from the Google security permissions page: as soon as we detect this, at the latest during the next daily check, the channel is disconnected and the same data is erased.

Your use of YouTube is governed by the YouTube Terms of Service, and Google's processing of your data by the Google Privacy Policy. For any question or complaint about this processing: contact@kreatoai.com.

You can connect your Kreatoai account to an AI such as ChatGPT (OpenAI) or Claude (Anthropic). Nothing is sent to it until you have given your consent on our authorization page. After that, it only receives data when it uses our tools to answer one of your requests.

What the connected AI can receive

• Your workspace: its name, description, logo, your audience, your tone, your topics, your plan, your credit balance, the number of free posts you have left and your time zone
• Your connected accounts: the network, the display name, the profile picture and the account's identifier on that network
• Your posts: the text, the addresses of attached media, the scheduled date, the status of each delivery, the link to the post once it is live and, if delivery fails, the reason
• Comments on your Facebook Pages and Instagram accounts, when you ask it to read them: the text, the date, the number of likes and the display name or username of their author, as the network shows them under the post. Kreatoai reads them from the network at the time of the request and does not keep them
• The media you ask it to host: their address on media.kreatoai.com

What it never receives

Not your password, not your email address, not your social accounts' access tokens, not your private messages, not your leads, not your payment details.

What we keep

For each action by the AI, we keep for 90 days the name of the tool used, the result, any error code and the identifier of the post or media involved. Never the content of your conversations with the AI: we do not see it.

What the AI then does with this data is up to its publisher: see the OpenAI privacy policy or the Anthropic privacy policy.

How to disconnect it

From the AI itself, or in Kreatoai: Settings, Claude and API tab, Connected apps section. Access is removed immediately.

Some of our processors are located outside the European Economic Area (EEA). These transfers are covered by standard contractual clauses approved by the European Commission or by adequacy decisions.

• Account data: kept for as long as your account exists. When you delete it, it is erased immediately and permanently, including your stored media
• Content you create: kept for as long as your account exists, and erased with it. Media uploaded only for a post is erased after 30 days
• Access tokens: revoked and deleted as soon as you disconnect the third-party platform
• Messenger / Instagram DM messages: kept for as long as your account is connected. Deleted within 30 days of disconnecting the account, unless you explicitly ask for earlier deletion
• Billing data: our payment records are kept for 10 years for our accounting obligations, detached from your account once it is deleted. Your card details never pass through our servers: they are held by Dodo Payments
• Technical logs: 12 months at most

Under the GDPR, you have the following rights:

• Right of access: get a copy of all your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: ask for your data to be deleted ("right to be forgotten")
• Right to data portability: receive your data in a structured, readable format
• Right to object: object to the processing of your data for certain purposes
• Right to restriction: temporarily limit the processing of your data

To exercise these rights, contact us at contact@kreatoai.com. We reply within 30 days.

You can also lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr

Cookies strictly necessary for the service to work, set without consent:

• Authentication cookies: they keep you signed in.
• Preference cookies: they keep your settings (theme, language, side menu).

Google Analytics. With your consent, given in the banner, Google Analytics measures visits to the site. Without consent, no Google cookie is set. You can change your mind by clearing the site's data in your browser.

Microsoft Clarity. With the same consent, we record how you use the site (clicks, scrolling, pages viewed) to improve it. These recordings are kept for 30 days, and what you type is never recorded.

Where you came from. We note the site or network that brought you to us, to know where our users come from.

We use no advertising cookies and never resell any data.

Your data travels encrypted, access to your social accounts is encrypted before it is stored, and your password is never stored in plain text. Only authorized people have access to it.

We may change this policy. If there is an important change, we will let you know by email.

A question about your data? Write to contact@kreatoai.com.