Who is responsible and what this notice covers
usecreable LLC, a Wyoming limited liability company, is the controller of the personal data described here. Address: 30 N Gould St, STE R, Sheridan, WY 82801, United States. Contact us for privacy requests or support at support@usecreable.com.
This notice covers the usecreable application and the usecreable promotional pages that refer to it. It describes account, campaign, payment, support and measurement activities. Brands, agencies, social platforms and payment providers may act as separate controllers for their own activities. The service is for people aged 18 or over.
Data we collect and where it comes from
We collect the information you provide when registering, completing onboarding, joining an organization, creating campaigns, submitting content, using training materials or contacting us. This can include your name, email, profile image, country, preferences, onboarding answers, organization details, messages and uploaded files.
When you connect a social account or submit a public post, we obtain account identifiers, profile information, posts, engagement and audience metrics, and authorization information from the social platform and our social-data provider. Access depends on the permissions you grant and the data available from those sources. Disconnecting an account stops the connection; it does not itself erase records already needed for campaigns or payments.
We receive transaction references, amounts, billing and tax information, payment status and payout-account status. Stripe collects payment instruments and identity-verification information through its own payment and onboarding flows. Our application uses payment references rather than storing complete card numbers or card security codes.
Technical data includes IP addresses, device and browser information, access and security logs, timestamps and actions within the service. Optional analytics and advertising can collect additional usage events and identifiers as described below. Organizations may provide invitations and collaboration information about you; public social sources may supply information used to verify submitted content.
Purposes and legal grounds
Where the GDPR applies, we process data on these grounds:
- Providing the service and taking requested steps before a contract: accounts, access, social connections, campaigns, content review, compensation, payments, training features and support. Without information needed for a particular function, we cannot provide that function.
- Legal obligations: applicable accounting, tax, payment, regulatory and lawful-authority requirements.
- Legitimate interests: protecting accounts, preventing fraud, resolving disputes, diagnosing errors, operating internal support and preserving evidence of agreed campaign terms. We balance these interests against your rights; you may object as explained below.
- Consent: optional product analytics, session recording and advertising measurement. Consent is separate from accepting the Terms and is not required to register or perform ordinary payment operations. Any separate optional marketing consent is requested for that purpose.
Cookies, analytics and advertising
Necessary cookies and similar storage support authentication, security and your preferences. The application stores privacy choices in uc_privacy for 180 days. Optional analytics and advertising start disabled in the application; you can accept, refuse or choose them separately and reopen Privacy choices at any time. Global Privacy Control overrides advertising permission. Browser preferences may need to be set again on another device or after clearing storage.
When you explicitly save a choice in the application, we record the analytics and advertising settings, receipt time, choice version, application source and whether Global Privacy Control applied. A random identifier distinguishes that save from a retry; it does not identify a visitor. The receipt is linked to your account only if you are signed in. This technical register helps us apply and document your choices, including refusals, and does not contain your browsing history. Receipts remain in our audit history without automatic expiry; account erasure removes their link to your account. They are separate from the 180-day browser cookie.
With analytics consent, PostHog receives product events, page visits, account identifiers and device information, and may record sessions, clicks and scrolling. Form inputs are masked, but this does not make every visible part of a page anonymous. With advertising consent, Meta receives conversion events and available matching data, including hashed email, advertising identifiers, IP address and browser information. Hashing does not make personal data anonymous. Advertising attribution cookies used by the app last up to 90 days. An account's advertising choice also governs its future server-side conversion delivery; accepting later does not authorize earlier conversion events.
Promotional pages hosted on Lovable may use Meta Pixel and Google Analytics. The application's controls do not automatically control scripts on those pages. Consult the choices and information provided on the page you visit. Withdrawal stops future optional collection or delivery covered by that choice; it does not automatically erase data already received by a provider. You can request erasure separately and use your browser controls to remove cookies and local storage.
Service providers and other recipients
Authorized members of your organization and campaign counterparties receive the profile, content, performance and transaction information needed for their role. Public social posts remain public under the settings of the relevant platform. Files or screenshots you choose to share may be accessible to anyone with their sharing link; do not include unnecessary sensitive information.
Our configured services include:
- Google Cloud and Firebase: hosting, databases, file storage and infrastructure. Google sign-in and Google Drive are used when you select those features. Google Vertex AI/Gemini supports analysis of fraud signals and campaign-related information. Google privacy, Cloud data terms.
