Privacy Policy

Contents

CreativAI, Inc. (“CreativAI,” “we,” “us,” or “our”) a Delaware corporation, provides software and infrastructure that allows customers to ingest, index, search, analyze, and extract structured information from video, images, documents, live streams, and related content.

This Privacy Policy explains how we collect, use, share, retain, and protect information in connection with our website, cloud services, APIs, SDKs, integrations, and related services (collectively, the “Services”).

If your organization has entered into a separate agreement with CreativAI, including a master services agreement, order form, data processing addendum, or other enterprise agreement, that agreement may contain additional or different privacy and data-protection terms and will control to the extent of a conflict.

1. Our Role and Scope

CreativAI processes different categories of information in different roles.

Customer Content. When a customer uploads, imports, connects, streams, or otherwise provides content to the Services, CreativAI generally processes that content on the customer’s instructions to provide the requested functionality. In those circumstances, the customer is responsible for determining the lawful basis for its collection and use of that content, and CreativAI acts as a processor or service provider where applicable.

Account and Service Data. CreativAI generally acts as the controller or business for information used to create and administer accounts, provide support, secure the Services, process billing, communicate with users, and operate our business.

This Privacy Policy does not govern the privacy practices of our customers. If your information appears in content uploaded by a CreativAI customer, requests concerning that customer-controlled content should generally be directed to the applicable customer.

2. Information We Collect

2.1 Information You Provide to Us

We may collect:

Account information, such as name, email address, organization, authentication information, and account preferences.
Billing and transaction information, such as billing identifiers, subscription or usage information, invoices, and payment status. Payment card and bank account information is collected and stored by our third-party payment processor, Mercury, and not by CreativAI. CreativAI does not store full payment card numbers.
Customer Content, including videos, images, documents, live-session recordings, audio or speech contained in media, metadata, tags, descriptions, and other materials you choose to provide.
Biometric and similar information. Customer Content may contain images, video, audio, or speech that includes faces, voices, or other characteristics that may constitute biometric identifiers or biometric information under applicable law. The Services do not perform facial recognition, speaker identification, or other biometric identification unless expressly enabled pursuant to a separate written agreement with the customer.

Any biometric information contained in Customer Content is treated as Customer Content and is retained and deleted according to the same retention and deletion practices applicable to Customer Content under this Privacy Policy.

Customers are responsible for providing any notices and obtaining any consents or other authorizations required by applicable law before collecting, recording, uploading, or processing biometric information through the Services, including where individuals are recorded in live sessions, video, or audio.
Derived Service Data, including embeddings, transcripts, extracted data tables or “Data Plates,” search queries, search history, conversation history, confidence scores, processing results, and user corrections or feedback associated with your workspace.
Integration information, such as identifiers, scopes, and tokens needed to connect third-party sources or devices that you explicitly authorize.
Support and communications, including messages you send to us, feedback, security questionnaires, and other business communications.

2.2 Information Collected Automatically

We may receive information about you from third parties, including identity and authentication providers, integration partners, service providers, business partners, resellers, and marketing or lead-generation sources.

For example, if you sign in through a third-party authentication provider such as Google, we may receive information that provider makes available to us, such as your name, email address, profile information, organization information, and authentication identifiers, depending on your account settings and the permissions you grant.

We may also receive business contact information, such as your name, company, job title, email address, or other professional information, from business partners, resellers, publicly available sources, or marketing and sales providers.

3. How We Use Information

We use information to:

Provide, operate, maintain, and improve the functionality, performance, and reliability of the Services. Improvements to the Services may use usage data, operational data, account data, and aggregated or de-identified information, but not Customer Content for general model training or improvement as described in Section 4. Where we use de-identified information, we will maintain it in de-identified form and will not attempt to re-identify it except as permitted by applicable law.
Process customer-initiated indexing, semantic search, knowledge extraction, live-stream analysis, assistant interactions, and related workflows.
Authenticate users, enforce account and collection permissions, issue secure access links, and protect against unauthorized access, fraud, abuse, and security threats.
Meter usage, administer subscriptions, process billing, maintain transaction records, and enforce applicable account limits.
Provide customer support, respond to requests, and communicate service, security, product, or account updates.
Comply with law, enforce our agreements, establish or defend legal claims, and protect the rights, safety, and integrity of CreativAI, our customers, and others.

4. Customer Content and AI Model Training

We do not use Customer Content to train, fine-tune, or improve CreativAI models or third-party foundation models.

