Privacy Policy

1.1 Information You Provide

• **Account Information:** When you create an account, we collect your name, email address, and password.
• **Profile Information:** Username, profile picture, and any other information you choose to provide.
• **Instagram Account Data:** When you connect your Instagram account via Meta's official Graph API, we receive access to your Instagram username, profile information, and permissions to manage direct messages on your behalf.
• **Payment Information:** If you subscribe to a paid plan, our payment processor (Stripe) collects your billing information. We do not store complete credit card numbers.
• **Email Collection Data:** When your followers provide their email addresses through our email capture feature, we store these emails securely in your account.
• **Communications:** When you contact us for support or feedback, we collect the content of your messages.

1.2 Information Collected Automatically

• **Usage Data:** Information about how you use the Service, including DM automation activity, message templates, and feature usage.
• **Device Information:** IP address, browser type, operating system, device type, and unique device identifiers.
• **Log Data:** Server logs, including access times, pages viewed, and actions taken within the Service.
• **Cookies and Similar Technologies:** We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities. See our Cookie Policy for more details.

1.3 Information from Third Parties

• **Meta/Instagram:** We receive information from Meta's Graph API when you authorize our access to your Instagram account, including profile data and direct message permissions.
• **Authentication Providers:** If you sign up using Google, Facebook, or GitHub, we receive basic profile information from these providers.
• **Payment Processor:** Stripe provides us with payment confirmation and subscription status information.

3.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• **Meta/Instagram:** Your Instagram account credentials are authenticated via Meta's official OAuth flow. We use Meta's Graph API to send automated direct messages on your behalf.
• **Payment Processing:** Stripe processes all payment transactions. See Stripe's Privacy Policy at https://stripe.com/privacy.
• **Cloud Hosting:** We use cloud infrastructure providers (AWS, Google Cloud, or similar) to host our Service and store data.
• **Analytics:** We use Google Analytics and Facebook Pixel to analyze usage patterns. See our Cookie Policy for opt-out options.
• **Email Services:** We use email service providers to send transactional and marketing emails.
• **Customer Support Tools:** We may use third-party tools to manage customer support tickets and communications.

3.2 Business Transfers

If CreatorFlow is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your information is transferred and becomes subject to a different privacy policy.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, or government agencies).

3.4 Protection of Rights

We may disclose information when we believe it is necessary to: (a) protect our rights, property, or safety, or that of our users or others; (b) enforce our Terms of Service; (c) detect, prevent, or address fraud, security, or technical issues.

5.1 European Users (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland, you have the following rights:

• **Right to Access:** Request a copy of the personal information we hold about you.
• **Right to Rectification:** Request correction of inaccurate or incomplete personal information.
• **Right to Erasure:** Request deletion of your personal information ("right to be forgotten"), subject to certain exceptions.
• **Right to Restriction:** Request restriction of processing of your personal information.
• **Right to Data Portability:** Request transfer of your personal information to another service provider.
• **Right to Object:** Object to processing of your personal information based on legitimate interests.
• **Right to Withdraw Consent:** Withdraw consent for data processing at any time (without affecting lawfulness of processing before withdrawal).
• **Right to Lodge a Complaint:** File a complaint with your local data protection authority.

5.2 California Users (CCPA)

If you are a California resident, you have the following rights:

• **Right to Know:** Request disclosure of personal information we collect, use, and share.
• **Right to Delete:** Request deletion of your personal information, subject to certain exceptions.
• **Right to Opt-Out:** We do not sell personal information and have not sold personal information in the past 12 months.
• **Right to Non-Discrimination:** We will not discriminate against you for exercising your CCPA rights.

5.3 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@creatorflow.so or through your account settings. We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

8.1 European Users

For users in the EEA, UK, or Switzerland, we ensure that any international data transfers comply with GDPR requirements through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where data is transferred to countries deemed to provide adequate protection
• Other legally approved mechanisms to ensure appropriate safeguards