Privacy Policy

• When you contact us: your name, your email address or phone number, your message, and which offer or button you used to write to us. Our team gets a copy by email. Sending the form doesn’t create an account or add you to a mailing list.
• Your account: the email address you sign in with. Accounts are only for people we’ve added: our clients’ contacts, our own team, and people we’ve invited to fill in a form. No one else can create one, and you must be 18 or older to have one.
• When you become a client: your company’s name, legal name and website, and contact details for you and the people you work with: names, email addresses, phone numbers, and each person’s role, such as owner or billing contact.
• Your profile: your name and, if you add one, a photo.
• Files: anything you send us through the portal or a form. See Files and photos.
• Forms: your answers to forms we send you, such as a project intake. Each save is kept as its own version.
• Issues: requests, comments and attachments you add in the portal. When you file an issue, our team inbox gets an email with a short excerpt. When you nudge one to ask us to look again, it gets an email naming the issue.
• Email: messages you send us. See Email.
• Secure requests: passwords, API keys and similar secrets you send through a secure request link.
• Text message registration: if we help register your business to send text messages, the details carriers require: your business’s legal name and address, its tax ID (EIN), a representative’s contact details, your website and privacy policy link, sample messages, and how people sign up. We share them only with the texting provider and carrier registry the registration is filed with.
• Payments: when we bill you through Stripe, you pay on Stripe’s own page, and Stripe handles your card or bank details. We see the invoice and whether it’s paid, never your full card number.
• Consulting session materials: code, architecture notes, documents and other materials you share during an engineering review or AI training session. We use them only to deliver the session and treat them as confidential. If we keep copies, we’ll erase them when you ask.

Apart from a business tax ID for text message registration, we don’t ask for government ID numbers such as Social Security numbers, health information, or information about race or ethnicity, religious beliefs or sexual orientation. Please don’t send them to us.

• Sign-in sessions: when you sign in, we keep a session record with your IP address, your browser’s user agent (which describes your browser and operating system) and when the session started. It’s deleted automatically once it expires.
• Activity log: we record actions in the portal, such as signing in, saving a form, uploading a file or accepting our Terms of Service, with who did it and when. Each entry also records the IP address, its approximate location, and the browser and device used. Accepting the Terms records the version you accepted, the version of this policy you acknowledged, the time and your IP address. Our team’s own actions are recorded the same way. Your portal’s Activity page shows your recent activity without IP addresses or locations.
• Sign-in alerts: when you sign in to a client account, our team gets an alert in our admin tools, unless we’ve turned alerts off for that client. The alert goes only to our team.
• Email opens and clicks: when you open an email from our website or portal, or follow a link in one, Resend can record it, and for a click, the IP address and browser used. See Email.
• Approximate location: our host, Vercel, works out a general location (city, region and country) from your IP address. It isn’t GPS, and it may reflect a VPN, a mobile carrier or a company network.
• Visit statistics: Vercel Web Analytics tells us how our site is used: which pages are viewed, the page that sent you, and your browser, operating system and country. It doesn’t use cookies to recognize you; Vercel tells visits apart by a hash of the request and discards it within 24 hours.
• Our host’s view: like any web host, Vercel receives your IP address and browser details with every request to our site.

Our pages don’t load ads, social media widgets, or fonts from other companies, so visiting our site doesn’t tell those companies you were here.

• From your organization: a client can add you as one of its contacts, which gives us your name, email address, phone number and role.
• From Google: if you review us on Google, we may show your review on our website with the name it was posted under.
• From Stripe: whether an invoice has been paid.
• From your website: if we look after your site, our checks record how it responds: whether it answered, how quickly, whether its security certificate is valid, and any error message.
• Our own records: notes our team writes about our work with you, project plans, reminders and billing records. Our notes are visible only to our team.

