Privacy Policy
MAS IMPORT EOOD is the controller for personal data processed through CreateFor.Me, except when an identified provider acts independently. This Policy explains what we process, why, how long we keep it and your choices.
1. Data we process
- Account: name, email, username, password hash, verification, plan and account status.
- Profile and content: bio, profile/cover images, links, temporary Drops, captions, Channel articles, categories and reaction totals.
- Connected platforms: Instagram/TikTok account identifiers, display information, permitted media metadata, encrypted access/refresh tokens, expiry and sync status.
- Usage and analytics: profile views, link/product clicks, timestamps, referring domain, truncated or hashed security identifiers, device/browser and diagnostic information.
- Safety: reports, report details, optional reporter email, moderation decisions, appeals and evidence needed to prevent repeated abuse.
- Billing: entitlement, plan, renewal, cancellation and transaction-status identifiers received from Freemius. We do not need your full card number.
2. Purposes and legal bases
We process data to perform our contract with creators; provide profiles, synchronization and billing; pursue legitimate interests in security, analytics, fraud prevention and service improvement; comply with legal obligations; and request consent where required, including optional marketing or non-essential cookies.
3. Public information
Published profiles, links, Drops and Channel articles are public and may be indexed, copied or shared. Drafts and account settings are not public. An 18+ label is visible but does not disclose why a creator selected it beyond the presence of restricted material.
4. Social connections
Social connection is optional and can be disconnected. Tokens are encrypted at rest using the Createfor.me application key and used only for authorised API requests. Disconnecting removes active tokens from the Service where technically supported; imported public references remain until you remove them.
5. Reactions and visitor measurement
To count reactions and reduce repeated manipulation without creating visitor accounts, we create a rotating one-way hash from limited request information. Raw IP addresses may also appear temporarily in infrastructure/security logs. We do not offer creator tracking pixels or custom third-party pixels.
6. Sharing and processors
We disclose data only as needed to hosting/storage, email, security, analytics, social API and billing providers; professional advisers; a buyer in a lawful business transfer; or authorities where legally required. Providers receive only data necessary for their role and are subject to contractual/legal safeguards where required.
7. International transfers
Some providers may process data outside the EEA. Where required, we use adequacy decisions, Standard Contractual Clauses or another lawful transfer mechanism.
8. Retention
- Manual Drop media: removed after its displayed expiry; operational cleanup can take up to 24 additional hours.
- Account/profile data: while the account is active and then for a limited period needed for deletion, disputes or law.
- OAuth tokens: until disconnect, expiry, account deletion or required revocation.
- Detailed analytics/security data: normally no longer than 13 months unless needed to investigate abuse.
- Reports and moderation records: normally up to 24 months, longer where necessary for safety, litigation or legal duty.
- Billing/legal records: for periods required by tax, accounting and consumer law.
Backups may retain deleted information for a limited rolling period and are not restored except for disaster recovery.
9. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection and portability, or withdraw consent. You may complain to the Bulgarian Commission for Personal Data Protection or your local supervisory authority. Identity verification may be required.
10. Minors
Creator accounts are for adults aged 18 or older. We do not knowingly permit minors to register. Report suspected minor involvement immediately using the priority report category.
11. Security
We use access controls, encrypted passwords/tokens, validation, rate limits, restricted admin access and monitoring. No online service is completely secure. Never send credentials through public profiles or reports.
12. Cookies and local storage
Essential cookies support authentication, security and preferences. The 18+ acknowledgement can be stored locally in the visitor’s browser. Non-essential analytics or marketing technologies will require consent where applicable.
13. Contact and deletion
MAS IMPORT EOOD
Registration number: BG204276083
Registered address: Nadezhda 2, Sofia, Bulgaria
Privacy requests: privacy@createfor.me.
See our Data Deletion Instructions.