Privacy Policy

1. Who We Are and Scope

CreatorHero LLC ("CreatorHero," "we," "us," or "our") is the controller of Personal Data processed in connection with the website at https://www.creatorhero.com/ (including subdomains), our browser extension, desktop and mobile applications, and documentation (together, the "Services"), except where we process certain data you submit to the Services on your behalf as a processor/service provider, as described below.

The Services are intended for adults (18+ or the age of majority where you live, if higher) and are not directed to children. See the "Children" section (later in this Policy) for more information.

This Privacy Policy explains what Personal Data we collect, from whom, why we use it, with whom we share it, how long we keep it, and your privacy rights.

This Policy should be read together with our Terms and Conditions and Cookie Policy. Capitalized terms not defined here have the meanings given in the Terms and Conditions. In this Policy, 'User Content' refers to content and related data you upload, submit, or otherwise make available through the Services, and 'Services Data' refers to account- and service-related data stored or processed within the Services.

Contact Information

Owner and Data Controller:

CreatorHero LLC 7345 W Sand Lake Rd, Ste 210 Office 4621, Orlando, FL 32819, USA

Email: contact@creatorhero.com

2. Personal Data We Collect and Sources

We collect Personal Data you provide directly, collected automatically when you use the Services (Trackers such as cookies, pixels, and SDKs, as defined in the Cookie Policy), and from service providers we rely on to operate core features (for example, payments, analytics, and support).

A. Data you provide to us

• Account and Profile Data: name, email address, username, role or agency affiliation (if applicable), account settings and preferences.
• Support and Contact Data: messages you send via email, forms, or chat (including attachments), issue descriptions, and related correspondence.
• Content You Process via the Services ("User Content"): files, text, images, audio or video, links, and related metadata that you submit or transmit when using the Services (handled as set out in the Terms and Conditions).
• Billing and Administrative Data (if applicable): plan selections, country, tax or VAT information, and invoice history.
• Commercial Communications Preferences: opt-in or opt-out status for newsletters and promotions; unsubscribe choices; consent records where required.
• Identity and age-verification data (only if needed): where needed to confirm eligibility or prevent fraud, we may request ID details or images and limited data (e.g., date of birth). We keep only the minimum necessary to perform the check and record the result. Any images collected are deleted promptly after verification, except where required by law or to establish, exercise, or defend legal claims, as described in the Retention section.

B. Data collected automatically when you use the Services

• Usage Data: actions and events in the product (for example, log-ins, feature interactions, clicks, page views, timestamps), referral URLs, session duration, crash or error logs.
• Device and Network Data: IP address, approximate location derived from IP, device identifiers, operating system, browser type and version, screen resolution, language, and time zone.
• Trackers (cookies, pixels, SDK/mobile identifiers): consent choices, analytics/session identifiers, and similar information used for essential functionality and metrics. Details, purposes, and retention for each category are described in the Cookie Policy.

C. Data we receive from third parties to operate core features

• Payments: tokenized payment details, transaction confirmations or declines, chargeback information, fraud-prevention signals (from our payment processor).
• Support and Communications Tools: ticket metadata and delivery status (from our support or chat vendors).
• Analytics and Performance: aggregated or pseudonymized metrics (from analytics or CDN vendors).

D. Data we do not seek to collect

Sensitive Personal Data (for example, health or biometric data) is not required to use the Services. This includes information entered into free-text fields, unless strictly necessary. Please do not include Sensitive Personal Data in support tickets or uploads. If you choose to provide it, we will process it only for the specific purpose you requested, and as permitted by law.

Children's Data: we do not knowingly collect Personal Data from individuals under 18.

3. Purposes and Legal Bases

We only process Personal Data for specific, explicit purposes.