• Originals are kept exactly. We store every file and photo exactly as you sent it. Information stored inside a file stays with it: a photo can carry the camera, the time and, from many phones, the place it was taken. Remove that before sending if you’d rather we didn’t have it.
• Copies we make. For photos and video in your files, we make a small preview image. For an image in an issue, we also make a smaller copy for display with that embedded information removed; the original is still kept. Your profile photo is kept as you uploaded it, along with a small square copy, and replacing it doesn’t delete the earlier one.
• Where it came from. Each stored file records who sent it, when, and how: from which page of the portal, or through which tool.
• What you see. Your portal’s Files page shows the files you and your team sent us. Files our team adds to your record aren’t listed there.
• Who can see them. Anyone on our team, and contractors or other outside help we hire when their work needs it. No other client can see your files: each client’s are kept apart, and the portal shows you only your own. See Who we share information with.
• The label on your files. The email address your client record was first created with is its permanent label. It names the folders your files are stored in, and if you later change your sign-in address, the original stays as that label.

Email you send us arrives in our business mailbox, hosted by Proton. We can bring copies into our own admin tools, either forwarded as they arrive or imported from an export. Forwarded mail passes through AWS, where the raw message is deleted after 14 days. In our tools, each message’s body is encrypted with its own key. The subject, a short preview, and the names and addresses on the message are stored without that extra layer, and attachments are noted by name, type and size only. Our team’s reading, replies and imports there are recorded.

Email we send you from our website and portal goes out through Resend; replies we write from our business mailbox go out through Proton. We keep a record of each email our system sends, including what it said, so our team can see what you were sent and when. For a sign-in link, we keep only the subject and when it went, never the link itself.

Opens and clicks. Resend can record when an email from our website or portal is opened and which of its links are clicked. Resend keeps these records, and our team can see them there. We use them to check that our email is being delivered and to know a message arrived. An open is noticed through a tiny image in the email, so if you turn off images in your email app, opens aren’t recorded. Each link passes through Resend on its way to the page, so following one records the click: the link, the time, and the IP address and browser it came from. That includes the links in sign-in emails, so Resend’s record of a click can hold the sign-in link itself. Replies from our business mailbox aren’t tracked.

When you open, sign or decline an agreement on our signing page, we record:

• Your verified email address and account, from the portal sign-in you used, and when that sign-in started. We also keep a one-way fingerprint of that sign-in session, never the session itself.
• When you opened the agreement, agreed to use electronic records, and signed or declined it, and your reason if you declined.
• Your IP address at each of those steps, and the approximate location our host derives from it. This location isn’t GPS and may reflect a VPN, a mobile carrier or a company network.
• Your browser’s user agent at each of those steps.
• The time zone your browser reports, and the reading progress it reports: which sections you scrolled past and whether you reached the end.
• The signature you adopt: the name you type and the style you pick, or an image of the signature you draw.
• The name on your client record at the time, the version of the electronic records disclosure you agreed to, the versions of our Terms of Service and this policy named on the signing page, and that you checked the box naming them.
• A fingerprint (a SHA-256 hash) of the document, and one of your signature record.

Why. To show that you signed, what you signed and when; to detect tampering and fraud; and to give you and us a reliable copy.

Who can see it. You, the other signers of the same agreement, and our team. Every signed copy ends with a certificate of completion that lists each signer’s name, email address, sign-in details, IP address, approximate location, browser, reading progress and signing time. Anyone a signed copy is shared with can see those details too.

Where it’s kept. With the agreement in our database; in a private archive locked against deletion; as a PDF filed with your client records; and in the email each signer receives, which Resend delivers. How long is covered under How long we keep information.

• To deliver our services and manage projects, including timelines, deliverables and communication
• To run the client portal: signing you in, keeping your account secure, and showing your agreements, files, forms and issues
• To let our team know when you sign in, so we can follow up
• To look after websites we build or host for you
• To bill you and keep business, tax and legal records
• To answer questions and follow up on inquiries
• To prevent fraud, abuse and unauthorized access, investigate problems, and enforce our agreements
• To comply with the law
• To see how our website is used, through visit statistics
• To show finished work in our portfolio as your agreement allows, and reviews you’ve posted publicly

We don’t use your information for advertising. Nothing we run makes decisions about you on its own: our AI tools produce drafts, and a person decides what to do.

