Privacy Policy

1. General and the data controller

This policy explains how קרינורי לאבס בע"מ (CREANORY LABS LTD), ח.פ. 517398442, מרחוב הארבעה 28, תל אביב (the “Company”), which operates the CREANORY platform, collects, receives, uses, stores, transfers and protects personal information in connection with the website, the platform and their related services (together, the “Platform”).

It applies to marketing managers, content creators, corporate representatives and any other user of the Platform, and — to the relevant extent — to participants in meetings recorded through it. The Platform’s terms of use apply alongside this policy. In the event of a conflict on a privacy matter, this policy prevails.

Privacy questions and requests may be sent to admin@creanory.com.

2. Providing information and consent

Providing information depends on the user’s will and consent, and there is no legal obligation to provide it unless stated otherwise. However, without the fields marked as required it may not be possible to open an account, verify identity, enable a particular tool, produce an output, connect a calendar or provide a requested service.

When a user provides information about another person — for example a meeting participant, an employee, a customer or a filmed subject — the user must ensure they are entitled to do so, provide that person with the required information, and obtain their consent where the law requires it.

The Platform is intended for adults with legal capacity and is not intended for minors. Information about minors, or sensitive information not necessary for providing the service, must not be knowingly uploaded.

3. The information we collect

3.1 Information provided at registration

• First and last name, email address, role or user type (manager or creator) and account-verification details.
• A password managed and hashed by Supabase Auth; the Company never has access to the plaintext password.
• Brand details: brand name, website address, description of products or services, customer type and primary market.
• The invitation code or link used to register, and the email-verification status.

3.2 Information collected during use

• Uploaded content and materials: advertising videos, images, product photography, logos, references, font files, briefs, brand documents and texts.
• Work outputs: review reports, scores, marketing copy, images, meeting summaries, brand-research reports and the “brand brain” containing findings from public sources together with corrections the user provides.
• The content of conversations with the AI agents, retained so that work continues coherently between visits.
• Wallet balance, credits, charges, refunds and transactions. The wallet is a closed payment instrument usable only inside the Platform, as detailed in the terms of use. Card processing is performed by an external, licensed payment processor; the Company does not collect or store credit-card details, and receives only a transaction approval and a payment identifier.
• Last-activity timestamp, usage-quota counters and technical error logs.
• Consent records: the document version approved, a fingerprint of its content, the time, the language, and a hash of the IP address and browser identifier; the raw IP address is not stored in the consent record.

3.3 Google account and Google Calendar data

What we access. If the user chooses to sign in with Google, we receive the basic identifying details required for sign-in (email, openid and profile). If a Google Calendar is connected, the Platform uses the calendar.events scope to read the user’s events and — at her request and on her approval — to create or reschedule an individual event on the calendar she connected; rescheduling is performed in a way that has Google notify the attendees. The Platform does not create, modify or delete calendars themselves.

Why we access it. Calendar data is used for one purpose only: to show the user their own availability and schedule inside their own account, and to create, display and keep in sync the meetings and production milestones they ask the Platform to manage. It is used to operate the feature the user turned on, and for nothing else.

How it is stored. OAuth access and refresh tokens are stored encrypted with AES-256-GCM. They are held server-side and are never exposed to the browser.

How it is shared. Google user data is not sold, is not used for advertising of any kind, and is not used to train generalized AI models. Where the user has enabled an AI scheduling feature, the specific event details needed for that request may be processed by our AI sub-processors solely to produce the answer the user asked for, under commercial API terms whereby customer content is not used by default to train their models. It is not shared with any other user, workspace or third party.

How long it is kept, and how it is deleted. The connection is optional and can be revoked at any time from the account settings or from the user’s Google account. On disconnection, or on account closure, the stored tokens are deleted and calendar data retained for the feature is removed under the account-closure rules in §12.

Limited Use. Creanory’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Limited Use and AI/ML, stated explicitly. Raw or derived user data received from Google Workspace APIs is not used, transferred or sold to create, train or improve foundational or generalized machine-learning or artificial-intelligence models — not by Creanory and not by any third party. Where the user enables an AI scheduling feature, only the specific event details needed for that one request are processed by our AI sub-processors, solely to produce the answer the user asked for, under commercial API terms whereby customer content is not used by default to train their models.

3.4 Information from public sources

For brand research, the Platform may locate and process publicly available information on the internet, including content on the brand’s website, source addresses, activity descriptions, markets, target audiences and public business information. The system may produce automated hypotheses or conclusions; these are presented as such and can be corrected.

3.5 Online store connection (Shopify / WooCommerce)

A user may choose to connect their business’s online store. The connection is read-only, and through it the Platform receives and processes order data (time, amount, status, currency and the store’s internal customer identifier) and catalogue data (products, prices and availability), in order to present business metrics and reports and to operate the Platform’s services for that business.

