Privacy Policy
Last updated: March 24, 2026
1. Who We Are & What This Policy Covers
Cread, Inc. ("Cread", "we", "us", "our") is a technology company providing an AI-powered advertising platform available at cread.app. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website and services. It applies to all registered users, visitors, and anyone whose data we process in connection with our services. If you have questions about this Policy, contact us at privacy@cread.app. Residents of the European Economic Area (EEA), United Kingdom (UK), Brazil, Colombia, Argentina, Mexico, and California have additional rights described within this Policy.
2. Information We Collect
We collect information you provide when registering an account (name, email, company name, payment information) and through your use of the service (ad copy, images, product descriptions, campaign data you upload or generate). We automatically collect technical data about your device and browser — including IP address, browser type, operating system, pages visited, and time spent. When you connect third-party accounts such as Meta, we receive data from those platforms (account identifiers, page IDs, ad performance metrics, creative assets) as authorized by you through that platform's permissions. We also receive information from payment processors (transaction records, billing details) and authentication providers (OAuth tokens).
3. How We Use Your Information
We use your information to: provide, operate, and improve the Cread platform; process payments and manage your subscription; authenticate your identity and secure your account; generate AI-powered content based on your brand inputs; enable campaign publishing to connected advertising platforms; send transactional communications (receipts, service alerts, security notices); send marketing communications with your consent where required by law; conduct analytics to improve the product; prevent fraud and enforce our Terms of Service; comply with legal obligations; and, in anonymized and aggregated form, improve our AI models. We do not sell your personal information to third parties.
4. Legal Basis for Processing (GDPR, Habeas Data & Regional Laws)
If you are located in the EEA or the United Kingdom, we process your personal data on the following legal bases: (a) Contract performance — processing necessary to provide the service; (b) Legitimate interests — analytics, fraud prevention, and product improvement; (c) Consent — for optional marketing and cookie-based analytics; (d) Legal obligation — where required by applicable law. You may withdraw consent at any time without affecting prior processing. If you are located in Colombia, we process your personal data in accordance with Ley 1581 de 2012 (Habeas Data) and its regulatory Decree 1377 de 2013. Processing is based on your prior, express, and informed authorization (autorización), except where the law permits processing without it. You have the right to know, update, correct, and delete your data, and to revoke authorization at any time. If you are located in Brazil, processing is conducted under the LGPD with lawful bases equivalent to those above. If you are located in Argentina, we comply with Ley 25.326 (Protección de Datos Personales). If you are located in Mexico, we comply with the LFPDPPP. Contact privacy@cread.app to exercise any of these rights.
5. Data Sharing & Sub-Processors
We share personal data with trusted service providers who assist in delivering the service, including: cloud infrastructure providers (hosting and storage), payment processors, AI model providers (text and image generation), email and communication platforms, analytics services, and customer support tools. All service providers are contractually required to protect your data and use it only for specified purposes. We may disclose data to law enforcement, regulators, or courts when required by applicable law. In the event of a merger, acquisition, or sale of Cread, your data may be transferred to the acquiring entity. We may share anonymized, aggregated data that does not identify you. We do not sell your personal data to third parties for their own marketing purposes.
6. International Data Transfers
Cread, Inc. is based in the United States, and your data is primarily processed and stored on US-based servers. If you are located in the EEA or UK, we rely on the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), and the UK International Data Transfer Agreement (IDTA), as applicable. If you are located in Colombia, international transfers of your personal data are conducted in accordance with Ley 1581 de 2012 and Decree 1377 de 2013, which require that the receiving country provides adequate data protection levels or that appropriate contractual safeguards are in place. If you are located in Brazil, transfers comply with LGPD international transfer requirements. If you are in Argentina or Mexico, we apply equivalent safeguards under Ley 25.326 and the LFPDPPP respectively. By using the service, you acknowledge that your data may be transferred to and processed in the United States. Contact privacy@cread.app for details on the specific transfer mechanisms applicable to your jurisdiction.
7. Data Retention
We retain your personal data for as long as your account is active and for a reasonable period thereafter to meet legal and contractual obligations. Upon subscription cancellation, your data is archived for 60 days to allow account reactivation. After this period, personally identifiable information is deleted or anonymized, except where retention is required by law (for example, billing records for tax purposes, typically up to 7 years). Aggregated and anonymized data may be retained indefinitely. If you request account deletion before the retention period expires, we will process your request within 30 days, subject to outstanding legal obligations.
8. Your Privacy Rights
Depending on your location, you may have the following rights: access a copy of your personal data; correct inaccurate data; request deletion ("right to be forgotten"); restrict or object to certain processing; data portability; and withdraw consent at any time. California residents have rights under the CCPA/CPRA, including the right to know, opt out of the sale of personal data (we do not sell personal data), and non-discrimination. Brazilian residents have rights under the LGPD including access, correction, deletion, and portability. UK residents have equivalent rights under UK GDPR. Colombian residents have rights under Ley 1581 de 2012 (Habeas Data), including the right to know what data is held, to update and correct it, to request deletion, to revoke authorization, and to file a complaint (queja) with the Superintendencia de Industria y Comercio (SIC) at sic.gov.co. Argentine residents have rights under Ley 25.326, including access, rectification, and deletion, with complaints to the AAIP at argentina.gob.ar/aaip. Mexican residents have ARCO rights (Acceso, Rectificación, Cancelación, Oposición) under the LFPDPPP, with complaints to the INAI at inai.org.mx. To exercise any right, email privacy@cread.app. We will respond within 30 days or the timeframe required by applicable law.
9. Children's Privacy
Cread is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18 (or under 16 in the EEA/UK). Consistent with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly solicit or collect information from children under 13 without verifiable parental consent. If you are a parent or guardian and believe your child has provided personal information to Cread, contact us immediately at privacy@cread.app. Upon verification, we will promptly delete the relevant data.
10. Contact, Complaints & Policy Updates
For questions, concerns, or requests regarding this Privacy Policy, contact our privacy team at privacy@cread.app. If you are located in the EEA, Cread will appoint a European Data Protection Representative as required — contact privacy@cread.app for current representative details. If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority: EU — edpb.europa.eu; UK — ICO at ico.org.uk; Brazil — ANPD at gov.br/anpd; Colombia — Superintendencia de Industria y Comercio (SIC) at sic.gov.co; Argentina — AAIP at argentina.gob.ar/aaip; Mexico — INAI at inai.org.mx. We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice within the platform before changes take effect.