We use AI for the business side of our work and to build tools and software, as our stance on AI describes. We treat what it produces as a draft, not an answer, and a person keeps the final say on what reaches you. We prefer that creative work meant to carry a human feeling, such as art, music or a story in your own words, be made by people.

AI tools in our work. The AI tools we use, for example Anthropic’s Claude, OpenAI’s Codex, Cursor, and models we reach through OpenRouter, may see your code, content and records while we work on them. We choose which tool sees what for each task. How each provider handles what its tool sees, including how long it keeps it and whether it learns from it, is governed by that provider’s own terms, not by us. If you’d rather some part of your work not go through an AI tool, tell us before it starts.

Our internal tools. We run 2 internal tools that can send information to an AI model, through OpenRouter, a service that passes each request to the model we choose. Both write only for our team, and only when we’ve turned AI on. Without it, they fall back to a fixed template, and nothing goes to OpenRouter.

• Operations reports. Our operations tool reviews our open work and writes a status report for our team. It can send: the subject, status, priority and dates of each open issue, with the email address of the person who filed it; the name, state and latest error of each website check; the titles of reminders due within 3 days; site and project names; and recent lines from our activity log: who did what and when, with a short detail that can name a file, or an email’s subject and who it went to. When looking into a problem, it can also fetch the front page of up to 3 websites we look after and send the start of that page’s text.
• Text alerts. When our system texts our own team a summary of what needs attention, the AI writes it from item titles, client and project names, and times.

Neither internal tool can send issue descriptions or comments, our notes, form answers, the contents of files, signatures, secrets, or the body of any email.

We don’t train AI models on your information ourselves. We haven’t set OpenRouter to avoid model providers that keep or train on requests, so each provider’s own terms decide what happens to a request it receives. The providers are listed under Who we share information with.

Our systems don’t send text messages to clients, to people who contact us, or to visitors of our site. The only automated texts go to our own team’s phone, through our provider Telnyx, as alerts about our work. An alert can name a client, a project, or the title of an issue or reminder.

If you give us your phone number, we use it to reach you about our work, by a call or a text from someone on our team. We don’t add it to any texting list, sell it, or share it for anyone’s marketing.

If we ever offer automated texts to you, we’ll ask for your permission first, say what we’ll send and how often, and update this section before the first message goes out. You’ll be able to reply STOP to end them.

We don’t sell, rent or trade personal information, and we don’t share it for anyone else’s advertising. We share it only as described here.

Service providers. These companies run parts of our business for us, and each receives only what its job needs:

Our team. Anyone on our team can see what you upload or share with us: your files, records, form answers and messages. Changes they make are recorded in our activity log. To help you, they can also view your portal as you see it, read-only, for up to an hour at a time; each view is recorded in our activity log.

Contractors and other outside help. We sometimes hire contractors or bring in other outside help. When their work needs it, they may be able to see what you’ve uploaded or shared with us, including your files, records, form answers and messages.

People you work with. Teammates you’ve asked us to give portal access see the areas you shared with them. Everyone who signs an agreement gets the signed copy and its certificate, which shows each signer’s details (see When you sign an agreement).

Our portfolio. Finished work we make for you may appear in our portfolio and on our social channels, as your agreement allows.

Legal reasons. We may disclose information if the law requires it, or if we believe it’s needed to comply with a legal obligation, protect our rights or property, prevent fraud or security problems, or protect someone’s safety.

If our business changes hands. If our business is reorganized, merged or sold, the information we hold passes to whoever takes it over, still under this policy.

We’re based in the United States. Our database and files are stored with AWS in its US West (Oregon) region. Our business email is hosted by Proton, which is based in Switzerland. Our other providers may process information in the United States or elsewhere. If you contact us or use our services from outside the United States, your information will be transferred to and processed in the United States.

