Privacy

CREAO respects your privacy and gives you control over your data.

What data does CREAO collect?

CREAO collects the minimum data necessary to provide the service:

Account data — email address, name, and authentication credentials
Onboarding answers and progress — if you use guided onboarding, CREAO saves your selected work sector, desired outcome, optional details, connection milestones and progress so you can resume. After you start the agent, your answers provide context to the selected AI model and may inform draft-agent suggestions. Our analytics and engagement services (Statsig and Customer.io) receive your selected sector and outcome, session and step identifiers, and completion metadata, not your free-text answers or connector credentials. Onboarding records are replicated to our analytics warehouse; the views used for onboarding analytics exclude free-text answers and configuration. These records are removed with your CREAO account, and the warehouse mirror follows source deletion.
Agent Brain context files — for accounts using file-based memory, CREAO can organize information you provide in conversations into private context files, such as travel plans, client records, brand preferences, family and school details, and equipment history. These files may contain personal data about other people you mention, including names, relationships, ages, schools, teachers and contact details. Creation can happen automatically during background curation, without a separate request to remember each fact
Event registration data — on event-specific registration pages, CREAO may collect your name, professional role, practice area, experience range, an optional question, and a referral source tag to estimate attendance and tailor the session. Event forms do not request client names, matter details, identity-document numbers, or uploaded files. Responses may be submitted directly to a Google Workspace Sheet controlled by the event organizer rather than stored in CREAO’s product databases
Developer profile — optional display name, company, and website you provide on the CREAO CLI console (developer.creao.ai/cli). Keyed to your CREAO account and deleted when that CREAO account is deleted. This is CLI data, not the Developer Platform USD account
Developer Platform account — when you first sign in on the Developer product at developer.creao.ai (a CREAO account must already exist, or is created by that same sign-in), CREAO registers a Developer account: a USD wallet balance in cents (developer_wallets) and a default project (developer_projects). You can add more projects and set each one’s name (up to 100 characters). That name is shown only to you and may incidentally include personal information. You can fund that wallet through Stripe Checkout; each credit is recorded in developer_wallet_entries. These rows are a separate product account linked to your CREAO account (agent.creao.ai and CLI). Creating a CREAO account alone does not create them. Deleting your CREAO account does not delete them. They are retained until the Developer account is closed, or until you request erasure at privacy@creao.ai
Developer Platform /v2 run and request logs — when an authenticated project-key request reaches a /v2/* Developer Platform route after authentication and account rate-limit checks, CREAO stores one request-log row (developer_v2_http_requests) with your Developer account identifier, project and project-key identifiers, HTTP method, route pattern and path, handler name, status or error code, created or fetched run identifiers where applicable, agent and conversation identifiers where applicable, timing, request and response byte counts, and settled sell-price USD cents when a run later settles. CREAO also stores a run row (developer_v2_runs) for hosted and general-agent executions, including request identifier, mode, status, timing, input JSON payload, result JSON payload, per-model usage breakdown, settled sell-price USD cents, upstream cost used only to compute that sell price, error metadata when a run fails, and the webhook delivery timestamp. If you set webhook_url, CREAO POSTs the run result to that endpoint; the URL itself is not stored on the run row. These rows belong to the Developer account, not the CREAO chat account. Deleting the CREAO account does not delete them. They are retained until the Developer account is closed, or until you request erasure at privacy@creao.ai
Developer Platform Console Analytics — when you open Analytics on developer.creao.ai/analytics while signed in to the Developer product, CREAO shows aggregated usage, published account-level /v2 limits, settled USD spend, and per-request metadata for projects you own. That page reads the existing /v2 ledger rows above; it does not collect a new data category. Session APIs return route pattern, status, duration, model identifier, token counts, and settled sell-price USD cents only. They omit raw paths, prompt and response bodies, error-message text, upstream model cost, and C-end credits. A project that is not yours is treated as not found. A /v2 project key cannot call these Console routes
CREAO CLI keys — when you create Account API keys for CREAO CLI, CREAO stores the key label, HMAC token hash, public token prefix/preview, creation and revocation timestamps, and last-used-at timestamp for validation, revocation, audit, and abuse prevention. The raw API key is shown once at creation and is never stored. Account API keys can create, edit, and run personal agents owned by your account, and can manage those agents’ long-term memory, skill file space, personal workspace files, and account-level Agent Brain skills as described below. They can also read and post in your team rooms as you (see CREAO CLI team rooms below). Super Agent (/v1/super-agent/*) and product-profile (GET/PUT /v1/product-profile) routes are available only to allowlisted accounts. Key rows are deleted when your account is deleted
CREAO CLI agent data — when you create or edit personal agents through CREAO CLI, CREAO stores the agent definition in the same encrypted agent resource store used by the main CREAO app, including agent name, description, version, skill instructions, app configuration, dashboard template, write-autonomy setting, release note, and timestamps. These agent rows are deleted when your account is deleted
CREAO CLI agent memory — when you read, overwrite, or clear a personal agent’s long-term memory through CREAO CLI (/v1/agents/{agent_id}/memory), CREAO retrieves or updates reflection playbooks for that agent via CREAO’s reflection service. Overwrite and clear operations send playbook content and status to that service; read responses return playbook identifiers, names, content, triggers, rationales, statuses, and timestamps. CREAO does not store a separate CREAO CLI copy of these playbooks beyond ordinary request logging described below; source playbooks remain in the reflection service and are purged when the underlying agent is deleted
CREAO CLI agent files — when you list, download, or delete files in a personal agent’s skill file space through CREAO CLI (/v1/agents/{agent_id}/files), CREAO uses the same encrypted file registry and object storage used by the main CREAO app for that agent’s skill folder (including auto-staged skill files such as SKILL.md). List and download responses include file identifiers, names, MIME types, sizes, content hashes, timestamps, and short-lived presigned download URLs. Delete removes the registry row and the stored object. These files are deleted when your account is deleted, or when you delete them via the API or the product UI
CREAO CLI workspace files — when you upload, list, download, or delete files in a personal workspace through CREAO CLI (/v1/workspaces/{workspace_id}/files), CREAO uses the same encrypted file registry and object storage as the main CREAO app’s workspace Files panel (workspace-root uploads only; not thread artifacts or organization shared files). Upload stores the file bytes, a display name, MIME type, size, and content hash. List and download responses include file identifiers, names, MIME types, sizes, content hashes, timestamps, and short-lived presigned download URLs. Delete removes the registry row and the stored object. These files are deleted when your account is deleted, or when you delete them via the API or the product UI. Passing the same workspace_id on an async or realtime run binds that conversation to the workspace so the agent can read those uploads; file contents may then be sent to the selected LLM provider through the same channel as files uploaded in the web Files panel
CREAO CLI run data — when you start async or realtime agent runs through CREAO CLI, CREAO stores the request identifier, agent/conversation/thread/session identifiers, optional bound workspace identifier, run mode, status, timing, input JSON payload, result JSON payload, error metadata when a run fails, credits used, and a per-model usage breakdown (model identifier plus numeric counters such as tokens, generated-image count, or duration). Realtime responses use a public NDJSON render protocol sent to the Account API key holder: assistant text, thinking deltas, search queries and result cards, todo lists, opaque tool start/end (without tool input or output), and artifact announcements. The persisted result JSON may include a compact blocks snapshot; thinking text is not stored in that snapshot. A completed-run GET with an Account API key (cr_sk_) may hydrate thinking content onto those markers from the owned assistant message. List and webhook payloads stay marker-only. Unlike the input and result payloads, that usage breakdown is also copied into CREAO’s internal analytics warehouse. A first run of a named agent (no conversation_id) assembles the same run prompt used by the main CREAO app’s agent-detail Run action: the stored agent name, skill instructions, and app configuration are combined with your input as the user request before the model is called. Follow-up turns on an existing conversation send your new input without re-assembling that full prompt. Super Agent runs (POST /v1/super-agent/runs, POST /v1/super-agent/realtime/runs) use chat_async or chat_realtime with no agent_id and do not assemble a named-agent prompt; they are stored with the same run-row shape and are listed only through /v1/super-agent/runs. When CREAO’s reflection analytics/retrieval is enabled, named-agent async and realtime runs use the same reflection path as chat: your current query text may be used by CREAO’s reflection search to retrieve relevant profiles/playbooks, and user turns and selected assistant final-turn summaries (with compact tool metadata) may be processed by CREAO’s reflection service for quality monitoring. If you configure a webhook URL, CREAO also stores that URL and delivery timestamp and may POST the run output to the developer-configured endpoint. Run rows are deleted when your account is deleted
CREAO CLI request logs — when an authenticated Account API key request reaches a /v1/* CREAO CLI route after authentication and account rate-limit checks, CREAO stores one request-log row with your account identifier, Account API key row identifier, HTTP method, route pattern and path, handler name, status or error code, created or fetched run identifiers where applicable, agent and conversation identifiers where applicable, timing, request and response byte counts, and credited usage when the call creates a billable run. CREAO does not store request payloads, response payloads, headers, raw API keys, or tokens in this request log. Rows are deleted when your account is deleted
CREAO CLI account usage — when you call GET /v1/account/usage with an Account API key (cr_sk_), CREAO returns your own remaining platform-wallet credits and a rolling 24-hour sum of CREAO CLI request count and reported credit spend. The response is scoped to the key owner. It does not include other accounts’ balances, internal credit units, or the billing deduction ledger.
CREAO CLI product profile — when an allowlisted account reads or replaces the once-per-account product profile through GET/PUT /v1/product-profile, CREAO stores optional persona (up to 4,000 characters) and brand context (up to 8,000 characters). Non-empty fields are sent to the selected LLM provider on each Super Agent turn as written, so the Super Agent can follow that voice. An empty or missing profile uses the default CREAO Super Agent voice. The row is hard-deleted when your account is deleted. Internal analytics warehouse views exclude persona and brand-context text
CREAO CLI Super Agent runs — when an allowlisted account starts a Super Agent run through /v1/super-agent/runs or /v1/super-agent/realtime/runs, CREAO uses the same Super Agent chat runtime as agent.creao.ai/chat (connectors and most skills). These runs do not load CREAO long-term memory, and they cannot create or modify personal agents. CREAO stores the same run and request-log fields as other CREAO CLI runs (agent_id is empty; Super Agent conversations cannot be mixed with Agent Runs). Input and output may be sent to the same LLM providers as chat. Realtime Super Agent streams use the same public NDJSON render protocol as Agent Runs, including thinking, search, and todo cards that leave the host toward the API key holder. A Super Agent GET may also return thinking content on those markers after the run completes. Super Agent run rows are deleted when your account is deleted
CREAO CLI team rooms — where team rooms are enabled for your team, an Account API key acts as you in team rooms through /v1/rooms: it can list the rooms you have joined, read any room you can read in the app (as a team owner or manager, that includes private rooms you have not joined), see members and agent status, follow a room’s new messages live, and post messages. A post made with a key is stored like any message you send in the room, under your name and marked as sent through the API, together with the optional idempotency key (client_msg_id) you supply; mentions in it notify people and, unless the request sets trigger_agents to false, start the mentioned agents, which then work exactly as when you mention them in the app. CREAO stores no copy of what a key reads, and the live room stream is not stored. Request-log rows for these calls follow the CREAO CLI request logs entry below. Anyone or anything you give your key to, including an agent you let read it from your Secrets, can read your rooms and post as you until you revoke the key. When an agent uses your key, the room content it reads is sent to that agent’s LLM provider like any other content it works with
CREAO CLI Super Agent allowlist — CREAO may store an allowlist row with your account identifier, the account email, and the administrator who added the account, so Super Agent and product-profile routes can be gated. The row is hard-deleted when your account is deleted or when an administrator removes the account from the allowlist
Conversation data — messages, files, and artifacts you create during chat sessions. On iOS and Android, URLs, text, and files shared into CREAO from other apps through the system Share sheet are treated as chat attachments and retained under the same conversation data policy. When CREAO’s reflection analytics/retrieval is enabled, user turns and selected assistant final-turn summaries (with compact tool metadata) may be processed by CREAO’s reflection service for quality monitoring, and your current query text may be used by CREAO’s reflection search to retrieve relevant profiles/playbooks
Cloned voice data — when the voice-cloning feature is enabled and you explicitly enroll a voice, CREAO sends the reference audio to MiniMax to create a provider-hosted voice profile. CREAO stores the display name you choose, an internal profile identifier, the provider voice identifier, consent timestamp/version, lifecycle timestamps, and a generated MP3 preview. CREAO does not retain the reference recording in its own object storage and requests deletion of MiniMax’s uploaded reference file after activation. You must own the voice or have the speaker’s permission to clone and use it. Voice recordings and derived profiles can identify a speaker; CREAO uses this feature to synthesize speech, not to verify identity. Enrollment requires an explicit consent attestation, and CREAO records its version and timestamp
Usage data — credit consumption, feature usage, acquisition attribution (UTM parameters, Google click IDs (gclid, gbraid, and wbraid), Meta click ID (fbclid), Reddit click ID (rdt_cid), and Impact affiliate click ID (IM_REF), referring site, landing path, owner-derived affiliate or referral attribution from public shared-thread and agent-install pages, and KOL-defined affiliate sub-tracking parameters such as media or sub_id), the type of client you signed up and signed in from (native iOS or Android app, mobile browser, desktop browser, or desktop app) together with the app version when you use one of the native apps, session metadata for billing, analytics, and product improvement. When Google Analytics or Google Ads conversion measurement is enabled, CREAO also sends your CREAO user identifier (after sign-in), first-touch campaign/referrer parameters, Google click ID (gclid), the browser GA4 client identifier derived from the _ga cookie and, on agent run requests where a live session is active, the session identifier derived from the _ga_<container> cookie, conversion events, and the signed-in email address for sign-up, login, and purchase enhanced-conversion matching (the email is also set on the Google tag when a signed-in session is restored, so later conversions in that session can be matched); the Google tag hashes email data before Google receives it for matching. When Meta Pixel or Meta Conversions API measurement is enabled, CREAO may send hashed email, hashed CREAO user identifier, IP address, user agent, Meta browser/click identifiers (_fbp, _fbc), and sign-up or purchase conversion events to Meta for attribution matching. When Reddit Pixel or Reddit Conversions API measurement is enabled, CREAO may send hashed email, a namespaced hash of the CREAO user identifier, IP address, user agent, the Reddit browser identifier (_rdt_uuid), Reddit click ID (rdt_cid), and page-visit, pricing-view, sign-up, or purchase conversion events to Reddit for attribution matching; no conversation content is sent for these analytics events
Billing coupon data — when a one-time subscription coupon is created or redeemed, CREAO stores the coupon code, campaign type, discount terms, optional internal distributor note, Stripe coupon/promotion identifiers, and admin/redeemer attribution needed to prevent reuse, reconcile checkout, support customers, and audit discount issuance. Redeemer email is visible only to CREAO admins and is removed if the redeemer’s account is deleted
Billing address and tax data — when sales-tax calculation is enabled for your Stripe checkout (today: the CREAO platform Stripe account in Hong Kong), Stripe Checkout asks for your full billing address and saves it on your Stripe customer record to calculate sales tax or VAT where CREAO is registered to collect it. Stripe collects, stores and uses it under its own terms; CREAO does not keep a copy of the address in its own database. Tax amounts appear on the Stripe invoice and receipt
Affiliate and referral billing data — when you join or use an affiliate referral campaign, CREAO may store referral handle attribution, KOL account identifiers, configurable commission rates, invitee reward credit grants, and related credit ledger metadata so rewards, revenue share, and payouts can be calculated and audited. For Impact.com affiliate campaigns, CREAO may send eligible sign-up, subscription, and credit-purchase conversion records to Impact.com for partner attribution and reconciliation; these records may include SHA1-hashed email, CREAO user ID, Impact click ID, order ID, conversion timestamp, event type, subscription or purchase amount, and promo code
Memory data — your user-scoped Agent Brain profile, context files and reusable skills, curated from conversations when enabled and available from Settings → Personalization. Historical database-memory records remain available for reading and deletion, but new legacy records and Dream profiles are no longer generated. Agent-app playbooks are a separate store described below
Login geolocation — a location estimate derived from your IP address is recorded with each login event. A country code (ISO 3166 alpha-2, from Cloudflare) is used for analytics, abuse detection, and billing routing. CREAO may also derive and store a coarse city/region estimate — from Cloudflare’s edge geolocation of your IP on live logins, or an offline geolocation database applied to the stored IP for historical (backfilled) estimates — used for regional product analytics and to segment location-relevant CREAO communications (see Location-based communications below). When derived, this estimate is approximate — it reflects your network’s location, not a precise position, and can be wrong (for example with VPNs or mobile carriers). No GPS or precise-location data is collected, and only the coarse city/region estimate — never the raw IP — is shared with our marketing-automation subprocessor (customer.io) for this purpose, and only for users outside the EU/EEA/UK (see Location-based communications below)
Sign-up credit check — the free credits a new account receives may be held until an automated check finds no sign of an account farm. The check compares the account’s existing login signals (device fingerprint, device identifier, IP address when no fingerprint is present) and email alias with other accounts, and looks at whether the account was placed in a suspicious-account group for review. Daily credits stay available meanwhile. Credits held for a flagged account are released when the review clears it, when the account upgrades to a paid plan, or when an admin restores it. Only the hold’s status, amount and the names of any matched checks are stored, and they are deleted with your account
Location-based communications — CREAO may use the coarse city/region estimate described above to segment marketing and lifecycle emails by area (for example, an event or announcement relevant to your metro). This applies to users outside the EU/EEA/UK: because CREAO does not yet operate a per-user consent mechanism for this purpose, users in the EU/EEA/UK are excluded from location-based marketing segmentation entirely, and their location estimate is not shared with our marketing-automation subprocessor for it. You can opt out of marketing emails at any time via the unsubscribe link or your notification settings
Historical Dream profiles — previously generated summaries of preferences, working style and activity. Automatic and on-demand generation and the Dream tab are retired; retained records are not used for current memory injection
Reflection playbooks — app-specific workflow rules inferred from agent-app interactions, available in the agent’s Playbook tab. Authorized app runs may retrieve relevant playbooks from the reflection service and send them to the selected model provider. Personal reflection-profile and user-playbook retrieval is retired; ordinary chats are not published to the reflection service
Linked social profiles — when you connect an X (Twitter) or Discord account from the Rewards hub or Settings, CREAO stores the provider account ID, username, display name, and avatar URL so the UI can show which accounts you have linked. For Discord we also retain the OAuth access token so reward verification (CREAO server membership) can run without prompting you to re-authenticate. For X, the OAuth token is used only at link time to confirm account ownership — CREAO does not call back to X to read your follows, posts, or social graph. To prevent reward-farming via re-binding, an X or Discord identity that has been linked to a CREAO account is bound permanently to that account — it cannot be disconnected from the UI. As a security measure, linked profile data and stored OAuth tokens are also removed automatically whenever your authentication state is revoked (password reset, admin force-logout, account ban) — this prevents an attacker who briefly held a session cookie from leaving an attached account behind after the rightful owner regains control. They are otherwise removed only when you delete your CREAO account, at which point all linked profile data and stored OAuth tokens are deleted with it. You can still revoke CREAO’s access at any time from your provider’s settings (X → Connected apps, Discord → Authorized apps), which invalidates the stored token immediately
Campaign participation data — if you join a CREAO campaign or challenge, CREAO may store campaign-specific enrollment state, eligibility checks, public leaderboard identity, and setup metadata. For the Agent Trading Campaign, this includes Season 1 submitted WEEX email/UID, Season 2 submitted debot email and Robinhood Chain wallet address, the linked X profile used as your public leaderboard identity (x_username, x_provider_account_id, display name, and avatar), Discord link and CREAO Discord server membership requirements where applicable, your selected CREAO agent app ID, your user-chosen public leaderboard agent name/slug, Agent API Trigger setup metadata, readiness/freeze audit hashes, and disqualification/finalization status. For the optional Season 2 Kite Agentic Wallet side event, CREAO may also store your cloned Kite agent app ID, which Passport skill paths were installed on your CREAO account (authenticate-user, kite-passport, wallet-send), the Base-chain wallet address you confirm, wallet/deposit/transaction verification timestamps, a verified Base deposit balance (USDC), a submitted Base transaction hash, side-event completion status used for the leaderboard Kite badge and score bonus, and reward-credit grant status/timestamps for enrollment-lock and Kite-completion bonuses. Total CREAO credits consumed may be used to determine prize eligibility; public campaign pages may show eligibility status or prize-claim rank, while exact credit totals are visible only to you and CREAO admins
Hackathon signup data — if you create a CREAO account through a hackathon signup link while that event’s offer is open, CREAO records which hackathon the account signed up through, the complimentary plan granted (one month of Pro Plus), when that plan period ends, and when the record was created (hackathon_signups). It is used to apply the offer once per account, support you, and measure event sign-ups, and it is deleted when your account is deleted
Campaign financial performance data — for trading challenges, CREAO may use the WEEX API credentials you configure in CREAO Secrets to request demo-account balance and order data from WEEX during a WEEX-backed campaign. For Robinhood/debot-backed campaigns, CREAO may check your submitted Robinhood Chain wallet balance at enrollment, receive Debot monitor callbacks on a CREAO community Agent webhook wrapper (which forces phase-based dry-run when appropriate, then forwards to your Platform Agent app), and import wallet equity, PnL, trade count, trade history, and funding history from debot or the Robinhood chain for ranking and audit. CREAO stores leaderboard snapshots such as USDT or ETH equity, PnL, and trade count for ranking, audit, and results pages, and may persist size-bounded Debot callback payloads (plus a payload hash, event id, dry-run flag, phase, HTTP status, and dispatch outcome) in s2_trading_challenge_api_invokes for My Entry history, idempotent retries, and admin dry-run testing. For the Season 2 Kite Agentic Wallet side event, CREAO may query a Base-chain RPC endpoint with your confirmed Base wallet address and submitted transaction hash to verify deposit balance and that the transaction succeeded and originated from that wallet; CREAO stores the resulting verification metadata (not a private key) in s2_trading_challenge_kite_side_events. CREAO does not store your raw WEEX API key, secret, passphrase, or debot developer API credentials (DEBOT_API_KEY / DEBOT_API_SECRET) in the campaign database, and never collects a wallet private key for debot-backed campaigns or for the Kite side event. During the audit phase, authorized campaign admins may export campaign credentials from the secrets store to verify trading history; these exports are logged as administrative actions
Scheduled-run result delivery — when you enable “Email me a summary” on a scheduled agent app, CREAO sends a summary email after each run. We store the email delivery record in schedule_email_deliveries (schedule ID, run status, delivery outcome, and timestamp). These records are deleted automatically after 30 days by a nightly cron. The delivery setting is off by default and can be changed at any time from the schedule settings
Scheduled-run reconnect warnings — when a scheduled agent run cannot use one of your connectors because the connection’s authorization has failed, CREAO records which connection it was so it can ask you to reconnect it: the connection’s internal ID, the provider (for example Google Sheets), how the failure was detected, and the time of the run. This is stored with the run (app_sessions.warnings) and its schedule (app_schedules.last_run_warnings), plus one record per failure period in connector_warning_episodes (your user ID, the connection ID and provider, the last run and schedule IDs, and when the failure was first and last seen and when it was resolved). No connector account name, email address, third-party account ID, token or connector content is stored, and these warnings are shown only to you, not to other members of a shared agent or to team owners. See Data Retention for how long they are kept