Where CreativAI uses third-party AI providers or other subprocessors to process Customer Content, such providers process Customer Content only as necessary to provide the requested Services and are not permitted to use Customer Content to train, fine-tune, or improve their general models or services.

Customer Content is processed to provide the functionality the customer requests. Relevance feedback, corrections, labels, or similar customer-specific signals may be used to improve or re-rank that customer’s own results at query time, but are not aggregated into general model-training datasets or used for the benefit of other customers.

5. How AI Processing Works

For core indexing functions such as video and image understanding, embedding generation, and speech transcription, CreativAI uses models that we host and operate on our own cloud infrastructure, including infrastructure provided by AWS and GCP. These models are operated by CreativAI and are not shared with or hosted by third-party model providers.

For certain cloud-based conversational or knowledge-extraction features, the text of a user query and a limited set of selected frames or related context may be sent to a hosted large-language-model provider, currently including Google Gemini, to generate a response.

For certain conversational, knowledge-extraction, or similar features, CreativAI may send the text of a user query and a limited set of selected frames or related context to third-party AI providers acting as subprocessors. Selected frames may contain faces, individuals, or other personal information contained in Customer Content.

Our current subprocessors, including third-party AI providers, their processing locations, and the purposes for which they process information, are identified on our subprocessor list, which we will provide upon request. We will provide notice of material changes to our subprocessors through the notification mechanism described on that page or in an applicable Data Processing Addendum.

Third-party AI providers are not permitted to use Customer Content to train, fine-tune, or improve their general models or services.

A fully self-hosted deployment option may be available for customers that require no external model processing, subject to the applicable commercial agreement.

AI outputs may be probabilistic or incomplete. Customers can review underlying media, inspect outputs, and correct extracted information within the Services.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We may disclose information to the following categories of recipients as necessary to operate the Services:

Cloud infrastructure and storage providers, including providers such as Amazon Web Services and Google Cloud Platform.
Identity and authentication providers, including Firebase Authentication for our managed cloud service and, where applicable, customer-hosted identity solutions.
Hosted AI providers used for certain customer-requested conversational or knowledge-extraction features, as described above.
Payment processors, which receive billing information needed to process payments and do not need access to Customer Content.
Communications and notification providers used to send transactional email, push notifications, and service notices.
Analytics providers, including Google Analytics, which receive information about use of the Services only if you accept analytics cookies.
Professional advisers and service providers that support our business under appropriate confidentiality and data-protection obligations.
Government authorities or other parties when required by law, legal process, or a valid legal request, or when reasonably necessary to protect rights, safety, security, or the integrity of the Services.
A successor or transaction counterparty in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable confidentiality and legal requirements.

Customer Content is private to the applicable customer by default. Other users receive access only when the customer deliberately shares a collection, workspace, or other resource or otherwise authorizes access.

7. Human Access to Customer Content

CreativAI personnel do not have routine access to Customer Content through ordinary administrative tooling.

Administrative tooling is designed to expose account-level and aggregate operational metadata rather than the underlying files, frames, or transcripts.

Access to production systems is restricted on a least-privilege basis. Access to Customer Content for customer support purposes will occur only with the customer’s authorization. If access is required without prior customer authorization for security, legal, compliance, fraud-prevention, or similar reasons, such access will be limited to authorized personnel and only to the extent reasonably necessary.

Access to Customer Content is logged and auditable and is subject to applicable confidentiality and security controls.

8. Data Retention and Deletion

8.1 Accounts in Good Standing

Customer Content, including original media, documents, derived embeddings, extracted tables, conversation history, and search history, is generally retained for as long as the customer keeps the content in the Services and maintains the applicable account or storage.

Customers may delete individual items, collections, conversations, or their entire account.

8.2 Overdue or Unpaid Storage

Where storage is metered and applicable storage charges remain unpaid, CreativAI may suspend affected collections no earlier than 30 days after payment becomes overdue, after providing written notice to the email address associated with the account.

Suspension does not delete Customer Content. During suspension, available export functionality will remain accessible so that you may export your Customer Content.

CreativAI will not permanently delete Customer Content solely because of nonpayment until at least 30 days after the applicable suspension begins. Before permanent deletion, CreativAI will provide an additional written warning to the account email address at least 48 hours before deletion.

If the outstanding balance is resolved before permanent deletion, access to the affected content may be restored.