• Encrypted connections. Our website and portal use HTTPS, and our storage refuses connections that aren’t encrypted.
• Encrypted storage. Everything we store is encrypted at rest by AWS. Secrets from secure requests, the bodies of business email in our admin tools, and the keys we save for other services get a second layer: each is encrypted with its own key, which is protected by a key in AWS Key Management Service that rotates automatically. Other records, such as form answers, issues, our notes and text message registration details, rely on the first layer.
• Private files. Files are never public. They open only through links that stop working within an hour.
• No passwords. You sign in with a link that works once, within 15 minutes, and we limit how many links one address can request.
• Who counts as our team. Admin access is set in our server configuration, never by a setting stored in our database, so it can’t be granted through the portal.
• Limited access for our software. It can reach only the storage and keys it needs, and it has no permission to delete archived signed agreements or earlier versions of stored files.
• Activity log. Changes to your records, and every time our team reveals a secret, are recorded with who did it and when.
• Backups. Daily database backups kept for 35 days, monthly backups kept for a year, and the ability to restore the database to any moment in the last 35 days.
• Sealed agreements. Signed agreements are sealed so tampering can be detected, and locked in storage for the retention period.

No way of sending or storing information is completely secure, so we can’t promise absolute security. If we learn of a breach that affects your personal information, we’ll tell you as the law requires.

We use a few cookies, all needed for the portal to work. These are the only cookies our site sets, and our visit statistics don’t use cookies. We don’t use advertising or cross-site tracking cookies.

Scripts on the page can’t read our cookies, other websites can’t make your browser send them in the background, and on our live site they travel only over encrypted connections.

While you’re writing an issue, the portal keeps your unsent draft in your browser’s session storage so you don’t lose it. It stays on your device and is cleared when you sign out or close the tab. We don’t use your browser’s long-term storage.

Deleting and erasing. When you or we delete something in the portal, it’s hidden from view and kept in our records, and our team can restore it. A deleted file is hidden, and the stored file stays. If you ask us to erase your information, we’ll erase what we can and aren’t required to keep, and tell you what we kept and why. We keep signed agreements and their evidence for the period above, records we need for security, fraud prevention or to show what happened, such as our activity log, and anything the law requires us to keep. Your email address can stay as the label on records we keep, such as signed agreements, and we can’t erase what Stripe keeps under its own obligations. Copies in our backups expire on the schedule above; we don’t erase them early.

You can do these yourself in the portal:

• Update your profile: change your name, photo and sign-in email from your Profile. A new email address takes effect once you use the confirmation link we send to it, and we let the old address know.
• Get your files: download your signed agreements, and the files you’ve sent us, from the portal.

You can ask us to:

• Access: send you a copy of the personal information we hold about you, in a common format you can reuse
• Correct: fix anything that’s wrong
• Erase: erase your information, within the limits under How long we keep information
• Close your account: end your portal access; there’s no button for this in the portal, so email us
• Object: stop using your information for something, such as showing your Google review on our site
• Send a copy: of anything you signed electronically, by email or on paper, free
• Stop using electronic signatures: withdraw your consent for future documents, as described in our Terms of Service

To make any of these requests, or to send a legal notice, email team@creo.design. We may need to confirm it’s you first, usually by asking you to write from the email address on your account. You can also complain to the data protection authority where you live.

Where the law asks for a legal basis, we rely on:

• Contract: to deliver our services, run the portal, and carry out our agreements with you
• Legitimate interests: to run and improve our business and website, keep accurate records, look after the sites we manage, secure our systems and prevent fraud
• Consent: for anything we ask your permission for, such as text messages if we ever offer them; you can withdraw it at any time
• Legal obligation: to keep tax and business records and respond to lawful requests

Our services are for businesses and adults. We don’t knowingly collect personal information from anyone under 18. If we learn that we have, we’ll erase it. Parents or guardians who believe their child has given us information should contact us.

Our website links to other sites, such as our Google reviews and social media profiles. This policy doesn’t cover them, and a link doesn’t mean we endorse them. Their own privacy policies apply.

We may update this policy as our practices, our tools or the law change. Each update is published here as a new numbered version with its effective date, and earlier versions stay readable from this page. When you accept our Terms of Service in the portal, or sign an agreement, we record which version of this policy was current. The version named when you sign an agreement stays with that agreement. Otherwise, if you keep using our services after a change, the updated policy applies.

Questions about this policy or our privacy practices: hello@creo.design

Privacy requests and legal notices: team@creo.design

Creo Collective LLC, doing business as Creo Design, Montana, USA