Privacy Policy

Last updated: August 25, 2026

1. What we collect

• Account data: your email address and display name, used for sign-in.
• Workspace data you enter: brand deals, schedules, settlement records, notes, and files you upload.
• Connected-platform data: if you connect a platform (e.g. TikTok, Instagram, YouTube), we store the OAuth tokens you grant and the statistics of your own published content (such as view, like, and comment counts) retrieved through that platform's official API.

2. How we use it

Solely to operate the Service for you: showing your deals, schedules, payouts, and the performance of your own content. We do not sell personal data and do not use it for advertising. It is shared only with the processors required to run the Service: Vercel (hosting), Supabase (database and file storage), Anthropic (AI assistant processing), and Paddle (payments).

3. Platform data specifics

Data retrieved from connected platforms is used only to display and aggregate your own content performance inside your workspace. We never post on your behalf, never access other users' data, and honor each platform's data policies. Disconnecting a platform stops further collection; you may also request deletion of previously collected statistics.

4. AI features

When you use the assistant, the messages and files you submit — together with the workspace records needed to answer (deals, schedules, settlements) — are processed by Anthropic to generate the response. Under our agreement with Anthropic, this data is not used to train their models. Your conversations are stored in your workspace so you can return to them, and are covered by the retention terms below.

5. Payments

Paid subscriptions are sold and processed by Paddle.com as merchant of record. Paddle collects your payment details and billing address directly and handles them under its own privacy policy; we never receive or store card numbers. What we keep is your subscription status and invoice metadata, so the Service knows what your plan is.

6. Storage and security

Data is stored in Supabase (hosted in Seoul, South Korea) with row-level security and server-side access controls. OAuth tokens are stored server-side and are never exposed to the browser. Files live in a private bucket accessible only through short-lived signed URLs.

7. Retention and deletion

Data is kept while your account is active. To delete your account and all associated data — including tokens and collected statistics — contact us at the address below and we will complete the deletion within 30 days. Platform-initiated deletion requests are honored automatically — see creworks.app/legal/data-deletion.

8. Contact

creworks.ai@gmail.com