Privacy and Cookie Policy

Last updated: 21 September 2026

This policy explains what personal data CREATUS.AI collects when you visit creatus.ai, why we collect it, who we share it with and what rights you have. It applies to the website at creatus.ai and its pages. Please also read our Terms of Use.

1. Who we are

The website creatus.ai is operated by CREATUS.AI, based in the European Union. We are the controller of the personal data described in this policy. You can reach us about anything in it at [email protected].

2. Other services we link to

Some pages of creatus.ai link to separate apps and websites, such as our music app, our social app and partner websites where individual AI tools run. Each of those services has its own terms and privacy policy, which apply when you use it. This policy covers creatus.ai only.

3. What we collect

When you browse the website. Like every website, our hosting and network providers receive technical data each time a page loads: your IP address, browser and device type, the page requested, the page you came from, and the date and time. We use it to deliver the website, keep it secure and fix problems.

Analytics, if you allow it. With your consent, given through the cookie banner, we use Google Analytics, Microsoft Clarity and Hotjar to understand how visitors use the website. These tools record which pages you visit, how long you stay and how you interact with them, such as clicks, scrolling and mouse movement. Microsoft Clarity and Hotjar can also produce heatmaps and session recordings. By default they mask the text you type into form fields. We also use Cloudflare Web Analytics, which measures page performance in aggregate and does not use cookies.

When you contact us. If you use a contact form or email us, we receive your name, your email address, your message and anything else you choose to include.

When you subscribe to our newsletter. We receive your email address, and we record when and how you subscribed so that we can show you agreed.

The creatus.ai website does not take payments and does not require you to create an account.

4. Why we use it, and our legal basis

• Running and securing the website, including protecting it against attacks and abuse: our legitimate interest in operating a safe, working website (Article 6(1)(f) of the General Data Protection Regulation).

• Analytics to improve the website: your consent (Article 6(1)(a)). You can withdraw it at any time.

• Answering your messages and discussing a project you ask us about: steps taken at your request before entering into a contract (Article 6(1)(b)), or our legitimate interest in replying to you (Article 6(1)(f)).

• Sending the newsletter: your consent (Article 6(1)(a)). Every email contains an unsubscribe link.

• Meeting legal obligations, such as keeping required records or responding to lawful requests from authorities (Article 6(1)(c)).

We do not sell your personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who we share it with

We share personal data only with providers that help us run the website, and only as far as they need it:

• Hostinger, which hosts the website and stores form submissions;

• Cloudflare, which delivers and protects the website and provides Web Analytics;

• Google, for Google Analytics and for Google Fonts, which loads the typefaces on some pages;

• Microsoft (Microsoft Clarity) and Hotjar, for analytics if you consent;

• the provider we use to send our newsletter;

• content delivery networks that serve open source code libraries used by our homepage (cdnjs and unpkg), which receive your IP address when your browser loads those files.

We may also disclose personal data where the law requires it, to establish, exercise or defend legal claims, or to a successor if our business or its assets are transferred.

6. Transfers outside the European Union

Some of these providers are based in, or process data in, the United States or other countries outside the European Economic Area. Where that happens, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the Commission's standard contractual clauses.

7. How long we keep it

• Messages you send us: for as long as we need them to deal with your enquiry and any follow up, and no longer than necessary for that purpose or than the law requires.

• Newsletter subscriptions: until you unsubscribe. After that we keep only a record of the unsubscribe, so that we do not email you again.

• Analytics data: for the retention period set in each analytics tool, after which it is deleted or anonymised.

• Technical logs: for the short periods our hosting and network providers keep them for security and troubleshooting.

8. Your rights

Under the General Data Protection Regulation you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect processing that took place before. To exercise any of these rights, email [email protected]. We will reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority. You can do so in the EU country where you live, where you work or where you believe your rights were infringed. The European Data Protection Board keeps a list of the national supervisory authorities.

9. Cookies

Cookies are small files that a website stores in your browser. We use:

• Necessary cookies, which make the website work and remember your cookie choice. These do not require consent.

• Analytics cookies set by Google Analytics (names beginning with _ga), Microsoft Clarity (such as _clck and _clsk) and Hotjar (names beginning with _hj). These are placed only if you accept them in the cookie banner.

To change your choice, clear the cookies for creatus.ai in your browser and the banner will ask you again. You can also block or delete cookies in your browser settings, although blocking necessary cookies may stop parts of the website from working.

10. Children

creatus.ai is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) and providers with recognised security practices. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy when our website, our providers or the law change. We will publish the new version on this page with a new "last updated" date.

13. Contact

CREATUS.AI, European Union. Email: [email protected]