Privacy Policy

1. Information We Collect

1.1 Account Information

• Email Address: For account creation, login, and communications
• Name: Display name (optional)
• Password: Stored only as a Bcrypt hash (10+ rounds), never in a form that can be read back
• Authentication Tokens: JWT tokens for session management

1.2 Usage Information

• AI Prompts: Your messages to CreonOS agents
• Generated Work: Files, pages and other content the agent creates for you
• Background Jobs: If you start a background job, the agent keeps working on our servers after you close the app, using the brief you approved and your project's files, and we email you when it finishes. You can stop a job at any time.
• Project Data: Workspace files, project graphs, execution logs
• Feature Usage: Which AI models, agents, and tools you use
• Settings: Theme preferences, editor settings, language preferences

1.3 Payment Information

• Billing Details: Processed by Stripe on the web and by Apple on iOS. We never see or store your card number. On iOS every purchase goes through Apple's in-app purchase system and we receive only a signed confirmation that it happened.
• Payment History: Invoices, subscription status, transaction IDs
• Subscription Tier: Free, Pro, Ultra, Studio or Agency

1.4 Technical Information

• IP Address: For security and rate limiting
• Browser & Device: User agent, OS, screen resolution
• Cookies: Session cookies, preferences (see Cookie Policy)
• Logs: API requests and error logs (see section 5 for how long they are kept)

1.5 Files, Photos, Video and Audio

• Attachments: Photos, video and documents you choose to attach to a conversation. Nothing is read from your device library unless you pick it.
• Voice and microphone: When you use voice mode we access your microphone, and audio is captured only while you are speaking and converted to text. The microphone is not open at any other time. We do not keep the audio. The transcript is treated exactly like anything else you type.
• Generated media: Images and video the agent creates or finds for you, stored in your workspace.

1.6 Connected Accounts

If you connect a third-party account, we store an access credential for it so the agent can act on your behalf. These are encrypted at rest and are never sent to your browser or exposed to the AI model.

• GitHub: To read your repositories, work on a branch and open pull requests. We never push to your default branch.
• Google / Gmail: Read access to your inbox, and send access only if you explicitly grant it. We ask for the narrowest scope that does the job.
• Supabase: The address of your own Supabase project and its public key, so the apps you ask for can have sign-in and saved data in your project. The secret key is refused and never stored. If you also let CreonOS manage your Supabase account, Supabase gives us an access token, which we keep encrypted on our server and never show to the AI model. With it the agent can apply your project's database changes, deploy an edge function and save a secret you type, each one only after you approve a card showing exactly what will change. A secret you type goes straight to Supabase and is never kept here.
• Amazon Web Services: Only if you link your own AWS account: the name of a role you created. No AWS password or key is stored.
• Your own domain: If you put a published site on a domain you own, we run that domain's DNS records while it is connected to us.

Every connection is listed in Settings, Connections. Disconnecting one there revokes it at the provider wherever the provider allows it (GitHub and Google do) and deletes the stored credential here. Deleting your account does the same for every connection. Each connect, disconnect and revoke, and each time the agent opens or pushes to your repository, changes your Supabase project or sends an email for you, is written to an audit record on your account. That record never contains the credential itself.

1.7 Age and Content Restrictions

• Year of birth: Asked so we can apply our minimum age. We ask for the year alone rather than a full date, and we do not verify it.
• Restriction settings and PIN: Which capabilities are switched off for the account. The PIN is stored hashed and never in plain text.

1.8 Reports of Harmful Content

If you report something through the app we record what you told us, any link you gave, your account, your IP address and the time. We keep this so we can investigate and act on it, and because we may need to show what we did about it.

1.9 Diagnostics and Analytics

• Crash and error reports: What broke, where, and the state of the app at the time.
• Performance data: How long things took, so we can find what is slow.
• Interaction events: Which features are used, and whether a run finished. Not the content of your work.
• Anonymous visitor identifier: A random ID stored in your browser so we can count visitors without accounts. It contains nothing about you, it is not an advertising identifier, and it is never shared. When you are signed in, this data is associated with your account.

1.10 Pages You Publish

Publishing puts a page on a public web address that anyone with the link can open. That is the point of the feature, and it means anything you put on that page stops being private. Publishing always asks first and is never automatic. You can ask us to take a published page down at any time.

1.11 What the Agent Remembers About You

So that you do not have to repeat yourself, the agent can save short notes about how you work and what you are building. This is the only part of the product that keeps a record about you rather than a record of what you did, so it is worth being precise about it.

• What can be saved: preferences you have stated, corrections you have given the agent, facts about a project you are working on, and links to things you have pointed it at.
• What is never saved: passwords, payment details, access tokens for connected accounts, and the contents of your files. Notes are written by the agent in plain English, not scraped.
• Project notes stay with the project. A note taken while working on one thing is scoped to that workspace and is not carried into an unrelated one.

You can see all of it, and you can delete any of it. Settings contains a Memory tab listing every note in full, with the date it was written. Nothing is hidden behind a summary, and deleting a note removes it immediately and permanently. Deleting your account deletes all of them.

