Privacy policy

1. Data controller

The controller of the personal data collected through CreativeStar is CreativeStar, based in Spain.

• Privacy email: [email protected].
• Website: https://creativestar.store.

In this policy, the "Platform" means the CreativeStar animation and rendering software service, its website and the free tools offered on it.

2. Scope of this policy

This policy explains what personal data we process, why we process it, which legal bases we rely on, how long we keep it and how the rights granted by data protection law can be exercised.

It applies to sign-up, authentication, account management, use of the application, animation settings, rendering, technical support, the newsletter, the creators program and communications related to the service.

Payment operations handled by Polar may involve processing carried out by Polar in its own contractual and privacy role. This policy covers only the processing carried out by the controller and what it is required to explain under applicable law.

3. Categories of personal data

Depending on how the user uses the Platform, we may process the following categories of data:

3.1. Account data

• Email address.
• Internal user identifier.
• Name or alias, if provided.
• Account creation date.
• Account status and settings.
• Data needed to authenticate the user and manage their session.
• If the user signs in with Google or Discord: the identifier of that account and the email, name and profile picture the provider shares with us.

3.2. Authentication and security data

• Passwords, stored with cryptographic hash functions, never in plain text.
• Technical session data and authentication tokens.
• Records of sign-in attempts, account recovery and security events.
• IP addresses, dates, session identifiers and technical data generated when using the service.

3.3. Projects and usage data

• Animation parameters and settings.
• Project and render job identifiers.
• Job status and technical errors.
• Metadata needed to process and manage projects.
• Data on the use of features and subscription limits, when needed to provide the service or investigate issues.

3.4. Uploaded images, working files and results

Some animations accept images from the user, such as a logo or a photo. Images the user uploads are stored so they can be used in their projects and renders, and are processed only for that purpose.

The Platform also stores working files, technical assets and exported videos. These files may contain no personal data or include it incidentally, depending on the content the user provides.

We recommend not uploading images containing other people’s personal data without their permission.

3.5. Subscription and transaction data

We may process the data needed to identify the plan purchased, the subscription status, renewal dates, cancellation and eligibility for certain features.

Payments are processed through Polar under its contractual model. Polar shares with us the customer, subscription and order identifiers, the purchase email, the product bought and the payment status. We never receive or store payment card numbers.

3.6. Communications and support

We may process the email address, the content of messages sent to support and the information needed to investigate and resolve issues.

Users are advised not to send passwords, credentials, card details or other sensitive data to the support address.

3.7. Newsletter

If the user leaves their email to receive the free pack or news, we use that address only to send those messages. Every message includes an unsubscribe link.

3.8. Creators program

If the user arrives through a content creator link, we store which creator brought them, a random identifier for their browser, the date and a keyed hash of their IP address from which the address cannot be recovered, to apply the creator discount and calculate their commission. The creator only sees totals, never the user’s name or email.

If the user takes part as a creator, we also process the data needed to calculate and pay their commissions.

3.9. Free website tools

The free tools on the website run in the user’s browser: photos loaded into them are never sent to our servers and never stored.

4. Purposes and legal bases

We process personal data only for a specific purpose and with an applicable legal basis.

Creating and managing the account, authenticating the user and providing the service purchased.

Performance of the contract or pre-contractual steps requested by the user.

Saving settings and images, processing projects and running renders.

Performance of the contract.

Managing the subscription, its status, cancellation and coordination with Polar.

Performance of the contract and, where applicable, compliance with legal obligations.

Answering questions and support requests.

Performance of the contract or legitimate interest, depending on the request.

Sending the newsletter and the free pack.

The user’s consent, which can be withdrawn at any time.

Attributing visits and sign-ups to the creators program and paying commissions.

Legitimate interest in running the program and performance of the contract with the creator.

Measuring website audience.

Legitimate interest for cookieless aggregated measurement; consent for Google Analytics.

Detecting and fixing website errors.

Legitimate interest in the service working properly.

Protecting the Platform, investigating unauthorised access and preventing fraud or abuse.

Legitimate interest in the security of the service, or compliance with legal obligations where applicable.

Keeping records required by tax, accounting or legal obligations.

Compliance with applicable legal obligations.

Handling claims and defending rights in proceedings.

Legitimate interest and, where applicable, the establishment, exercise or defence of legal claims.

Where processing relies on legitimate interest, we have assessed that it is necessary for that interest and that the rights of the people concerned do not override it.

We do not use consent as a generic legal basis for processing that is necessary to perform the contract.

5. Technical logs and abuse prevention

The Platform keeps technical logs to diagnose errors, protect the infrastructure, investigate incidents and detect possible breaches of the terms of use.

These logs may include IP addresses, user identifiers, dates, access events, relevant operations and data about render jobs.

Errors that happen in the browser while using the website are sent to Sentry so we can fix them: the error message, the page it happened on, the browser and the operating system. They include no IP address, cookies or account data.

Access to these logs is limited to authorised people who need them for support, security or administration.

Abuse detection relies on technical logs and manual review. We do not use automated decision systems that produce legal effects on the user without human involvement.

If automated assessment or profiling with significant effects is introduced, its legal implications will be reviewed and this policy updated.

6. Retention periods

We keep data for as long as needed for the purposes described, taking into account legal obligations, security requirements and the need to handle possible claims.

Uploaded images.

For as long as a saved project uses them. If none does, they are deleted after 14, 30 or 90 days without use, depending on the plan (Basic, Pro or Max).

Exported videos.

Available to download for 30, 90 or 365 days after the render finishes, depending on the plan (Basic, Pro or Max). The file is then deleted.

Technical logs and usage events.

Up to 90 days after they are generated, unless they must be kept on a limited basis because of an incident or a legal obligation.