- Stripe: payments, payout onboarding, identity and payment-risk checks. Privacy.
- InsightIQ: social-account connections, public and authorized social information, content and audience metrics. Privacy.
- Resend: transactional emails and delivery information. Privacy.
- Sentry: application errors, technical diagnostics and security troubleshooting. Privacy.
- PostHog: optional product analytics and session recording. Privacy.
- Meta and Google Analytics: advertising and website measurement where used, subject to the relevant choices. Meta privacy, Google privacy.
- Discord: internal operational notifications, which can include account/contact details and campaign or transaction events; community features when you choose to join. Privacy.
- GitHub: feedback reports, including your email, account identifier, report text and any screenshot you submit. Privacy.
- Vimeo: training videos when you access them. Privacy. Lovable: promotional-page hosting. Privacy.
We may disclose relevant records to professional advisers, competent authorities or parties to a business reorganization where legally permitted. Provider notices explain their own processing; they do not replace this notice for activities controlled by usecreable.
Location and international transfers
Our main production database and file-storage buckets are configured in Google Cloud's European region in Belgium. usecreable LLC is based in the United States. Providers, support operations and some processing, including global AI endpoints, can involve other countries; European hosting does not mean all processing stays in Europe.
Transfers subject to the GDPR require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, unless a specific lawful exception applies. The arrangements depend on the recipient and service; Google's Cloud Data Processing Addendum and providers' published data terms describe their available contractual protections. Contact us for information about the recipients and safeguards relevant to your data, or to request a copy where applicable. Accepting these Terms or this notice is not blanket consent to international transfers.
How long we keep information
Retention depends on the category and the purpose:
- Account, profile and social-connection data is kept while needed to operate your account. On an erasure request, we delete or anonymize personal information that no longer has a lawful reason to be retained, revoke access and address connected records.
- Campaign terms, content, approvals, metrics and payment records may remain after account closure where needed to complete commitments, substantiate payments, meet applicable accounting/tax duties or resolve claims within the applicable limitation period. Shared organization records and other people's rights are considered separately; deleting an account does not automatically erase a team's campaign history.
- In-app notifications are scheduled for deletion after 90 days when read, or 180 days when unread. Temporary advertising conversion-request context expires after seven days and is removed by scheduled cleanup.
- Ordinary Google Cloud logs are configured for 30 days; the provider's required audit-log bucket uses 400 days. Records retained separately for an incident, dispute or legal duty follow that specific purpose.
- Pending uploads in the media-library and delivery storage are scheduled for removal after one day. Some unpurchased delivery versions become eligible for deletion after a 30-day window once their workflow marks them for removal. Purchased assets, campaign evidence and shared files have separate lifecycle rules; this is not a 30-day limit for every uploaded file.
- Storage keeps a seven-day recovery window after object deletion. The database uses a rolling set of seven automatic backups and seven days of transaction logs. Recovery copies disappear through rotation; erasure is not an instantaneous rewrite of every backup.
- Support, analytics and provider-held records are retained according to the time needed to resolve the request, analyze the relevant service period, investigate incidents or satisfy the provider's applicable obligations. Account closure, consent withdrawal and an erasure request are different actions. Ask us about the period or criteria for a particular record.
Automated checks and your rights
We use automated checks on post ownership and availability, engagement patterns, metric changes and campaign requirements. Results can affect content acceptance, eligibility, tracking and payment holds, or trigger further review. AI can assist staff in interpreting signals. You may contest a result, provide context and request human review at support@usecreable.com; we do not present an automated score as infallible.
Depending on applicable law, you may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, withdraw consent or exercise rights concerning targeted advertising or data sharing. Meta matching may qualify as sharing for targeted advertising under some US laws. Use Privacy choices to refuse advertising; we also honor Global Privacy Control. We do not charge for or discriminate against the ordinary exercise of privacy rights.
We may request proportionate information to verify your identity. Where the GDPR applies, we normally respond within one month; any lawful extension or refusal will be explained. You may complain to a competent supervisory authority, including where you live or work. If you believe a child has provided personal information, contact us so we can address it.
Security and updates
We use access controls, encrypted connections and other technical and organizational measures appropriate to the service. No system can guarantee absolute security. We update this notice when processing changes and provide additional notice or request a new choice where required. The date shown on this page identifies this version.