← KREATA

Privacy Policy

Last updated 27 October 2026

1. Who we are

CROXSTUDIOS LTD, a company registered in Rwanda ("we", "us"), operates KREATA and is responsible for your personal data. Contact us about privacy at [email protected].

2. What we collect

We collect the data below, in the ways described.

  • Account data: your name, e-mail address and password (stored only as a salted hash), or your Google account identifier if you sign in with Google.
  • YouTube and Google data: when you connect a channel or sign in with Google, the data you authorise (such as channel details, videos and analytics), and the tokens needed to keep that connection working.
  • Content you create or upload: prompts, scripts, images, audio, video and files in your k-Drive and projects, and the rights information you declare for them.
  • Usage and billing data: credits spent, plan, which features and models you use, and payment status from Stripe.
  • Security and audit data: log-in events, API key activity, your IP address and browser details, and records of requests that our content policy refused (see section 6).

3. How we use it

To provide and secure KREATA, run the AI features you request, bill you, support you, prevent abuse and fraud, and meet legal duties. Our legal bases are performing our contract with you, our legitimate interests in keeping the service safe, your consent where we ask for it (for example connecting YouTube), and legal obligation.

4. Google and YouTube data

KREATA’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use YouTube data only to show you your channel’s analytics and to run the features you ask for, and we do not sell it or use it to train AI models.

Benchmark sharing is off unless a channel admin turns it on (“Share revenue privately”). When it is on, we use that channel’s revenue figures — read from YouTube Analytics or typed in by you — only to check and improve KREATA’s own revenue estimates. They are pooled and anonymised, never reported for a group of fewer than 5 channels, and never shown to anyone outside your workspace or on any public page. Figures read from YouTube Analytics are deleted after 30 days; turning sharing off deletes everything shared for that channel.

KREATA uses YouTube API Services, and by using our YouTube features you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google’s Privacy Policy (https://policies.google.com/privacy). You can revoke KREATA’s access to your Google account at any time at https://myaccount.google.com/permissions, and you can disconnect a channel or delete your account in KREATA to have the related data removed.

5. Who we share data with

We do not sell your personal data. We share it only with the service providers that help us run KREATA, and only what they need:

  • Google (sign-in and YouTube API Services): sign you in with Google and read your channel and video data with your permission.
  • Stripe: take payments and manage subscriptions (we never see or store your card number).
  • AI model providers: to generate the content you request, we send your prompts and input files to our approved model providers and routing partners, which currently include Kie.ai (we route image, video, music and text generation requests through Kie.ai and other approved inference providers), OpenAI (for text and moderation), DeepSeek (for text analysis in our video tools) and ElevenLabs (for voice and speech).
  • Apify: fetch public YouTube transcripts you request.
  • Resend and Gmail (SMTP): send account and notification e-mails.
  • Cloudflare R2 and our hosting provider: store your files and run the service.

6. AI processing and content safety

When you run an AI feature, your prompt and any files you attach are sent to the model provider for that feature so it can respond. We do not use your content to train our own models. To detect prohibited content we may also send the text of a request to OpenAI’s moderation service before it runs.

To enforce our Terms, we screen generation requests before they reach any provider. If a request is refused, we keep a record of it (your account, workspace, API key, the model, the category and a short excerpt of the request, limited to its first 120 characters with obvious personal details masked) for 12 months and then delete it. Other security and audit records are kept for as long as needed for security and legal purposes.

7. How long we keep data

We keep your account data and content while your account is active. If you delete your account we delete or anonymise your data, except what we must keep for legal, tax, fraud-prevention or dispute reasons. Refused-request records follow the period in section 6. Revenue you choose to share for benchmarks follows the periods in section 4; figures you type in yourself are kept for up to 24 months.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict some processing, and to withdraw consent. Write to [email protected] and we will respond within the time the law requires. In Rwanda the relevant law is the law on the protection of personal data and privacy, supervised by the National Cyber Security Authority; you can also complain to the data protection authority where you live.

9. Security

We protect data with encryption in transit, hashed passwords, per-workspace access controls, scoped and capped API keys, and audit logging. No system is perfectly secure; tell us at once if you suspect a problem.

10. International transfers

Our providers may process data in countries other than yours. Where the law requires, we rely on appropriate safeguards for these transfers.

11. Cookies and local storage

We use cookies and your browser’s local storage to keep you signed in, remember your settings and keep the service secure. We do not use them for third-party advertising.

12. Children

KREATA is not for children under 16 and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

13. Changes

We may update this policy and will show the date of the latest version here, and tell you about material changes.

Terms of Service · Privacy Policy