Creator Mode Privacy Policy

Last updated: October 4, 2026 (2026-10-04)

This policy explains what data Creator Mode ("we", "us") collects from clients and visitors using our platform, how we use it, and the third-party processors involved in delivering the service. It applies to our website and to our iPhone and Android apps.

If you have questions, email matt@thecreatormode.com.

1. What we collect

Account data — name, email, password (hashed), role, agency affiliation, timezone, and the contents of your dashboard profile.
Sign-in provider data — if you sign in with Google, we receive your name, email address, and profile image from Google to create and access your account. We don't receive your Google password.
Content you upload — videos, scripts, captions, brand assets, and any text or files you submit through the platform.
AI conversation data — messages you exchange with the AI Brand Profile chat, AI tools (Trend Engine, Script Writer, Instagram Page Coach, the AI ops agent), and voice transcripts.
Billing data — Stripe customer IDs and subscription / payment metadata. We never store your card number — Stripe holds card details on their PCI-compliant infrastructure.
Usage analytics — pages viewed, feature usage, error events, device + browser metadata, and an approximate location (city level) worked out from your IP address. Used to measure product performance and diagnose bugs.
Email engagement — open + click metadata on transactional emails we send (delivery confirmation, review nudges, etc.).
Device permissions (mobile apps) — with your permission, our iPhone and Android apps use your microphone for voice features (dictation, voice notes, and recording voiceovers), your camera so you can film video without leaving the app, and your photo library so you can upload footage and images you already shot. Video, photos, and audio you record or select are uploaded to your account and sent to our transcription, voice, and video-processing providers so we can turn them into text, playback, and finished edits. We only access the specific photos and videos you choose — never your whole library. You can grant or revoke camera, microphone, and photo access anytime in your device's Settings. The apps do not access your contacts or your device's location.
Notifications (mobile apps) — if you allow notifications, we store a device token so we can tell you when a video is ready or needs you. It is deleted when you sign out or delete your account, and you can turn notifications off anytime in your device's Settings.

2. How we use it

Operate the service: process video, generate AI outputs, deliver emails, run scheduled jobs (SLA reminders, monthly credit resets).
Personalize AI tools to your brand. Profile data captured during onboarding shapes the prompts the AI uses on your behalf.
Bill subscriptions and credit top-ups via Stripe.
Improve the platform: fix bugs, optimize performance, build new features. Aggregate usage trends inform roadmap decisions; we do not sell or rent personal data.
Communicate with you: transactional emails, product updates, and optional marketing emails (you can opt out of marketing at any time).

Where required by law (e.g. GDPR), we process personal data on these legal bases: performing our contract with you (operating the service and billing), our legitimate interests (securing the platform, analytics, and improving the product), and your consent (microphone access and optional marketing).

3. Third parties we share data with

We rely on a small number of trusted vendors ("sub-processors") to operate the platform, each bound by data-processing terms. Our key sub-processors today:

Cloud hosting + database (Supabase, Vercel) — run the application and store your account info, uploaded content, AI conversation history, and usage logs.
File + video storage and streaming (Cloudflare, Mux) — store the files and videos you upload and stream them to review pages.
Payments (Stripe) — subscription billing and credit-pack purchases. Card details never touch our servers — Stripe holds them on PCI-compliant infrastructure.
AI + machine-learning (Anthropic, Google, AssemblyAI, ElevenLabs) — process the text, audio, and video you submit through AI tools (the brand interview, Instagram Page Coach, Trend Engine, Script Writer, the AI ops agent, voice transcription, and voice playback). We send only what the tool needs to act on and receive its output. We use these providers under business/API terms that do not use your content to train their AI models.
Public-content analysis (Apify) — pulls public posts from social handles you explicitly provide (e.g. an Instagram handle you submit for the Instagram Page Coach or competitor analysis).
Scheduling + publishing (Metricool) — schedules and publishes the posts you approve to your connected social accounts.
Email delivery (Resend) — transactional email (welcome, review nudges, billing), including per-agency sender domains.
Analytics + error monitoring (PostHog, Sentry) — measure feature usage and capture errors so we can fix bugs. Aggregate behavioral data; never sold or shared with advertisers.
Performance + security (Cloudflare, Upstash) — content delivery, rate limiting, and abuse protection.
Ad measurement (Meta) — when you sign up or subscribe on our website, we tell Meta (Facebook and Instagram) that it happened, so we can see which of our ads work. We send a scrambled (hashed) copy of your email and phone number, your IP address and browser details — never your content. We never do this for anything you do in our iPhone or Android apps.

