Privacy Policy

creavio PRIVACY POLICY
Last Updated: October 13, 2026

This Privacy Policy describes how creavio, Inc. ("creavio," "we," "us," "our") collects, uses, shares, and protects information when you use our platform and services.

1. INFORMATION WE COLLECT
1.1. Information You Provide Directly. When you create an account or use the Platform, we collect: your name, email address, password, payment information (processed by Stripe), business name and details, and any other information you choose to provide.
1.2. Information Collected Automatically. When you access the Platform, we automatically collect: IP address, device type and operating system, browser type and version, pages visited and features used, and usage analytics.
1.3. User-Uploaded Content. Creators upload content to the Platform including: photographs, videos, graphics, contracts and documents, and other files related to their creative business.
1.4. Client Data. Creators store information about their clients on the Platform, including: client names, email addresses, phone numbers, mailing addresses, booking details, payment history, and communications.

2. HOW WE USE INFORMATION
We use information we collect to:
(a) Operate, maintain, and improve the Platform;
(b) Process payments and manage subscriptions;
(c) Send transactional communications (account confirmations, invoices, booking notifications, contract delivery);
(d) Send product updates and marketing communications (with opt-out);
(e) Analyze usage patterns to improve features and user experience;
(f) Comply with legal obligations and enforce our Terms of Service;
(g) Detect, prevent, and address fraud, abuse, and security issues.

3. LAWFUL BASIS FOR PROCESSING (GDPR)
For users in the European Economic Area (EEA) and United Kingdom, we process personal data on the following legal bases:
(a) Contract Performance. Processing necessary to provide you with the Platform services you signed up for.
(b) Legitimate Interests. Processing for analytics, security, fraud prevention, and service improvement, where our interests do not override your rights.
(c) Consent. Processing based on your explicit consent, such as marketing communications. You may withdraw consent at any time.
(d) Legal Obligation. Processing required to comply with applicable laws, regulations, or legal proceedings.

4. INFORMATION SHARING & SUB-PROCESSORS
We do not sell personal information. When you choose to run an originality check, you direct us to send the selected text to an outside checking service; under Cal. Civ. Code 1798.140(ad)(2)(A) that is a disclosure you direct, not a sale. Because that service has no contract with us, regulators may treat it as a sale or sharing (11 CCR 7050(e)), so you can opt out at any time by not ticking, or by withdrawing consent in the extension's Settings, which stops all originality checks. We share information with the providers below only as necessary to operate the Platform, and with the writing-checks provider described under "Third parties" below. We engage the following categories of providers, which are sub-processors under our Data Processing Addendum:
(a) Cloud infrastructure & hosting;
(b) Payment processing;
(c) Email and SMS and MMS delivery;
(d) AI processing under enterprise or API terms that prohibit training on your data;
(e) Search and SEO data (aggregate only, no personal data);
(f) Media processing (image, print and video);
(g) Analytics; and
(h) Social, advertising, and business platforms that you connect (used only when a Creator or authorized Agency connects an account, and limited to publish, manage, and read access for that connected account). Google account connections are described in Section 14. That section does not add Google as a sub-processor.
Google Analytics 4 (within category (g)) receives online identifiers including IP address, browser and device information, pages viewed, and events. Under the California Consumer Privacy Act, as amended by the CPRA, this constitutes "sharing" of personal information for cross-context behavioral advertising. You may opt out of this sharing as described in Section 6.4 (Do Not Sell or Share My Personal Information).
Third parties. We also disclose information to a plagiarism-search and AI-written-text-detection provider for creavio write, which is a third party. Our only such provider is Copyscape (Indigo Stream Technologies Ltd.). Copyscape provides its service to us on its standard terms, and no contract between us contains the terms California law requires of a service provider (Cal. Civ. Code 1798.140(ag)(1)), so it is a third party, not our service provider. It receives the text a creavio write user selects, only when that user clicks Check, and only for the checks the user picks. It does not receive the user's name, email address, or the site the text came from. We tell users not to run either check on text that contains personal information about anyone, but we do not screen or block what they select, so any personal information in checked text is disclosed to this third party. See Section 7(f), Section 10, and the creavio write privacy policy at creav.io/legal/write-privacy.
A current, itemized sub-processor list, including each sub-processor's name, location, and processing purpose, is available to customers on request under our Data Processing Addendum by contacting [email protected]. We will notify Creators of material sub-processor changes at least 30 days before they take effect. We may also disclose information when required by law, legal process, or government request, or to protect the rights, safety, or property of creavio, our users, or the public.