Account data.

While the account remains active and for the additional time strictly needed to complete its deletion or meet legal obligations.

Saved projects.

While the account exists or until the user deletes them.

Support messages.

For as long as needed to resolve the request and keep evidence of how it was handled when there is a valid reason.

Transaction data.

For the periods required by applicable legal obligations or needed to handle claims.

Newsletter email.

Until the user unsubscribes.

Creator attribution (cs_ref cookie).

60 days from arriving through the creator link.

Backups

Some data may remain for a while in database backups after being deleted from the main system. These backups are renewed periodically on the database provider’s rotation cycle, are subject to security measures and restricted access, and are not used for ordinary purposes.

When a backup is restored, the necessary procedures are applied so that data that should have been deleted does not remain in the restored system.

7. Recipients and providers

To provide the service, we give access to personal data to providers acting as processors, only where necessary and under an appropriate contract. We never sell or hand data to third parties.

• Hetzner: application hosting.
• PlanetScale: database.
• Cloudflare: file storage and network.
• Amazon Web Services: render processing.
• Vast.ai: editor preview processing.
• Resend: sending emails.
• Polar: payments and subscriptions, as Merchant of Record. It processes some data under its own privacy policy.
• Google and Discord: sign-in, only if the user chooses it.
• Umami and Google Analytics: website audience measurement; Google Analytics only with consent.
• Sentry: website error logging, with the data hosted in the European Union.

We do not use artificial intelligence providers to process user data.

8. International transfers

The Platform’s main servers are hosted in the European Union.

Some providers (Cloudflare, Resend, Polar, Google, Discord, Umami and Sentry) are established outside the European Economic Area or may process data outside it, and rendering on Amazon Web Services takes place in the United Kingdom.

In those cases, the transfer relies on the mechanisms provided by the GDPR: an adequacy decision of the European Commission, such as the one for the United Kingdom or the EU-US Data Privacy Framework for certified companies, or the standard contractual clauses approved by the Commission, together with any additional measures needed.

9. Cookies and similar technologies

The Platform uses strictly necessary cookies and local storage to provide the service, keep the session, handle authentication, remember the language and protect security, plus the creators program cookie when the user arrives through a creator link.

Audience measurement with Umami uses no cookies. Google Analytics only loads if the user accepts it, and that choice can be changed at any time from the "Cookies" link in the footer. We use no advertising cookies.

The details of each cookie, its purpose and its duration are in the cookie policy.

10. Data security

We apply technical and organisational measures appropriate to the risk, taking into account the nature of the data, how the service works and the possible harm from unauthorised access or processing. Among them:

• Protection of credentials with cryptographic hash functions.
• Access control to systems, databases and logs.
• Least privilege according to each role.
• Encrypted communications and protected sessions.
• Monitoring of errors and relevant security events.
• Incident handling and data deletion procedures.
• Review of providers’ security terms.

These measures reduce risk, but no system can guarantee that incidents will never happen.

If a personal data breach occurs, we will assess the risk and meet the obligations to notify the supervisory authority and inform the people affected where the GDPR requires it.

11. Your rights

Users can exercise the rights granted by applicable law, including:

• Access: knowing whether their data is processed and obtaining access to it.
• Rectification: correcting inaccurate or incomplete data.
• Erasure: requesting deletion when the legal requirements are met.
• Restriction: requesting that processing be restricted in the cases provided for.
• Portability: receiving certain data in a structured format and transmitting it to another controller when the requirements are met.
• Objection: objecting to processing based on public or legitimate interest in the cases provided for by law.
• Withdrawal of consent: where processing relies on consent, withdrawing it without affecting the lawfulness of earlier processing.

To exercise these rights, write to [email protected].

We may ask for reasonable additional information to verify identity when there are well-founded doubts, without collecting excessive data.

Requests are answered within the periods set by applicable law. As a rule, the GDPR provides one month, which may be extended in the cases provided for by law.

Exercising these rights is free of charge, except where the law allows otherwise.

12. Deleting accounts and data

Users can ask for their account to be deleted by writing to [email protected] from the email address linked to the account.

The request starts the deletion of the account data, the related projects, uploaded images and exported videos, which is completed in the main system within one month of the request being confirmed. Cancelling a subscription does not delete the account.

Certain data may be kept for as long as needed to meet legal obligations, handle claims or keep evidence of security incidents when there is a valid legal basis.

Data in backups disappears when the backups containing it expire, with restricted access and no ordinary use in the meantime.

13. Automated decisions

The Platform does not use solely automated decisions that produce legal effects on users or similarly significantly affect them.

Logs may be used to identify suspicious behaviour, but suspensions for abuse rely on reviewing incidents and on human judgement.

If this changes, the policy will be updated and the information required by law provided.

14. Children’s data

The Platform is intended exclusively for people aged 18 or over.

We do not intend to offer the service to minors. If we learn that an account belongs to a minor, we may take the steps needed to verify the situation and handle the account in accordance with applicable law.

This contractual restriction does not replace the controller’s legal obligations regarding personal data already processed.

15. Complaints to the supervisory authority

Anyone who believes the processing of their data breaks the law can contact the controller at [email protected].

They can also lodge a complaint with the competent data protection authority. In Spain, the supervisory authority is the Spanish Data Protection Agency (AEPD, aepd.es), without prejudice to the powers of other authorities where applicable.

16. Changes to this policy

This policy may be updated when features, providers, purposes, legal obligations or processing practices change.

The current version shows its update date. When a change requires specific notice or additional action from the user, it will be handled as applicable law requires.

17. Contact

For questions about privacy or data protection:

• Controller: CreativeStar.
• Privacy email: [email protected].
• Website: https://creativestar.store.