In-app notifications — when an agent run you started reaches a notifiable state (chat and workflow completions, awaiting your input, run failures, a workflow approval pending, running out of credits, an action awaiting approval, or an organization invite), CREAO stores an in-app notification inbox row in notifications. Each row holds the notification reason, the related thread / agent-app / session identifiers, a stable i18n key plus structured parameters used to render the localized message, and its read state. To render the inbox, the row also stores the related names: the chat thread’s title (which for an ordinary chat thread defaults to the start of your first message, truncated to 100 characters), agent app name, organization name, and for team rooms the room name and the sender’s name. No message text or generated output is stored. In-app notifications always show these names; the Settings → General “Show names in push notifications” toggle, off by default, controls only whether they appear in the push body sent to Apple (see the Apple/APNs row below). Repeated team-room messages are merged into one row per room until you read it. A sender’s name in your notification is a copy of the display name shown to you at the time; it stays in your notification rows (until they are deleted with your account) even if the sender later deletes theirs. Account-level and per-schedule controls let you decide whether completion notifications are eligible for delivery. Notification rows are deleted when your account is deleted
Event bus records — when a chat run or a scheduled agent run fails, or a timer of one of your agent triggers fires, CREAO stores an event in events (the event type, a subject such as the thread or run session identifier, your user id as the owner, and the actor that caused it), a small payload in event_payloads holding only identifiers (thread, run, agent app, session and schedule ids, plus the run’s notification preference) — never message text or generated output — except that a fired agent-trigger timer’s event also carries that timer’s note and payload, and an email that fires an Outlook agent trigger carries that email’s sender, recipients, subject, first 255 characters, flags and attachment names and sizes (see Agent triggers below), a routing checkpoint in event_routing, and one delivery record per matching subscription in event_deliveries. Your event subscriptions (which event types you receive, stored in event_subscriptions) hold your user id and the subscription state. These rows drive the in-app notification described above and the agent triggers described below, and nothing else. Events and everything that hangs off them are deleted after 30 days, and all event-bus rows are deleted when your account is deleted
Agent triggers — when you (or an agent acting on your request) set up a trigger that runs one of your agents from a timer or from new emails in your connected Outlook mailbox, CREAO stores the trigger in agent_triggers (your user id, the organization of the target agent, the agent, the trigger’s name and kind, the constants you gave the decision script as params, and where the script lives), the decision script itself as a small JavaScript file in your private storage (never in a database column and never in the analytics warehouse), each timer in agent_trigger_timers (the item it belongs to, its note and payload, when it fires), and one record per fired event in agent_trigger_runs (the script’s decision, its reason, the validated inputs it chose for the run, and the run started). For an Outlook email trigger, CREAO also stores in connector_triggers your user id and team, the Outlook connection it watches, the folders it watches, the sender addresses or domains you allowed, an encrypted key used to verify deliveries, and counts of filtered and over-limit emails. Our connector provider Pipedream watches the mailbox and sends each new email to CREAO; CREAO keeps only the sender, recipients, subject, first 255 characters, flags and attachment names and sizes, and never stores the email body or attachment contents. An email from a sender on your list starts the agent, except that the first email from each address or domain on the list waits for your approval once; emails from anyone else are discarded without being stored. If you allowed no senders, no email starts a run until you approve it, and the request expires after 24 hours. While a run waits, CREAO sends you an approval notification that names the trigger, the agent and the sender’s address; on a phone’s lock screen those names are hidden unless you have chosen to show names in notifications. Approving or denying is recorded on the run. The script runs in an isolated interpreter with no network or file access and sees only the event, your params, and the target agent’s input fields. Only you can see or change your triggers; the runs they start appear in the agent’s run list like any run you start. params, timer notes and payloads, run reasons and inputs are excluded from the analytics warehouse. See Data Retention for how long these are kept
Push device registration — if you enable push notifications on the CREAO mobile app, CREAO stores one row per device in push_devices so it can deliver notifications to that device. Each row holds the device push token (an opaque delivery credential issued by the platform’s push service, treated as a secret — never displayed back to you and never written to logs in raw form), the device platform, the delivery environment, the app version and device locale captured at registration (used to localize push copy), and lifecycle timestamps (first registered, last seen, and a disabled marker). No message content is stored. You can remove a device at any time by disabling push notifications or signing out; device rows are hard-deleted when your account is deleted
iOS in-app consent acknowledgements — on the iOS and iPadOS App Store app only, CREAO stores device-local flags in browser local storage when you accept the Privacy and Personal Information Protection Agreement (before sign-in) and when you acknowledge the third-party AI processing disclosure (after sign-in, keyed to your account on that device). These flags record only that you agreed — not message content — and are not synced to CREAO servers. They are cleared when you uninstall the app or clear the app’s site data
Team-collaboration attribution — when you and other members work in the same organization, CREAO stores the user identifier of the team member who sent each message, uploaded each file, or performed each tracked action so collaborators can see each other’s display name and email next to those entries (in chat, shared files, and the organization activity log) and know who did what. This attribution is visible only to other members of the same organization — never to users outside the org or to anonymous visitors of a shared link. Any member of the organization can PUBLISH an agent they created to the whole organization, making its configuration visible and runnable by every other member — publishing is treated as ordinary collaboration and is not restricted to owners or admins. (Connecting a new data source is restricted: that stays with organization owners and admins.) For a shared agent app, sharing covers only the agent’s configuration: each member’s own runs, generated outputs, and pending action approvals are private to that member and are not visible to other members (including the agent’s creator). CREAO does show members with access to a shared agent aggregate, non-identifying usage counts — for example the agent’s total run count and how many runs were by members other than the creator — derived from run records without exposing any individual member’s runs, prompts, outputs, or identity. Publishing, unpublishing, changing a shared object’s team role, and co-editing saves are attributed team activity, visible to the organization with the acting member’s name like the other tracked actions above. Any member of the organization can schedule a shared agent app to run on a recurring basis; a schedule a member creates is owned by and billed to that member, and its runs and outputs are private to them under the same per-member rule. Editing, pausing, or deleting a schedule is limited to the member who created that schedule — not the agent’s creator or the organization owner. All members can view the agent’s schedules read-only, including each schedule’s configuration and the name and email of the member who created it. Per-agent access delegation — an agent’s owner (its creator) or an organization owner/admin can grant another member of the same organization a role on a specific agent: manager (edit and delete the agent’s configuration), editor (edit its configuration, without delete or grant rights), or viewer (run it). When publishing, the creator also picks the default role every organization member receives on that shared agent — viewer or editor. CREAO stores one row per grant recording the agent, the member granted, the role, and who granted it, so the access list can be reviewed and audited. A grant can only be given to a current member of that organization, and it stops conferring access the moment that person leaves the organization — their grants are also purged during removal. Organization owners and admins hold full permission over every agent in their organization regardless of who created it. Converting a shared agent back to personal withdraws all delegated access
Team rooms and scheduled room messages — in a team room, CREAO stores the messages, files, mentions and membership of the room so its members (and the organization’s owners and admins) can read and search them. A room member can schedule a message to be posted to the room later, once or on a recurring cadence; CREAO stores the scheduled message’s text, its schedule and timezone, and who created it, and posts it as that member at each scheduled time, marked as scheduled in the room. A room agent can set up such a schedule only when one member asks it to directly, and the message then posts as that member. In the same way, the room assistant can create a saved agent only when one member asks it to directly: the agent is created in that member’s own account and is private to them, it can contain what was said in the room, and the room shows a note naming the agent and the member it was created for. Only the member who created a scheduled message can edit it; they and the room’s managers can pause or delete it. Scheduled message text is not exported to our analytics warehouse. Room members can also save shortcuts, named message templates sent by typing /name: CREAO stores each shortcut’s name, description and message text, who created it and who last edited it, and, when an agent made it, which agent did so for which member. Any member who can post in the room can create, edit or delete any shortcut, and every change posts a message in the room naming who made it. A message sent with a shortcut is posted as the member who sent it and records the shortcut’s id and name at the time. A shortcut is kept until a room member deletes it; an archived room keeps its shortcuts. Its text and description are not exported to our analytics warehouse (see Data Retention). A room’s agents can be given access to a team shared folder: an agent a member added uses that member’s own access, and the room assistant uses the access of the room manager who chose the folder; either reaches only files that person can open inside the folder, and anyone in the room can read those files through the agent. While the room assistant has a folder it may edit, each file posted in the room is also saved as a team file in the assistant’s own folder inside it, where that folder’s sharing applies; deleting the message deletes that copy unless someone has since moved or edited it.
Organization invite emails — when an organization admin invites a new member, CREAO stores the invitee’s email address in org_invites to deliver the invitation and track its status (pending, accepted, or revoked). The invitee may or may not have an existing CREAO account. If the invitee signs up with that email, the invite is accepted automatically and they join the organization as an organization-only account (no personal workspace). Invites created under the retired per-seat team plan may also carry a link to the seat they reserved (seat_id); CREAO no longer reserves seats or writes that link. Invite records are deleted when the invitation is revoked by an admin, when the organization is deleted (FK cascade), or when the invite expires. Accepted invites retain the email for audit purposes until the organization is deleted
Team logo — an organization owner or manager can upload one image (PNG, JPEG, WebP, or SVG, up to 5 MB) to represent the team. CREAO stores the image bytes as a single object in its private S3 upload bucket under an organizations/{organization id}/branding/ key whose final segment is random and server-generated, and keeps that key on the organization record (organizations.logo_key). The logo is shown to every member of that organization (home screen, team switcher, team settings) and is delivered through the same unguessable-key image CDN or short-lived presigned URL pattern as other stored images; it is never listed publicly and contains no data about an individual. Replacing the logo writes a new object and deletes the previous one; removing it clears the key and deletes the object. The logo is deleted with the organization
Action approvals — when an agent or chat session proposes a guarded write through a connector (email, social media, messaging, etc.), CREAO stores the proposed action payload (for example tweet text, email subject, or message content), validation results, approval status, approver/rejector audit metadata, and apply result so you can review, approve, reject, retry, and audit external actions. This applies to both Agent App sessions and regular chat threads
Workflow orchestration data — when a dynamic workflow is staged (via the /workflow command, or when the agent proposes one in ordinary chat) and you approve it, CREAO stores approved workflow definitions (name, description, and JSON task spec), workflow run and task execution records (status, task prompts, summaries, parent-thread artifact copies, and per-task cost), and append-only progress events so the host can schedule, pause, resume, cancel, retry, and audit the workflow
Slide deck generation data — when you use the /slide command, the agent authors the deck itself as a set of HTML files (slide markup, theme stylesheets, and any images it generates or you provide). CREAO validates and sanitizes that bundle server-side and then stores it: each accepted version is written to encrypted object storage as a content-addressed archive, and a database record keeps the deck’s title, its version number, and a reference to that archive. Asking the agent to change a deck creates a new version rather than replacing the old one, and earlier versions and their archives are retained. The rendered PDF, PPTX, per-slide images, and HTML preview are saved to your thread’s encrypted file storage and retained under the same policy as other generated files and conversation data. Deleting a thread does not remove that thread’s stored deck versions or their archives; deleting your account removes them, along with the rendered outputs, within 30 days — see Data Retention
Agent Store engagement — when you interact with agents in the public Agent Store, CREAO stores your likes, bookmarks, shares, written reviews (with star rating), and view impressions. View impressions include your account ID when you are signed in and a SHA-256 hash of your IP address (truncated to 16 hex chars) for deduplication only — no raw IP, user agent, or precise geolocation is stored.
Discover Skills install activity — when you install a community-recommended skill from Discover Skills, CREAO records the Discover Skills entry and your user ID so we can keep install counts accurate and avoid double-counting repeat installs
Discover agent run activity — when you run an ordinary agent copied from a Discover/store listing in chat, CREAO records your user ID, the agent and original listing IDs, run and thread identifiers, version identifiers when known, start and end times, the observed outcome, and whether the run began through Discover Try or a manual action when known. A Try event identifier may link the run to your Discover interaction. We use this metadata to understand completion and repeat use and improve Discover. These records do not include your prompts, responses, or generated file contents
Suggested agent execution activity — for agents built from personalized suggestions, CREAO records the agent, suggestion owner and executing account identifiers, execution/thread/schedule identifiers, trigger type, start/end times and observed outcome for ordinary web and scheduled runs. We use these records to understand completion and repeat use. They contain no prompts, responses, memory contents or generated outputs.
Account-level Agent Brain skills — when you install or author a custom skill on agent.creao.ai/skills or through CREAO CLI (/v1/skills), CREAO stores the skill name, description, SKILL.md content, optional supporting files, source URL, tags, and timestamps in custom_skills. Which skills are enabled for your account is stored in users.builder_options.enabledSkillIds. Disabling a skill removes it from that enabled list and unmounts its files from the sandbox; it does not delete the skill. If you belong to an organization, you can publish a custom skill to your team: its name, description, SKILL.md content, and supporting files become visible to the organization’s members, who can enable it for their own runs (enabling copies the skill’s files into that member’s private workspace storage) and, when holding the editor role, edit it. Every save is stored as a version attributed to its author so the history can be reviewed and restored, and members with access see the aggregate number of members who have enabled the skill. Unpublishing withdraws access and removes the copies from members’ storage. Custom-skill rows, their version history, and the enablement list are deleted when your account is deleted
LLM transaction forensics — when the super agent calls a large language model on your behalf, CREAO stores per-request invocation metadata for billing accuracy and abuse prevention: source IP address (from cf-connecting-ip), user agent, country code, Cloudflare edge-location code (cf.colo), provider name and request path, token counts, cache status, JWT issued-at and age, upstream response identifier, run-history thread identifier (internal UUID), and the per-request cost in USD. This data is written to credit_deduction_logs (one row per LLM call) and is retained alongside other billing records. Rows are also written for model calls CREAO makes for you but does not charge to your account (for example memory extraction, embeddings, and follow-up suggestions); those rows carry the same metadata and cost but zero credits, and exist so every call the provider invoices can be reconciled. It is used to spot stolen sandbox credentials, replay attacks, and runaway agent loops, and to reconcile our spend against upstream provider invoices
Usage-cap counters — to enforce the per-plan limits on how much you can spend and how many images or videos you can generate over rolling windows (1 hour to 30 days), CREAO keeps a small hourly tally per account in user_usage_hourly: your user identifier, which kind of usage it counts (overall credit spend, image generations, or video generations), the UTC hour, and a running total for that hour. It is derived from charges already recorded above and holds no per-request detail — no prompt or generated content, no IP address, user agent, model identifier, or thread identifier. Rows older than 31 days are deleted hourly by a cron job, and all rows for an account are removed when the account is deleted
Connected-database configuration — for enterprise organizations that connect their own database (Bring Your Own Data), CREAO stores the encrypted connection credentials and the database/schema names the workspace admin chose to expose. Credentials are encrypted under a dedicated key separate from the one used for user-uploaded secrets so the two rotation lifecycles stay independent. Connection records are hard-deleted immediately when an admin disconnects the source and cascade on organization deletion
Connected-cloud configuration — when you connect your own AWS account (Bring Your Own Cloud) so the agent can read observability data or provision infrastructure on your behalf, CREAO stores non-secret references to the connection: the cloud provider, a display name, the AWS account ID, the cross-account IAM role ARN you paste back after deploying our CloudFormation stack, the region the tools run against, and the grant tier (readonly for debugging or deploy for provisioning). The only secret in this record is a per-connection ExternalId, which CREAO generates and stores encrypted (AES-256-GCM, under a dedicated key separate from other secrets). No long-lived cloud credentials — no access keys, secrets, or static tokens — are ever stored. Access uses short-lived AWS STS credentials minted on demand via AssumeRole with the ExternalId; those credentials are held only in-process on the host that reads your account and never enter the agent sandbox
Account deletion requests — when you ask to delete your CREAO account, CREAO records the request and how it was handled: its status and timestamps, the IP address it was made from, an email and name snapshot captured at the time of the request, any reason code(s) you optionally select and free-text detail you optionally type when asked why you’re leaving, and any notes an administrator adds while actioning it. This record is stored separately from your account so it can serve as evidence that the request was received and carried out. See Data Retention for how long it is kept
Rate-limit abuse events — when a request is rejected for exceeding a rate limit (HTTP 429), CREAO records a sampled event used to detect scans and brute-force abuse: the time, the endpoint path and HTTP method, the source IP address, an allowlist of non-sensitive request headers (user agent, referer, origin, forwarded-for, accept-language), the limiter bucket, and a size-capped, secret-redacted excerpt of the request body. Body capture is skipped entirely for authentication, billing, credit, secret, token, payment, and login routes, and recording is sampled to at most one event per actor per endpoint per minute. This is written to rate_limit_violations. See Data Retention for how long it is kept
Job applications (CREAO Careers) — when you apply for a role on careers.creao.ai, CREAO collects what the application form asks for: your name, email address, any links you supply (portfolio, GitHub, LinkedIn), your answers to the role’s free-text questions, and — if you attach one — your CV/resume file. The file itself is stored in CREAO’s private S3 upload bucket under a careers/applications/ key derived from a random application identifier; CREAO also records its original filename, MIME type, size, and a content hash (used to recognise the same CV submitted to more than one role). If you were signed in to a CREAO account when you applied, the application is linked to that account ID so you can see your own submissions under My Applications; applying does not require an account. Applications are readable only by CREAO recruiting staff on an allowlisted internal admin surface, and CVs are never exposed on a public URL. Staff may also record an application’s hiring status and interview round, and may link two applications that share a candidate’s email addresses so duplicate submissions are recognised as one person
Job-alert subscriptions (CREAO Careers) — if you ask to be notified about new roles, CREAO stores the email address you give, the scope you chose (this role, this category, or all new roles), and the job or category the request came from, so it can email you when a matching role is published. This is a standalone subscription record — it does not require or create a CREAO account. Ask us at support@creao.ai to remove it
Paired devices (CREAO Connect) — when you pair your own computer or server with CREAO so the agent can run local capabilities on it, CREAO stores a device row: a user-chosen device name, platform, a hashed/preview form of the device’s access token, the merged list of capabilities (and MCP tool schemas) the device advertises, status (active/revoked), pause (“do not disturb”) state, and presence timestamps (last seen, last graceful disconnect). Each successful connect also records the source IP address and a derived geolocation string, used for new-location/takeover detection on the pairing UI. A capability task is stored durably so it can continue without keeping a chat request open: the task record contains device/user/thread identifiers, capability name, status, progress, deadlines and timestamps, while a separate cloud-only payload record contains the arguments sent to the device and its bounded result. Raw arguments and results are excluded from CREAO’s analytics warehouse; only bounded task metadata is mirrored there. When remote approval is available for your account, a consent prompt your device raises for a task is also mirrored to CREAO so you can answer it on the web or the phone app: the capability, the target tool or worker, the caller, and the argument preview the Mac prompt shows (up to 500 characters, which can include a shell command, file path or other text the agent supplied). Mirrored prompts and their answers are stored in the same cloud-only payload record and are likewise excluded from the analytics warehouse. The “approval needed” push and in-app notification names the device and the tool or worker being asked about, never the argument preview, and its inbox row is deleted once the prompt is answered, expires or is cancelled. When a device capability result is too large to return inline, CREAO temporarily stores the result in an encrypted, per-device-scoped S3 object (device_attachments binding row) addressed by a short-lived signed URL. That URL is resolved by the agent’s own sandbox process, which downloads the bytes to a temporary path inside that sandbox and shows the model only the local file path — the signed URL is never placed in the model’s context, including in error messages. The same channel runs in reverse when the agent sends a file to your device: the bytes are uploaded from the agent’s sandbox to a per-device-scoped S3 object under a separate uploads/ prefix, and the capability task carries only that object’s identifier, never the file contents. Your device exchanges that identifier for a short-lived signed URL and downloads the bytes itself, and only when the task it belongs to actually refers to that identifier. Device, task, payload and attachment-binding rows are deleted when your account is deleted, or immediately when you revoke the device; the stored attachment object itself also expires automatically (see Data Retention). Separately, if you use the paste-to-configure flow for MCP servers in the desktop app, the setup text you paste is sent to Claude Haiku to be read — see AI & Model Usage for what that means and what is not kept When a task is delegated to a vision-capable Local Worker, such as the desktop operator that drives native Mac apps, screenshots of the app windows it works in are sent through CREAO’s gateway to the model provider for that task — see AI & Model Usage. Those screenshots can show anything visible in those windows, including private messages and documents. The worker’s session (its transcript and screenshots) is kept only on your Mac so the agent can continue it with a follow-up, which can resend recent screenshots; CREAO does not store it (see Data Retention).
Curated MCP install activity (CREAO Connect) — when you open a curated MCP server in Connect, CREAO stores a short-lived install handoff linked to your account, the catalog entry, its status, and (after redemption) the paired device that continued the install. CREAO also records the bounded outcome of each wizard step — entry and revision identifiers, device and account identifiers, step and outcome, duration, and closed failure fields such as a macOS permission kind, script exit code, or rejection code. These records contain no values you type into server settings and no free-text error messages. The handoff’s bearer-token hash is excluded from the analytics warehouse; the remaining handoff fields and the step outcomes are mirrored there to measure where curated installs stop. Source rows are removed when your account is deleted, and the warehouse mirror follows that source deletion through replication; otherwise the rows are eligible for the cleanup described in Data Retention

We do not sell your data to third parties.