5. CREATOR CLIENT DATA
5.1. Creators are the Data Controllers for all client data they collect and store on the Platform (client names, emails, phone numbers, addresses, booking details, contracts, invoices, photos, and other information).
5.2. creavio is the Data Processor, processing client data on behalf of Creators as defined under GDPR Article 28.
5.3. Creators are solely responsible for their own privacy practices with their clients, including obtaining appropriate consent for data collection and use.
5.4. For details on how we process client data on behalf of Creators, see our Data Processing Addendum.
5.5. Agency-Managed Workspaces. Some workspaces on the Platform are operated by an agency on behalf of a brand or business under creavio's Agency tier. Where a workspace is agency-managed, the agency's authorized personnel can access that workspace's data through an audited, revocable session, and the agency, or the brand, or both, not creavio, is the data controller responsible for that data and for the privacy notices and consents owed to the brand's customers and contacts. creavio processes such data only on the agency's instructions. If you are a brand or a brand's customer and have questions about an agency-managed workspace, contact the agency that manages it; you may also reach us at [email protected].

6. YOUR RIGHTS
6.1. All Users. Regardless of your location, you have the right to: access your personal data, correct inaccurate data, request deletion of your data, request a portable copy of your data (data export), and manage your data through Settings > Data & Privacy in your dashboard.
6.2. EEA and UK Users. In addition, you have the right to: restrict processing of your data, object to processing based on legitimate interests, withdraw consent at any time (without affecting prior processing), and lodge a complaint with your local supervisory authority.
6.3. California Users. Under the California Consumer Privacy Act (CCPA), you have the right to: know what personal information we collect and how it is used, request deletion of your personal information, opt out of the sale of personal information, and not be discriminated against for exercising your privacy rights. We do not sell personal information. When you choose to run an originality check, you direct us to send the selected text to an outside checking service; under Cal. Civ. Code 1798.140(ad)(2)(A) that is a disclosure you direct, not a sale. Because that service has no contract with us, regulators may treat it as a sale or sharing (11 CCR 7050(e)), so you can opt out at any time by not ticking, or by withdrawing consent in the extension's Settings, which stops all originality checks.
6.4. DO NOT SELL OR SHARE MY PERSONAL INFORMATION (CALIFORNIA). Under the California Consumer Privacy Act (CCPA) as amended by CPRA, "sharing" personal information includes disclosing it to third parties for cross-context behavioral advertising, even without payment. Because creavio uses Google Analytics 4, which receives identifiers (IP address, device ID, cookies) that may be used for advertising purposes, California residents have the right to opt out of this sharing.

To opt out: (a) Use the "Do Not Sell or Share" link in the footer of creav.io, or (b) enable the Global Privacy Control (GPC) signal in your browser, or (c) email [email protected] with subject line "Do Not Sell or Share." creavio honors GPC signals automatically and will disable GA4 data collection for your session when GPC is detected. A Do Not Sell or Share choice and a Global Privacy Control signal also stop originality checks: creavio withdraws originality consent, and a check request that carries the GPC signal is refused before any text is sent.

We do not sell personal information. When you choose to run an originality check, you direct us to send the selected text to an outside checking service; under Cal. Civ. Code 1798.140(ad)(2)(A) that is a disclosure you direct, not a sale. Because that service has no contract with us, regulators may treat it as a sale or sharing (11 CCR 7050(e)), so you can opt out at any time by not ticking, or by withdrawing consent in the extension's Settings, which stops all originality checks. creavio does NOT share personal information for targeted advertising beyond GA4 analytics. We do not share data with data brokers.

6.5. GLOBAL PRIVACY CONTROL (GPC). If your browser transmits a Global Privacy Control signal (navigator.globalPrivacyControl = true), creavio will treat it as a valid opt-out of the sharing of your personal information for cross-context behavioral advertising, consistent with California law. When GPC is detected, Google Analytics 4 will be disabled for your session. Essential cookies (authentication, security) are not affected. The same signal also stops originality checks, as Section 6.4 describes.

