GDPR Compliance

CreatifyHQ takes data protection seriously. This page explains our compliance with Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and related data protection legislation. If you are based in the EU, EEA, or UK, this page is particularly relevant to you. All rights described here are available to you regardless of where you are located — we apply the same standards globally.

1. Scope — Does GDPR Apply to You?

GDPR applies to you if:

• You are physically located in the EU or EEA (European Economic Area) when using CreatifyHQ, or
• You are a citizen or resident of an EU/EEA member state, regardless of where you currently reside

UK GDPR (post-Brexit UK data protection law) applies if you are based in the United Kingdom.

Even if GDPR technically does not apply to you (for example, if you are in the US or Canada), CreatifyHQ applies GDPR-equivalent protections to all users as our global baseline standard.

2. Our GDPR Commitment

CreatifyHQ has implemented the following specific measures to achieve and maintain GDPR compliance:

• Privacy by Design: Data protection is built into our systems from the ground up, not added as an afterthought
• Data Minimisation: We collect only the personal data necessary to provide the Service — nothing more
• Purpose Limitation: Data is used only for the clearly stated purposes in our Privacy Policy
• Storage Limitation: Data is retained only as long as necessary, then securely deleted
• Data Processing Agreements: All sub-processors are bound by GDPR-compliant DPAs
• Transfer Safeguards: Standard Contractual Clauses (SCCs) for all transfers outside the EEA/UK
• Breach Notification: 72-hour notification protocol for reportable breaches
• Right to Erasure: Self-service account deletion available in-app at any time
• Consent Records: Explicit consent is obtained and recorded where required (e.g., voice profile training, marketing emails)

3. The Six Data Protection Principles

Under GDPR Article 5, personal data must be processed in accordance with six core principles. Here is how CreatifyHQ upholds each one:

Principle	How CreatifyHQ Upholds It
Lawfulness, fairness, and transparency	We have a clear legal basis for all processing; our Privacy Policy is plain-language and publicly available
Purpose limitation	Data is used only for the specific purposes stated — not repurposed for advertising, profiling, or sale
Data minimisation	We collect only what is necessary: name, email, content inputs. No unnecessary data collection.
Accuracy	Users can update their name and email at any time via Settings → Profile
Storage limitation	Clear retention periods are defined in our Privacy Policy; data is deleted after expiry or on request
Integrity and confidentiality	AES-256 encryption at rest, TLS in transit, bcrypt password hashing, JWT authentication, rate limiting

4. Your Rights Under GDPR

GDPR grants EU/UK residents the following rights. CreatifyHQ honours all of these for every user worldwide:

Article 15 — Right of Access

You have the right to obtain a copy of all personal data we hold about you, and information about how we process it. To submit an access request, email [email protected] with the subject "Data Access Request (Art. 15)". We will respond within 30 days and provide a JSON export of your data free of charge.

Article 16 — Right to Rectification

You have the right to correct inaccurate personal data. You can update your name and email address directly in Dashboard → Settings → Profile. For other corrections, contact [email protected].

Article 17 — Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data. This right applies when the data is no longer necessary for the original purpose, when you withdraw consent, or when the processing was unlawful. See our Data Deletion page for full instructions, including self-service deletion via Settings → Security → Delete Account.

Article 18 — Right to Restriction of Processing

You have the right to request that we restrict our processing of your data in certain circumstances — for example, while you contest the accuracy of data, or while an objection is being assessed. Contact [email protected] to request restriction.

Article 20 — Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON), and to transmit it to another controller. To request a data export, email [email protected] with the subject "Data Portability Request (Art. 20)".

Article 21 — Right to Object

You have the right to object to processing based on legitimate interests (e.g., analytics, platform improvement). If you object, we will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests. Contact [email protected].

Article 22 — Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated processing that have significant legal or similarly significant effects on you. CreatifyHQ does not use solely automated decision-making with such effects. Our AI generates content at your direction — all publishing decisions are made by you.

Right to Withdraw Consent

Where processing is based on consent (e.g., voice profile training, marketing emails), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. You can withdraw consent via Settings or by emailing [email protected].

5. Legal Basis for Processing

We rely on the following legal bases under GDPR Article 6 for our processing activities:

• Art. 6(1)(a) — Consent: Voice profile training from uploaded samples; optional marketing emails. You may withdraw consent at any time.
• Art. 6(1)(b) — Contract performance: Account management, content generation, publishing, billing, transactional emails. Without this processing, we cannot deliver the Service.
• Art. 6(1)(c) — Legal obligation: Retention of billing records for 7 years as required by financial regulation.
• Art. 6(1)(f) — Legitimate interests: Platform analytics and improvement; security and fraud detection. We have conducted a legitimate interests assessment (LIA) and balanced these against your interests and rights.

For the full processing activity register and legal basis per activity, see our Data Processing page.

6. International Data Transfers

We operate from the United States. When we transfer personal data from the EU/EEA or UK to the US (or other countries outside the EEA/UK), we ensure appropriate safeguards are in place as required by GDPR Chapter V:

• Standard Contractual Clauses (SCCs) — European Commission approved model clauses (2021 SCCs) are in place with all sub-processors located outside the EEA, including Railway, OpenAI, Anthropic, SendGrid, and Stripe
• EU-US Data Privacy Framework (DPF) — where sub-processors are certified under the EU-US DPF or UK Extension, we rely on this framework as an additional safeguard
• Adequacy decisions — for countries with an EU adequacy decision in force

You may request copies of the SCCs applicable to specific sub-processors by emailing [email protected].

7. Data Processing Agreement (DPA)

If you are using CreatifyHQ in a business context (B2B) and process your end-users' or customers' personal data through our platform, you may be acting as a data controller and CreatifyHQ as your data processor. In this case, a formal DPA may be required under GDPR Article 28.

To request a DPA:

• Email [email protected] with the subject "DPA Request"
• Include your company name, country, and a brief description of your use case
• We will provide a completed, signed DPA within 5 business days

Our DPA includes GDPR Article 28 requirements, SCCs for international transfers, and our sub-processor list with corresponding safeguards.

8. Children's Data

Under GDPR, special protections apply to children's data. The threshold in GDPR Article 8 is age 16 (member states may lower this to age 13). CreatifyHQ sets the minimum age for all users at 16 years globally.

We do not knowingly collect personal data from anyone under 16. If you are aware that a child under 16 has created a CreatifyHQ account, please contact us immediately at [email protected] and we will delete the account promptly.

9. Complaints to Supervisory Authorities

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection supervisory authority. You do not need to contact us first, though we encourage you to do so as most issues can be resolved quickly.

• EU: Contact your national Data Protection Authority. Find yours at edpb.europa.eu
• UK: Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint
• Ireland: Data Protection Commission (DPC) — dataprotection.ie
• Germany: Your state-level DPA (Landesdatenschutzbehörde)

10. Contact Our Privacy Team

For all GDPR-related enquiries, data subject requests, or to request a DPA:

• Email: [email protected]
• Subject line: Include the relevant GDPR article (e.g., "Art. 15 Access Request") for fastest routing
• Response time: All requests acknowledged within 5 business days; responded to within 30 days (we may extend by a further 2 months for complex requests, with notice)