CREAO is designed with GDPR principles in mind: - Lawful basis — we process data based on contractual necessity (to provide the service), legitimate interest (to improve the product and measure advertising performance where permitted), and consent where required for advertising cookies, Google Ads enhanced conversions, Meta Pixel / Conversions API, and similar marketing measurement - Data minimization — we collect only what is needed to deliver the service - Right to access — you can export your data at any time - Right to deletion — you can delete your CREAO account and its associated data (agent.creao.ai and CLI); a limited audit record of the deletion request itself (request metadata, an email snapshot, and any administrator handling notes) may be retained where required for legal, compliance, and security purposes, as described in Data Retention. A Developer Platform account, if you created one by signing in at developer.creao.ai, is a separate product account linked to that CREAO account. Deleting the CREAO account does not delete the Developer wallet or projects; request that erasure at privacy@creao.ai until a self-serve Developer close-account flow is available - Right to portability — conversation and file data can be exported in standard formats

Data processing — see the Subprocessors section below for a list of third parties that process data on our behalf - International transfers — user data is stored in the United States. For EU users, data transfers are governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Chapter V. Some AI providers process generation requests outside the US (for example, BytePlus seedance / seedream uses Singapore-region endpoints; Claude inference, Gemini conversation, image-generation and text-to-speech requests, and Veo video generation via Google Vertex AI may be processed in any Google Cloud region worldwide when using Vertex’s global endpoint; and Fugu Ultra via Sakana AI may be processed by Sakana AI and the external LLM providers it orchestrates). Apple processes Sign in with Apple authentication on Apple’s own servers in the United States. Transfers to these processors are likewise governed by SCCs or equivalent transfer mechanisms where applicable. Apple publishes a Data Processing Addendum covering its developer APIs. Sakana’s public Fugu terms state that the service is provided outside the EEA, UK, and Switzerland, so EEA, UK, and Swiss use of Fugu Ultra requires confirmed DPA and transfer terms before the model is enabled for those regions - Data Processing Agreement — enterprise customers can request a DPA by contacting privacy@creao.ai

CCPA compliance

For California residents, CREAO provides: - Right to know — what personal information we collect and how it is used - Right to delete — request deletion of your personal information - Right to opt-out — we do not sell personal information, and you may opt out of sharing for cross-context behavioral advertising. CREAO honors browser Global Privacy Control signals by disabling Google advertising user-data and personalization consent and by not sending email match data for Google Ads enhanced conversions - Non- discrimination — exercising your rights does not affect pricing or service quality

CREAO uses cookies required for authentication, session management, security, and signup attribution. CREAO may set first-touch attribution cookies on .creao.ai containing encoded UTM/referrer information (for example, campaign parameters, click IDs including Impact’s IM_REF, referring site, and landing path) so the signup can be attributed after moving between CREAO subdomains. When Google Analytics or Google Ads conversion measurement is enabled, Google may set _ga and _ga_* cookies on CREAO domains to distinguish browsers and sessions for analytics and conversion measurement, and _gcl_* conversion-linker cookies to attribute ad clicks to conversions; CREAO reads the _ga client identifier and, on agent run requests where a live session is active, the _ga_<container> session identifier, to stitch server-side analytics events into the originating browser session so they inherit the real traffic source. When Meta Pixel measurement is enabled, Meta may set _fbp (browser identifier) and _fbc (click identifier) cookies on CREAO domains; CREAO reads these cookies and may forward them server-side to Meta’s Conversions API for attribution matching. If your browser sends Global Privacy Control, CREAO denies Google advertising user-data and personalization consent and does not send email match data for enhanced conversions. Public shared-thread and agent-install pages may also capture the page owner’s affiliate handle or referral code using first-party browser storage (creao_aff cookie for affiliate handles, localStorage for referral codes) so signup and install flows can credit the right creator; for Impact.com campaigns, this same first-party attribution path may retain the Impact click ID long enough to attribute sign-up and paid-conversion events. These owner-attribution entries are first-party, same-domain, attribution-only storage and are not cross-site tracking cookies. During OAuth sign-in, CREAO may also set a 5-minute creao_attribution cookie carrying the same type of information so attribution survives the redirect, and a 10-minute HttpOnly creao_visitor_id cookie carrying the per-device identifier used by our abuse-detection system; this identifier is already sent as a request header during non-OAuth sign-in, and the cookie exists solely to carry it across the OAuth provider redirect, where custom headers cannot be attached. A new CREAO account starts with the standard free workspace and its own team, which CREAO names from the first name or email prefix you sign up with (you can rename it at any time); an account created by accepting a team invite joins the inviter’s team instead. (A retired team-plan sign-up flow previously set a one-hour creao_signup_intent cookie; CREAO no longer sets or reads it, and any leftover copy has expired on its own.) When you open a hackathon signup link, CREAO sets a 24-hour creao_hackathon cookie whose only value is the hackathon’s short name (for example calhacks13); it carries no identifier, is cleared once you sign in, and only tells the sign-up step which hackathon offer to apply. When customer.io in-app messaging is enabled, customer.io’s browser SDK stores a visitor identifier and message-display state (for example, which in-app messages you have already seen or dismissed) in first-party cookies and browser storage on CREAO domains, so a message is not shown to you repeatedly; signing out clears the identity it has stored. We use Cloudflare Turnstile for bot protection, which is a privacy-preserving alternative to traditional CAPTCHAs and does not use tracking cookies.

In-app privacy notices (iOS App Store)

The CREAO iOS and iPadOS app distributed via the Apple App Store shows additional in-product privacy notices that do not appear on web, Android, or the standalone desktop app:

Before sign-in — you must review and accept CREAO’s Privacy and Personal Information Protection Agreement (a snapshot of the policy at https://creao.ai/terms/privacy, effective July 09, 2026) before creating an account or signing in. Acceptance is stored on the device in browser local storage and is not tied to a specific account.
After sign-in, before AI features — you are shown a short disclosure that messages, files, and other content you provide may be sent to third-party AI providers (such as Anthropic and OpenAI) for processing, with a link to review Section 5.9 (AI Service Provider Data Sharing) of the in-app policy. You must acknowledge this disclosure before using AI features; acknowledgement is stored per account on the device in browser local storage.
Settings → Privacy — you can reopen the full in-app policy at any time, including the AI Service Provider Data Sharing section.

These flows satisfy Apple’s App Store requirements for explicit disclosure and consent on iOS. They do not change what data CREAO collects, which subprocessors receive it, or how it is retained beyond what is described in this Privacy page.

AI & Model Usage

In an organization chat, the agent can work with team files within your permissions, including reading, editing, creating, and managing sharing. File contents and tool results enter the selected model provider’s context. To resolve sharing recipients, the agent can retrieve organization members’ names and email addresses; these results also enter model context. On the iOS and iPadOS App Store app, CREAO shows an explicit third-party AI processing disclosure after sign-in and blocks AI features until you acknowledge it. The disclosure states that messages, files, and other content you provide may be sent to third-party AI providers (such as Anthropic and OpenAI) for processing, and links to Section 5.9 (AI Service Provider Data Sharing) of the in-app Privacy and Personal Information Protection Agreement. This gate does not change which providers receive data or how it is used — it ensures you see that disclosure before your first AI request on iOS. Web, Android, and standalone desktop users accept equivalent terms through other product surfaces and do not see this additional gate. If a chat model declines a request, CREAO may retry it once using the model currently assigned to Lite. The retry sends conversation context and supported attachments to Lite’s serving providers, which may differ from the providers for your original selection. The default Lite route is described below. The chat shows a switch notice and selects Lite for follow-up messages in that chat; you can choose another model at any time. If you delegate a task to a vision-capable Local Worker on a paired Mac, screenshots of the native app windows the worker operates in (for example Mail, Notes or Messages) are sent through CREAO’s device model proxy to the Lite vision model’s serving providers, together with the task instructions. Delegate tasks only in apps whose visible content you are comfortable sending to those providers. When the agent asks a finished Local Worker a follow-up, the worker continues its earlier session, which is stored on your Mac: together with the new task, that session’s text history and up to its 4 most recent screenshots can be sent again to the Lite vision model’s serving providers. Worker sessions, including their screenshots, stay in the CREAO Connect state directory on your Mac and are not uploaded to CREAO; only the worker’s reply returns to the agent. Connect’s run retention removes them (see Data Retention).

Most CREAO model-provider API paths do not use your data to train AI models. Conversations and files sent to Anthropic, OpenAI, Google, MiniMax, Z.AI, Moonshot AI, Thinking Machines, Fireworks AI, Meta, and BytePlus are processed under API agreements or provider API terms that prohibit use of your data for model training. MiniMax M3 conversation requests are served by Fireworks AI directly under CREAO’s own Fireworks account; Fireworks’ API terms prohibit use of your data for model training. If Fireworks returns a capacity error (a rate limit or transient server error), the request is automatically retried once via OpenRouter and served by DeepInfra, Novita, or Together AI — that fallback path is governed by CREAO’s API agreement with OpenRouter, whose API terms prohibit training use. MiniMax M3.1 Flash takes a different path: it is sent directly to MiniMax under CREAO’s own MiniMax API agreement, so conversation content for it — including any image attached to a MiniMax M3.1 Flash conversation — reaches MiniMax and no relay. Internal response-quality evaluations use a separately selected model and provider, defaulting to MiniMax M3 through OpenRouter; MiniMax’s own API remains an alternative. The selected provider’s API terms described here also apply to evaluation requests. Moonshot AI models are reached via OpenRouter — CREAO’s API agreement for that provider is with OpenRouter, whose API terms prohibit training use. Kimi K3 is served by Fireworks AI under CREAO’s own Fireworks account, and it accepts images: an image attached to a Kimi K3 conversation is sent to OpenRouter and Fireworks as part of the request. The two GLM models take different paths: GLM 5.2 is reached via OpenRouter and served by Fireworks AI under CREAO’s own Fireworks account, while GLM 5.3 and GLM 5.3 Flash are sent directly to Z.AI under CREAO’s own Z.AI API agreement, whose terms prohibit training use — so conversation content for the GLM 5.3 models reaches Z.AI and no other company, not even a relay. CREAO can move either onto the OpenRouter path as a fallback (for example during a Z.AI outage), in which case OpenRouter relays the request and Z.AI still performs the inference, as it is the only host OpenRouter offers for those models. Of the GLM models, only GLM 5.3 Flash accepts images: an image attached to a GLM 5.3 Flash conversation is sent to Z.AI as part of the request. GLM 5.2 and GLM 5.3 are text-only, so an image attached to those is described by CREAO’s own analyze_image step instead and never reaches Z.AI as image bytes. Thinking Machines’ Inkling is reached via OpenRouter, whose API terms prohibit training use. DeepSeek V4.1 Flash is served by default through OpenRouter, with Fireworks AI preferred under CREAO’s Fireworks account. Conversation messages, context, and attached images are sent to OpenRouter and the serving inference host. If Fireworks cannot serve a request, OpenRouter may use another available host for the same model: GMICloud, Novita, DeepInfra, Parasail, Morph, or io.net. DeepSeek’s own API endpoint is excluded from CREAO’s Flash routing, so DeepSeek itself does not receive this content. OpenRouter and Fireworks API terms prohibit use of this data for model training. This is the default Flash model used by the Lite tier and default agents; selecting Flash does not keep conversation content exclusively on CREAO systems. Background Agent Brain curation and periodic thread-note checkpoints using this Flash selection follow the same default route, independently of the model selected for chat.CREAO also retains an explicitly selected legacy DeepSeek V4 Flash route on CREAO-managed inference servers hosted on Nebius. This is not the default Flash route. Legacy self-hosted requests may fall back to OpenRouter hosts serving the same V4 checkpoint after a capacity or availability error, with Fireworks preferred and DeepSeek’s own API excluded. A corrupted stream may also be regenerated on the same self-hosted infrastructure.DeepSeek V4 Pro is a different arrangement, and the difference matters. CREAO does not self-host DeepSeek V4 Pro. Conversation requests for this model are relayed via OpenRouter and served either by DeepSeek’s own API (the preferred host) or, as a fallback, by GMICloud — so conversation content for DeepSeek V4 Pro is sent to DeepSeek, and may be sent to GMICloud. Both paths are governed by CREAO’s API agreement with OpenRouter together with the serving provider’s own API terms, which prohibit use of your data for model training. Flash excludes DeepSeek’s own API, but its default route still sends conversation content to external inference hosts.Requests relayed through OpenRouter may also be served by Fireworks AI under CREAO’s own Fireworks account (currently GLM 5.2 and Kimi K3, and potentially other OpenRouter-routed open models); Fireworks’ API terms prohibit use of your data for model training, and Fireworks states it does not log or store prompt or generation data for open models by default.Muse Spark is reached directly via the Meta Model API under Meta’s developer API terms, which prohibit use of your content to train Meta’s models; Meta may use aggregated, anonymized service-usage data (not your content) to improve its services. This includes image inputs sent for generation tasks (for example, image-to-video with Veo). Providers may retain data briefly for abuse monitoring and safety as required by their terms, but not for training purposes on these paths.Fugu Ultra via Sakana AI is a qualified exception while governed by Sakana’s public Fugu terms. Those terms may allow submitted content to be used for Sakana training and improvement unless an opt-out or separate no-training/DPA arrangement is in place. Do not select Fugu Ultra for regulated, sensitive, confidential, or personal data unless your workspace has confirmed the required Sakana terms.

How is data sent to AI models?

When you chat with the super agent, your messages and relevant context (files, memory, Dream profile, skill instructions, and — for organizations that have connected their own database — the names of the connected databases and schemas, plus any standing instructions your organization configured for those databases) are sent to the selected LLM provider via their API. All API calls use encrypted connections. Responses are streamed back to your browser in real time.For the separately gated personal-chat feature that answers a question about an uploaded large video, CREAO does not send the full video, a download URL, or storage credentials to the AI provider or the chat sandbox. CREAO verifies that the video is your completed private upload, creates up to five size-bounded visual frame samples plus basic media metadata (duration, dimensions, codec, and whether an audio stream exists), and sends only those samples, metadata, and your focused question through the configured vision-model provider channel. The original video remains in CREAO’s private storage. Temporary host-side source and frame files are deleted after the request; CREAO does not retain a video-analysis cache or transcript for this feature.For the separately gated personal-chat feature that answers a question about an uploaded large image, CREAO does not send the original image, a download URL, or storage credentials to the AI provider or the chat sandbox. CREAO verifies that the image is your completed private upload, creates one size-bounded overview and, when useful, up to four size-bounded detail tiles (only the first frame for an animated GIF), and sends only those derivatives, their dimensions/labels, and your focused question through the configured vision-model provider channel. The original image remains in CREAO’s private storage. Temporary host-side source and derivative files are deleted after the request; CREAO does not retain a large-image-analysis cache or OCR transcript for this feature.For the separately gated personal-chat feature that works with an uploaded large PDF, CREAO copies the PDF into your own chat workspace, where the agent reads it like any other file you attach. It can extract the text of the pages it needs, render selected pages to images, and split, merge, trim, or otherwise edit the file when you ask. CREAO does not send the PDF file itself, a download URL, or storage credentials to the AI provider; only the page text and rendered page images the agent selects for a given question are sent to the model you selected, through the configured AI-model provider channel. Because rendered pages go to a vision model, the agent is instructed to render only the pages a question needs — roughly twenty at most in one turn — and to tell you which pages it read and which it did not. The copy lives in your private workspace storage alongside your other uploads and is removed when you delete the file or your account.Scheduled agent runs use the model selected for that schedule and send the run’s prompt, inputs, and relevant agent context through the same provider channel and under the same provider terms, including the Fugu Ultra exception above.After an agent run completes, CREAO may send a size-bounded excerpt of the run’s request or output to a configured supported LLM to generate the title and summary shown on its run card. This metadata request uses the same encrypted provider channels and provider terms described above.When you approve a dynamic workflow, individual workflow task prompts and scoped task context may be sent to LLM providers as isolated worker or synthesis requests. CREAO stores task summaries and copies generated artifacts into the parent thread’s file store, but worker intermediate transcripts are not inserted back into the parent conversation context.When you use CREAO CLI to create or edit a personal agent from natural-language instructions, that free-text input is sent through the same agent/LLM workflow used by the main CREAO app so the agent definition can be designed and persisted. No additional AI provider or data category is introduced for this path.Connected-database metadata is limited to the source name, type, and the database/schema NAMES that the workspace owner chose to expose. Database row contents are not sent to the LLM unless the agent is explicitly asked to query the data; in that case, the query result rows flow through the same provider channel as the rest of your conversation.When a warehouse-backed answer is produced, CREAO also records a query receipt for that turn: the SQL text the agent ran (truncated), the data source it targeted, how long the query took, the row count, and — on failure — an error code. Receipts are shown to you alongside the answer so the SQL behind a number is inspectable. They are stored with the conversation and are NOT inserted into the model’s context, so they add no new data flow to any LLM provider. Note that the SQL text itself can embed values you asked the agent to filter on.Separately, CREAO staff can review agent-written SQL that FAILED, to find and fix cases where the agent writes queries a database rejects. An internal dashboard, restricted to administrators, shows a rolling window of recently failed statements (truncated to 600 characters) together with the database’s error message. This reads query history the data warehouse itself retains — typically about seven days — rather than a copy CREAO stores, and it covers only statements that errored: a query that ran successfully never appears there. As above, failing SQL can embed values you asked the agent to filter on. Today this surface covers CREAO’s own analytics warehouse; if it is extended to customer-connected databases, this notice will be updated first.When the agent uses a connector tool (X, Gmail, Slack, GitHub, custom MCP servers, etc.), the tool’s response is made available to the agent so it can act on the result — and this includes error responses, not just successful ones. If a connector call fails, the provider’s error message (for example, “this action requires a higher access tier” or “missing required field”) is forwarded to your selected LLM provider so the agent can explain the failure or correct and retry. CREAO applies a best-effort pass to strip credential-shaped tokens from these error messages before they enter the context.Eligible text/JSON tool responses above 32 KiB may instead be saved as private workspace files. In that case, a short preview and file reference are sent to your selected LLM provider, followed by any content the agent selectively retrieves for your task. See Data Retention for how these saved outputs are retained.When the agent retrieves the result of a capability task on your paired CREAO Connect device (including a custom MCP server you configured on that device), the result — arbitrary local output such as command output, file contents, or an MCP tool’s response — is inserted into the agent’s context and forwarded to your selected LLM provider, the same way other tool results are. Starting a background task does not itself send a future result to the model; the result enters model context when the agent checks the completed task. This output is explicitly framed to the model as untrusted, since it originates from code CREAO does not control running on your own machine.For a connected AWS account (Bring Your Own Cloud), the results the agent reads from your account — CloudWatch log events, metric data points, and alarm states — flow into the agent’s context to answer your request. Like other connector data, that means these tool results are sent to your selected LLM provider as part of the conversation context. The agent reads only what the tool you triggered returns; CREAO does not bulk-export or continuously ingest your cloud account.If you install the CREAO Slack Agent App in a Slack workspace, messages that @mention the bot or are sent to it directly are sent to your selected LLM provider as part of the agent’s context, and the agent’s reply is posted back into that Slack thread or DM. See Connector Data Access below for what’s collected, from whom, and how consent works for this feature.Organizations can also configure standing instructions for a connected database — free text (up to 20,000 characters per data source) authored by your own organization’s members, not by CREAO. When that data source is connected to a chat, these instructions are injected verbatim into the agent’s system prompt for every conversation in the organization, so they are forwarded to your selected LLM provider as part of the context window. Organizations can likewise save reusable prompt templates (a name plus a prompt body); a template’s prompt body is only sent to the provider if a member actually inserts it into a message. Both surfaces are editable by any member of the organization.Personal reflection-profile and user-playbook retrieval has been retired in favor of file-based Agent Brain memory. Agent apps continue to use app-specific reflection playbooks: app conversations may be processed by the reflection service to learn playbooks, and relevant saved playbooks are sent to your selected LLM provider during app runs. Access is checked against the app, and shared organization apps use only approved playbooks. Developer API agent-memory operations use this same app-specific store, separate from your personal Agent Brain memory. Room runs with memory disabled do not retrieve or publish reflection memory.Legacy database-memory extraction and Dream profile generation are retired. Existing records remain available for historical access; active profile curation uses file-based Agent Brain memory as described below.For accounts using file-based Agent Brain memory, CREAO queues a background DeepSeek V4.1 Flash review through OpenRouter, preferring Fireworks AI, after a session. The review considers the completed conversation, thread notes, the existing bounded USER.md profile, relevant context files and agent-authored skills; it may rewrite the profile, create or update context files, and create, rewrite, merge, or remove agent-authored skills. Relevant context-file contents, including any third-party personal data they contain, can therefore be sent to the curator’s model provider. A compact context index is included in later conversations, and the conversational agent can read relevant files on demand and include their content in requests to your selected model provider. During long conversations, CREAO also sends recent messages and existing thread notes to DeepSeek V4.1 Flash every ten user turns to refresh concise thread notes. Jobs are retried after transient failures and run independently of the model selected for the conversation. The gateway may use a third-party provider serving the same model when routing or availability requires it, under the DeepSeek processing and fallback terms below.When you request an AI edit to an agent-authored skill file from the Memory view, CREAO sends the complete current selected file—either SKILL.md or a supporting file—and your edit instruction in one request to the default DeepSeek V4.1 Flash OpenRouter path, preferring Fireworks AI, independently of the model selected for chat. The edited file is validated and written back only if the version you opened has not changed in the meantime. This request uses the same encrypted gateway, failover terms, and usage-based credit billing described for DeepSeek V4.1 Flash above.Legacy database-memory search no longer sends candidate memories to Claude Haiku for reranking. File-based Agent Brain memory and app-specific reflection playbooks use the separate retrieval paths described above.When you paste MCP setup instructions into CREAO Connect on a paired device, that text (up to 16 KB) is sent to Claude Haiku to be read into a proposed server configuration. Two things about this are worth stating plainly. First, the text you paste leaves your computer — the desktop app says so above the button, before you click, because setup instructions copied from a vendor page sometimes contain a live API key. Second, the reply is only ever a proposal: it is validated server-side, anything that looks like a credential is blanked before it comes back, and nothing is written to your machine until you tick an individual entry yourself. This adds no new subprocessor (Anthropic is already used above), and CREAO does not store the pasted text — only its length, how many servers were read, and why any were rejected.Separately, a paired CREAO Connect device can send a direct model request — a caller-composed prompt naming any model from CREAO’s existing model catalog — through CREAO’s own gateway to that model’s provider, billed to your account like any other model usage. This capability is off by default for every paired device and only reaches models already disclosed above (including OpenRouter-routed models where the catalog uses that path); no new provider is introduced. CREAO does not persist the request or response bodies sent through this path — only outcome metadata (which model, whether it succeeded, and its status) is recorded.Follow-up suggestion chips shown under an answer are generated by the same LLM provider you selected for the conversation, in a short internal follow-up request the platform makes right after the answer is complete: it asks the same model, with the conversation context it already has plus the names of your saved agents and available integrations, to return the suggestions as structured data. No additional provider or separate platform model is involved, and no extra copy of your conversation is sent anywhere — the request reuses the same session with the same provider (and, like the rest of the turn, is part of its normal usage-based billing). The request and its reply are used only to render the chips and are not kept as part of the conversation history the agent sees on later turns.When a turn creates files, CREAO may make one further internal request to record where each new file came from — for example, that an extended video came from the original clip and its last frame. Three things about this differ from the follow-up chips above and are worth stating plainly. First, it does not use the model you selected for the conversation: it goes to a small Claude model (Anthropic, already listed above), so the request may reach a different provider than the rest of your conversation. Second, it does not send your conversation; it sends only a short summary of what the agent did in that one turn — the commands and tool calls it ran, plus a few selected lines of their output chosen because they look like they name a file. Those excerpts can include fragments of command output. Third, unlike the chips, its reply is stored: the derivation — the source file names and the kind of operation — is saved alongside the file’s own record, is retained and deleted with that file, and is not shown to you or fed back to any model today. This request is not billed to your account and consumes none of your credits.So the agent can answer “can I use this feature?” for your account instead of quoting the public plan descriptions, CREAO includes a short account-capability summary in the agent’s system prompt, which is forwarded to your selected LLM provider like the rest of the context. This summary is deliberately minimal: a set of yes/no flags for capabilities such as scheduled runs, long-running media renders, premium models, longer generated PDFs, and video generation, plus how many scheduled runs or renders may run at the same time. It contains no plan or package name, no prices or amounts, no billing history, no credit balance, and no account identifiers.Personal file memory remains user-scoped; legacy organization memories and Dream profiles are not automatically injected into current runs. For a shared team agent, reflection-derived agent playbooks learned from members’ conversations with that agent may be included when other authorized members run it, once approved for shared use. The agent’s creator can view, approve, reject or delete these playbooks; other organization members with app access can view them.