6.6. How to Exercise Your Rights. You may exercise your rights by emailing [email protected] or using the Settings > Data & Privacy section in your dashboard.

7. DATA RETENTION
(a) Account Data. Retained for the duration of your account plus 30 days after account deletion.
(b) Legal Records. DMCA notices, contract signatures, and payment records are retained for 7 years per legal requirements.
(c) Email Logs. Retained for 90 days.
(d) Analytics Data. Retained for 12 months.
(e) Backups. Purged within 30 days of deletion.
(f) creavio write Checks. creavio does not store text sent for plagiarism or AI-written-text checks. Our provider for both checks, Copyscape (Indigo Stream Technologies Ltd.), has told us in writing that it keeps that text for 14 days and then deletes it, that Copyscape staff can access the text during those 14 days, and that it does not use it to improve its service or train algorithms. For the plagiarism check, Copyscape searches the web for the text, or for parts of it, through Google; Copyscape has not told us exactly what it sends to Google. Copyscape has not signed a data processing agreement with us, so do not run either check on text that contains personal information about anyone. See the creavio write privacy policy at creav.io/legal/write-privacy.

8. COOKIES & TRACKING
8.1. Essential. Authentication session token (stored in localStorage) and portal session cookie (HttpOnly). These are required for the Platform to function.
8.2. Analytics. Anonymous usage data to understand how the Platform is used and to improve features.
8.3. Analytics and Advertising Cookies. We use Google Analytics 4 (GA4), which sets analytics cookies (_ga, _gid) that may be used to inform advertising. You may opt out via the consent banner or at creav.io/privacy-choices. This paragraph is only about those cookies on creavio's own website. It is not about Google user data received from a Google API you connect. That data is Section 14, and creavio does not use it to inform advertising on this website.
8.4. How to Control Cookies. You can manage cookies through your browser settings. Disabling essential cookies may prevent you from using the Platform.

9. DATA SECURITY
We implement appropriate technical and organizational measures to protect your data, including:
(a) Encryption in transit (TLS) and at rest;
(b) Tenant data isolation (all queries scoped to your account);
(c) Regular security monitoring and logging;
(d) PBKDF2 password hashing with 100,000 iterations;
(e) AES-256-GCM encryption for sensitive data such as contract signatures;
(f) Role-based access controls and secure file storage.

10. INTERNATIONAL DATA TRANSFERS
Except as stated in the next paragraph, data is processed in the United States and other countries where Cloudflare operates infrastructure. For transfers of personal data from the EEA or United Kingdom, we rely on Standard Contractual Clauses as approved by the European Commission to ensure adequate protection of your data.
Exception for creavio write Checks. Text sent for plagiarism or AI-written-text checks goes to Copyscape (Indigo Stream Technologies Ltd.). Copyscape has not told us in which countries it processes that text. Copyscape's terms are governed by the laws of Gibraltar; that is a choice of law, not a statement of where the text is processed. We have no Standard Contractual Clauses or other transfer agreement with Copyscape, so the protections described in the paragraph above do not apply to that text. For a transfer of that text from the EEA or the United Kingdom, we rely on your explicit consent, given when you tick Allow originality checks (GDPR Article 49(1)(a)), after you are shown these words: "It has not told us which countries it processes text in. If that is outside the US, the EU or the UK, there may be no legal finding that the country protects data adequately and no contract safeguards for your text." Do not run either check on text that contains personal information about anyone.

11. CHILDREN'S PRIVACY
creavio is not directed at children under 16. We do not knowingly collect personal data from children under 16. If we discover that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact [email protected].

12. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. Material changes will be communicated via email and in-platform notification at least 30 days before the effective date. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

13. CONTACT
Privacy inquiries: [email protected]
DMCA inquiries: [email protected]

14. GOOGLE USER DATA
14.1. Limited Use. creavio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is at https://developers.google.com/terms/api-services-user-data-policy. That page was last updated February 15, 2024. It limits use of this data to providing or improving user-facing features that are prominent in the requesting application's user interface. A transfer is allowed only to provide or improve those features with your consent, for security, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after your explicit prior consent. People may not read the data except with your affirmative agreement for the specific data, for security, to comply with applicable law, or when the data is aggregated and used for internal operations. creavio does not sell Google user data. creavio does not transfer it to advertising platforms, data brokers, or information resellers. creavio does not transfer, sell, or use it for serving ads, including retargeting, personalized, or interest-based advertising, except that a Google Ads connection is used only to operate and report on the advertising account you connected, which is the feature you turned on. creavio does not use Google user data from any other Google API to serve ads. creavio does not use Google user data to determine credit-worthiness or for lending. creavio does not use it to train AI models.

14.2. What this section is, and what it does not change. This section describes Google user data creavio accesses when you connect a Google account, how creavio uses it, where it is stored, when it is shared, and how you revoke access. It does not change Section 4, Section 7(f), Section 10, the Data Processing Addendum, or the sub-processors page. Google is not added there as a sub-processor. A Google account you connect is your account. Sending it what you ask creavio to send is your instruction to that account, not creavio hiring Google to process your client database. For the plagiarism check, Copyscape may still search the text through Google, as Section 7(f) already says. That is only the plagiarism check. Section 10 does not describe a Google search. The creavio write privacy policy at creav.io/legal/write-privacy remains the full disclosure for Google Docs, and this section does not change it.

14.3. Google sign-in. If you sign in, create an account, or link Google to an existing account, creavio asks Google only for the scopes openid, email, and profile. creavio does not ask for offline access. creavio receives the name, email address, Google account id, and verified-email flag that Google returns for that sign-in. creavio uses them only to create your account, sign you in, or link Google to an existing account. creavio stores the name, email address, and Google account id as account data for the period in Section 7(a). creavio uses the sign-in token to read that profile and does not store that Google access token. creavio does not store a Google refresh token for sign-in. creavio does not receive your Google password. Revoking creavio at the page in Section 14.11 does not delete the creavio account, and it does not remove the Google account id, the email, or the name. Unlinking Google sign-in in your creavio account settings removes the stored Google account id. Otherwise creavio keeps those for sign-in until you delete the account.

14.4. Google Analytics. creavio has two Google Analytics connections. Both ask for https://www.googleapis.com/auth/analytics.readonly. Neither writes to your Google Analytics property. creavio stores each connection's refresh token encrypted, the Google email on the connection, and the property you select. A short-lived access token may be cached for up to its expiry, at most one hour, so creavio does not request a new one on every call. creavio does not use those reports to advertise on creavio's website and does not sell them.

The reporting connection also asks for openid, email, and profile. creavio receives the accounts and properties your Google account can access, and the reports you open, including standard reports and realtime reports. creavio uses them to show that property's analytics in your account. Disconnecting that reporting connection deletes the connection and the reports creavio stored for it.

The page connection asks for analytics.readonly and openid email. It does not ask for profile. creavio uses it to read a 28-day report for the property you select, by page, of sessions, users, engagement rate, average session duration, and conversions, and to write those numbers onto pages in your account. Disconnecting that page connection deletes the connection. Report numbers creavio has written onto pages in your account are not removed by that disconnect. They remain in your account, and account deletion follows Section 7.

14.5. Search Console. creavio has two Search Console connections. creavio stores each connection's refresh token encrypted, the Google email on the connection, and the property you select. A short-lived access token may be cached for up to its expiry, at most one hour, so creavio does not request a new one on every call.

The read connection asks for openid, email, profile, and https://www.googleapis.com/auth/webmasters.readonly. Reads on that connection use webmasters.readonly on the property you select. creavio receives the sites your Google account can access and the search analytics it requests for that property, including queries, pages, clicks, impressions, click-through rate, and position. creavio uses them to show that site's search performance in your account. Disconnecting that read connection deletes the connection and the reports creavio stored for it.

The sitemap connection asks for https://www.googleapis.com/auth/webmasters and openid email. It does not ask for profile. creavio uses that grant to read search analytics for a property you selected and to write clicks, impressions, click-through rate, and position onto pages in your account. Sitemap submit for a property of yours that is not a hosted creav.io site uses that webmasters scope, through this sitemap connection. Sitemaps for hosted creav.io sites are submitted with creavio's own Google account, not with your grant. You do not have to connect Search Console for creavio to submit a sitemap for a hosted creav.io site. Disconnecting the sitemap connection deletes that connection. Search numbers creavio has written onto pages in your account are not removed by that disconnect. They remain in your account, and account deletion follows Section 7.