If a project is built on files you provide that describe how you like an agent to work, such as a README or an instructions file in a repository you connect, the agent may read those and keep what is relevant to that project. That is the purpose those files serve, and the notes it takes from them are visible and removable in the same place as all the others.

1.11 Session Recordings (only if you allow them)

If you allow recording, we record how you use the app so we can see where people get stuck and fix it. A recording holds the layout of the screens you open, where you click, how you scroll, your screen size and your browser type. It does not hold what you type. Every text box, including passwords and the messages you send to the agent, is masked in your browser before anything is sent to us. The text of your chats, your code, the names of your files and projects, and any email address shown on screen are masked the same way, and previews of the pages the agent builds are not recorded at all. We record only while you are signed in. A recording stops after 30 minutes and we start at most three a day for one account. Recordings are stored in our own storage with Amazon Web Services in London, are never sold or shared with an analytics or advertising company, and can be opened only by a CreonAI administrator, which is logged each time. Nothing is recorded unless you say yes, and you can turn it off at any time under Settings, then Account.

1.12 AI Assistants You Connect (Claude, ChatGPT, Cursor and others)

You can connect CreonOS to an AI assistant so it can build and publish websites on your account. When you connect one, you sign in to CreonOS and choose what it may do and how many credits it may spend in a day.

• What we receive: only what the assistant sends for each request, such as the description of the website you want, the change you asked for, or which project to publish, or the address of a website you ask it to check. We do not receive your conversation with the assistant, its memory or your chat history, and we never ask for them. If you ask an assistant to check a website without connecting a CreonOS account, we receive only that address and the network address the request came from, and keep the result for two days.
• What we keep: a record of the connection (the assistant's name, what you allowed, your daily limit and when it was last used), the sign in tokens in a form that cannot be turned back into the token, and a log of each request (which action, a short excerpt of what was asked, and whether it worked) so we can show you what an assistant did and investigate misuse. The websites it builds are ordinary projects on your account and are kept like any other project.
• What the assistant sees: the results we send back, such as a build's progress, a short summary, a picture of a page and the address of a published site. When you ask it to, it also sees the enquiries visitors sent through the forms on your published sites (the name, contact details and message they gave), so it can help you reply. Your assistant's provider handles those under its own privacy policy.
• Your own web address: if your plan includes one and you ask your assistant to connect a web address you own to one of your published sites, we receive that address, read its public settings (its DNS records, such as which company handles its email) and copy them into the settings we then run for it, so they keep working. The assistant sees the nameservers to set at the company the address was bought from, how far the set up has got, and a short summary of what we found.
• Asking the CreonOS team for help: if you ask your assistant to pass a request to us, we receive what you asked for, your account email and any phone number you chose to give, and keep it like any other enquiry to Creon Studio.
• Disconnecting: remove an assistant at any time in Settings, under Connected assistants. Its access ends on its very next request.

1.12 If You Contact a Business Through a Site Built With CreonOS

Some sites built with CreonOS have a contact, booking, order or sign-up form. When you fill one in, the business that owns that site is responsible for your data (the controller). We store the message securely in the EU on their behalf and email it to them, and we show it to them in their own dashboard (the processor). We keep it for as long as the business chooses, 24 months unless they shorten it, and we delete it when they ask or when their account is closed. We never market to you and never use your message for anything but delivering it to that business. We do not store your IP address, only a salted hash for abuse control, for 90 days. To see, correct or delete what you sent, ask the business; if you cannot reach them, write to us and we will pass it on.

2. How We Use Your Information

2.1 Service Delivery

• Provide AI-powered development assistance
• Run AI agents that carry out the tasks you ask for, including background jobs you start
• Store and sync workspace data across devices
• Deliver real-time notifications and updates

2.2 Platform Improvement

• Analyze usage patterns to improve AI models
• Identify and fix bugs through error logs
• Develop new features based on user behavior
• Optimize performance and reduce latency

2.3 Communication

• Send account verification emails
• Notify about service updates and new features
• Respond to support requests
• Send security alerts (e.g., unusual login activity)

2.4 Legal Compliance

• Comply with GDPR, UK Data Protection Act, and other regulations
• Respond to legal requests (e.g., subpoenas, court orders)
• Enforce our Terms of Service
• Detect and prevent fraud, abuse, and security incidents

3. Data Sharing and Third Parties

3.1 AI Service Providers

Note: These providers process what we send under their own terms and privacy policies. We use their paid business APIs, and we send them only what the task needs.

3.2 Other Service Providers

• Amazon Web Services (AWS): Hosting, database, file storage, content delivery and email, in AWS's London region
• Stripe: Payments on the web (see Stripe's Privacy Policy)
• Apple: Payments in the iOS app, and sign in if you choose Sign in with Apple
• Google and GitHub: Sign in, if you choose to sign in with them, and the connected accounts described in section 1.6
• Sentry: Error monitoring, set not to collect personal details
• Meta Platforms Ireland: Only if you choose "Allow all" on our website: measuring our adverts on Facebook and Instagram (see section 7). Never from the iPhone or iPad app.

3.3 The Companies CreonOS Connects To, and What Each One Gets

The services you can connect, sign in with or pay through, in one place. Each one only receives what is listed here, and only when you use that part of CreonOS.