• Service delivery and account administration. Operating the Services, creating and managing accounts, authenticating log-ins, hosting and technically processing User Content, remembering preferences, and providing dashboards. Legal basis: performance of a contract and, where contract does not strictly apply, legitimate interests in running and improving the Services.
• Billing, payments, and collections. Processing payments and refunds, issuing invoices, handling chargebacks, and meeting tax and accounting duties. Legal basis: performance of a contract and legal obligations (tax/accounting), plus legitimate interests in fraud prevention and collections.
• Support and service communications. Responding to tickets and emails, and sending in-product or email notices about incidents, updates, and changes to terms. Legal basis: performance of a contract and legitimate interests in maintaining service continuity.
• Technical troubleshooting with limited account access. Only where strictly necessary to diagnose issues that cannot be resolved otherwise. Access is temporary and logged. Legal basis: legitimate interests in ensuring reliability and security, and performance of a contract.
• Security, fraud prevention, and enforcement. Protecting accounts and Content; detecting spam, abuse, and attacks; enforcing Acceptable Use. Legal basis: legitimate interests in safeguarding the Services and Users, and legal obligations where applicable.
• Analytics and service improvement. Measuring usage, diagnosing performance, planning capacity, and improving features. Legal basis: legitimate interests in understanding and improving the Services.
• Commercial communications (marketing). Sending newsletters, product updates, offers, and event invitations; managing preferences and unsubscribe choices. Legal basis: legitimate interests where permitted by law and consent where required. You can opt out at any time via the link in our emails or by contacting us.
• Integrations. Connecting to third-party services and exchanging data as configured by you. Legal basis: performance of a contract and legitimate interests in interoperability.
• Compliance and legal duties. Keeping required records; responding to lawful requests; complying with sanctions/export rules; establishing, exercising, or defending legal claims. Legal basis: legal obligations and, where appropriate, legitimate interests.
• Identity and age verification (only if needed). Confirming eligibility or preventing fraud when strictly necessary. Legal basis: legitimate interests (platform integrity and fraud prevention) and legal obligations where applicable.
• Automated decision-making and profiling. We do not use automated decision-making that produces legal or similarly significant effects about you. We may use light personalization to enhance your experience. Legal basis: legitimate interests or consent where required.

4. Data Retention

We retain Personal Data only for as long as necessary for the purposes described in this Policy, and then delete it or irreversibly anonymize it.

Retention periods generally applicable to the Services are as follows:

• Account and profile data (name, email, role, preferences): while the account is active and up to 24 months after closure, then deleted or anonymized.
• User Content stored in the Services: until you delete it or the account ends. After termination, we remove User Content from active systems within a commercially reasonable period.
• Billing, invoices, and tax records: at least 7 years (or longer if local law requires it).
• Support tickets and correspondence: up to 3 years after the ticket closes.
• Security and audit logs: 12–24 months depending on log type.
• Analytics identifiers: up to 24 months; de-identified aggregate metrics may be kept longer.
• Marketing preferences and suppression lists: retained as long as needed to honor your opt-out.
• Identity or age-verification data (only if needed): the minimum necessary to perform the verification and prevent fraud.

Services Data associated with an inactive Creator Account may be deleted after 3 months, and Services Data associated with an inactive Agency Account may be deleted after 6 months, measured from the date the applicable License became inactive.

5. Sharing and Disclosure of Personal Data

We do not sell Personal Data.

We also do not "share" Personal Information for cross-context behavioral advertising as defined by the California CPRA.

We disclose Personal Data only to:

• Service providers (processors) under written contracts that require confidentiality, security, and use only on our documented instructions.
• Integrations you enable. If you connect a Third-Party Service or direct us to transfer Content, we will exchange data with that service as you configure.
• Corporate transactions. In connection with a merger, acquisition, financing, reorganization, or sale of assets.
• Legal and safety. Where we are required to comply with law, court orders, or lawful requests from authorities; to enforce our Terms; or to protect rights, safety, and security.

6. International Data Transfers

CreatorHero LLC is based in the United States, and we may process Personal Data in the United States and in other countries where our service providers operate.