14.6. YouTube. creavio uses YouTube API Services. If you use creavio's YouTube features, you agree to the YouTube Terms of Service at https://www.youtube.com/t/terms. Google's privacy policy is at https://policies.google.com/privacy. YouTube Developer Policies section III.A.2 also names that policy at http://www.google.com/policies/privacy.

When you connect a YouTube channel, creavio asks for https://www.googleapis.com/auth/youtube.upload, https://www.googleapis.com/auth/youtube, https://www.googleapis.com/auth/youtube.readonly, and https://www.googleapis.com/auth/yt-analytics.readonly. creavio does not ask for https://www.googleapis.com/auth/youtubepartner. The connection asks Google for offline access, and creavio stores the access token and the refresh token encrypted. A separate revenue consent, after you turn revenue on for a channel you already connected, adds only https://www.googleapis.com/auth/yt-analytics-monetary.readonly. creavio saves that revenue grant only when Google returns the same channel you selected. If Google returns a different channel, creavio does not save the grant.

creavio uses the upload and channel scopes to publish the video you submit and to read the connected channel. On upload, creavio sends the title, the description, the privacy status, the tags, the category id, and selfDeclaredMadeForKids. The title is the one you supply, up to 100 characters. If you do not supply a title, creavio sends your post caption as the title, or the word Untitled when there is no caption. The description is the one you supply, up to 5000 characters. When the post has hashtags, one publish path appends them to the description and also sends them as tags. Tags are at most 30. The privacy status is public, unlisted, or private. If you do not set one of those, creavio sends unlisted. The category id is the one you set, or 22 when you do not set one. selfDeclaredMadeForKids is true only when you explicitly say yes. Otherwise creavio sends false. creavio then sends the video file. creavio reads the channel name, handle, and image. For a video published through creavio, creavio reads viewCount, likeCount, commentCount, and favoriteCount. With the analytics scope, creavio reads a daily report for the connected channel of views, estimatedMinutesWatched, averageViewDuration, and subscribersGained. That report is returned to your account and is not stored as its own table. creavio reads estimatedRevenue, estimatedAdRevenue, and cpm only when you asked for revenue, the separate revenue scope is granted, and a 24 hour notice that the revenue request was denied is not still in effect. After a denial, creavio does not request those three fields again for 24 hours. creavio does not manage content-owner assets or analytics groups.

creavio also calls YouTube with an API key, and not with your YouTube authorization, to search public videos for listening and to read a public subscriber count for a handle you look up.

YouTube API Services Developer Policies sections III.D.2 and III.E.4 (https://developers.google.com/youtube/terms/developer-policies) require an API client to delete stored YouTube data after you revoke access inside the client, to delete stored API data after you revoke access at Google's security settings, and to delete or refresh stored API data on the clocks in section III.E.4. creavio does only what the next paragraphs describe.

If you disconnect YouTube inside creavio, creavio asks Google to revoke the token first. It then clears the access token, the refresh token, the scopes, the channel id, the channel name, the handle, and the image, marks the connection disconnected, and replaces the connection metadata with a record that stored YouTube data is still being removed, before it deletes the other stored YouTube data. It deletes the snapshots, the post metrics, and the daily stats stored for that connection, of every age. It deletes every YouTube mention, every snapshot of a YouTube public subscriber count, and every YouTube influencer-stat row stored for your account, including rows newer than 30 days. It clears the provider response, the provider request id, and the reconciliation state on publish attempts for that connection. It does not clear the HTTP status or the error message on those attempts. If the connection has no post targets and that delete finishes, creavio deletes the connection row. If that row delete fails, or a post target exists, the row stays, with status disconnected, those YouTube fields empty, and that record removed. If the delete of stored YouTube data cannot finish, the connection is still disconnected, the tokens and channel fields above are already cleared, and that record stays. creavio logs the error, and the disconnect answer uses the code youtube_data_delete_incomplete. The daily job finishes that remaining delete the next time it reaches the connection. creavio does not, on that disconnect, delete the post you wrote, the target row, the YouTube video id, the video address, or the upload session address stored on the target. Deleting data stored by creavio does not delete the video or the channel on YouTube. To delete those, use YouTube.