Any permanent deletion will be carried out in accordance with the retention and deletion practices described in this Privacy Policy and the applicable Terms of Service.

8.3 Account Deletion

When an account is deleted, CreativAI will remove the account and associated Customer Content, embeddings, metadata, conversation history, credentials, and connected-integration tokens from active systems within 30 days, except where limited retention is required or permitted as described below.

Residual copies may remain in backup systems for up to 90 days after deletion. Backups are maintained for disaster-recovery and business-continuity purposes and are not restored to active systems except as reasonably necessary for disaster recovery or similar system-restoration purposes.

CreativAI may retain limited information after account deletion where reasonably necessary or legally required, including:

Account and contact records for as long as necessary to administer prior transactions, resolve disputes, enforce agreements, prevent fraud or abuse, and comply with legal obligations.
Security and system logs for as long as reasonably necessary for security monitoring, incident investigation, fraud prevention, troubleshooting, and compliance purposes.
Billing, invoice, and transaction records for the period required by applicable tax, accounting, financial-reporting, and other legal obligations.
Legal or compliance records for as long as required to comply with applicable law, legal process, regulatory requirements, or to establish, exercise, or defend legal claims.

When information is retained for one of these limited purposes, it will not be used for unrelated purposes and will be deleted or de-identified when the applicable retention need ends.

Deleted Customer Content is not retained or used for model training.

9. Your Choices and Controls

Customers may:

Choose what content enters the Services. We do not ingest a customer’s content source unless the customer uploads content or expressly connects or authorizes that source.
Review and manage stored content, including collections, items, metadata, tags, processing status, extracted tables, searches, and assistant conversations.
Correct certain metadata or AI-extracted values and, where supported, export extracted tables, billing history, or usage history.
Delete individual items, collections, conversations, connected integrations, or the entire account.
Control sharing. Customer Content is private by default unless the customer affirmatively grants access or makes a resource public.
Disconnect third-party integrations. Disconnecting an integration stops future collection from that source and removes or revokes stored connection credentials as applicable.

10. Privacy Rights

Depending on where you live and the law that applies, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information; to object to or restrict certain processing; to withdraw consent where processing is based on consent; and to appeal certain privacy-request decisions. You may also have the right not to be discriminated against for exercising your privacy rights.

Submitting a Request. To exercise a privacy right, use available in-product controls or contact us at contact@creativ-ai.com. We may need to verify your identity and authority before completing a request.

Response Timing. We will respond to verified privacy requests within the time required by applicable law. Where applicable, this generally means within 45 days under certain U.S. state privacy laws and within one month under the GDPR or UK GDPR, subject to any legally permitted extension. If an extension is necessary, we will notify you as required by applicable law.

Authorized Agents. Where permitted by applicable law, you may designate an authorized agent to submit a privacy request on your behalf. We may require the agent to provide proof of authorization and may also require you to verify your identity or confirm that you authorized the request, unless applicable law provides otherwise.

Appeals. If we deny a privacy request and applicable law gives you a right to appeal that decision, you may submit an appeal by contacting contact@creativ-ai.com and identifying the request you are appealing. We will review and respond to the appeal within the timeframe required by applicable law.

Complaints to Supervisory Authorities. If you are located in the European Economic Area, United Kingdom, or another jurisdiction that provides this right, you may lodge a complaint regarding our processing of personal information with your applicable data-protection or supervisory authority.

If CreativAI processes personal information solely on behalf of a customer, we may direct your request to that customer or assist the customer in responding to your request in accordance with our contractual and legal obligations.

11. California Privacy Disclosures

To the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to CreativAI or to particular processing activities, California residents may have rights under the CCPA, including rights to know, access, delete, correct, opt out of the sale or sharing of personal information, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment for exercising applicable privacy rights.

Requests to exercise applicable California privacy rights may be submitted using the methods described in Section 10 (Privacy Rights), including by contacting contact@creativ-ai.com.

CreativAI does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

If our practices change in a manner that creates an applicable right to opt out of sale or sharing, we will provide the legally required notice and opt-out mechanism.

Where the CCPA requires additional disclosures regarding categories of personal information collected, sources of personal information, business or commercial purposes, categories of recipients, or applicable retention practices, CreativAI will provide those disclosures as required by applicable law.

12. European and UK Privacy Disclosures

Where the European Economic Area (“EEA”), United Kingdom, or similar data-protection law applies, our legal bases for processing account and service data may include performance of a contract, our legitimate interests in operating, securing, and improving the Services, compliance with legal obligations, and consent where required.

When CreativAI processes Customer Content or other personal data on behalf of a customer, CreativAI generally acts as a processor or service provider, and the customer is responsible for establishing the applicable legal basis for that processing.

Customer data is primarily stored in the United States unless otherwise agreed in writing. Personal data may also be processed in other countries where CreativAI or its subprocessors operate, as described in our applicable Data Processing Addendum and subprocessor disclosures.

Where personal data is transferred from the EEA to a country that has not been recognized as providing an adequate level of data protection, CreativAI uses appropriate safeguards, including the European Commission’s Standard Contractual Clauses (“SCCs”), where applicable. For transfers from the United Kingdom, CreativAI may use the UK International Data Transfer Addendum to the SCCs or the UK International Data Transfer Agreement (“IDTA”), as applicable.

If CreativAI participates in and is certified under the EU-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework, or Swiss-U.S. Data Privacy Framework, we may also rely on those frameworks for applicable transfers.

If CreativAI is required under applicable European or UK data-protection law to appoint a representative in the EEA or United Kingdom, the representative’s identity and contact information will be published in this Privacy Policy or otherwise made readily available to affected individuals.

13. Security

CreativAI maintains administrative, technical, and organizational safeguards designed to protect personal information and Customer Content against unauthorized access, use, disclosure, alteration, or destruction.

Our security program includes access controls, encryption, infrastructure and network security measures, vulnerability management, monitoring and logging, and other safeguards appropriate to the nature of the information we process.

We periodically review and update our security measures in light of changes to our Services, technology, risks, and applicable requirements.

Additional information about CreativAI’s security practices and any applicable security certifications or independent assessments may be made available through our security documentation or Trust Center.

No security program can guarantee absolute security.

14. Security Incidents

We maintain an incident-response process that includes detection, containment, assessment, notification, and post-incident review.

Where CreativAI processes Customer Content on behalf of a customer and becomes aware of a security incident involving unauthorized access to, acquisition of, use of, or disclosure of personal data contained in that Customer Content, CreativAI will notify the affected customer without undue delay, in accordance with the applicable Data Processing Addendum and applicable law.

We will provide information reasonably available to us regarding the nature of the incident and will reasonably cooperate with the affected customer so that the customer can assess and satisfy its applicable breach-notification obligations.

Where CreativAI is directly required by applicable law to notify individuals or regulators of a personal-data breach, we will provide such notice within the legally required timeframe and through appropriate channels.

15. Cookies, Tracking, and Browser Signals

The Services use cookies and similar technologies that are necessary for authentication, security, session management, user preferences, and core service functionality. With your consent, we also use analytics cookies and similar technologies, such as those set by Google Analytics, to understand how visitors use our website and Services and to improve them. Analytics cookies are not used for advertising.

Analytics cookies are placed only if you accept them in our cookie banner. To change your choice or withdraw your consent at any time, select "Cookie settings" in the footer of our website.

CreativAI does not use Customer Content or personal information for targeted or behavioral advertising and does not sell or share personal information for cross-context behavioral advertising.

Browser “Do Not Track” signals are not interpreted consistently across the industry. Where applicable law requires us to recognize a legally valid opt-out preference signal, such as Global Privacy Control (“GPC”), we will honor that signal for the processing to which it applies.

Where required by applicable law, we will obtain consent before placing any non-essential cookies or similar technologies.

16. Children

The Services are intended for business and professional users and are not directed to or intended for individuals under 18 years of age. We do not knowingly permit individuals under 18 to create accounts or directly collect personal information from them through account registration.

Customer Content may include individuals under 18 depending on a customer’s lawful use case. Customers are responsible for ensuring that they have all notices, consents, permissions, and other legal bases required to collect, record, upload, or otherwise process information relating to children or minors through the Services.

If we learn that we have collected personal information directly from a child in a manner prohibited by applicable law, we will take appropriate steps to delete that information.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will provide notice through the registered account email address, in-product notifications, or other reasonable communication channels before the changes take effect. Where appropriate or required by applicable law, we will provide at least 30 days’ prior notice.

The Last Updated date at the beginning of this Privacy Policy indicates when this version was most recently revised.

18. Contact Us

For privacy questions, requests, or concerns, contact us at:

Email: contact@creativ-ai.com
Mailing address: 4615 Armour Drive, Santa Clara, CA, 95054