Privacy Policy

Overview

CleverCreator AI ("we", "us", "our") operates the platform available at clevercreator.ai and all associated subdomains and products. This Privacy Policy explains how we collect, use, store, and share information about you when you use our services.

By using CleverCreator AI, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

Information we collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third parties.

Information you provide

• Account information: name, email address, password (hashed), and optional profile photo.
• Payment information: billing address and card details — processed and stored by Stripe. We never store raw card numbers.
• Content you create: prompts, conversations, generated images, workflows, and other content produced using our tools.
• Communications: messages you send to our support team and responses we provide.
• Survey and feedback responses: when you voluntarily participate in research or provide feedback.

Information collected automatically

• Usage data: features used, pages visited, session duration, and interaction patterns — used to improve the product.
• Device and browser data: IP address, browser type, operating system, and language preferences.
• Cookies and similar technologies: see the Cookies section below for full details.
• Log data: server logs including request timestamps, error logs, and performance metrics.

Information from third parties

• Social login providers: if you sign in with Google, GitHub, Microsoft, or Facebook, we receive your name, email, and profile picture from that provider.
• Referral partners: if you were referred by a partner, we receive a referral identifier.

How we use your information

We use your information to operate, improve, and protect the service. Specifically:

• To create and manage your account and authenticate you.
• To provide and personalise the AI tools and features you use.
• To process payments and manage your subscription.
• To send transactional emails (receipts, password resets, security alerts).
• To send product updates and announcements — you can opt out at any time.
• To diagnose bugs, monitor performance, and improve reliability.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

How we share your information

We do not sell your personal data. We share it only in the following limited circumstances:

• Service providers: trusted vendors who help us operate the platform (hosting, payments, email delivery, analytics, error monitoring). Each is bound by data processing agreements requiring them to protect your data.
• AI model providers: your prompts are transmitted to third-party AI providers (OpenAI, Anthropic, Google) to generate responses. These providers have their own data policies and do not use your prompts for training under our enterprise agreements.
• Legal requirements: if required by law, court order, or government authority — we will notify you if permitted to do so.
• Business transfers: in the event of a merger, acquisition, or asset sale, your data may transfer as part of that transaction. We will notify you with at least 30 days' notice.
• With your consent: in any other circumstance where you have explicitly agreed.

Data retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Account data: retained until you delete your account, then purged within 30 days.
• Content and conversations: retained for the life of your account. You can delete individual conversations at any time.
• Payment records: retained for 7 years to comply with financial regulations.
• Log data: retained for 90 days for debugging and security purposes.
• Backup data: may persist in encrypted backups for up to 90 days after deletion.

Your rights

Depending on your location, you have the following rights regarding your personal data:

• Access: request a copy of all personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your account and all associated data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: request that we limit how we process your data.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us. We will respond within 30 days. For GDPR requests, we respond within the statutory 30-day window.

Security

We take security seriously and implement industry-standard safeguards to protect your data:

• All data is transmitted over TLS 1.2 or higher.
• Passwords are hashed using bcrypt with a high cost factor — we never store plaintext passwords.
• Sensitive credentials are stored in Azure Key Vault, not in environment variables or code.
• We perform regular security audits and penetration tests.
• Access to production data is restricted to authorised personnel on a need-to-know basis.
• We maintain an incident response plan and will notify affected users within 72 hours of a confirmed breach.

To report a security vulnerability, please use our contact form.

Cookies

We use cookies and similar technologies to operate the platform, remember your preferences, and understand how the product is used. You can manage cookie preferences in your browser settings, or contact us if you'd like to opt out of non-essential cookies.

International data transfers

CleverCreator AI is operated from the United Kingdom. If you access our services from outside the UK or European Economic Area, your data may be transferred to and processed in countries that have different data protection laws.

Where we transfer data internationally, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) approved by the UK ICO and European Commission. Enterprise customers requiring a Data Processing Agreement can request one via our contact form.

Children's privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and display a prominent notice on the platform at least 14 days before the changes take effect. Your continued use of the service after the effective date constitutes acceptance of the updated policy.

Contact & complaints

For privacy-related questions or to exercise your rights, use our contact form.

If you are based in the UK or EU and believe we have not handled your data correctly, you have the right to lodge a complaint with your local supervisory authority (UK: ICO at ico.org.uk; EU: your national data protection authority).