Once each day, at 03:00 UTC, in the scheduled job creavio already runs, creavio checks up to 25 stored YouTube connections, continuing from the last connection it checked. When fewer than 25 remain, the next run starts from the beginning. If a connection still has YouTube data left from a disconnect that could not finish, creavio finishes that delete before it does anything else with that connection, and it does not refresh the token on that run. For each connection it checks that does not have that remaining work, it first deletes or clears stored YouTube API data older than 30 days. That delete does not depend on a successful refresh. It deletes post metrics, snapshots, and daily stats older than 30 days for that connection. A daily stat counts as older than 30 days when its date is before the UTC date of that cutoff. It clears the provider response, the provider request id, and the reconciliation state on publish attempts older than 30 days. It does not clear the HTTP status or the error message. If that aged-row delete cannot finish, creavio still deletes channel fields older than 30 days on that connection, logs the error, and does not refresh that connection on that run. The check continues with the other connections in that run, and the remaining aged rows wait until a later run reaches that connection again. When that aged-row delete finishes, creavio tries to refresh the authorization. A missing refresh token is not a revocation. If the access token is still usable, with an expiry at least 60 seconds ahead, creavio uses that access token. If the access token is missing or expired, creavio logs that the refresh token is missing and does not delete the connection. If Google rejects the refresh as invalid_grant, and no publish job for that connection is locked with a lock that has not expired, creavio deletes that connection's stored YouTube API data in the same way a disconnect does. If Google rejects the refresh as invalid_grant while a publish job is locked and the lock has not expired, creavio does not delete the tokens or the connection. It marks pending publish jobs superseded, leaves the locked job, and runs the full delete the next time the daily job checks that connection after the lock has expired. The 30 day cleanup for that connection has already run. If the refresh is not attempted, including when the Google client settings are missing, creavio logs that and does not delete the connection on that run. If the refresh fails for another reason, including a network error, an HTTP 429, or an HTTP 500, creavio logs that and does not delete the connection on that run. If the channel name, the handle, the image, or a cached YouTube field is older than 30 days, or has no refresh time, creavio deletes those fields when the channel read fails, when YouTube returns a different channel, when the refresh does not succeed, when the refresh token is missing, and when a publish is in progress. The cached fields are the channel id stored in connection metadata, the partner program mark, the revenue denial time, and the metadata refresh time. A channel record refreshed within 30 days stays in place when that read fails. On that 30 day clear, the account id, the tokens, the Google email, and the revenue setting stay. If the refresh succeeds and the channel read matches the connected channel, creavio stores the channel name, the handle, the image, the channel id, and the refresh time. The account id stays. If YouTube returns a different channel, creavio does not store that channel. creavio does not delete the tokens because of age. creavio also checks up to 25 accounts that still have a YouTube mention, a snapshot of a YouTube public subscriber count, or a YouTube influencer-stat row older than 30 days, continuing from the last account it checked, including an account with no YouTube connection. It deletes those aged rows. If one of those deletes cannot finish, creavio logs the error and retries that account on a later run. It does not skip ahead past the account that failed. When a run finishes every account it selected and fewer than 25 such accounts were selected, the next run starts from the beginning. A YouTube handle you typed into a client record or into settings is not deleted by the disconnect or by the daily job.

You can also revoke creavio at https://security.google.com/settings/security/permissions. creavio does not read that page. The daily job is how creavio learns that Google has rejected the grant. The job does not check every YouTube connection every day. Questions or complaints about these YouTube practices: [email protected].

14.7. Google Business Profile. If you connect Google Business Profile, creavio asks for https://www.googleapis.com/auth/business.manage. creavio reads the Business Profile accounts your Google account can access and stores the first account's name and id on the connection. If you submit a local post, creavio sends that post to a location on an account you connected. The post includes the text you submit, a language code (the one you set, or en when you do not), a topic type (the one you set, or STANDARD when you do not), and a call to action only when you supply one. Posts sent from the social scheduler always use en and STANDARD, and include your caption followed by your hashtags. creavio uses this access to list those accounts, to publish the post and any photo you submit, and to read the view and action counts Google reports for posts creavio published. creavio stores the connection tokens encrypted. Disconnecting the profile asks Google to revoke the token and removes the tokens from the connection. The account name on the connection, and the post record in your account, are not removed by that disconnect. They remain in your account, and account deletion follows Section 7.