The Platform does not ingest identifying details of the business’s end customers — no name, no email address, no phone number and no shipping address. Order data is stored with the store system’s internal identifier only, which does not allow a person to be identified outside the business’s own admin interface. Store access credentials (tokens and keys) are stored encrypted with AES-256-GCM, and the connection can be disconnected at any time from the account settings.

3.6 Advertising-account connections

Advertising accounts — Meta (Facebook/Instagram), Google Ads and TikTok Ads — may be connected in order to read the business’s campaign spend and performance metrics, for display in reports and dashboards. The Platform does not create, modify, pause or delete campaigns in those accounts. The scope requested from Google Ads is https://www.googleapis.com/auth/adwords — this is the only scope the Google Ads API offers, it has no read-only variant, and it therefore technically confers write access as well; Creanory uses it solely to read the performance metrics of the business’s own advertising account, for display to that business.

Custom audiences on the user’s instruction. At the user’s request only, the Platform uploads to the business’s Google Ads account an audience list based on the business’s customers (for example, customers who purchased), with identifying details transferred as a one-way hash as is customary on the advertising platform, in order to target the business’s own advertising. The list is updated automatically and serves that business’s advertising account only. The upload is subject to the advertising platform’s terms and approval, and can be stopped at any time.

3.7 The business’s recipient lists

As part of the mailing services, a user may upload a recipient list belonging to their business — email addresses and, where needed, first name and phone number — for sending mail on behalf of that business only. At upload the user must declare the source of the list, and that declaration is stored together with the upload record. Responsibility for the recipients’ lawful consent lies with the user, as stated in the terms of use.

A recipient who requests removal is recorded on a permanent suppression list stored as a one-way hash — the address itself is not retained — and every future send is checked against it. Recipient lists are used solely to provide the service to that business, are not disclosed to other businesses, and are not used by the Company for its own purposes.

3.8 Social-network publishing and message handling

A user may connect the business’s Facebook Page and Instagram business account to the Platform. Through this connection the Platform publishes posts the user approved, reads the comments on the business’s posts and the messages the business receives, and replies to them — with a short public reply and a private message — under rules the user defined. For this purpose the following is stored: the commenter’s or sender’s identifier on the external platform and their name as displayed there, the content of the comment or message and its time, the post it refers to, and a record of the messages sent. Details given in the conversation — a name and a telephone number — are recorded as a lead on the business’s leads screen (section 3.9).

Access is made through the Meta permissions shown at the time of connection, access tokens are stored encrypted with AES-256-GCM, and the connection can be disconnected at any time. Sending is paced and complies with Meta’s rules for business messaging; the Platform does not message anyone who neither contacted the business nor commented on one of its posts.

3.9 Leads and the CRM

The business’s leads screen gathers the enquiries it received: from lead forms in advertising (Meta), from forms on the business’s landing pages connected to the Platform, from social-network conversations (section 3.8) and from the user’s manual entry. For each lead the details given in the enquiry are stored — name, telephone, email address, the content of the enquiry — together with its source, the campaign and the page it came from, and its handling status. At the user’s choice, leads are passed to the business’s CRM (for example HubSpot) or received from it. This data belongs to the business, is processed for it only and is not used by the Company for its own outreach; contacting leads is done by the business and on its responsibility, subject to law.

4. Purposes of use

• Opening an account, verifying identity, managing permissions and providing secure access to the Platform.
• Operating AI tools, brand research, creative review, producing and editing outputs, and maintaining continuity of work.
• Connecting those who commission work with content creators, and managing orders, auctions, credits, the internal wallet and the referral programme.
• Recording meetings with consent, transcribing them, producing summaries and presenting the outputs to the user.
• Sending operational messages, such as registration verification, onboarding invitations, welcome messages and consent confirmations.
• Information security, preventing misuse and fraud, detecting and fixing faults, backup and maintenance.
• Complying with legal obligations, resolving disputes, enforcing the terms of use and protecting the rights of the Company and its users.
• Aggregate or anonymised analysis and service improvement. The Company does not train generalized models on customer content and does not use confidential materials for its own promotion without explicit consent.

5. Use of artificial intelligence

Some information and content is transferred to AI providers in order to perform the requested action. These providers may process content in the United States. Users should avoid entering personal information that is not necessary, and in particular sensitive information, third-party trade secrets, or information provided under a duty of confidentiality, unless suitably authorised.

Anthropic is the principal provider for text, analysis, reports, brand research and web-search tooling. OpenAI is used for image generation and editing and for transcription. Under these providers’ commercial API terms, customer content is not used by default to train their models; information may be retained for a limited operational period, typically up to 30 days, for security and abuse-prevention purposes, unless otherwise agreed or required by law.