Which AI providers does CREAO use?

CREAO supports multiple LLM providers:

Anthropic (Claude Fable, Opus, Sonnet, Haiku)
OpenAI (GPT-6 Astra, GPT-6.1 Sol, GPT-6 Sol, GPT-6 Luna, GPT-5.6, GPT-5.5)
Google (Gemini Pro, Gemini Flash; Veo and Gemini Omni Flash for video generation; Gemini Transcribe for speech-to-text voice transcription, where enabled)
MiniMax (MiniMax M3.1 Flash — sent directly to MiniMax under CREAO’s own MiniMax agreement, including attached images; MiniMax M3, whose conversation requests are served by Fireworks AI; the default internal quality evaluations use OpenRouter. MiniMax’s own API can also process evaluations when selected; see the evaluation data categories below.)
Z.AI (GLM 5.3 and GLM 5.3 Flash — sent directly to Z.AI under CREAO’s own Z.AI agreement, and performed by Z.AI; also GLM 5.2, which is relayed via OpenRouter but whose inference is performed by Fireworks AI)
Moonshot AI (Kimi K3, via OpenRouter)
Thinking Machines (Inkling via OpenRouter)
DeepSeek (model publisher; DeepSeek V4.1 Flash is served via OpenRouter, preferring Fireworks AI and excluding DeepSeek’s own API. V4 Pro is served via OpenRouter by DeepSeek’s own API by preference, or GMICloud as a fallback; DeepSeek receives V4 Pro conversation content under its API terms, which prohibit training use)
Fireworks AI (preferred inference host for DeepSeek V4.1 Flash via OpenRouter, including messages, context, and attached images; also serves MiniMax M3 directly, GLM 5.2 via OpenRouter, and internal quality evaluations through OpenRouter when selected, under CREAO’s Fireworks account)
DeepInfra / Novita / Together AI (MiniMax M3 fallback through OpenRouter; DeepInfra and Novita can also serve DeepSeek V4.1 Flash fallback requests, including attached images)
GMICloud (OpenRouter fallback inference for DeepSeek V4 Pro and V4.1 Flash; Flash requests can include attached images)
Parasail / Morph / io.net (OpenRouter fallback inference for DeepSeek V4.1 Flash, including messages, context, and attached images)
Meta (Muse Spark models via the Meta Model API. Muse Spark 1.3 and 1.2 go directly to Meta by default and reach OpenRouter only if CREAO moves them onto that path as a fallback, in which case OpenRouter relays the request and Meta still performs the inference, being the only host OpenRouter offers for those models; Muse Spark 1.1 has no such fallback)
BytePlus (Seedance video generation, Seedream image generation)
Sakana AI (Fugu Ultra model orchestration)

Anthropic, OpenAI, Google, MiniMax, Z.AI (reached directly for GLM 5.3 and GLM 5.3 Flash; reached via OpenRouter and served by Fireworks AI for GLM 5.2), Moonshot AI, and Thinking Machines Inkling, Fireworks AI, OpenRouter-served DeepInfra, Novita, and Together AI (the MiniMax M3 fallback path), OpenRouter-served DeepSeek and GMICloud (the DeepSeek V4 Pro path), Meta (reached directly via the Meta Model API; Muse Spark 1.3 and 1.2 may instead be relayed via OpenRouter as a fallback, still served by Meta), and BytePlus are accessed via API paths with no-training commitments. DeepSeek V4.1 Flash is relayed through OpenRouter by default, preferring Fireworks AI under CREAO’s account. Messages, context, and attached images reach OpenRouter and the serving inference host; other OpenRouter hosts may serve requests if Fireworks is unavailable. Kimi K3 is relayed through OpenRouter and served by Fireworks AI under CREAO’s account; images attached to a Kimi K3 conversation reach both. DeepSeek’s own endpoint is excluded. The explicitly selected legacy V4 selfhost route remains on CREAO-managed Nebius infrastructure, with same-checkpoint OpenRouter fallback. DeepSeek V4 Pro is NOT self-hosted, and is the one path on which DeepSeek itself receives conversation content: it is relayed via OpenRouter and served by DeepSeek’s own API by preference, or by GMICloud as a fallback, under those providers’ API terms, which prohibit training use. Providers may retain data briefly for abuse monitoring and safety per their terms, but not for model training on those paths. Fugu Ultra is accessed through Sakana AI’s orchestration API, whose public Fugu terms may allow content to be used for Sakana training and improvement unless an opt-out or separate no-training/DPA arrangement is in place; the service may also route content to external LLM providers. Do not use Fugu Ultra for regulated, sensitive, confidential, or personal data unless your workspace has confirmed the required Sakana terms. CREAO may also send a sampled subset of completed conversations and assistant responses to MiniMax M3 for internal response-quality evaluation, independent of the model selected for the original conversation. Where a sampled response was given memory entries from your earlier conversations, that evaluation may include the text of those entries so each one can be judged for relevance and effect.For eligible users, some Claude requests may be served through Google Vertex AI or Amazon Bedrock (AWS) rather than Anthropic’s first-party API; in the Amazon Bedrock case, AWS’s Bedrock enterprise terms govern processing and your data is not used for model training. Separately, and for any user rather than an eligible subset, a Claude request that CREAO sends to Anthropic’s first-party API may be automatically retried once on Google Vertex AI — the same Claude model — if the first-party attempt returns a capacity or availability error before any of the response has been produced. This is a reliability failover rather than a routing choice, so it applies per model (the Claude Sonnet, Haiku and Opus versions CREAO has verified on Vertex; Claude Fable is excluded) and not per user.Google models reach Google through Vertex AI by default, for all users, not a subset: Gemini conversation requests, Gemini image generation, Gemini text-to-speech, and Veo video generation are all served through Vertex AI rather than the Gemini API (also called Google AI Studio). The Gemini API remains the fallback for a model Vertex does not serve, and CREAO can move an individual model back to it without a release. If a Veo video generation job encounters a transient provider error during processing, CREAO may retry it on the Gemini API, or automatically retry the job through an alternative provider such as BytePlus Seedance, to complete your request. In the other direction, a BytePlus Seedance video generation job that cannot reach BytePlus, or that BytePlus has not completed within its allotted time, may be automatically retried on Google’s Gemini Omni Flash model — only when Omni can serve the exact same request (same prompt, duration, aspect ratio and resolution; reference audio, video and last-frame inputs are never moved) and your credits cover it. In all Google Vertex AI cases, Google’s Vertex AI enterprise terms govern processing, and your data is not used for model training.

What about code execution?

Code generated by the AI runs in an isolated sandbox. The sandbox has no access to other users’ data, no persistent network access to internal systems, and is destroyed after the session ends. Generated files are stored encrypted and associated only with your account. If you share a thread via the Share feature, files and artifacts within that thread become accessible to anyone with the share link.

Connector Data Access

Connectors provide scoped access to third-party systems (OAuth/API-key based). See Skills and Connectors for the full feature overview and Security for auth model and security controls.

Connector group	Auth mode	Typical data categories	Revocation
Calendly (when enabled)	OAuth through Pipedream Connect, bound to one Calendly user	Your Calendly profile (name, email, time zone, scheduling link) and organization membership; organization members’ names, emails and roles; event types and their booking questions; open booking slots, your busy times (including events on calendars connected to Calendly) and availability schedules; scheduled events and their invitees (names, emails, answers to booking questions, cancel and reschedule links, no-show status). Organization owners and admins can also read other members’ events. Authorized tools can create single-use scheduling links, cancel events (which emails every invitee) and mark or unmark invitees as no-shows. CREAO does not book meetings on anyone’s behalf	Disconnect in CREAO and revoke Pipedream’s access in your Calendly account settings
HighLevel (when enabled)	OAuth through Pipedream Connect, bound to one HighLevel sub-account (location)	Contacts in that sub-account (names, emails, phone numbers, tags, custom fields, source and attribution); businesses; campaigns; opportunity pipelines, stages and opportunities (names, values, statuses, assigned users); calendars, free booking slots and appointments (times, titles, descriptions, meeting locations). Authorized tools can create, update and upsert contacts, add contacts to campaigns (which can start that campaign’s outbound messages), create and update opportunities, and book appointments (which runs the sub-account’s own confirmation automations). CREAO does not expose HighLevel conversations, messaging, payments or billing	Disconnect in CREAO and revoke Pipedream’s access in HighLevel
Square (when enabled)	OAuth through Pipedream Connect, bound to one Square seller	Your seller profile and locations; payments and refunds (amounts, fees, statuses, card brand and last four digits; CREAO removes card fingerprints and BINs); orders and line items; customer profiles (names, emails, phone numbers, addresses, birthdays, notes); catalog items, variations and prices; invoices. Authorized tools can create customers, update customer profiles, create orders, create and update catalog items and prices, create draft invoices and create checkout payment links. CREAO does not take payments, issue refunds, change inventory or send invoices. Pipedream’s Square authorization also grants access no CREAO tool uses (loyalty, subscriptions, bank accounts, settlements, employees and webhooks)	Disconnect in CREAO and remove Pipedream from the connected apps in your Square Dashboard
Todoist (when enabled)	OAuth through Pipedream Connect	Tasks, projects, sections, labels, filters, comments, collaborators and project invitations in your Todoist account. Authorized tools can create, update, complete, move and delete these items, import tasks from CSV and invite people by email. Exported task CSVs are saved to your CREAO files.	Disconnect in CREAO and revoke the Pipedream integration in Todoist settings
LinkedIn (when enabled)	OAuth through Pipedream Connect	Your member profile; organization details and membership/access roles; comments on posts; and text, article links, images, videos, comments, likes, and post identifiers you ask an agent to read or submit. Authorized tools can publish personal or organization posts, create comments and likes, and delete posts your account may delete. Images are transferred from CREAO storage through Pipedream to LinkedIn. For video uploads, CREAO reads your selected video from its storage and sends the video bytes directly to LinkedIn upload URLs; upload initialization, processing-status checks, and publishing requests pass through Pipedream.	Disconnect in CREAO and revoke the Pipedream connection in your LinkedIn account settings
Zoom (when enabled)	OAuth through Pipedream Connect	Your Zoom user profile; meetings and webinars you host (topics, times, agendas, join links and settings), meeting registrants and past-meeting participant lists, webinar participant reports and Q&A; cloud-recording metadata, time-limited recording download links, meeting transcripts and AI Companion meeting summaries; team chat channels and messages you ask an agent to send; account users; and Zoom Phone call logs and call recordings. Participant, registrant and call data can include other people’s names, email addresses and phone numbers. Authorized tools can create, update and delete meetings, update webinars, register attendees, send chat messages, and create or remove account users where your Zoom role permits.	Disconnect in CREAO and remove the Pipedream app under Zoom App Marketplace Manage → Added Apps
Google Workspace (Gmail, Calendar, Docs, Sheets, Drive, Tasks)	OAuth	Mail, calendar events, docs, spreadsheets, files, tasks. Gmail attachments you ask an agent to download are copied into your CREAO conversation files, and up to 100 KB of a text attachment’s content is passed to the agent	Disconnect in CREAO + revoke in Google account if needed
Google Marketing (Ads, Analytics, Search Console)	OAuth	Campaign/reporting and web analytics data	Disconnect in CREAO + revoke in Google account if needed
Meta Ads (Meta Marketing API)	OAuth	Advertising objects in the Meta ad accounts you grant access to: campaigns, ad sets, ad creatives and ads, their budgets, bid strategies, targeting and schedules, plus delivery/performance insights and the ad account’s image library (image hashes, names, dimensions and short-lived preview links). The scopes CREAO requests (`ads_management`, `ads_read`) permit writes — creating and updating campaigns, ad sets and ads, including budget and status changes that can cause ad spend on your account. CREAO also stores your Meta user ID and name for connection display	Disconnect in CREAO (deletes the stored token) + remove CREAO under Meta Settings → Business integrations
Instagram (when enabled)	OAuth through CREAO’s dedicated Instagram Login app	Authorized Business or Creator account profiles, media and active Stories; selected JPEG images, videos, optional Reel cover images and photo/Reel captions sent to Meta for photo, Reel and Story publishing. Meta fetches the selected media through HTTPS URLs. Stories expire on Instagram after 24 hours. CREAO stores a separate encrypted token, granted scopes, expiry, Instagram account ID and username. No Facebook Page is required.	Disconnect Instagram in CREAO to delete its stored token; revoke the dedicated CREAO Social app in Instagram settings to remove the provider-side authorization. Meta Ads uses a separate app.
Microsoft (Outlook, Outlook Calendar, Teams, OneDrive, Word, Excel)	OAuth	Mail, calendar events, collaboration messages, files, documents, workbook data. Outlook tools can also read folder metadata (folder names, item/unread counts) from a shared or delegated mailbox your account has been granted access to — which may belong to another person — subject to the access Microsoft’s OAuth consent grants CREAO. Outlook Calendar is a separate connector from Outlook mail (connecting one does not connect the other) and covers calendar events including subject, location, attendee email addresses and online-meeting join details; free/busy availability for mailboxes you query, which may belong to other people, subject to the access Microsoft’s OAuth consent grants CREAO; and contact/directory lookups for scheduling. Outlook attachments you ask an agent to download are copied into your CREAO conversation files, and up to 100 KB of a text attachment’s content is passed to the agent.	Disconnect in CREAO + revoke in Microsoft account if needed
Dropbox (when enabled)	OAuth through Pipedream Connect	File and folder names, paths, metadata, revisions and shared links in your Dropbox; the content of files, exports, previews and shared-link files you ask an agent to bring into a conversation, which CREAO stores in that conversation’s files; and files you ask an agent to upload, transferred from CREAO storage through Pipedream to Dropbox. Authorized tools can create, move, rename, restore and delete files and folders and create public share links. Temporary download links returned to the agent expire after four hours.	Disconnect in CREAO and revoke the Pipedream app in Dropbox account settings (Connected apps)
Box (when enabled)	OAuth through Pipedream Connect	File and folder names, paths, metadata, text representations and versions; comments; shared links; collaborators’ names and email addresses; Box Sign requests and signer email addresses. Files you ask an agent to download are copied from Box into your CREAO conversation files, and files you ask it to upload are transferred from CREAO storage to Box. Authorized tools can upload files and new versions, create, move and delete folders, share items, add or remove collaborators and send signature requests.	Disconnect in CREAO and revoke the Pipedream app in your Box account settings
Klaviyo (when enabled)	Private API key entered through Pipedream Connect	Customer profiles (email address, phone number, name, location and custom properties), list memberships and read-only consent status; lists, campaigns, flows and metrics; campaign and flow performance statistics, including attributed revenue. Authorized tools can create lists, create or update profiles, and add profiles to lists. CREAO does not create or send campaigns, edit templates or flows, create segments, or change subscription or consent status.	Disconnect in CREAO and delete or rotate the private API key in Klaviyo Settings → API keys
Vercel (when enabled)	Personal access token entered through Pipedream Connect	Projects, deployments and their status, project domains, and deployment build logs (bounded and with secret-like values redacted). Authorized tools can create a deployment from a connected Git repository or cancel a deployment. CREAO does not read environment-variable values or purchase domains.	Disconnect in CREAO and revoke the token in Vercel Account Settings → Tokens
Creative design (Canva)	OAuth	Your Canva profile and design metadata; design content you ask an agent to export; image assets and files you ask an agent to upload or import; and the titles, dimensions, formats, and export settings used for designs the agent creates on your behalf. The Pipedream-managed Canva OAuth profile also grants asset read and brand-template content/metadata read permissions, although CREAO’s current Canva tool allowlist does not expose brand-template tools. Design creation, asset upload, file import, and export-job creation are treated as write actions and require approval under the default Always ask autonomy mode	Disconnect in CREAO + revoke the Pipedream connection in your Canva account settings if needed
Notes (Evernote, when enabled)	Evernote developer token entered through Pipedream Connect	Notebook names, stacks and identifiers; note titles, content, tags, attributes and metadata, including attachment names and types but not attachment files, that you ask an agent to read, create or update. Updating a note replaces its stored title, body, tags or notebook in place, and CREAO first reads the note to keep any title or body you did not ask to change. Creating and updating notes and notebooks require approval under the default Always ask autonomy mode. Pipedream stores the developer token; CREAO does not receive it	Disconnect in CREAO and revoke the developer token with Evernote
Collaboration (Slack, Discord, Notion, Asana, Linear)	OAuth or API key	Messages, channels/pages, tasks/issues/project data	Disconnect in CREAO + revoke in provider account
Developer (GitHub, Webflow)	OAuth	Repository metadata/content, issue/workflow data; CMS collections, site content, and publishing metadata	Disconnect in CREAO + revoke in provider account
Social/commerce (X, YouTube, Reddit, eBay, Telegram)	OAuth or token	Social content, publishing metadata, user-uploaded and agent-generated media files (images/video) forwarded from CREAO storage to X when you post, storefront/listing data, bot messaging data	Disconnect in CREAO + revoke in provider account
TikTok	OAuth	Your TikTok profile (display name, avatar, bio, verified status) and, where you grant the optional permissions, your follower/following/likes/video counts; the list of your own videos with their view, like, comment and share counts; and the video files you ask an agent to upload or post, which are transferred from CREAO storage to TikTok along with any caption, hashtags and post settings you provide. CREAO stores your TikTok user identifiers (`open_id`, and `union_id` where TikTok returns it) and display name for connection display. CREAO can put a video on your account two ways: as a draft in your TikTok inbox (`video.upload`), which you finish and post yourself in the app; or as a direct post to your profile (`video.publish`). A direct post can be public, and the agent asks you to confirm the visibility and post settings before it publishes; until CREAO’s TikTok app passes TikTok’s content audit, TikTok restricts direct posting (the connected account must be set to private). CREAO cannot delete a post once made, and cannot read anyone else’s content	Disconnect in CREAO (revokes the token with TikTok, then deletes it) + remove CREAO under TikTok Settings → Security & permissions → Manage app permissions
Commerce (Shopify)	User-supplied custom-app credentials	Products, variants, inventory and collections; orders, refunds and fulfillment data, including full order history where the store grants it; your customers’ personal data — name, email address, phone number and billing/shipping address — which the connector can read and write back to the store; draft orders; online-store content (blog posts, articles, pages) and custom data (metafields, metaobjects); optionally, theme source files and publishing through a separately supplied, encrypted Theme Access password	Disconnect in CREAO + revoke in provider account. Uninstalling the first-party CREAO app triggers stored-token revocation. Multiple customer-owned stores can be connected to one CREAO account, with a separate encrypted credential/token record per user/store/app pair; disconnect deletes only the selected connection’s row. For customer-owned custom apps, uninstalling in Shopify stops API access but does not notify CREAO; disconnect in CREAO or delete your CREAO account to remove stored client credentials and tokens
Commerce (Gumroad)	OAuth	Products (create, update, publish/unpublish and delete, including uploaded product files and cover images), discount codes; sales data and your buyers’ personal data — buyer name and email address per sale — including full sales history and refunds, which the connector can issue; membership subscribers and their subscription status; aggregated sales summaries; your creator account profile. The scopes CREAO holds permit writes — creating/deleting products, publishing to your public storefront, and refunding sales. Earnings and payout data are not accessible	Disconnect in CREAO + revoke in your Gumroad account under Settings → Advanced → Applications
Logistics (Hapag-Lloyd, CMA CGM)	User-supplied API credentials	Ocean freight rate offers (Quick Quotes / Spot for Hapag-Lloyd; SpotOn instant quotes and contract quote lines for CMA CGM), routing and price data; the Hapag-Lloyd Online Business email you provide at connect time	Disconnect in CREAO (deletes stored credentials, cached tokens, and email) + rotate or delete the application on the carrier’s API portal
Logistics (MSC)	User-supplied API credentials	Ocean freight contract-rate data (service-contract references, ports, container specifications, freight and surcharge amounts, validity windows) fetched from your own MSC account	Disconnect in CREAO (deletes the stored subscription key) + regenerate or revoke the key on the MSC Developer Portal
Logistics (CargoAI)	User-supplied API credentials	Air-cargo rate search and booking under your CargoCONNECT account (flight schedules, rate offers, and the AWB/flight identifiers of bookings you make through CREAO); the office identity you provide at connect time (email address, first and last name, company name, IATA code, CASS code, country)	Disconnect in CREAO (deletes the encrypted API key, the office identity, the quote cache, and the booking index) + rotate or revoke the key with CargoAi
Custom MCP servers	API key, bearer token, or none	Tool schemas fetched from user-specified HTTPS endpoints during setup or refresh; no user message content is sent during schema discovery	Disconnect in CREAO + revoke or rotate credentials at the server
Browser use (cloud browser sessions)	Your own site logins, entered by you in a live browser view	Content of web pages the agent visits on your instruction, including pages behind logins you have saved; persistent login cookies for sites you connect; task trajectories are LLM-evaluated by the vendor as an advisory check the agent weighs when reporting results; files the browser agent writes during a task (for example a CSV or Markdown extract of the pages it visited) are copied into your CREAO file storage for that conversation, where you can download them and the agent can read them (10 MB per file, 100 MB per task); when a task stops before finishing — because you stopped it, because it reached CREAO’s time limit, or because it failed — the browser’s report so far, those files, and a digest of the steps it took are shown in chat as partial results	Log out of the site in the live browser on the run’s card, which clears that site’s login from the saved login CREAO keeps for you; to have a saved login deleted outright, ask privacy@creao.ai — CREAO no longer exposes a self-serve control for it; delete copied files from Files like any other generated file

