Privacy policy

Last updated: 2 October 2026

CreatorAI ("CreatorAI", "we", "us") is an AI-powered social media content platform for creators, available at creatorai.in. This policy explains what information we collect, why we collect it, how it is stored, and how you can have it deleted. We have tried to write it in plain language.

CreatorAI is operated by Abhishek Kumar Srivastava, a sole proprietor based in India, trading as CreatorAI. He is the person responsible for (the "data controller" of) the personal data described in this policy, including data received from Meta.

1. Information we collect

Account information

• Your name and email address, provided when you register — either directly or through "Continue with Google", in which case Google shares your name and email address with us.
• Your password, stored only as a one-way cryptographic hash — we cannot see or recover your actual password.
• Your subscription plan and monthly usage counts (used to apply plan limits).

Content you provide

• Photos and videos you upload for caption generation, enhancement, viral clip extraction, or scheduling.
• Text you enter, such as topics, captions and brand details.
• Content generated for you by our AI features.

Social media platform data (Instagram and Facebook)

If you choose to connect your Instagram professional account and Facebook Page, we receive — with your explicit permission through Meta's official login — the following:

• Your Instagram Business account ID, username and display name.
• Your Facebook Page ID and Page name.
• An access token that allows CreatorAI to publish posts you schedule, on your behalf. When a scheduled Facebook post is due, we use it to obtain a Page access token from Meta, which is used only to publish that post.
• Access to the business portfolio that owns your Facebook Page, if your Page is owned by one and you select that portfolio in Meta's login dialog. Meta requires this so that your Page is returned to CreatorAI when you connect. We use it only to find and connect your Page — we do not read or change your business portfolio's settings, users, assets or ad accounts.

Access tokens are encrypted at restand are never shown in the app, included in logs, or shared with anyone. They are used only to publish the posts you explicitly schedule and to keep your connection active. We do not read your private messages, we do not read or analyse your Page's posts, comments, followers or engagement data, and we do not post anything you did not schedule.

Technical information

• Standard server logs (request paths, timestamps, response codes) used for reliability and debugging.
• Browser storage (localStorage) used to keep you signed in. We do not use third-party advertising cookies or trackers.

2. How we use your information

• To operate the product: generate content, enhance photos, extract clips, and publish scheduled posts to your connected accounts.
• To enforce plan limits and manage your subscription.
• To secure the service and diagnose problems.
• To contact you about your account (for example, a failed scheduled post or an expiring social connection).

We do not sell your personal data, and we do not use your data or your social accounts for advertising.

3. Third-party services we rely on

CreatorAI is built on established infrastructure and AI providers. Your data is shared with them only to the extent needed to provide the feature you are using:

• Google Gemini, Anthropic (Claude) and OpenAI — process text and images you submit to generate captions, scripts and other content. OpenAI also transcribes audio from videos you submit for clip and script features.
• Replicate (Flux) — generates AI images from prompts you provide.
• Meta Platforms (Instagram/Facebook Graph API) — used to connect your accounts and publish your scheduled posts.
• Tavily — performs web searches for trend and topic features.
• Cloudflare R2 — stores media files you upload for scheduling.
• Railway and Vercel — host our servers, database and website. Data we receive from Meta (such as encrypted access tokens, Page and Instagram account IDs, names and usernames) is stored and processed on these services.
• Razorpay — processes subscription payments. We do not see or store your full card or bank details.
• Google Sign-In — lets you log in with your Google account, if you choose to.

These providers may process or store data on servers located outside India. Each is bound by its own privacy and security commitments. Data we receive from Meta is shared only with the hosting providers above (Railway and Vercel); it is not sent to our AI providers.

4. How long we keep data

• Account data is kept while your account is active.
• Uploaded media for scheduled posts is kept so that your queue and history work; you can delete individual posts at any time.
• Social access tokens are kept only while your account is connected — disconnecting an account deactivates the token in our system.
• Server logs are retained for a limited period for debugging and security.

5. Data deletion

You can have your data deleted in the following ways:

• Disconnect social accounts:in CreatorAI, open Social posting and remove a connected account — this deactivates its access token. You can also revoke CreatorAI's access at any time from your Facebook settings under "Business integrations" (or "Apps and websites"), or from your Instagram settings under "Website permissions", which invalidates the token on Meta's side.
• Delete individual content: scheduled and draft posts can be deleted from your queue inside the app.
• Delete your entire account and data: email us at support@creatorai.infrom your registered email address with the subject "Delete my account". We will delete your account, your uploaded media, your connected-account records and encrypted tokens within 30 days, and confirm by email when done. Some minimal records may be retained where required by law (for example, payment records).

6. Security

• All traffic to and from CreatorAI is encrypted with HTTPS.
• Passwords are stored as salted one-way hashes.
• Social media access tokens are encrypted at rest with a key held separately from the database.

No online service can guarantee absolute security, but we treat your credentials and tokens as the most sensitive data we hold and design accordingly.

7. Requests from public authorities

If we receive a request from a government or other public authority for users' personal data, we review whether the request is legally valid before responding, challenge requests we consider unlawful, disclose only the minimum data legally required, and keep a record of each request, our response and the legal basis for it.

8. Your rights

You may request access to, correction of, or deletion of your personal data at any time by writing to support@creatorai.in. If you are in India, you also have rights under applicable Indian data protection law, including the Digital Personal Data Protection Act, 2023, to the extent it applies.

9. Children

CreatorAI is intended for users aged 13 and above (and you must meet the minimum age required by Instagram and Facebook to connect those accounts). We do not knowingly collect data from children below this age.

10. Changes to this policy

If we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email or in the app.

11. Contact

Questions or requests about privacy: support@creatorai.in. See also our contact page.