None of these companies is given a password of yours. You can disconnect GitHub, Google, Supabase and the others in Settings, Connections, and change your answer about Meta at any time (section 7).

3.4 What We Never Do

• ❌ We never sell your personal data to third parties
• ❌ We never share your code with advertisers
• ❌ We never use your private code to train public AI models
• ❌ We never rent your email list for marketing

4. Data Security

4.1 Encryption

• In Transit: HTTPS (TLS) for all traffic
• Stored Files: Files we keep in cloud storage, such as published pages and shared work, are encrypted with AES-256
• Passwords: Bcrypt hashing with 10+ rounds (never stored in plaintext)
• Connected Accounts and API Keys: Encrypted individually in the database, never logged

4.2 Security Practices

• Regular security reviews of the code
• Automated dependency and code security scanning on every change
• Rate limits on sign in and on every public endpoint
• Sign-in tokens that are signed, short-lived and renewed automatically

4.3 Data Breach Notification

If a breach affects your personal information, we will report it to the Information Commissioner's Office within 72 hours where the law requires it (UK GDPR Article 33), and tell you without undue delay if it puts you at high risk (Article 34).

5. Data Retention

5.1 Active Accounts

• Account Data: Retained while your account is active
• Usage Data: Retained while your account is open
• Server Logs: Kept to investigate faults and abuse. They can include your email address and IP address
• Backups: Deleted data can remain in automatic backups for up to 7 days
• Session recordings: Deleted automatically 30 days after they are made

5.2 Deleted Accounts

• Account data is permanently deleted within 30 days of account deletion
• Anonymized usage statistics may be retained for analytics
• Legal obligations may require retaining certain data (e.g., billing records for 7 years)

5.3 Data Export

Before deleting your account, you can request a full data export in JSON format. Email marco@creonai.io to request your data export.

6. Your Privacy Rights (GDPR)

6.1 Right to Access (Article 15)

Request a copy of all personal data we hold about you. We will provide this within 30 days in machine-readable format (JSON).

6.2 Right to Rectification (Article 16)

Correct inaccurate or incomplete personal data. You can update most data directly in your account settings.

6.3 Right to Erasure (Article 17)

Request deletion of your account and all associated data. This is irreversible and takes effect within 30 days.

6.4 Right to Data Portability (Article 20)

Export your data in JSON format for transfer to another service.

6.5 Right to Object (Article 21)

Object to processing of your data for marketing purposes. Unsubscribe from emails via the link in any email.

6.6 Right to Withdraw Consent (Article 7)

Withdraw consent for optional data processing (e.g., analytics cookies) at any time.

6.7 How to Exercise Your Rights

Email marco@creonai.io with your request. We will respond within 30 days, and usually much sooner.

7. Cookies, Storage and Tracking

We use cookies for authentication and preferences, and browser storage for your settings and a random visitor identifier used to count visits. See our Cookie Policy for full details on types, purposes, and how to manage them.

Advertising only if you choose it. On our website you can choose "Allow all". Only then, the Meta Pixel tells Meta (Facebook and Instagram) which of our pages you visited and whether you signed up, so we can measure our adverts and show them to people like you. Meta receives that with the technical details its pixel collects from your browser, such as your IP address and browser type, and uses it under its own privacy policy. CREONAI LTD and Meta Platforms Ireland Limited are joint controllers for collecting and sending this data. Your legal basis is consent, and you can withdraw it at any time with "No thanks" or "Count visits only", or under Settings, then Account, then Ads measurement. The iPhone and iPad app never uses the Meta Pixel.

We use no other advertising network, we do not share your data with data brokers, and we never sell it. Analytics are used to understand how the product is used and nothing else.

If you allow session recording, your answer and a count of how many recordings have started today are kept in your browser's storage. Our Cookie Policy lists both.

8. Children's Privacy and Parental Controls

CreonOS is not intended for users under 13 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately at marco@creonai.io and we will delete it promptly.

We ask for your year of birth and refuse accounts below the minimum age. This is what you tell us: we do not verify it, and we say so plainly rather than implying a check we do not perform.

Settings contains content restrictions that can be protected with a PIN. They switch off the agent's access to the open web, to photo and video search, and to publishing pages publicly. These are enforced on our servers rather than hidden in the app, so they hold on any device the account is used on and cannot be bypassed by modifying the app.

9. International Data Transfers

Your account and project data are stored in the United Kingdom, in AWS's London region. Some of it is sent to service providers outside the UK to be processed, mainly in the United States for AI processing (see section 3). We ensure these transfers comply with GDPR through:

• Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
• Adequacy Decisions: Transfers to countries recognized by the EU as providing adequate protection
• Data Processing Agreements (DPAs): With all third-party processors

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes via:

• Email to your registered address
• In-platform notification banner
• Updated "Last Updated" date at the top of this page

Continued use of CreonOS after changes constitutes acceptance of the updated policy.

11. Contact Information

CreonOS is run by one person. There is no support queue and no ticket number: that address reaches the person who builds it, and it is answered.

12. Supervisory Authority

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):