Some connectors run through direct provider API integrations; others may run through integration relay infrastructure. In all cases, access is bound to your authenticated connector account and approved permissions. Calendly connector. When enabled for your account, Calendly connects through Pipedream-managed OAuth for one Calendly user. Pipedream manages the OAuth credentials and CREAO stores the Pipedream account identifier and connection display metadata. Reads and the writes listed above use CREAO’s existing connector and agent processing paths, and every write requires approval under the default Always ask autonomy mode. Cancelling an event emails every invitee and cannot be undone, and a scheduling link lets whoever receives it book one meeting. Disconnecting does not undo cancellations, links or no-show marks already written to Calendly. Disconnect in CREAO to remove the active connection and request deletion of the connected Pipedream account. HighLevel connector. When enabled for your account, HighLevel connects through Pipedream-managed OAuth for one sub-account (location); agency-level connections are not supported. Pipedream manages the OAuth credentials and CREAO stores the Pipedream account identifier and connection display metadata. Contact, pipeline and booking reads and the writes listed above use CREAO’s existing connector and agent processing paths, and every write requires approval under the default Always ask autonomy mode. Adding a contact to a campaign or booking an appointment can cause HighLevel to message that contact according to the sub-account’s own automations. Disconnecting does not undo records already written to HighLevel. Disconnect in CREAO to remove the active connection and request deletion of the connected Pipedream account. Square connector. When enabled for your account, Square connects through Pipedream-managed OAuth for one Square seller. Pipedream manages the OAuth credentials and CREAO stores the Pipedream account identifier and connection display metadata. Reads and the writes listed above use CREAO’s existing connector and agent processing paths, and every write requires approval under the default Always ask autonomy mode. No Square tool moves money: orders and payment links create records and a checkout page, and a buyer is charged only by paying on that page; invoices are created as drafts and are not sent. The authorization Pipedream holds is broader than the tools CREAO exposes, as listed above. Disconnecting does not undo records already written to Square. Disconnect in CREAO to remove the active connection and request deletion of the connected Pipedream account. Todoist connector. When enabled for your account, Todoist connects through Pipedream-managed OAuth. CREAO can read and change the tasks, projects, sections, labels, filters, comments and collaborators your Todoist account can access, and can invite people to your projects by email. CREAO stores the Pipedream account identifier and connection display metadata; Pipedream manages the OAuth credentials. Creating, updating, completing, moving, deleting, importing and inviting require approval under the default Always ask autonomy mode. A task export is saved as a CSV file in your CREAO files for that conversation, where you can download or delete it like any generated file; a CSV you import is transferred from CREAO storage through Pipedream to Todoist. Disconnect in CREAO to remove the active connection and request deletion of the connected Pipedream account; revoke the Pipedream integration in Todoist settings to remove upstream access. LinkedIn connector. When enabled for your account, LinkedIn connects through Pipedream-managed OAuth. The permissions you grant during LinkedIn authorization and your organization roles determine which member and organization operations are available. CREAO stores the Pipedream account identifier and connection display metadata; Pipedream manages the OAuth credentials. Requested inputs and results use CREAO’s existing connector and agent processing paths. Video uploads and publishing are separate actions: uploading a video does not create a post. Uploading, posting text, images or videos, commenting, liking, and deletion require approval under the default Always ask autonomy mode. Posts can be public, and disconnecting does not remove content already published on LinkedIn. Disconnect in CREAO to remove the active connection and request deletion of the connected Pipedream account; revoke the Pipedream authorization in LinkedIn settings to remove upstream access. Zoom connector. When enabled for your account, Zoom connects through Pipedream-managed OAuth, and Pipedream holds the OAuth credentials; CREAO stores the Pipedream account identifier and connection display metadata. What the agent can read or change is bounded by the permissions granted during Zoom authorization, your Zoom role, and your Zoom plan: cloud recordings and transcripts need cloud recording, AI summaries need AI Companion, webinar tools need a webinar license, Zoom Phone tools need a Zoom Phone license, and adding or removing account users needs a Zoom administrator role. Transcripts and summaries of meetings you host can contain what every participant said. Recording download links are time-limited but work for anyone who holds them until they expire, so treat them like the recording itself. Creating, updating and deleting meetings, updating webinars, registering attendees, sending chat messages, and creating or removing users require approval under the default Always ask autonomy mode; Zoom may email hosts, registrants or new users as a result. Disconnect in CREAO to remove the active connection and request deletion of the connected Pipedream account; remove the Pipedream app from your Zoom account to revoke upstream access. Stripe connector. When you connect Stripe through Pipedream, CREAO can access customer contact and address data, products, prices, subscriptions, invoices and line items, Checkout Sessions, PaymentIntents, refunds, balances, payout records, and billing meters, subject to the permissions of your connected Stripe credentials. Authorized write tools can create and modify these records, confirm or capture payments, issue refunds and payouts, cancel subscriptions, and delete or void eligible records. These operations can move money or affect your customers when you connect a live-mode account. Pipedream manages the connected credentials; CREAO uses the existing connector and agent processing paths for requested inputs and results. Disconnect in CREAO and revoke the connection or restricted key in Stripe to remove upstream access. This optional connector is separate from Stripe’s role processing your own CREAO subscription payments. Etsy seller connector. When enabled for your account, CREAO’s first-party Etsy OAuth connector can access the connected seller’s shop profile, taxonomy choices, listings, product photos and digital files, inventory and variations, shipping/processing profiles, receipts, transaction line items, payment summaries, carrier choices, and shipment status/tracking values. CREAO requests listings_r, listings_w, shops_r, shops_w, transactions_r, and transactions_w; it does not request buyer-email, saved-address, profile, billing-statement, or permanent-listing-delete scopes. Receipt payloads are filtered before reaching the agent to remove buyer email and street-address fields. Product files and photos you select are transferred from CREAO storage to Etsy. The encrypted OAuth tokens, Etsy user/shop identifiers, shop display name, granted scopes, and token-expiry timestamps are kept until you disconnect Etsy or delete your CREAO account; token and PKCE-state tables are excluded entirely from the analytics warehouse. Disconnect in CREAO and, if desired, revoke CREAO under Etsy Shop Manager → Apps → Connected apps. Slack app (bot install) is a different model from the “Collaboration” row above. A single workspace member (“the installer”) installs the CREAO Slack app and grants it standing, workspace-wide read access — channel, group, and DM message history and files, not just the installer’s own OAuth-scoped data — for every channel the bot is subsequently added to. The installer explicitly acknowledges a consent notice before the integration activates, but other members of the workspace whose messages become readable once the bot joins their channel have not individually authorized anything themselves; their consent is provided at the workspace level, through whoever installs the app. Every agent run triggered from Slack executes as the installer’s CREAO account (their agent, credits, and connected tools), regardless of which workspace member sent the triggering message. The installer can revoke access at any time by uninstalling the app from Slack or CREAO’s integration settings, which best-effort revokes the bot token. Posting media to X (attaching user-uploaded or agent-generated images and video to a tweet) requires the media.write OAuth scope. When you post, CREAO fetches the media bytes from your CREAO storage and uploads them to X’s API; each posting action still requires your explicit approval. If you connected X before this scope was introduced, you may need to reconnect X to grant media.write before media attachments will work.

Slack Agent App (Inbound)

This is a separate feature from the “Collaboration” Slack connector above, which lets your agent send messages out to Slack. The Slack Agent App instead lets people bring a CREAO agent into a Slack workspace by @mentioning it or messaging it directly — and it involves a different set of data subjects, so it’s documented on its own.

Who installs it and who’s bound to it: A CREAO account holder (“the installer”) authorizes the app into a Slack workspace via Slack OAuth. Every @mention or direct message to the bot in that workspace — from any member, whether or not they have a CREAO account — runs as the installer’s own agent, on the installer’s credits, using the installer’s connected integrations. The installer must explicitly acknowledge this before the integration activates: anyone with access to a channel the bot is in, or who can message it directly, can trigger a run on the installer’s behalf.
What’s collected from a triggering message: the Slack workspace/channel/thread identifiers, the triggering member’s Slack user ID, and the text of the message or mention (plus references to any attached files) needed to generate the agent’s response. This is retained only long enough to process the request and support troubleshooting — see Data Retention below — and is not linked to a CREAO account unless the triggering member happens to also be the installer.
Where it goes: the message text is sent to the installer’s selected LLM provider as agent context (see AI & Model Usage above) and the agent’s reply is posted back into the originating Slack thread or DM, visible to that thread’s Slack participants. If the installer’s selected agent is a routing agent (CREAO auto-provisions a default “Team Request Router” the first time the app is installed), it may forward the message on to a second, more specific agent it selects — still executing as the installer’s account, on the installer’s credits, so the same data-flow guarantees above apply to that second agent’s LLM provider and connected tools as well.
Removing it: the installer can disconnect the app from CREAO settings at any time, which revokes CREAO’s Slack access token; removing the app from the Slack workspace has the same effect. A workspace member whose message was processed and who is not the installer can request deletion of their retained data via privacy@creao.ai.

Skill Data Handling

Built-in skills are instruction packages — they do not create new third-party data sharing paths by themselves. See Skills and Connectors for the full feature overview and Security for safety boundaries. Built-in skills may operate on:

User prompts and conversation context
User-provided files and generated artifacts
Connected-service data when relevant connectors are authorized

Data leaves CREAO only when required by tools/providers used during execution. CREAO also evaluates sampled completed responses to measure quality, identify missing or misused integrations, and assess whether remembered details helped the answer. These evaluations can use a different model and provider from the one you selected for the conversation. The default judge is MiniMax M3 accessed through OpenRouter; CREAO can change the evaluation model and inference provider at runtime among supported language-model providers listed below, including Anthropic, OpenAI, Google, MiniMax, Z.AI, Meta, and models served through OpenRouter or on CREAO-managed infrastructure. Media-generation services and Sakana’s Fugu orchestration are not used for these evaluations. Evaluation requests served by Fireworks AI reach it through OpenRouter; CREAO does not call Fireworks directly for evaluation. Evaluation requests contain sampled conversation text and assistant responses. Integration evaluations may also include connected-service names, such as Gmail or Slack, but never connection tokens, credentials, or account contents fetched merely for the evaluation. Memory evaluations include the text of the profile entries and bounded excerpts of context and agent-authored skill files actually read during the sampled run. CREAO retains those excerpts with the run’s memory telemetry, together with file identifiers, excerpt hashes and truncation indicators, to assess relevance, use and response impact. Index availability alone is not treated as a file read. The selected provider and any inference host receive these categories under the API terms described here.

Subprocessors

The following third-party services process data on behalf of CREAO:

Subprocessor	Purpose	Data Processed
Google Workspace (Google LLC)	Event registration collection and organizer reporting through Apps Script and Google Sheets	Event registrant name, professional role, practice area, experience range, optional question, referral source tag, and submission timestamp
AWS (Amazon Web Services)	Cloud infrastructure, data storage, compute; Claude model inference via Amazon Bedrock for eligible users; AWS IoT Core for CREAO Connect device transport (opaque task notifications and cancellation signals)	All service data
Anthropic	LLM provider (Claude models); may also process internal quality evaluations when selected, as described above	Conversation messages, context; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
OpenAI	LLM provider (GPT models); image generation and editing (GPT Image — GPT Image 2.5 text-to-image requests may reach OpenAI relayed via OpenRouter, either as an automatic fallback when OpenAI’s own Images API returns a transient error or if CREAO makes OpenRouter the preferred host for that model; OpenAI performs the generation in both cases — see the OpenRouter row); speech-to-text transcription (GPT-4o mini Transcribe), where enabled; may also process internal quality evaluations when selected, as described above	Conversation messages, context; image-generation prompts and user-provided reference images for image generation/editing tasks; voice recordings and audio files submitted for transcription (GPT-4o mini Transcribe, where enabled); when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
Google Cloud	AI provider. Served through Vertex AI by default for all users: Gemini conversation requests, Gemini image generation, Gemini text-to-speech, and Veo and Gemini Omni Flash video generation. The Gemini API (Google AI Studio) is the fallback for a model Vertex does not serve, and is the only surface for Gemini Transcribe speech-to-text (where enabled). Also Claude model inference via Vertex AI — for eligible users as a routing choice, and for any user as an automatic same-model retry when Anthropic’s first-party API returns a capacity or availability error; may also process internal quality evaluations when selected, as described above	Conversation messages, context, user prompts, image/video/audio inputs for video generation tasks (Veo, Gemini Omni Flash); image-generation prompts and user-provided reference images for image generation tasks (Gemini); text submitted for speech synthesis; voice recordings and audio files submitted for transcription (Gemini Transcribe, where enabled); when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
MiniMax	LLM provider for MiniMax M3.1 Flash, served directly via the MiniMax API; alternative provider for internal response-quality evaluation (MiniMax M3 via the MiniMax API, when selected); user-requested voice cloning and cloned-voice text-to-speech. MiniMax M3 conversation requests are served by Fireworks AI, with an automatic OpenRouter fallback — see the Fireworks AI and OpenRouter rows	For MiniMax M3.1 Flash requests: conversation messages, context, and user-provided image inputs. For evaluation: sampled completed conversations and assistant responses used for quality evaluation; for conversations flagged as possibly integration-related, the names of services the user has connected (names only — never tokens, credentials, or account contents); where the sampled response was given memory entries from the user’s earlier conversations, the text of those entries, so each can be judged for relevance and effect. For voice cloning: the reference recording, provider voice identifier, preview/synthesis text, and speech-generation settings; CREAO requests deletion of the uploaded reference file after activation and requests deletion of the provider-hosted cloned voice when the user deletes it or closes their account. Cleanup failures retain the profile for retry and block account removal until cleanup succeeds
Z.AI	LLM provider (GLM models); may also process internal quality evaluations when selected, as described above	Conversation messages, context, and user-provided image inputs for GLM 5.3 Flash requests — the only vision-capable GLM. GLM 5.2 and GLM 5.3 are text-only: an image attached to those is described by CREAO’s own analyze_image step and never reaches Z.AI as image bytes; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
Moonshot AI	LLM provider (Kimi models); may also process internal quality evaluations when selected, as described above	Conversation messages, context; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
Meta Platforms (Meta Model API)	LLM provider (Muse Spark models) — distinct from the Meta Pixel advertising row below and from the Meta Ads connector (see Connector Data Access: a user-authorized flow to your own ad account, not a CREAO subprocessing relationship); this is a conversation-content data flow; may also process internal quality evaluations when selected, as described above	Conversation messages, context, and user-provided image inputs for Muse Spark requests; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
Thinking Machines	LLM provider (Inkling model), reached via OpenRouter; may also process internal quality evaluations when selected, as described above	Conversation messages, context; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
OpenRouter	Default gateway for internal quality evaluations (MiniMax M3); LLM API gateway — relays requests to Z.AI, Moonshot AI, Thinking Machines, and DeepSeek models, and can relay Meta’s Muse Spark 1.3 and 1.2 as a fallback (GLM 5.2 requests are served by Fireworks AI under CREAO’s Fireworks account; GLM 5.3 and GLM 5.3 Flash do NOT ride this path by default — they go directly to Z.AI — and reach OpenRouter only if CREAO moves them here as a fallback, in which case Z.AI still performs the inference, being the only host OpenRouter offers for those models; DeepSeek V4 Pro rides this path for ALL of its conversation requests — served by DeepSeek’s own API by preference, or GMICloud as a fallback (see those rows) — while DeepSeek V4.1 Flash uses it by default, preferring Fireworks AI with other inference hosts available for fallback; DeepSeek’s own endpoint is excluded. The legacy V4 selfhost route may also use it for same-checkpoint fallback; see the Fireworks AI and Nebius rows. Muse Spark 1.3 and 1.2 go directly to Meta by default and ride this path only if CREAO moves them here as a fallback, in which case Meta still performs the inference, being the only host OpenRouter offers for those models; Muse Spark 1.1 never rides it). Also carries MiniMax M3 conversation requests as an automatic fallback when Fireworks returns a capacity error — served by DeepInfra, Novita, or Together AI (see those rows). Also carries GPT Image 2.5 (Sunburst and Flare) image-generation requests as an automatic fallback when OpenAI’s own Images API returns a transient error — OpenRouter relays these to OpenAI, which still performs the generation. Text-to-image only: a request that supplies reference images (an edit) or asks for a transparent background never rides this path and stays on OpenAI’s API directly. CREAO can also make OpenRouter the preferred host for these two models without a release, in which case OpenAI’s own API becomes the fallback — OpenAI performs the generation either way; may also process internal quality evaluations when selected, as described above	Conversation messages, context, and attached images for DeepSeek V4.1 Flash and Kimi K3 (relayed to the serving inference host); image-generation prompts and generation parameters (quality, size, output format) for GPT Image 2.5 requests that ride this path — never user-provided reference images, which are excluded from it; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
Fireworks AI	Inference host for internal quality evaluations only through OpenRouter, when selected; LLM inference provider — serves MiniMax M3 conversation requests directly under CREAO’s Fireworks account (with an automatic OpenRouter fallback to DeepInfra, Novita, or Together AI when Fireworks returns a capacity error — see those rows) and GLM 5.2 requests relayed via OpenRouter, also under CREAO’s Fireworks account; serves Kimi K3 requests relayed via OpenRouter; is the preferred host for DeepSeek V4.1 Flash requests via OpenRouter by default, and may also serve other OpenRouter-routed open models and same-checkpoint fallback requests from the legacy V4 selfhost route	Conversation messages and context for requests served by Fireworks, including attached images for DeepSeek V4.1 Flash and Kimi K3. Per Fireworks’ API terms, not used for model training; Fireworks states prompt and generation data for open models is not logged or stored by default; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
Nebius	GPU infrastructure provider — hosts CREAO’s own self-hosted inference servers (serving the explicitly selected legacy DeepSeek V4 Flash route, not the default V4.1 Flash route). Inference runs on CREAO-managed servers; Nebius provides the underlying hardware and network and has no application-level access to request content; may also process internal quality evaluations when selected, as described above	Conversation messages and context for self-hosted model requests are processed transiently in memory on CREAO-managed servers hosted at Nebius; not used for training by anyone; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
DeepSeek	LLM provider and model publisher — serves DeepSeek V4 Pro conversation requests via its own API, relayed through OpenRouter (the preferred host for that model; GMICloud is the fallback). Does NOT receive DeepSeek Flash conversation content: V4.1 Flash uses OpenRouter/Fireworks by default with DeepSeek’s own API excluded; the legacy V4 selfhost route is described in the Nebius row; may also process internal quality evaluations when selected, as described above	Conversation messages and context for DeepSeek V4 Pro requests, relayed via OpenRouter under DeepSeek’s API terms, which prohibit use of your data for model training; when selected for evaluation, sampled conversation text and responses, connected-service names, and injected memory-entry text as described above
GMICloud	LLM inference host for DeepSeek V4 Pro and V4.1 Flash fallback requests relayed through OpenRouter	Conversation messages and context; attached images for V4.1 Flash; processed under OpenRouter’s no-training API terms
DeepInfra	LLM inference host for MiniMax M3 and DeepSeek V4.1 Flash fallback requests relayed through OpenRouter	Conversation messages and context; attached images for V4.1 Flash; processed under OpenRouter’s no-training API terms
Novita	LLM inference host for MiniMax M3 and DeepSeek V4.1 Flash fallback requests relayed through OpenRouter	Conversation messages and context; attached images for V4.1 Flash; processed under OpenRouter’s no-training API terms
Together AI	LLM inference provider — serves MiniMax M3 conversation requests relayed via OpenRouter, only as an automatic fallback when Fireworks returns a capacity error	Conversation messages and context for fallback-served MiniMax M3 requests, relayed via OpenRouter under OpenRouter’s no-training API terms
Parasail	LLM inference host for DeepSeek V4.1 Flash fallback requests relayed through OpenRouter	Conversation messages, context, and attached images; processed under OpenRouter’s no-training API terms
Morph	LLM inference host for DeepSeek V4.1 Flash fallback requests relayed through OpenRouter	Conversation messages, context, and attached images; processed under OpenRouter’s no-training API terms
io.net	LLM inference host for DeepSeek V4.1 Flash fallback requests relayed through OpenRouter	Conversation messages, context, and attached images; processed under OpenRouter’s no-training API terms
Sakana AI	LLM orchestration provider (Fugu Ultra)	Conversation messages and context for Fugu Ultra requests. Under Sakana’s public Fugu terms, content may be routed to external LLM providers and may be used for Sakana training or improvement unless an opt-out or separate no-training/DPA arrangement is in place
BytePlus (a ByteDance group company)	AI provider (Seedance video generation, Seedream image generation)	User prompts, generation parameters, user-provided image inputs (for image-to-video generation), and user-provided video and audio inputs (for video editing and motion/style/audio reference) for video / image generation tasks. Generated media is also delivered directly from BytePlus CDN infrastructure (short-lived signed URLs), through which BytePlus receives the user’s request metadata (IP, browser) at delivery time. Separately, BytePlus refuses a reference image or video that may depict a real person unless it has been registered in CREAO’s private BytePlus asset library first. When BytePlus refuses such a file in one of your Seedance generations, CREAO uploads a copy of that file to that library automatically and resends the request; BytePlus holds that copy durably and reuses it for later generations instead of receiving the file again — it is not a per-request input like the ones above. The copy stays until CREAO removes it; your own file is unaffected and remains the original
E2B	Sandbox execution	Code, files during execution
Browser Use (Browser Use Cloud)	Cloud browser automation for agent web tasks — hosts the remote browser sessions the agent drives on sites the user directs it to, stores persistent login state (cookies/local storage) the user saves for those sites, holds a workspace for selected input files and files the browser agent writes, and runs an LLM evaluation (“judge”) of each finished task’s trajectory, which the agent treats as advisory evidence when reporting the outcome (it does not independently verify results)	Task instructions written by the agent from your request; contents of chat uploads or agent-generated files selected for your browser task (CREAO stages a temporary snapshot and uploads it to the browser workspace before execution; staging copies are scheduled to expire after 3 days, with noncurrent versions expiring after 1 additional day); content and screenshots of the web pages visited during a task (which can include pages behind your own logins); saved site login state (cookies/local storage) when you connect a site; the judge’s evaluation covers the same task trajectory (steps, page summaries, final output). When a task finishes, or stops before finishing for any reason — you stopped it, it reached CREAO’s time limit, or it failed — CREAO copies the browser’s final report, any files it wrote, and a digest of the steps it took into your own CREAO storage for that conversation and shows them in chat as partial results where the task did not finish; the vendor-side copies remain subject to the vendor’s retention. Under Browser Use’s public privacy policy, content submitted to its agent (“Inputs”) may be used to train or improve its models, and no training opt-out is described; this applies to task instructions, transferred files, and visited-page content, including pages behind your own logins, unless a separate no-training/DPA arrangement is in place
Cua AI (CuaDriver)	Usage telemetry from CuaDriver, the third-party macOS automation tool that CREAO’s curated catalog installs on your own Mac for the desktop operator Local Worker. It runs locally on your Mac, not on CREAO’s servers, and CREAO does not receive this data	Which tools ran, the macOS version, and which agent called it. No screen content or typed text. Turn it off with `cua-driver telemetry disable`, which applies to every app that uses CuaDriver
Stripe	Payment processing	Billing and payment data, including C-end subscriptions/credit packs and Developer Platform USD wallet top-ups, and, where sales-tax calculation is enabled, the billing address you enter at checkout for tax calculation. Payments are routed to a regional Stripe account based on your country (see Billing Routing below)
Cloudflare	CDN, DDoS protection, bot detection	Request metadata, and country plus a coarse city/region estimate derived from IP address (used for billing routing, login geolocation analytics, abuse detection, and internal regional analytics)
Better Auth Cloud	Email validation during signup (disposable, invalid-MX, reserved-TLD detection); supplementary abuse signals (IP reputation, bot / impossible-travel detection); auth event telemetry across all auth operations (signup, signin, password-reset, session-refresh, OAuth callbacks) for the Sentinel security dashboard	Email address; IP address; auth event metadata (event type, timestamp, user ID, user email, user display name, IP address, derived city / country / country code)
Sentry	Error monitoring	Error diagnostics (no conversation content)
incident.io	Incident management and on-call alerting	Operational alert metadata only — CloudWatch alarm names and service status (no conversation content, no user PII)
Amplitude	Product analytics and event data export	Usage events and session metadata (no conversation content)
Google Analytics / Google Ads (Google LLC)	Web analytics, advertising attribution, and conversion measurement on CREAO marketing and product domains	Browser GA4 client identifier (`_ga` cookie), session identifier (`_ga_<container>` cookie) sent via Measurement Protocol for live-session stitching on run-scoped events, CREAO user identifier after sign-in, first-touch UTM/referrer parameters, Google click ID (`gclid`), conversion events such as sign-up, login, purchase, and subscription cancellation, and hashed email match data for sign-up, login, and purchase enhanced conversions (no conversation content)
Meta / Facebook (Meta Platforms, Inc.)	Advertising attribution and conversion measurement through Meta Pixel and server-side Conversions API on CREAO marketing and product domains — CREAO advertising its own product, not the Meta Ads connector, which acts on your ad account only when you connect it	Hashed email for advanced matching, hashed CREAO user identifier, IP address, user agent, Meta browser/click identifiers (`_fbp`, `_fbc`), Meta click ID (`fbclid`), and conversion events such as sign-up and purchase (no conversation content)
Reddit (Reddit, Inc.)	Advertising attribution and conversion measurement through the Reddit Pixel and server-side Conversions API on CREAO product domains	Reddit browser identifier (`_rdt_uuid`), Reddit click ID (`rdt_cid`), page and pricing views, sign-up and purchase conversion identifiers, SHA-256-hashed email, a namespaced SHA-256 hash of the CREAO user identifier, IP address, and user agent (no conversation content)
Impact.com	Affiliate partner attribution and paid-conversion reconciliation for Impact.com campaigns	SHA1-hashed email, CREAO user identifier, Impact click ID (`IM_REF`), order ID, conversion timestamp, event type, subscription or credit-purchase amount, and promo code for eligible sign-up and paid-conversion events (no conversation content)
Statsig	Feature flag management and A/B experimentation	User identifier, email address, and feature-targeting custom attributes (e.g. trial eligibility status); product usage events such as upload outcomes, with the file type, size range and error code but never the file name or contents
Pipedream	Connector OAuth and integration relay (user-triggered, when you authorize a connector). CREAO also periodically calls Pipedream’s tool schema API for operational reliability monitoring; these automated calls send only internal app identifiers and receive only tool metadata — no user data is involved	OAuth tokens for connected services; connector tool inputs and file content when the agent executes integration actions on your behalf (e.g. files you attach to outgoing email are relayed via time-limited URLs, and email attachments you ask an agent to download pass through Pipedream’s API proxy)
Data integration service and the selected tool provider	Paid data and API tools; real-user availability remains disabled until applicable retention, commercial-use terms and any required data-processing agreement are confirmed. When enabled and invoked for your task, CREAO manages the account and charges CREAO credits	Discovery queries and the inputs supplied to the selected endpoint; tool results and execution/cost metadata. CREAO keeps its shared API key server-side and does not send your CREAO user or conversation IDs in the execution payload. The data integration service forwards the endpoint inputs to the selected provider
People Data Labs	Company data enrichment (premium data tool, when you request company intelligence)	User-provided company identifiers such as website, name, ticker, LinkedIn URL, and location hints
TinyFish	Research search (scholarly-paper and news search agent tools) and web page reading (`web_fetch` agent tool), when the corresponding feature is enabled for your account and the agent runs a search or reads a page on your behalf	Search: search query text and optional search-intent text composed by the agent (both may derive from your prompt), plus corpus type and recency parameters. Web page reading: the page URL(s) the agent supplies — which may come from a link in your prompt or from a search result — optional intent text describing what is needed from the page, and the rendered page content returned to the agent. When the agent additionally requests page metadata, the page’s own descriptive tags are returned as well — canonical URL, site name, Open Graph type and preview image, last-modified time, favicon, and any robots directive — all of it published by the page itself, with no additional data sent about you. Do not paste links containing private access tokens (e.g. password-reset or magic-login URLs) if you do not want the agent to send them. In both cases requests are made server-side with CREAO’s API key — no user identifiers, account data, or conversation history are sent
Parallel (Parallel Web Systems)	Web search (`web_search` agent tool) — the default search provider for most accounts, when the agent searches the web on your behalf	Search query text composed by the agent (it may derive from your prompt) and the requested result count. Requests are made server-side with CREAO’s API key — no user identifiers, account data, or conversation history are sent
Brave Search (Brave Software)	Web search (`web_search` agent tool) for accounts not served by Parallel and as Parallel’s fallback; image search alongside web searches in chat, rooms and scheduled runs, so the agent can show relevant pictures in its answer	Server-side search: search query text composed by the agent (it may derive from your prompt) and the requested result count (image searches also set strict safe-search), sent with CREAO’s API key — no user identifiers, account data, or conversation history are sent. Images in answers: when an answer shows a search image, your browser loads its thumbnail from Brave’s image proxy, so Brave receives your IP address and browser user agent; the request carries no referrer, and the site the image came from is not contacted unless you open its source link. The same applies to images the agent posts in rooms, for every member who views them
Google PageSpeed Insights (Google LLC)	Web page speed and Core Web Vitals audits (`pagespeed_audit` agent tool, when enabled for your account and the agent audits a page on your behalf)	The page URL(s) the agent supplies — which may come from your prompt, a search result, or a site’s own sitemap, and may reference your site or a third party’s (e.g. a competitor you name) — plus the device strategy (mobile/desktop) and which audit categories to run. Requests are made server-side with CREAO’s API key — no user identifiers, account data, or conversation history are sent. Only send URLs for pages you are comfortable disclosing to Google, and do not audit URLs containing private access tokens; Google returns aggregate real-user performance data it already publishes for the site, and may retain the request per its own terms
LlamaIndex (LlamaCloud / LlamaParse)	Full-content PDF extraction (`read_pdf` agent tool, when enabled for your account and the agent reads a PDF on your behalf)	The PDF document fetched from the public URL the agent supplies (a scholarly paper, report, filing, or any public PDF link from your prompt) and the extracted document text returned. Requests are made server-side with CREAO’s API key — no user identifiers, account data, or conversation history are sent. CREAO caches the extracted text keyed by the source URL and may serve a cached copy across accounts to avoid re-parsing the same public document
Discord	Rewards verification (platform-level — checks Discord account link and CREAO server membership for the Rewards hub)	OAuth access token, Discord user id, username, avatar, server membership status
X (Twitter)	Rewards account linking (platform-level — confirms ownership of an X account when you connect it from the Rewards hub); agent connector (when you authorize the X connector, the agent posts on your behalf with your approval — e.g. `x_create_tweet`)	OAuth access token (held to bind the identity), X user id, username, display name, avatar. When you post through the X connector, CREAO also transmits the tweet content and any attached user-uploaded or agent-generated media files (images and video) — fetched from CREAO storage and uploaded to X’s API — subject to your approval. The `media.write` scope is required for media attachments
Google Identity Services (Google LLC)	Identity provider for Google sign-in, including Google One Tap / FedCM and redirect-based OAuth	Google account identifier, verified email address, display name, profile image, and signed ID token or authorization code exchanged during authentication. CREAO verifies the token audience before creating a session
Apple (Apple Inc.)	Identity provider for Sign in with Apple (authentication flow)	Apple user identifier, verified email address (or Apple-relay email address), display name, and authorization code/tokens exchanged during the OAuth flow. Apple processes these on their servers to authenticate the user and return an ID token to CREAO
WEEX	Demo trading challenge account access and performance tracking (when you join a WEEX-backed campaign and configure WEEX API credentials)	WEEX UID/email, signed account-balance requests, demo-account equity, PnL, available balance, unrealized PnL, and trade count/performance metadata
debot	Robinhood Chain on-chain trading challenge monitor callbacks, wallet execution, and performance tracking when you join a debot-backed campaign	Submitted debot email, submitted Robinhood Chain wallet address, Debot monitor callbacks posted to CREAO’s community Agent webhook wrapper (then forwarded to your Platform Agent app), signed on-chain action requests, wallet equity/PnL/trade-count metadata, and debot trade-history metadata used for campaign ranking and audit
Kite / GoKite (`agentpassport.ai`, `cli.gokite.ai`, `gokite-ai`)	Optional Season 2 Kite Agentic Wallet side event: Passport skill install from the public `gokite-ai/passport-skills` GitHub repository, pinned `kpass` CLI download from `cli.gokite.ai`, and participant interaction with Kite Passport (`agentpassport.ai`) through the cloned CREAO agent	Skill/repository paths installed onto your CREAO account; CREAO server-side download of the pinned `kpass` binary (not user PII); wallet registration and on-chain actions you initiate with the Kite agent may be processed by Kite Passport services under Kite’s terms. CREAO does not send your CREAO password or debot credentials to Kite
Base (public Base-chain RPC, default `mainnet.base.org`, or a CREAO-configured `S2_BASE_RPC_URL`)	On-chain verification for the Season 2 Kite Agentic Wallet side event when you submit a Base wallet or transaction hash	Confirmed Base wallet address and submitted transaction hash queried by CREAO servers for ERC-20 `balanceOf` via `eth_call` (Circle native USDC on Base) and receipt checks; the RPC operator sees those identifiers and CREAO’s server request metadata (not your CREAO account password or private keys)
Apple (Apple Inc.)	iOS push notification delivery via the Apple Push Notification service (APNs), when you enable push notifications on the CREAO mobile app	Your device push token (an opaque per-device delivery credential issued by Apple) and the notification payload metadata sent at delivery time — the notification title and body (localized) plus identifiers such as the notification id and related thread id. By default, no conversation content, message text, or generated output is sent to Apple. If you opt into the Settings → General “Show names in push notifications” toggle, the related chat thread’s title (which for an ordinary chat thread defaults to the start of your first message, truncated to 100 characters), agent app name, organization name, and team room and sender names are rendered into the push body and sent to Apple as part of that opt-in
customer.io	Marketing automation and lifecycle messaging (email / in-app campaigns)	Read directly from the data warehouse by customer.io’s Reverse ETL over an SSL connection restricted by IP allowlist, and limited to a curated, read-only set of fields: email, name, account status, subscription plan/status and history (including Stripe subscription/customer identifiers), recorded spend and credit purchases, credit-usage logs, reward claims, first- and last-touch acquisition attribution (campaign / UTM parameters, ad click identifiers, referring site and landing page, client surface, and the Google Analytics and Meta advertising identifiers described under Cookie policy), connector lifecycle metadata (name, provider, auth mode, status, and timestamps), agent / thread / session / schedule lifecycle metadata, and a coarse city/region/country location estimate derived from IP for regional campaign segmentation. customer.io does NOT receive credentials (passwords, secrets, API keys, tokens), connector URLs or tool schemas, scheduled-run inputs or error details, conversation/message content, or forensic IP / user-agent logs (only the derived city/region/country estimate crosses, never the raw IP). Separately, the CREAO web app loads customer.io’s browser SDK to deliver in-app messages and report product usage directly from your browser. Over that path customer.io receives your CREAO user identifier once you sign in, your email address, name, account creation date, and whether your account is an internal CREAO account; the route patterns you navigate (page templates such as `/workspaces/$workspaceId`, never the query string, URL fragment, or any identifier embedded in a shareable link); and product events identified by name with numeric or identifier properties only. No prompt text, message content, thread title, or generated output is sent over this path, and the browser SDK is not loaded in the CREAO mobile or packaged desktop apps

Billing Routing

CREAO uses Stripe Connect to route payments through regional Stripe accounts so that charges are processed by a merchant entity closer to the cardholder, reducing payment declines. The country associated with your IP address (provided by Cloudflare via the cf-ipcountry header) determines which Stripe account processes your payment:

United States and Canada — payments are processed by New Boundary, Inc. (US Stripe account) as a connected account on the CREAO platform
All other regions — payments are processed directly by the CREAO platform Stripe account (Hong Kong)

The IP country only chooses the Stripe account. Where sales-tax calculation is enabled on that account, the tax on a purchase is calculated from the billing address you enter at checkout, not from your IP address. No new personal data is collected for this routing — only the country code already present in the request metadata is used. Your billing region is stored alongside your subscription record so that subsequent charges, portal sessions, and webhook processing use the same account. This value is cleared if your subscription is reset.

Data Retention

Data Type	Retention Period	Notes
Onboarding answers and progress	Until account deletion	Source records are removed with the account; the warehouse mirror follows source deletion.
Shopify pending install handoff	Expires after 15 minutes; expired records removed by scheduled cleanup	Encrypted OAuth authorization staged before CREAO sign-in is cleared immediately on successful account linking. Shopify uninstall and shop-redaction requests also remove the handoff.
Large tool and connector outputs	Same retention and deletion rules as the associated thread/workspace files; no separate time-based expiry	Eligible text/JSON tool results above 32 KiB may be saved in your private workspace storage, including data returned by connectors. Your agent receives a file reference and a short preview and can selectively read the saved content.
Data integration execution metadata	Until account hard deletion; no automatic time-based expiry	Retained for run status, settlement reconciliation and audit while the account exists. Stores user/thread identifiers, provider/endpoint, run IDs, an input hash and cost/status metadata, not raw request or response payloads. Removed during account hard deletion, including pending runs; this ends local polling/reconciliation and does not request deletion of vendor-side records. Separate credit-ledger records follow the billing/audit retention policy below. Vendor-side retention is subject to the terms confirmed before activation.
Data-tool rollout events (`monid_tool_events`)	Until thread hard deletion or account hard deletion (including removal for a ban); no independent time-based expiry	User, thread, message, run and tool-call identifiers, attempt number, tool name, enabled/disabled state and timestamps used to measure adoption and response quality. No tool inputs or retrieved content are stored. Source rows are mirrored to the internal Redshift ODS warehouse. Thread hard deletion removes its events; account hard deletion also removes that user’s events in threads owned by others. The warehouse mirror follows source deletion through replication.
Event registration submissions	Event date + 30 days	Name, professional role, practice area, experience range, optional question, referral source tag, and submission timestamp stored in the event organizer’s access-restricted Google Workspace Sheet for attendance planning and session preparation; the supplied event script stops accepting submissions and clears response rows after the retention deadline
Conversations & messages	Until deleted by user	Users can delete individual threads or all data
Team room shortcuts	Until a room member deletes the shortcut; an archived room keeps its shortcuts; no time-based expiry	Name, description, message text, and who created and last edited it (and which agent, when an agent made it for a member). Any member who can post in the room can delete any shortcut, and every change posts a message in the room. Text and description are not exported to the analytics warehouse. Messages sent with a shortcut are room messages and keep the shortcut’s id and name from the time they were sent.
Harness cycle feedback	Until workspace or cycle deleted	Optional free-text input on the Self-Improve hero between cycles (e.g. “focus more on the conversion funnel”). The current-cycle draft lives on `harness_processes.loop_state.nextCycleFeedback` and is cleared once the next audit dispatches; the value that informed each completed cycle is snapshotted onto `harness_sessions.summary.userFeedback` so the cycle history can show “your focus for this cycle”. Deleted via the workspace cascade when the workspace is removed
API keys	Until revoked by user, or automatically when the associated agent app is deleted	HMAC hash stored; raw key shown once at creation and never stored. Account-wide keys remain until the user revokes them; agent-scoped keys are also soft-revoked automatically when their target agent app is deleted so orphaned credentials stop counting toward the per-user active-key limit
API run data (inputs, outputs)	Until deleted by user	Prompts and results from API-triggered agent runs; same retention as conversations
CREAO CLI request logs (`developer_api_http_requests`)	Until account deletion	One row per authenticated Account API key `/v1/*` CREAO CLI request that passes authentication and account rate-limit checks. Stores account/API-key identifiers, method, route/path, handler, status/error code, run/agent/conversation links, timing, byte counts, and credited usage for run-producing calls. No request payloads, response payloads, headers, raw API keys, or tokens are stored. Rows are hard-deleted on account deletion; raw path is excluded from the Redshift ODS warehouse view
CREAO CLI product profile (`developer_product_profiles`)	Until account deletion	One row per account with optional persona and brand context used to shape Super Agent turns. Hard-deleted on account deletion. Persona and brand-context text are excluded from the Redshift ODS warehouse view
CREAO CLI Super Agent allowlist (`developer_super_agent_allowlist`)	Until account deletion or administrator removal	Account identifier, account email, and administrator attribution used to gate Super Agent and product-profile routes. Hard-deleted on account deletion or when an administrator removes the account. The ODS warehouse view projects only `id`, `user_id`, and `created_at`
Workflow definitions	Until account deletion	Saved workflow templates from approved dynamic-workflow proposals (staged via the `/workflow` command or proposed by the agent in ordinary chat), including name, description, and JSON task spec. Deleted during account deletion
Workflow runs, tasks, and events	Until the parent thread is deleted	Approved workflow execution records, including run/task status, task prompts, summaries, parent-thread artifact copies, progress events, and cost metadata. Deleted when the associated thread is deleted or when the account is deleted. Internal ODS warehouse views mirror these records for analytics under the same deletion controls
Generated files	Until deleted by user (cloud copy); device copies persist locally	Stored encrypted in cloud storage. A generated file’s record may also carry a derivation note — which earlier file(s) it came from and by what operation — which has no separate lifecycle: it is retained and deleted with the file itself. On the iOS/Android app you may additionally save a generated file to your device: images and videos to your Photos library, and other files to the app’s on-device Files area. Once written to your device these copies leave CREAO’s control — the cloud retention and deletion controls above do not reach them, and you remove them through your device (Photos, Files app, or by uninstalling the app)
Cloned voice profiles and previews	Until deleted by user or account deletion	CREAO stores profile/lifecycle metadata and an encrypted MP3 preview. The source recording is forwarded to MiniMax during enrollment but is not stored in CREAO object storage; CREAO requests deletion of MiniMax’s uploaded source file after activation. Deleting the profile removes the MiniMax voice and CREAO preview. Account deletion completes the same provider-side and storage cleanup before removing the account row; if cleanup fails, the account and profile remain available for retry. CREAO does not specify a separate expiry period for any MiniMax backup copies
Large-media upload sessions and private-PDF preparation (`media_upload_sessions`, `media_storage_usage`, `large_pdf_ingestions`)	Session/control metadata until the corresponding uploaded file is deleted; aggregate usage until account deletion	Direct browser-to-S3 upload bookkeeping for eligible large uploads (images, videos, PDFs, and every other accepted file type): opaque session identifier, owner/workspace context, MIME type, byte counts, lifecycle timestamps, aggregate storage usage, and bounded PDF-preparation state. For eligible private PDFs, CREAO stores the original as a private encrypted storage object and copies it into the chat workspace it was attached to, so the agent can read and edit it there. A background preparation step also produces bounded extracted-text chunks, a manifest, and (when text is unavailable) limited rendered-page samples as private encrypted storage objects; the preparation control row contains no source text, filenames, page images, or embeddings, only lifecycle metadata and a server-derived private artifact prefix. Other accepted file types (documents, spreadsheets, presentations, archives, audio) are stored the same way and copied into the chat workspace they were attached to, where the agent reads them like any standard upload. These source, workspace-copy, and derived objects are removed when the file or account is deleted. The temporary S3 staging object and unfinished multipart parts expire automatically if an upload is not completed. Original filenames, source S3 keys, and multipart identifiers are excluded from the warehouse projection; no media bytes are stored in the database.
Org shared files	Until deleted by the file owner or when the account/organization is deleted	Files a team member shares into their organization’s shared space, the per-member read/write grants on them, and an append-only sharing audit log (who shared, granted, revoked, updated, or deleted, and when). Folder sharing applies recursively to existing and new children unless a child has an explicit sharing override. The folder whose sharing policy applies also gives its creator read/write access to inheriting collaborator uploads, without transferring ownership. Only the member who shared a file can delete it or manage its grants; they may hand that ownership to another member of the same organization, and an organization owner can remove any shared file in their organization. Both actions are recorded in the sharing audit log. All of a member’s shared files and the grants made to them are removed when their account is deleted; the audit log is retained with the departed member’s identifiers scrubbed. Everything is removed when the organization is deleted. Non-secret columns are mirrored to the internal Redshift ODS warehouse for analytics under the same deletion controls
Paired-device capability tasks (CREAO Connect)	Until the device is revoked or the account is deleted	Durable task state includes the owning user/device, optional conversation link, capability name, progress, deadlines and outcome; a separately isolated payload row contains the capability arguments, bounded result and any mirrored consent prompts (capability, target, caller, an argument preview of up to 500 characters, and the answer). Payload content is excluded from Redshift. The “approval needed” inbox row for a mirrored prompt is deleted once the prompt settles. Revoking the device cascade-deletes its tasks, payloads and attachment bindings.
Paired-device capability attachments (CREAO Connect)	7 days	When a device capability result is too large to return inline, the bytes are stored under the `attachments/` prefix of CREAO’s private upload bucket and expire automatically after 7 days (and 7 days for noncurrent versions) via an S3 lifecycle rule. Files the agent sends to a device travel the same way under the `uploads/` prefix, with the same 7-day expiry: your device downloads the object during the task and nothing references it afterwards. These are transfer objects only: the agent’s sandbox process downloads them to its own ephemeral temporary storage, which is destroyed with the sandbox, and anything the run keeps is copied into your workspace files under the retention shown for Generated files. The `device_attachments` binding row is deleted when you revoke the device or delete your account
Curated MCP install handoffs (`mcp_install_intents`)	Link expires after 1 hour; expired rows are eligible for cleanup after 7 days	Account, catalog-entry, lifecycle and redeemed-device identifiers used to hand a web install to CREAO Connect and measure whether the client received it. Only a SHA-256 hash of the bearer token is stored, and that hash is excluded from the Redshift ODS warehouse view. Source rows are erased on account deletion and the warehouse mirror follows that source deletion through replication; otherwise cleanup runs opportunistically when another handoff is created
Curated MCP install step outcomes (`mcp_install_funnel_events`)	Eligible for cleanup after 120 days	Per-step entry/revision, account/device, outcome, duration, and closed diagnostic fields used to measure curated-install quality. The table has no server-setting values or free-text error field and is mirrored to the internal Redshift ODS warehouse. Source rows are erased on account deletion and the warehouse mirror follows that source deletion through replication; otherwise cleanup runs opportunistically when new outcomes are recorded
Local Worker sessions (on your Mac, CREAO Connect `runs/`)	By default the newest 50 runs, each kept at most 14 days	Each Local Worker run’s session transcript (task, text history and screenshots) and run summary, stored only in the CREAO Connect state directory on your Mac and never uploaded to CREAO. A follow-up to a finished worker copies the earlier session into the new run. Connect’s retention sweep removes older runs at startup and hourly; runs still in progress are kept
Local Worker install step outcomes (`worker_install_funnel_events`)	Eligible for cleanup after 120 days	Per-step worker entry/revision, account/device, outcome, duration, and closed diagnostic fields used to measure Local Worker install quality. The table has no free-text column and is mirrored to the internal Redshift ODS warehouse. Source rows are erased on account deletion and the warehouse mirror follows that source deletion through replication; otherwise cleanup runs opportunistically when new outcomes are recorded
Sandbox environments	Session duration + 30 min idle	Destroyed after inactivity timeout
Memory entries	Until deleted by user (personal) or org member (team)	Personal memories are viewable and deletable from Settings → Personalization. Team memories are shared across organization members and deleted when any organization member clears team memory, or cascade-deleted when the organization is deleted. Associated embedding vectors share the same retention and are removed when the memory entry is permanently purged.
Memory evaluation records (`memory_injections`, `learning_evaluations`)	Until account deletion	Internal records of how CREAO’s memory system performed on a run, used to compare memory approaches and measure whether memory improves answers. Each row stores which memory approach served the run, how it was assigned, and the memory entries that were supplied to the assistant for that run — identifiers plus a truncated snippet of each entry’s text — together with size, timing, and prompt-cache usage figures, and for file-based memory whether the run reused the conversation’s stored copy of the memory files and how far that copy differed from the current files. Per-entry quality verdicts (was this entry relevant, did it help) are stored alongside. No new content is collected: these are the same memory entries described above, recorded at the moment they were used. Deleted when the account is deleted, which also removes them from the internal analytics warehouse copy
Dream profiles	Active + last 10 versions (personal); org-scoped until org deleted	Personal profiles are deleted on account deletion (FK cascade). Org-scoped profiles cascade-delete when the organization is deleted. Viewable from Memory → Dream tab
Audit logs	90 days	Immutable, used for security monitoring
Team activity logs	Until app deletion	One row per tracked action on a shared agent (member added/removed, share toggled, schedule created/updated/deleted, etc.). Cascades when the agent app is deleted. The acting user’s id is replaced with a deleted-account placeholder when that user closes their account, so the action history remains coherent for surviving collaborators without exposing data tied to a deleted user
Live views (`live_views`)	Artifacts: until unpinned. Dashboards: until the owning agent is deleted	User-promoted bindings between an agent and one of its recurring outputs: the user-chosen view name, the bound artifact file name (or dashboard block id), the view kind, grid-layout position, and owner/organization identifiers. No output content is stored — artifact views resolve to existing generated files, and dashboard views to the latest run’s `app_sessions.dashboards` spec, both at read time. Unpinning an artifact view deletes it immediately; unpinning a dashboard view instead marks it dismissed (hidden from the Views board and never re-pinned) while retaining the binding row until the owning agent app is removed. Both cascade-delete when the owning agent app is removed (including during account deletion). Mirrored to the internal Redshift ODS warehouse for analytics under the same deletion controls
Organization invite records (`org_invites`)	Until revoked or org deleted	Stores the invitee email address, invite status and role; invites created under the retired per-seat team plan may also hold a link to the seat they reserved (`seat_id`), which CREAO no longer writes. An invite to an email with no CREAO account auto-accepts on the invitee’s signup to place them in the organization as an organization-only account. Pending invites are deleted when revoked by an admin. Expired invites become unusable but remain in the database until the organization is deleted. All invite records cascade-delete when the organization is deleted. Accepted invites are retained for audit until org deletion
Organization billing records (`org_credits`, `org_member_credit_caps`, `org_credit_operations`)	Until org deleted	Stores the organization’s shared credit pool balance, per-member monthly usage caps and cycle counters, and per-request deduction idempotency log; a team’s subscription is its owner’s personal subscription, recorded in the owner’s own billing records. All records cascade-delete when the organization is deleted
Connected-database configuration	Until admin disconnects the source	Encrypted credentials and discovery metadata (database/schema names) for enterprise BYOD sources. Hard-deleted immediately when an org admin disconnects the source; cascades on organization deletion. No backup copy is retained after disconnect
BYOD sensitivity catalog (`byod_catalog_entries`)	Until admin disconnects the source	Per-object review state for a connected BYOD source: table and column NAMES, the classifier’s sensitivity tag, an `allowed` flag, an optional admin-written business description, and who confirmed the review and when. Metadata only — no customer row values are stored. Cascades with the connection record: hard-deleted when an org admin disconnects the source, and on organization deletion
Connected-cloud configuration (`cloud_connections`)	Until the connection is disconnected/deleted	Non-secret references for a connected AWS account (Bring Your Own Cloud): provider, display name, AWS account ID, cross-account role ARN, region, and grant tier, plus the per-connection ExternalId stored AES-256-GCM encrypted. No long-lived cloud credentials are stored. The row is hard-deleted when you disconnect/delete the connection and is also removed when you delete your account; org-shared connections are removed on a best-effort basis when the organization is deleted (any residual rows become unreachable once the org is gone). When you disconnect a connection, any cached short-lived broker credentials are invalidated immediately; otherwise they expire on their own within the hour
Slack Agent App installation (`slack_installations`, `slack_thread_links`)	Until account deletion	Per-workspace install record for the Slack Agent App: Slack workspace/team identifiers, the installer’s bot token (AES-256-GCM encrypted, dedicated key), routing/allowlist/spend-cap configuration, and the installer’s deploy-time consent timestamp; `slack_thread_links` maps a Slack conversation to its CREAO thread. Disconnecting the app from CREAO settings (or removing it from the Slack workspace) revokes the Slack bot token and marks the installation inactive immediately, but the configuration row itself is hard-deleted only when the installer’s CREAO account is deleted — `installer_user_id` is plain text with no FK cascade, so deletion is performed explicitly in the account-deletion handler, which also removes the installation’s `slack_events` rows (below) regardless of their age
Slack Agent App event queue (`slack_events`)	Terminal rows purged after 30 days; all rows removed on account deletion	Dispatch bookkeeping for the Slack Agent App: the invoking Slack member’s Slack user ID and the raw text of the @mention or DM (plus file references) needed to build the agent run. The triggering member is not necessarily a CREAO account holder — the installer above is the CREAO account of record. Rows in a terminal state (completed, failed, or skipped) are purged by a daily retention job 30 days after last update; in-flight rows are retained only until the run settles. All of an installer’s rows are also hard-deleted immediately when their CREAO account is deleted, regardless of age. The non-secret columns (excluding message text and file references) are mirrored to the internal Redshift ODS warehouse for analytics under the same deletion controls
Event bus records (`events`, `event_payloads`, `event_routing`, `event_deliveries`, `event_subscriptions`)	Events and their payload, routing and delivery rows are deleted after 30 days; subscriptions until account deletion; all rows removed on account deletion	Identifiers (user, thread, run, agent app, session, schedule), event type, routing and delivery status; no message content. A fired agent-trigger timer’s payload also holds that timer’s note and payload. Payload rows are excluded from the analytics warehouse
Agent triggers (`agent_triggers`, `agent_trigger_timers`, `agent_trigger_runs`, `connector_triggers`, decision scripts in private storage)	Run records are deleted after 90 days; fired and cancelled timers 30 days after they settle; a deleted trigger and its script files 30 days after you delete it; a replaced script file about an hour after the replacement; all rows and script files removed on account deletion	Trigger settings and `params`, timer item, note and payload, each run’s decision, reason and chosen inputs, and the script text in your private storage. `params`, notes, payloads, reasons and inputs are excluded from the analytics warehouse; the script is never in a database
Connected-database standing instructions (`byod_data_source_instructions`)	Until the data source is disconnected or org deleted	Per-data-source standing instructions — free text (up to 20,000 characters) authored by organization members and injected into the agent’s system prompt for chats that use the data source. Cascade-deleted when the connected data source is disconnected or the organization is deleted. Any organization member can edit or remove the instructions
Organization prompt templates (`byod_prompt_templates`)	Until deleted by an org member or org deleted	Reusable chat prompt templates (template name, prompt body, optional data-source binding) authored by organization members. Deleted when any organization member deletes the template; org-scoped templates cascade-delete when the organization is deleted. Built-in templates (CREAO-managed defaults, not organization data) are seeded by CREAO and not tied to any account
Login records	365 days	One row per session with IP, user agent, device fingerprint, country code, and (when available) a coarse city/region estimate derived from the IP; used for abuse detection clustering and admin geo analytics
LLM transaction forensics (`credit_deduction_logs`)	12 months	One row per LLM API call, including calls CREAO makes on your behalf without charging your account (recorded with zero credits), with billing metadata (cost, model, token counts) and forensic invocation details (source IP, user agent, country code, Cloudflare edge-location code, JWT issued-at and age, upstream response identifier). Used for billing reconciliation, abuse cross-referencing (e.g. detecting stolen sandbox credentials and replay attacks), and audit. After 12 months the IP address and user agent fields are anonymized/dropped; aggregated totals (cost, tokens) may be kept longer for billing analytics
Usage-cap counters (`user_usage_hourly`)	31 days	Hourly per-account tally (user identifier, usage kind, UTC hour, total) used to enforce per-plan usage caps over rolling 1h/5h/1d/7d/30d windows. Derived from recorded charges; holds no prompt or generated content, IP address, user agent, model identifier, or thread identifier. Deleted hourly by cron once older than 31 days, and erased with the account on deletion
Video provider accounting operations (`video_expense_operations`)	30 days after reconciliation; unresolved records retained until the billing investigation is complete or account deletion	Provider operation ID, user/thread/job identifiers, model/provider, resolution, pricing inputs, cost and settlement state. Used to reconcile accepted video requests after cancellation, fallback or interrupted delivery. Contains no prompts or media bytes. All records, including unresolved operations, are hard-deleted on account deletion; no FK cascade exists, so deletion is performed explicitly in the account-deletion handler. Expense entries in the transaction ledger follow the retention policy above.
Video generation jobs (`video_generation_jobs`)	Job records: until account deletion; generated video and thumbnail: until clip or account deletion	Job records contain prompt text, input asset S3 keys (image, video, audio), generated video S3 key, status, billing metadata, and error details. Deleting a clip in Video Studio removes its generated video and thumbnail and hides it from history; the job record and deletion timestamp remain for billing and provenance. Source uploads and independently generated clips are not removed by clip deletion. Job records are hard-deleted explicitly on account deletion; no FK cascade exists.
Image generation jobs (`image_generation_jobs`)	Until account deletion	Job records for asynchronous AI image generation: prompt text, reference-image S3 keys, generated image S3 key, provider-returned text, status, billing metadata, and error details. Hard-deleted on account deletion; no FK cascade exists so deletion is performed explicitly in the account-deletion handler
Local media render jobs (`media_render_jobs`)	Until account deletion	Job records for checkpointed local ffmpeg renders: declarative render arguments, workspace input/checkpoint/output S3 keys, status, and error details. Hard-deleted on account deletion; no FK cascade exists so deletion is performed explicitly in the account-deletion handler
Hackathon signup records (`hackathon_signups`)	Until account deletion	One row per account created through a hackathon signup link: the hackathon’s short name, the complimentary plan granted, its period end, and the creation time. Used to apply the offer once per account and to count event sign-ups; deleted when the account is deleted.
In-app notifications (`notifications`)	Until account deletion	In-app notification inbox rows: the notification reason, related thread / agent-app / session identifiers, a stable i18n key plus structured parameters used to render localized copy (no free-text English is stored), and read state. Hard-deleted on account deletion; `user_id` is plain text with no FK cascade, so deletion is performed explicitly in the account-deletion handler
Push device registrations (`push_devices`)	Until device removal or account deletion	One row per registered mobile push device: the device push token (an opaque delivery credential treated as a secret — never logged raw and excluded from the Redshift ODS warehouse view), device platform, delivery environment, app version and device locale captured at registration, and lifecycle timestamps (first registered, last seen, disabled marker). No message content is stored. Removed when you disable push or sign out; hard-deleted on account deletion — `user_id` is plain text with no FK cascade, so deletion is performed explicitly in the account-deletion handler
Team logo (`organizations.logo_key`)	Until replaced, removed, or the organization is deleted	One image object per organization in the private upload bucket, uploaded by an owner or manager and visible to all members of that organization. Replacing or removing the logo deletes the previous object; the key is cleared and the object deleted when the organization is deleted. Contains no data about an individual
iOS in-app consent acknowledgements (device local storage)	Until the app is uninstalled or site data is cleared	App Store iOS/iPadOS only. Device-local boolean flags in browser local storage: pre-login privacy agreement acceptance (keyed to the policy effective date) and post-login third-party AI disclosure acknowledgement (keyed per user account on the device). No message content; not stored on CREAO servers and not included in account-deletion server-side purges — remove by uninstalling the app or clearing the app’s site data
Rate-limit abuse events (`rate_limit_violations`)	90 days	Sampled record (at most one row per actor + endpoint per minute) of rejected over-limit (HTTP 429) requests: time, path, HTTP method, source IP, an allowlist of non-sensitive request headers, the limiter bucket, and a redacted, size-capped request-body excerpt (body capture skipped entirely for auth / billing / credit / secret / token / payment / login routes). Used to detect scans and brute-force abuse. `user_id` is plain text with no FK cascade, so rows are erased explicitly in the account-deletion handler and are otherwise purged after 90 days by a daily retention job. Request headers and body excerpt are excluded from the Redshift ODS warehouse view
Video asset registrations (`video_assets`, `video_asset_audit`)	Provider copy: until 30 days without use, immediately on file or account deletion, or 15 days after a lapsed CREAO subscription to the provider. Registration record: until the file is deleted. Trail: retained with the departed user’s identifier scrubbed	A record that one of your image or video files has been registered in CREAO’s private BytePlus asset library, which is what lets a Seedance generation use a file that may depict a real person. Registration happens automatically, the first time BytePlus refuses the file in one of your generations for depicting a real person — nothing is registered in advance, and you are not asked to confirm anything. Each registration, use, and removal is recorded in an audit trail that carries no file content and no provider identifier. The row stores where the file lives, the media facts measured from its bytes (type, size, dimensions, duration, frame rate, content hash), a generated thumbnail, and usage timestamps — never the file’s own bytes. A sweeper deletes the provider’s copy after 30 days without a generation using it and keeps your file, so a later generation re-registers it without you uploading anything again. Separately, BytePlus deletes copies created during a paid period 15 days after that subscription lapses — its own policy, outside CREAO’s sweeper, and it likewise costs you nothing but a re-registration because your file is the original. Deleting the file, or your account, marks the registration for removal; the same sweeper deletes the provider’s copy and then the registration record itself. A refused registration is discarded after 7 days. Non-secret columns are mirrored to the internal Redshift ODS warehouse for analytics under the same deletion controls
BytePlus task bindings (`byteplus_task_bindings`)	Stale-pending released after 2 hours; terminal rows purged after 30 days	Mapping rows linking a BytePlus task identifier to the internal request identifier so that an asynchronous video-generation poll can be settled against the original credit hold. Each row contains the BytePlus task identifier, internal request UUID, user identifier, model identifier, status, timestamps, and a metadata blob mirroring the per-request forensic context already captured in `credit_history` and `credit_deduction_logs` (request path, country code, edge-location code, source IP, user agent, JWT issued-at). No conversation content or generated assets are stored
Billing coupon records (`billing_coupons`)	As required for billing, tax, audit, fraud-prevention, and dispute records	Stores one-time coupon code, campaign type, discount terms, optional internal distributor note, Stripe coupon/promotion identifiers, creator/disable/redeemer attribution, and redemption timestamps. Redeemer email and user ID are removed when the redeemer’s account is deleted; admin email attribution is limited to internal staff audit context. Coupon email fields are excluded from the Redshift ODS warehouse view
Amplitude analytics events	Per Amplitude default retention	Usage events and session metadata exported to Amplitude for product analytics; no conversation content
Google Analytics / Google Ads conversion events	Per Google account retention configuration	Web analytics and conversion events exported to Google for product analytics, advertising attribution, and conversion measurement. Sign-up, login, and purchase enhanced-conversion events include hashed email match data generated by the Google tag; no conversation content
Meta Pixel / Conversions API conversion events	Per Meta account retention configuration	Advertising attribution and conversion events exported to Meta for sign-up and purchase measurement. Events may include hashed email, hashed CREAO user identifier, IP address, user agent, Meta browser/click identifiers (`_fbp`, `_fbc`), and Meta click ID (`fbclid`); no conversation content
Reddit Pixel / Conversions API conversion events	Per Reddit account retention configuration	Advertising attribution events exported to Reddit for page visits, pricing views, sign-up, and purchase measurement. Events may include the Reddit browser identifier (`_rdt_uuid`), Reddit click ID (`rdt_cid`), a stable conversion ID, SHA-256-hashed email, a namespaced SHA-256 hash of the CREAO user identifier, IP address, and user agent; no conversation content
Impact.com conversion events	Per Impact.com account retention configuration	Affiliate attribution and paid-conversion records exported to Impact.com for eligible sign-up, subscription, and credit-purchase events. Events may include SHA1-hashed email, CREAO user identifier, Impact click ID (`IM_REF`), order ID, conversion timestamp, event type, subscription or purchase amount, and promo code; no conversation content
CREAO reflection interaction analytics, retrieval records, and playbooks	Until account deletion, thread deletion for persisted snippets, agent-app deletion for that agent’s shared playbooks, or per CREAO service retention policy	User chat turns and selected assistant final turns (with compact tool metadata) may be processed for interaction-quality monitoring; retrieval queries and resulting profile/playbook snippets may be processed to build prompt context; generated playbook records may be retrieved by CREAO for display in Settings → Personalization. For a shared team agent, deleting the Agent App triggers a best-effort purge of that agent’s playbook bucket from CREAO’s reflection service. CREAO can disable this by removing reflection configuration. You may request deletion of reflection-held playbook data through privacy@creao.ai
Acquisition attribution	Until account deletion	UTM parameters, platform click IDs (including `gclid`, `gbraid`, `wbraid`, `fbclid`, `ttclid`, `msclkid`, `twclid`, and `rdt_cid`), Meta browser/click identifiers (`_fbp`, `_fbc`), referring site, landing path, first-touch timestamp, last-touch timestamp, owner-derived affiliate handle or referral code from public shared-thread and agent-install pages, KOL-defined affiliate sub-tracking parameters such as `media` or `sub_id`, and the client type used at sign-up and on the most recent session (native iOS or Android app, mobile browser, desktop browser, or desktop app) together with the native app version, stored with the account to measure campaign effectiveness, credit creators, affiliate partner distribution, and signup journeys. Deleted when the account is deleted (FK cascade)
Action approvals	Until the parent is deleted	Proposed connector-write payloads, validation previews, approval/rejection audit metadata, and apply results for guarded actions. For Agent App actions, deleted when the Agent App is deleted (FK cascade). For chat thread actions, retained until the thread is deleted or the user deletes their account
Agent Store views	90 days	Per-impression rows (authenticated viewer ID when available plus a 16-char SHA-256 hash of the IP) used for view counts, deduplication, abuse prevention, and trending ranking. Pruned daily by an automated cron at 03:30 UTC
Agent Store engagement	Until store agent or account deletion	Likes, bookmarks, shares, and written reviews (with star rating) on Agent Store listings. Deleted when the Agent Store agent is removed (FK cascade) or when the user account is deleted
Discover Skills install activity (`discover_skill_installs`)	Until account deletion	One row per Discover Skills entry installed by a user, used for idempotent install counts and product analytics. Deleted when the account is deleted (FK cascade)
Discover agent run activity (`store_invocation_observations`)	Until account deletion	Account-linked chat run metadata used to analyze completion and repeat use of agents copied from Discover/store listings. Historical records remain if the copied agent or original listing is deleted; they are explicitly deleted when the executing account is deleted. Internal ODS warehouse copies follow the same deletion controls. No prompts, responses, or generated file contents are stored in these records
Suggested agent execution activity (`suggested_agent_runs`)	Until account deletion	Account-linked execution metadata, retained across ordinary agent deletion and removed when either the owning or executing account is deleted. Internal warehouse copies follow source deletion. No prompts or outputs are stored
Account-level custom skills (`custom_skills`)	Until account deletion	Skill name, description, SKILL.md content, optional supporting files, source URL, tags, and timestamps for custom skills you install or author from `agent.creao.ai/skills` or CREAO CLI (`/v1/skills`). Disabling a skill unmounts it from the sandbox but does not delete the row. Deleted when the account is deleted
File-based Agent Brain profile, curation jobs, and agent-authored skills	Thread notes: until the source thread is deleted. Terminal job rows: 30 days. `USER.md` and skills: until removed by curation/the agent or account deletion	For accounts assigned to the file-based mechanism, CREAO stores a bounded `USER.md` profile, thread-scoped notes, reusable `agent-` skill packages, and operational job metadata identifying which completed thread boundary awaits or completed review. Job rows do not copy message, note, profile, or skill content; active and retryable jobs remain until they settle, terminal rows are purged after 30 days, and deleting the source thread or account removes its rows immediately. During long conversations, recent messages and existing thread notes may also be sent to DeepSeek V4.1 Flash every ten user turns to refresh concise thread notes. After a session, the completed conversation, thread notes, profile, and relevant skills may be sent to DeepSeek V4.1 Flash for holistic curation independently of the chat model selected. The curator may rewrite the profile and create, rewrite, merge, or remove agent-authored skills; transient failures retry. A new conversation loads the current profile into the agent’s context. An open conversation keeps the copy it started with, stored on that conversation’s record and removed with it, and refreshes that copy only after about an hour without messages, when you switch the chat model, or when the conversation’s context is compacted; a `USER.md` change reaches an ongoing conversation at the next of those points. Matching skills load on demand. Agent-authored skills remain separate from user-installed `custom-` skills and cannot overwrite them. Workspace storage is removed through the same account-deletion path as other account files.
Account skill enablement (`users.builder_options.enabledSkillIds`)	Until account deletion	The list of skill ids currently enabled for Agent Brain on this account. Disable removes an id from the list without deleting the skill. Cleared when the account is deleted
File-based Agent Brain contexts (`memories/contexts/`)	Until you delete the context or its account workspace data is deleted through the account-deletion process	Private context files, descriptions, archive status, update time and source-thread references. You can archive, restore or delete any context from Memory. Archiving hides it from the index used for new snapshots but retains its files; existing conversations may retain an earlier index until their normal refresh boundary. Delete removes the context’s stored files and catalog/index entry, but does not erase source conversations or earlier conversation snapshots. Deleting a source conversation does not automatically delete a context derived from it. Context files have no automatic expiry and are handled as account workspace content during account deletion.
Job applications (`career_applications`)	24 months after the final hiring decision	Stores applicant name, email, supplied links, per-question answers, hiring status/interview round, and CV metadata (original filename, S3 storage key, MIME type, size, content hash). The CV file itself lives in CREAO’s private upload bucket under `careers/applications/` and is deleted with the record. Retained to run the hiring process, to answer follow-up questions from candidates, and to satisfy record-keeping obligations for recruitment decisions; deleted or anonymized afterwards unless a legal or dispute hold applies. Applicants may request deletion at any time at support@creao.ai
Candidate identity links (`career_candidate_links`, `career_candidate_match_dismissals`)	Lifetime of the linked applications	Records that two applicant email addresses belong to the same candidate (or that staff dismissed a suggested match), so repeat applications are recognised as one person rather than duplicates. Contains only the two email addresses and the staff user ID that made the decision. Deleted with the underlying applications
Job-alert subscriptions (`career_job_alerts`)	Until unsubscribe request, or 24 months of inactivity	Stores the subscriber’s email address, alert scope (role/category/all), and the job or category the subscription came from. Used solely to send new-role notifications. Removed on request to support@creao.ai
Affiliate commission history (`affiliate_commission_rate_history`)	Campaign duration + 12 months	Stores affiliate link ID, KOL user ID, commission rate, effective timestamp, and admin creator identifier for revenue-share calculation, payout audit, and dispute handling. Rows are deleted when the affiliate link is deleted
Campaign enrollment records (`s1_trading_challenge_participants`)	Campaign duration + 12 months after results	Used for eligibility, audit, fraud prevention, prize administration, and support. Includes CREAO account identifiers, submitted WEEX UID/email, linked public X profile metadata, Discord enrollment requirement status, user-chosen public leaderboard agent name/slug, readiness/freeze status, and final rank/PnL. Total CREAO credits consumed may be computed from billing logs to determine prize eligibility; public pages may disclose eligibility status or prize-claim rank, while exact credit totals are visible only to the participant and CREAO admins. Deleted or anonymized after the retention period unless a legal, tax, security, or dispute hold applies; account deletion removes or anonymizes personal data where legally required. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls
Campaign enrollment records (`s2_trading_challenge_participants`)	Campaign duration + 12 months after results	Used for eligibility, audit, fraud prevention, prize administration, and support. Includes CREAO account identifiers, submitted debot email, submitted Robinhood Chain wallet address, enrollment ETH balance status, Agent API Trigger setup metadata, user-chosen public leaderboard agent name/slug, readiness status, and final rank/PnL/score. Deleted or anonymized after the retention period unless a legal, tax, security, or dispute hold applies; account deletion removes or anonymizes personal data where legally required. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls
Campaign leaderboard snapshots (`s1_trading_challenge_leaderboard_snapshots`)	Campaign duration + 12 months after results	Stores time-series equity, PnL, and trade-count snapshots used for ranking, audit, and public results. Deleted or aggregated/anonymized after the retention period unless needed for prize, fraud, security, legal, or dispute records. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls
Campaign trade and leaderboard records (`s2_trading_challenge_trade_imports`, `s2_trading_challenge_leaderboard_snapshots`)	Campaign duration + 12 months after results	Stores imported Robinhood Chain/debot trades and time-series ETH equity, PnL, score, and trade-count snapshots used for ranking, audit, and public results. Deleted or aggregated/anonymized after the retention period unless needed for prize, fraud, security, legal, or dispute records. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls
Campaign Agent webhook invoke records (`s2_trading_challenge_api_invokes`)	Campaign duration + 12 months after results	Stores Debot → community Agent webhook wrapper invoke history for Season 2: size-bounded callback payload (or a truncated preview when oversized), payload hash, Debot event id, dry-run flag, campaign phase, Platform run id when available, HTTP status, and dispatch outcome (`accepted` / `dispatch_failed` / `rejected`). Used for My Entry history, idempotent Debot retries, admin dry-run testing, and support. Cascade-deleted with the participant row; otherwise deleted or anonymized after the retention period unless needed for prize, fraud, security, legal, or dispute records. Internal ODS warehouse views mirror metadata under the same deletion controls and do not expose raw callback payloads
Campaign Kite side-event records (`s2_trading_challenge_kite_side_events`)	Campaign duration + 12 months after results	Optional Season 2 Kite Agentic Wallet side-event progress: cloned Kite agent app ID, installed Passport skill paths, confirmed Base wallet address, deposit verification timestamp and USDC balance, submitted Base transaction hash, verification/completion timestamps, and reward-credit grant status/timestamp for the Kite completion bonus. Used for side-event eligibility, leaderboard Kite badge/+100 score bonus, support, and fraud prevention. Cascade-deleted with the participant row; otherwise deleted or anonymized after the retention period unless needed for prize, fraud, security, legal, or dispute records. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls. No wallet private keys are stored
Campaign admin action records (`s1_trading_challenge_admin_actions`)	Campaign duration + 12 months after results	Internal audit trail for admin operations. Actor email is internal staff, not user PII. Deleted after the retention period unless needed for prize, fraud, security, legal, or dispute records. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls
Campaign admin action records (`s2_trading_challenge_admin_actions`)	Campaign duration + 12 months after results	Internal audit trail for S2 admin operations. Actor email is internal staff, not user PII. Deleted after the retention period unless needed for prize, fraud, security, legal, or dispute records. Internal ODS warehouse views (`creao.ods.community_v1_*`) mirror these records for analytics under the same deletion controls
Slide decks and their version history (`decks`, `deck_revisions`, `deck_export_jobs`)	Until account deletion	Every accepted version of a deck is retained, not just the latest — asking the agent to change a deck adds a version rather than replacing one. Deleting a thread does not remove that thread’s decks. Deleting your account does: the deck records, their version history, their export jobs, and the stored archives and rendered PDF/PPTX/image/HTML outputs are all removed within 30 days of account closure
Scheduled-run email deliveries (`schedule_email_deliveries`)	30 days	Delivery records (schedule ID, run status, delivery outcome, error) created each time CREAO sends a scheduled-run summary email. Deleted automatically by nightly cron after 30 days. No email content is stored
Scheduled-run reconnect warnings (`connector_warning_episodes`, `app_sessions.warnings`, `app_schedules.last_run_warnings`)	A failure period closes when a later run uses the connection successfully, or after 30 days without another failure; closed records are deleted 180 days after they close; all records are removed on account deletion. Warnings stored on a run or schedule are kept and deleted with that run or schedule	Identifiers only (user, connection, provider, run and schedule IDs), how the failure was detected, and timestamps. No connector account name, email address, third-party account ID, token or content. Shown only to the run’s owner
Hidden duplicate connector connections (`mcp_servers` rows marked `superseded`)	Until the visible connection holding the same third-party authorization is disconnected or deleted, or until account deletion	When one person has more than one active connection of the same connector, CREAO keeps the newest and hides the others. A hidden connection is not listed, selected or used, and keeps its stored credentials and upstream authorization. Disconnecting or deleting the visible connection also deletes a hidden one that holds the same third-party authorization (the same Pipedream account or GitHub App installation). For connectors whose credentials CREAO stores per person (X, TikTok, Etsy, Meta Ads, Instagram, MSC, CMA CGM, Hapag-Lloyd, CargoAI), disconnecting deletes the hidden copies as well. A hidden connection to a different third-party account remains until account deletion.
Account data	Until account deletion	Deleted within 30 days of account closure (per GDPR Article 17 and CCPA requirements)
Account deletion requests (`account_deletion_requests`)	Minimum 5 years, or longer where required by applicable law	A record of each request to delete an account and how an admin handled it. Holds request metadata (status and timestamps, source IP), an email/name snapshot captured at request time, an optional selected reason code (or codes) and optional free-text detail on why the user is leaving, and any admin handling notes. This record deliberately has no foreign key to the user, so it survives deletion of the underlying account in order to evidence — for legal, compliance, and audit purposes — that the deletion request was received and actioned. Only non-PII fields (identifiers, status, timestamps, and the closed-set reason codes) are mirrored to the internal ODS warehouse; the email/name snapshot, IP address, cancel token, free-text reason detail, and admin notes are excluded from that view
Developer profile (`developer_profiles`)	Until CREAO account deletion	Optional CREAO CLI console profile fields (display name, company, website) on `developer.creao.ai/cli`, keyed to your CREAO account. Hard-deleted explicitly in the CREAO account-deletion handler. Not the Developer Platform USD account
Developer Platform wallet (`developer_wallets`)	Until Developer account closure or a privacy erasure request	USD wallet for the Developer product (`developer.creao.ai`): balance in cents and the login binding to your CREAO account. Created only when you activate a Developer account. Deleting the CREAO account does not remove this row. Closed with a future Developer close-account flow, or on request to privacy@creao.ai
Developer Platform wallet ledger (`developer_wallet_entries`)	Until Developer account closure or a privacy erasure request	Signed USD-cent movements for the Developer wallet (Stripe Checkout top-ups, later admin grants and run debits), including the Stripe Checkout session id (or other globally unique ref) used for idempotency. Deleting the CREAO account does not remove these rows. Closed with the Developer account, or on request to privacy@creao.ai
Developer Platform projects (`developer_projects`)	Until Developer account closure or a privacy erasure request	Project rows for the Developer product, including the default project created at activation and any further projects you create. Each row stores a name you choose (up to 100 characters), shown only to the owning Developer account; the name may incidentally include personal information. Belong to the Developer account, not the CREAO account. Deleting the CREAO account does not remove these rows. Closed with the Developer account, or on request to privacy@creao.ai
Developer Platform `/v2` request logs (`developer_v2_http_requests`)	Until Developer account closure or a privacy erasure request	One row per authenticated project-key `/v2/` request that passes authentication and account rate-limit checks. Stores Developer account/project/key identifiers, method, route pattern and path, handler, status/error code, run/agent/conversation links, timing, byte counts, and settled sell-price USD cents after a run settles. No request payloads, response payloads, headers, raw project keys, or tokens are stored in this request log. Deleting the CREAO account does not* remove these rows. Closed with the Developer account, or on request to privacy@creao.ai. Raw path is excluded from Console Analytics responses
Developer Platform `/v2` run data (`developer_v2_runs`)	Until Developer account closure or a privacy erasure request	Hosted and general-agent `/v2` executions: request identifier, mode, status, timing, input JSON, result JSON, per-model usage, settled sell-price USD cents, upstream cost used only to compute that sell price, error metadata, and the webhook delivery timestamp. Belong to the Developer account. Deleting the CREAO account does not remove these rows. Closed with the Developer account, or on request to privacy@creao.ai. Console Analytics never returns input, result, error-message text, or upstream cost
Linked social profiles	Until account deletion or auth-state revocation	X / Discord profile data and OAuth tokens. Discord tokens are reused for server-membership verification; X tokens are held only as proof of the link and are not used for outbound reads. Bindings are permanent (the same external identity cannot be re-linked to a different CREAO account, to prevent reward-farming). Deleted when the CREAO account is deleted (FK cascade) and also automatically wiped whenever authentication state is revoked (password reset, admin force-logout, account ban) so an attacker-attached link cannot outlive the security event. Provider-side revocation (X / Discord settings) immediately invalidates the stored token but leaves the binding row in place
Etsy connector credentials and shop binding	Until disconnected or account deletion	Encrypted OAuth access/refresh tokens, Etsy user/shop identifiers, shop display name, granted scopes, and expiry timestamps. Tokens and PKCE verifier rows are excluded from the analytics warehouse; buyer email and street-address fields are not stored in the connection record and are filtered before agent use
Payment data	As required by law	Managed by Stripe; CREAO does not store card numbers

Contact

For privacy and compliance inquiries or Data Processing Agreement (DPA) requests, contact privacy@creao.ai. CREAO, Inc. acts as the data controller for personal data processed through the platform.

Get Started

Features

Agent Brain

Advanced

Trust & Safety

AI & Model Usage

Connector Data Access

Slack Agent App (Inbound)

Skill Data Handling

Subprocessors

Billing Routing

Data Retention

Contact

​AI & Model Usage

​Connector Data Access

​Slack Agent App (Inbound)

​Skill Data Handling

​Subprocessors

​Billing Routing

​Data Retention

​Contact

AI & Model Usage

Connector Data Access

Slack Agent App (Inbound)

Skill Data Handling

Subprocessors

Billing Routing

Data Retention

Contact