This is our current list; we may add or change sub-processors as the platform evolves, and the version stamp above is bumped when we do.

We do not sell your data to advertisers or data brokers.

4. Where data is stored

The bulk of customer data sits with our cloud infrastructure provider in the US. Some AI / ML processors handle data through their own infrastructure, which may include US, EU, and other regions. Where we transfer personal data internationally (for example, from the EU/UK to the US), we rely on appropriate safeguards such as the Standard Contractual Clauses in our agreements with those processors.

5. How long we keep it

Account + content data: for the lifetime of your subscription, plus up to 90 days after cancellation to allow re-instatement.
Account deletion: if you have a client account, you can delete it at any time from Settings → Delete Account, in the app or on the web. Deleting removes your sign-in and personal information (name, email, phone) and disables the account so you can no longer log in. Operational records owned by your agency (e.g. videos you submitted, messages) are kept in de-identified form so the agency's own records stay intact. Team members provisioned by an agency can have their account removed by emailing us at the address in Section 12. Some legally required records (invoices, tax documents) are retained for 7 years per applicable accounting law.
AI conversation data: retained while your subscription is active so the AI tools can stay personalized to your evolving brand. Anonymized aggregates may be retained longer for product improvement.
Logs + analytics: 90 days for raw event data; aggregates indefinite.

6. Cookies + local storage

We use cookies + browser local storage for:

Authentication (your sign-in session)
Preference persistence (voice mode toggle, dismissed banners, active-org impersonation)
Product analytics (anonymous session identifier)
Error tracking (diagnostic context)

You can clear them via your browser; doing so will sign you out and reset some preferences.

7. Children

Creator Mode is a business tool and is not directed to children. We do not knowingly collect data from anyone under 13 (or under 16 in regions where that is the minimum age of consent). If you believe a minor has created an account, contact us and we'll remove it.

8. Your rights

Depending on your jurisdiction (GDPR / CCPA / similar), you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and personal data — directly from Settings → Delete Account in the app or on the web, or by emailing us (subject to the retention exceptions in Section 5).
Export a portable copy of your data (email us to request it).
Opt out of marketing emails (transactional emails will continue for service delivery).

California residents (CCPA/CPRA): we do not sell or share your personal information as those terms are defined under California law, and we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email matt@thecreatormode.com with the subject line "Privacy request" and we will respond within 30 days.

9. Security

All data is transmitted over HTTPS.
Passwords are hashed using industry-standard one-way algorithms (bcrypt or stronger), via our authentication provider.
We use rate limiting on authentication and AI endpoints to deter abuse.
We monitor for suspicious activity via our error-monitoring + infrastructure logs.
Content uploaded by clients is stored in private cloud buckets — accessible only to authenticated, authorized users.

No system is perfectly secure. If you discover a security issue, please email matt@thecreatormode.com before disclosing publicly.

10. Who controls your data (direct vs. agency accounts)

Creator Mode is used two ways, and this determines who is the data "controller":

Direct accounts — if you sign up with Creator Mode directly, Creator Mode is the controller of your personal data, and this policy governs how we handle it.
Agency-provisioned accounts — if a video agency set up your account and uses Creator Mode to serve you, that agency is the controller for their business records about you and their own privacy policy applies; Creator Mode acts as a processor for the data the agency stores in the platform on your behalf. Requests about that data may be referred to your agency.

11. Changes to this policy

Material changes will trigger a re-prompt at your next sign-in. Minor wording fixes may happen without notice. The version stamp at the top of this page reflects the current edition.

12. Who we are, and how to reach us

Creator Mode is operated by Creator Mode LLC, a Florida limited liability company.

For any question, request, or complaint about this policy or your data — including the access, correction, and deletion rights in Section 8 — email matt@thecreatormode.com. We answer privacy requests within 30 days.

If you need our postal address for a formal legal or regulatory request, email us and we will provide it.

Where the service is offered. Creator Mode is offered in the United States. We do not market the service in the European Union or the United Kingdom, and our apps are not distributed there.