What data does CREAO collect?
What data does CREAO collect?
CREAO collects the minimum data necessary to provide the service:
- Account data — email address, name, and authentication credentials
- Conversation data — messages, files, and artifacts you create during chat sessions
- Usage data — credit consumption, feature usage, and session metadata for billing and product improvement
- Memory data — facts and preferences the super agent saves on your behalf (you can view, search, and delete these at any time)
GDPR compliance
GDPR compliance
CREAO is designed with GDPR principles in mind:
- Lawful basis — we process data based on contractual necessity (to provide the service) and legitimate interest (to improve the product)
- Data minimization — we collect only what is needed to deliver the service
- Right to access — you can export your data at any time
- Right to deletion — you can delete your account and all associated data
- Right to portability — conversation and file data can be exported in standard formats
- Data processing — see the Subprocessors section below for a list of third parties that process data on our behalf
- International transfers — user data is stored in the United States. For EU users, data transfers are governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Chapter V
- Data Processing Agreement — enterprise customers can request a DPA by contacting privacy@creao.ai
CCPA compliance
CCPA compliance
For California residents, CREAO provides:
- Right to know — what personal information we collect and how it is used
- Right to delete — request deletion of your personal information
- Right to opt-out — we do not sell personal information
- Non-discrimination — exercising your rights does not affect pricing or service quality
Cookie policy
Cookie policy
AI & Model Usage
Your data is not used to train AI models. Conversations and files sent to AI providers (Anthropic, OpenAI, Google, MiniMax, xAI) are processed under API agreements that prohibit use of your data for model training. This includes image inputs sent for generation tasks (for example, image-to-video with Veo). Providers may retain data briefly for abuse monitoring and safety as required by their terms, but never for training purposes.
How is data sent to AI models?
How is data sent to AI models?
When you chat with the super agent, your messages and relevant context (files, memory, skill instructions) are sent to the selected LLM provider via their API. All API calls use encrypted connections. Responses are streamed back to your browser in real time.
Which AI providers does CREAO use?
Which AI providers does CREAO use?
CREAO supports multiple LLM providers:
- Anthropic (Claude Opus, Sonnet, Haiku)
- OpenAI (GPT-4o, GPT-4o mini)
- Google (Gemini Pro, Gemini Flash, Veo for video generation)
- MiniMax (MiniMax M2.7)
- xAI (Grok)
What about code execution?
What about code execution?
Code generated by the AI runs in an isolated sandbox. The sandbox has no access to other users’ data, no persistent network access to internal systems, and is destroyed after the session ends. Generated files are stored encrypted and associated only with your account.
Connector Data Access
Connectors provide scoped access to third-party systems (OAuth/API-key based). See Skills and Connectors for the full feature overview and Security for auth model and security controls.| Connector group | Auth mode | Typical data categories | Revocation |
|---|---|---|---|
| Google Workspace (Gmail, Calendar, Docs, Sheets, Drive, Tasks) | OAuth | Mail, calendar events, docs, spreadsheets, files, tasks | Disconnect in CREAO + revoke in Google account if needed |
| Google Marketing (Ads, Analytics, Search Console) | OAuth | Campaign/reporting and web analytics data | Disconnect in CREAO + revoke in Google account if needed |
| Microsoft (Outlook, Teams, OneDrive, Word, Excel) | OAuth | Mail, collaboration messages, files, documents, workbook data | Disconnect in CREAO + revoke in Microsoft account if needed |
| Collaboration (Slack, Discord, Notion, Asana, Linear) | OAuth or API key | Messages, channels/pages, tasks/issues/project data | Disconnect in CREAO + revoke in provider account |
| Developer (GitHub) | OAuth | Repository metadata/content and issue/workflow data | Disconnect in CREAO + revoke in GitHub settings |
| Social/commerce (X, YouTube, Reddit, Shopify, Telegram) | OAuth or token | Social content, publishing metadata, storefront data, bot messaging data | Disconnect in CREAO + revoke in provider account |
Skill Data Handling
Built-in skills are instruction packages — they do not create new third-party data sharing paths by themselves. See Skills and Connectors for the full feature overview and Security for safety boundaries. Built-in skills may operate on:- User prompts and conversation context
- User-provided files and generated artifacts
- Connected-service data when relevant connectors are authorized
Subprocessors
The following third-party services process data on behalf of CREAO:| Subprocessor | Purpose | Data Processed |
|---|---|---|
| AWS (Amazon Web Services) | Cloud infrastructure, data storage, compute | All service data |
| Anthropic | LLM provider (Claude models) | Conversation messages, context |
| OpenAI | LLM provider (GPT models) | Conversation messages, context |
| Google Cloud | AI provider (Gemini models, Veo video generation) | Conversation messages, context, user image inputs for image-to-video generation |
| MiniMax | LLM provider (MiniMax models) | Conversation messages, context |
| xAI | LLM provider (Grok models) | Conversation messages, context |
| E2B | Sandbox execution | Code, files during execution |
| Stripe | Payment processing | Billing and payment data |
| Cloudflare | CDN, DDoS protection, bot detection | Request metadata |
| Sentry | Error monitoring | Error diagnostics (no conversation content) |
| Pipedream | Connector OAuth and integration relay | OAuth tokens for connected services |
Data Retention
| Data Type | Retention Period | Notes |
|---|---|---|
| Conversations & messages | Until deleted by user | Users can delete individual threads or all data |
| Generated files | Until deleted by user | Stored encrypted in cloud storage |
| Sandbox environments | Session duration + 30 min idle | Destroyed after inactivity timeout |
| Memory entries | Until deleted by user | Viewable and deletable from the Memory page |
| Audit logs | 90 days | Immutable, used for security monitoring |
| Account data | Until account deletion | Deleted within 30 days of account closure (per GDPR Article 17 and CCPA requirements) |
| Payment data | As required by law | Managed by Stripe; CREAO does not store card numbers |