When we transfer Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, we implement appropriate safeguards including:

• EEA: European Commission Standard Contractual Clauses (SCCs) (2021/914)
• UK: UK International Data Transfer Addendum or the UK Addendum to the EU SCCs
• Switzerland: SCCs as recognized by the Swiss FDPIC

7. Security Measures

We maintain administrative, technical, and physical safeguards including:

• Encryption (where appropriate)
• Role-based access with least-privilege and multi-factor authentication
• Network segmentation and firewalls
• Logging and monitoring
• Vulnerability management and timely patching
• Secure development practices
• Employee confidentiality and security training
• Vendor due-diligence and contractual security obligations
• Business continuity and disaster-recovery planning
• Documented incident response process

8. Cookies and Tracking Technologies

We use cookies and similar technologies grouped into:

• Strictly necessary (security, authentication, core functionality): always active
• Analytics (usage, performance, diagnostics): consent where required
• Functional (preferences, enhancements): consent where required
• Marketing (CreatorHero outreach measurement): consent where required

Non-essential cookies and trackers load only with your opt-in via our consent banner (EEA/UK). Details are provided in our Cookie Policy.

9. Service Providers and Subprocessors

We engage carefully selected service providers to support core operations (hosting, cloud infrastructure, content delivery, analytics, payments, customer support, communications, security, and fraud prevention). These providers act as processors and are bound by written contracts requiring confidentiality, security, and processing only on our documented instructions.

10. Your Privacy Rights

To the extent permitted by applicable law, you have:

• Right to be informed. Clear information about our processing.
• Right of access. Obtain confirmation whether we process your data and receive a copy.
• Right to rectification. Have inaccurate or incomplete Personal Data corrected.
• Right to erasure. Ask us to delete your Personal Data in the circumstances set out in GDPR.
• Right to restriction. Request that we restrict processing while accuracy is verified or if processing is unlawful.
• Right to portability. Receive Personal Data you provided to us in a structured, machine-readable format.
• Right to object. Object at any time to processing based on legitimate interests.
• Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.
• Right to lodge a complaint. You can complain to your local data protection authority.
• Right to non-discrimination. We will not deny services because you exercise your privacy rights.

Additional rights for California residents: access, correction, deletion, portability, and the right to opt out of sale or sharing of Personal Information, and the right to non-discrimination.

How to exercise your rights: Email contact@creatorhero.com with your request and the email address associated with your account.

11. Children

The Services are intended for adults (18+ or the age of majority where you live, if higher) and are not directed to children. We do not knowingly collect Personal Data from anyone under 18. If you believe a minor has provided Personal Data, contact contact@creatorhero.com and we will delete it promptly.

12. Data Incident Notification

We maintain a documented incident response program. If we become aware of a data breach affecting Personal Data, we will investigate, mitigate, and notify affected individuals and relevant authorities as required by applicable law.

13. United States State Disclosures and Notice at Collection

This section supplements the Policy for residents of U.S. states with comprehensive privacy laws (including California).

• Categories collected: identifiers (name, email, IP address); commercial information; internet or network activity; approximate geolocation; professional or role information; support communications; and, only if strictly necessary, limited sensitive information for identity or age verification.
• Sources: you; your devices and browsers; and service providers.
• Purposes: operate and secure the Services; account administration; payments; support; analytics; legal compliance; fraud prevention; and marketing communications.
• Sale or sharing: we do not sell Personal Information and do not share it for cross-context behavioral advertising.
• Retention: see "Data Retention."

Your U.S. rights: access, correction, deletion, portability, and the right to appeal our decision on a request. To exercise your rights, email contact@creatorhero.com.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new "Last Updated" date and provide notice of material changes (for example, by email or in-product message). Where required by law, we will request your consent to material changes.

This Policy is designed to comply with multiple privacy laws.

Last updated: January 2026