Video from a picture. In the video-creation service, the uploaded picture and the written description are transferred to Google (the Veo video model) solely to produce the clip, under Google’s commercial API terms. The picture itself is not retained by us after production; what is kept is the clip produced, the description, and a technical signature of the uploader — a fingerprint (hash) of the picture file, a hashed network address, the browser type and the time of upload — in order to resolve third-party claims and prevent misuse. A clip produced in the public demo is deleted within a day.

To produce further short video clips and to produce narration for the team’s characters, the Company may also rely on the additional model providers listed in the table in section 7, on the same terms.

The “brand brain” is kept as a dedicated environment per customer, isolated from other customers’ environments, and is used to operate the service for that workspace only.

6. Meeting recording and transcription

Recording is performed only through a visible, declared Recall.ai recording bot, and only after notice has been given in advance and documented consent has been stored. A direct in-browser recording path is not active.

The user who starts a recording is responsible for informing all participants of the recording itself, its purposes, the use of AI tools and the transfer of information to sub-processors, and for obtaining any consent required under applicable law. Minors, privileged conversations and especially sensitive information must not be recorded without a proper basis and authorisation.

As of the date of this policy, processing of recordings by Recall.ai is configured in the Tokyo, Japan region. The Company may move processing to another region supported by the provider, including Frankfurt, Germany, updating this policy where required.

7. Service providers and transfers outside Israel

The Company uses external providers acting on its behalf for defined purposes. Information may be stored or processed outside Israel, including in the European Union, the United States and Japan, depending on the provider’s role and the service configuration. Such transfers are made in accordance with applicable law and subject to appropriate undertakings by the recipients.

A connection to Microsoft Outlook is not active for data retrieval as of the date of this policy. If it is activated, this policy will be updated and appropriate information will be given to users beforehand.

8. Cookies, fonts and communications

The Platform uses essential cookies only: Supabase Auth sign-in and session cookies, and a language-preference cookie. Basic operational cookies from the Vercel infrastructure may also be used. Blocking essential cookies may prevent sign-in or proper use.

In addition to essential cookies, the site may load third-party measurement and advertising tools — the Meta pixel, the Google Ads tag, the Taboola pixel, the TikTok pixel, the LinkedIn Insight Tag and Google Analytics — only after the visitor has explicitly approved this in the cookie notice (“Accept all”), and only on the public pages of the site (home, sign-up, sign-in, About, Contact and the legal pages) and on the plan-selection and payment page. These tools measure the effectiveness of the Company’s own advertising and build audiences for it, and may collect browsing data such as an IP address, device and browser identifiers, the pages viewed and conversion events (leaving contact details, completing registration, starting a trial, contacting us, proceeding to payment and purchasing — including the plan chosen and its amount), under those providers’ privacy policies. The Meta pixel may also pass to Meta the email address, phone number and name the visitor entered in a form on the site (for example at sign-up), one-way hashed in the browser, to measure conversions and find similar audiences. They are not loaded inside a user’s workspace after sign-in, other than on the plan-selection and payment page. Choosing “Essential only” prevents them from loading, and the choice can be changed at any time by clearing the site’s cookies in the browser. Fonts are loaded from Google Fonts, so when a page loads the browser may contact Google’s servers and expose communication data such as an IP address to them.

Google Analytics is a measurement tool rather than an advertising one, so it loads on the measurement consent category alone: a visitor who accepted measurement and refused advertising is counted, and is not added to any advertising audience. It measures how many visitors reached the site, from which pages and from which referring sources, and does not receive a name, an email address or any content created in the workspace.

In addition, the site’s basic visit count is measured by the hosting provider’s built-in tool (Vercel Web Analytics). It sets no cookie, stores no persistent identifier and does not track a visitor across sites — so it runs on every page and is not conditioned on the cookie notice.

Non-essential cookies and identifiers — including measurement, analytics and advertising cookies — are loaded only after the visitor’s explicit consent through the consent mechanism presented on the site. Refusing is as easy as accepting and does not impair use of the service. Consent can be changed at any time; a change in the scope of cookie use requires consent to be requested again.

9. Mailing, marketing messages and use of data

This section is drafted in accordance with section 30A of the Israeli Communications (Telecommunications and Broadcasts) Law, 5742–1982.

Operational messages. The Company sends, through Resend, the messages required to operate the service: registration verification, password reset, invitations, welcome messages, consent confirmations, status updates for jobs, auctions and payments, and system alerts. These are not advertising, they are an integral part of the service, and they cannot be unsubscribed from while the account is active.

Advertising material. Marketing messages — promotions, new features, marketing content, surveys and event invitations — will be sent only after the recipient’s explicit, documented consent, given in writing or electronically. Every such message will be marked as advertising, will identify the Company and how to contact it, and will include a simple, clear and free way to unsubscribe. A refusal notice will be honoured free of charge, unconditionally and without delay.