14.8. Google Calendar. If you connect Google Calendar, creavio asks for https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.readonly. creavio reads busy times on your primary Google calendar. A busy time is a start and an end. That query does not give creavio the event title. creavio stores each busy interval with the label Busy, which creavio writes. It is not the event title from Google. creavio uses busy times so a booking page does not offer a slot that is already busy. When a booking should appear on that calendar, creavio creates an event. The event can include the title, description, start, end, and attendee email supplied for that booking. creavio does not update an existing Google Calendar event. creavio does not delete the Google Calendar event when a booking is removed. creavio stores the connection tokens encrypted, the Google email on the connection, and the calendar id. Disconnecting the calendar deletes that connection and the busy intervals creavio stored for it. The event id for a booking creavio created is not removed by that disconnect. It remains in your account, and account deletion follows Section 7. creavio asks Google to revoke the calendar token only when no other Calendar connection, and no Search Console or Analytics connection made from your website settings, still shares that Google account. That check does not look at YouTube, Business Profile, or agency Search Console and Analytics connections. A revoke can end other creavio connections that use the same Google account, and you can reconnect them. If the Google email on the connection is missing, any other Calendar, Search Console, or Analytics connection on the creavio account blocks the revoke. If that check fails, creavio does not revoke. In those cases creavio still deletes the local calendar connection and the busy intervals.

14.9. Google Ads. If you connect Google Ads, creavio asks for https://www.googleapis.com/auth/adwords. creavio receives the Ads accounts your Google account can access and the campaign reporting it requests for an account you connected, including impressions, clicks, cost, and conversions. If you ask creavio to change a campaign, budget, or similar setting on that account, creavio sends that change only when creavio has turned on live sending to Google Ads. If live sending is not turned on, creavio checks the change and does not send it. If you ask creavio to send a customer list to that account, creavio prepares the list you selected. A person on that list can include an email address, a phone number, or both, that you selected in creavio. creavio hashes each one before any send. If live sending is not turned on, creavio checks the hashed list and does not send it. When live sending is turned on, creavio sends the hashed list. That list is data you selected in creavio. It is not data creavio received from a Google API. creavio uses the Google Ads connection only to operate and report on the account you connected, with your authorization, and that use adheres to the Limited Use requirements in Section 14.1. creavio stores the connection tokens encrypted. Disconnecting Google Ads removes those tokens. Reporting creavio has stored for that account is not removed by that disconnect. It remains in your account, and account deletion follows Section 7. creavio does not use Google Ads data to train AI models and does not move that data to a different advertising platform.

14.10. Google Docs, for creavio write. The creavio write extension can read and edit a Google Doc that is open in your browser. Google's consent screen describes that permission as "See, edit, create, and delete all your Google Docs documents". The extension uses it only to read the one doc open in the Google Docs view while that view is open, and to write a fix only when you click. The Google access token stays in Chrome on your computer and is not sent to creavio. The doc is checked on your computer and is not sent to creavio, except a paragraph you send with Improve this paragraph, which goes to creavio and to Anthropic only when you click, and only to write the rewrite you asked for. That text is not used to train AI models. Signing out of creavio write disconnects Google. The full statement is the creavio write privacy policy at creav.io/legal/write-privacy.

14.11. How to revoke, and who to contact. You can disconnect a connected Google service inside creavio. You can also revoke creavio's access to your Google account at any time at https://security.google.com/settings/security/permissions. Revoking access on that page does not by itself delete data creavio has already stored. For YouTube, the clocks in Section 14.6 are how stored YouTube API data is deleted after that revoke. For Google sign-in, Section 14.3 says what creavio keeps. For creavio write, disconnect also asks Google to cancel the extension's token, as the creavio write privacy policy describes. Questions or complaints about the practices in this section: [email protected].