Privacy Policy
Last Updated: October 7, 2026
Introduction
Creo AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered marketing platform and services.
By using Creo AI, you agree to the collection and use of information in accordance with this policy.
Information We Collect
Information You Provide
- Account Information: Name, email address, company name, phone number, billing information
- Business Data: Marketing content, customer data, campaign information, creative assets
- Communications: Messages, support requests, feedback you send to us
- User Content: Content, files, and information you upload or create using our services
Information Collected Automatically
- Usage Data: Pages visited, features used, time spent, actions taken
- Device Information: IP address, browser type, operating system, device identifiers
- Cookies and Tracking: We use cookies and similar technologies to track activity and preferences
- Performance Data: Error logs, system diagnostics, API usage metrics
How We Use Your Information
We use the collected information to:
- Provide, operate, and maintain our services
- Process your transactions and manage your account
- Improve and personalize your experience
- Generate AI-powered marketing content and insights
- Communicate with you about updates, features, and support
- Send marketing communications (with your consent)
- Detect, prevent, and address technical issues or security threats
- Comply with legal obligations and protect our rights
- Conduct research and development to improve our AI models
AI and Machine Learning
Our platform uses artificial intelligence and machine learning to provide marketing insights, generate content, and improve our services:
- We may use aggregated and anonymized data to train and improve our AI models. This never includes data from your connected Google accounts (see Google User Data below)
- Your specific content and data is not shared with other users
- AI-generated content is created specifically for your use
- You retain ownership of your input data and AI-generated outputs
Google User Data
Some Creo AI features work by connecting a Google account you control. You choose which features to connect, Google shows you the exact permissions before you agree, and you can disconnect at any time. This section explains what we access, why, and how we protect it.
What we access and why
- Gmail (read, send, and manage labels): we read messages in the connected inbox so we can sort and summarize incoming business email, flag leads and replies that need attention, and draft suggested responses. We send email from your account only when you or your approved outreach sends it, and we mark messages as read or archive them when you act on them in Creo. We do not create drafts in your mailbox or delete your email.
- Google Business Profile: we read your locations, reviews, and profile performance metrics so we can report on them and alert you to new reviews, and we post or remove review replies that you approve.
- Google Analytics (read only): we read website traffic totals such as sessions, users, page views, and engagement to show in your reports.
- Google Search Console (read only): we read search queries, pages, clicks, and impressions for your site to show in your reports and guide your search work.
- Google Ads: we create and manage the campaigns, budgets, ad groups, keywords, and ads you approve in your own Google Ads account, upload conversions from your website so the account can measure results, and read performance and cost data for your reports.
- Basic profile (name and email address): used to show which Google account is connected.
For websites we build and host, Creo uses its own Google account with the Site Verification and Search Console APIs to verify the domain, register it in Search Console, and submit its sitemap. That does not involve access to your Google account.
How we use it
- Google user data is used only to provide and improve the user-facing features you have turned on. We do not use it for any other purpose.
- We do not sell Google user data, use it for advertising, or use it to build profiles for advertising.
- We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
- Google user data is never shared with other Creo customers.
- To provide features such as email sorting, reply suggestions, and review sentiment, we send the relevant content (for example, the text of an email or review) to our AI providers, OpenAI and Anthropic, through their business APIs. They process it only to return a result to us and are not permitted to use it to train their models.
- Creo staff do not read your Google user data unless you ask us to (for example, for support), it is needed for security purposes such as investigating abuse, or it is required by law.
Creo AI’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Storage, security, and retention
- Access tokens for your Google accounts are stored encrypted, and all data is encrypted in transit.
- We store the email messages we sync, your reviews, and daily history of your Analytics, Search Console, and Business Profile metrics so your inbox view and reports stay complete. Other data, such as Google Ads performance, is fetched when needed.
- When you disconnect a Google account in Creo, we revoke our access with Google and delete the stored tokens. Data already imported stays in your Creo account so your history is not lost. You can ask us to delete it at any time by emailing augusta@getcreo.ai, and we will delete it within 30 days. When your Creo account is closed, it is deleted as described under Data Retention.
- You can also remove Creo’s access at any time from your Google Account at myaccount.google.com/permissions.
Information Sharing and Disclosure
We may share your information in the following circumstances:
Service Providers
We work with third-party service providers who help us operate our platform, including cloud hosting (AWS), our database provider (Supabase), AI providers (OpenAI and Anthropic), payment processing, email services (Resend), and analytics providers.
Business Transfers
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
Legal Requirements
We may disclose your information if required by law, court order, or to protect our rights, property, or safety.
With Your Consent
We may share your information with third parties when you explicitly consent to such sharing.
Data Security
We implement industry-standard security measures to protect your information:
- Encryption in transit (HTTPS/TLS) and at rest
- Secure authentication and access controls
- Regular security audits and monitoring
- Limited employee access to personal data
- Secure cloud infrastructure (AWS)
However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Data Retention
We retain your information for as long as necessary to provide our services and comply with legal obligations:
- Account data is retained while your account is active
- Usage logs and analytics data are retained for up to 2 years
- Financial records are retained as required by law (typically 7 years)
- Upon account deletion, we delete or anonymize your data within 90 days, except where retention is required by law
Your Privacy Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your personal data
- Portability: Request transfer of your data to another service
- Opt-Out: Unsubscribe from marketing communications
- Object: Object to certain processing of your data
To exercise these rights, please contact us at augusta@getcreo.ai
International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
Cookies and Tracking Technologies
We use cookies and similar tracking technologies to:
- Keep you signed in to your account
- Remember your preferences and settings
- Analyze site usage and improve our services
- Provide personalized content and recommendations
You can control cookies through your browser settings, but disabling them may affect functionality.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last Updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us: