Your data

• Your account: your email address and a password, which our account provider stores only as a hash. Until you sign up, a free session without an email keeps your place.
• What you tell Creato: your idea, your answers in the interview, the name and direction you choose and any words you write for your website.
• What Creato makes: your brands, their files, guidelines, copy, sites and content.
• Payments: what you bought, when and for how much. Stripe handles the payment itself; we never see or store your card number.
• Your website's forms: the name, email and message a visitor sends through a site you published.
• The API: your keys, stored only as a hash, and a log of requests (which key, which endpoint, when, the result), with nothing you sent in them.

• To make your brand and keep it: everything Creato makes starts from what you told it.
• To run your account, your workspaces and your purchases, and to email you about them.
• To credit the partner who sent you, if one did. Partners see the names, dates and plans of brands credited to them, never your email or answers.
• To show your brand in the public gallery, only if you turn that on for it, and only its name, logo, colors and a line about it.
• To keep Creato working and safe: limits, abuse checks and totals such as how many previews became kits, never a profile of you.

We do not sell your data, and we do not use it for advertising.

A few companies run parts of Creato for us and handle data only to do that:

• Supabase stores accounts and brands.
• Vercel hosts the app and your published sites.
• Anthropic runs the design model that reads your idea and answers and writes your names, copy and directions. Under its commercial terms, what we send is not used to train its models.
• Stripe takes payments.
• Domain registries are asked whether a name's domains are free. They receive the name, nothing about you.

Some of them work outside the country you live in. Where the law requires it, they are bound by standard data protection terms.

Creato sets only the cookies it needs to work. There are no advertising or third party tracking cookies.

• Sign in: keeps you signed in, for as long as your session lasts.
• creato_space: remembers which workspace you were looking at.
• creato_partner: when you arrive through a partner's link, names that partner for 30 days so they are credited.
• creato_embed: when you start from a partner's embed, ties your brand to it, for 24 hours.

The landing page also keeps the idea you are typing in your browser's own storage, so it is still there if you come back. It never leaves your device until you start.

• Your account, brands and their files: for as long as you have the account.
• Payment records: as long as tax and accounting law requires.
• Messages from your site's forms: until the brand is deleted.
• The API request log: 30 days.

You can download your brands at any time from their kits. You can ask us for a copy of the data we hold about you, to correct it, or to delete your account and everything in it, and we will do it within a month. Depending on where you live, you may also object to how we use your data or complain to your data protection authority.

If you sent a message through a business's website made with Creato, that business decides what happens to it. Ask them first; we will help them answer you.

Creato is for people starting a business. It is not meant for anyone under 16, and we do not knowingly keep their data.

If we change how we handle your data in a way that matters to you, we will say so on the site or by email before the change applies.