Consent to data collection and use. By using the Platform, and subject to this policy and to the Protection of Privacy Law, 5741–1981, the user consents to the Company collecting, storing, processing and analysing the details they provided and their service-usage data — including brand data, preferences, usage patterns, performance data and outputs created in the Platform — in order to operate, secure, measure and improve the service, develop new services and features, tailor content and experience, prevent fraud and misuse, and comply with legal obligations. This consent does not, in itself, constitute consent to receive advertising material, for which separate explicit consent is required as stated above.

Aggregate and anonymised data. The Company may produce statistical, aggregate and anonymised data that does not allow a person to be identified, and use it for any legitimate business purpose, including development, research, marketing and promotion of the service, without time limit. The Company does not sell personal information and does not train generalized models on customer content.

Third-party consent. A user who provides the Company with another person’s contact details for an invitation, collaboration or approach declares that they obtained that person’s consent to the provision of the details and to being contacted.

Mailing by the business to its own recipients. In the Platform’s mailing services, the user — not the Company — is the advertiser of the messages sent to the business’s recipients, and responsibility for complying with section 30A in respect of those recipients lies with the user. For its part, the Platform enforces on every send: marking the message as advertising, stating the advertiser’s details, an active and free unsubscribe link, and automatic filtering of every recipient on the suppression list — before every send, without exception. A recipient’s removal request is enforced permanently and cannot be reversed by the user. The business’s mailings are sent through Amazon Web Services (SES) infrastructure in Ireland, from a sender address on a domain the business verified; the provider reports deliveries, bounces, complaints, opens and clicks to the Platform, for sender-reputation management and for showing the business its campaign results. Consent and unsubscribe records are also kept in a copy outside the database, as a record of proof.

10. Sharing and disclosure

The Company will not sell personal information. It may disclose information only to the extent required: to the service providers listed in this policy; to other users within the creator marketplace and a specific engagement; under a legal obligation or authority; to protect rights, security or prevent fraud; or in the context of a merger, investment, sale of business or restructuring, subject to preserving data subjects’ rights.

Every workspace is isolated. A manager and a creator can view only the information their account and workspace permissions allow. This does not derogate from the user’s responsibility for information they choose to share with other users.

11. Who may access information, and information security

As of the date of this policy, administrative access within the Company is limited to holders of dedicated, documented authorisation. Administrative and export screens are protected server-side. Service-role keys are held server-side and are never exposed to the browser; OAuth tokens are stored encrypted with AES-256-GCM; and environment separation is enforced server-side and in the storage layers.

Development and maintenance may be performed using AI-based development tools, under the Company’s authorisation and supervision. Access to information is granted only where necessary for repair, maintenance, security or support.

The Company takes reasonable and accepted measures to reduce risk, but no system is completely secure. The user is responsible for keeping their access details confidential, securing their devices, and limiting the permissions of their own team.

12. Retention periods and deletion

Information will be retained only for as long as necessary for the purposes described in this policy, to fulfil obligations, and for security, record-keeping and the protection of legal rights. As of the date of this policy the following periods apply:

Deletion is not necessarily immediate from every backup copy or from providers’ systems, and information may be retained beyond these periods where required by law, to protect rights, handle a dispute, prevent fraud or maintain security. Anonymised information that does not permit identification may be retained without time limit.

13. Account closure and rights regarding information

Subject to law, a person may request to review the personal information held about them, to correct information that is incorrect, incomplete, unclear or out of date, and to request deletion or restriction of use where such a right exists. They may also request account closure, disconnect a calendar connection, and stop receiving marketing messages if any are sent in future.

A request should be sent to admin@creanory.com and include details enabling identification of the requester and the information sought. The Company may request identity verification and may withhold information whose disclosure would harm another person’s privacy or rights. Requests are handled within the periods prescribed by law.

Deletion or account closure will not apply to information that must or is lawfully justified to be retained, including transaction records, consents, fraud prevention and defence against claims.

14. Changes to this policy

The Company may update this policy following changes to the Platform, its providers, the law or the manner of processing. The current version will be published on the Platform and will state its update date. Where a material change occurs, appropriate notice will be given through an available contact channel or a prominent notice in the Platform, as the circumstances and the law require.

15. Contact

Data controller: קרינורי לאבס בע"מ (CREANORY LABS LTD), ח.פ. 517398442, מרחוב הארבעה 28, תל אביב.

• דואר אלקטרוני: support@creanory.com
• פניות פרטיות: admin@creanory.com
• כתובת: הארבעה 28, תל אביב
• טלפון: 054-4355537
• ח.פ.: 517398442