Privacy Policy

1. Introduction

CreatorBench ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. We comply with the General Data Protection Regulation (GDPR) for EU users and the California Consumer Privacy Act (CCPA) for California residents.

2. Information We Collect

3. How We Use Your Information

We use the information we collect to:

• Service Delivery: Provide, maintain, and improve our services
• Financial Management: Process transactions, manage subscriptions, generate invoices
• Platform Integration: Sync revenue and analytics from connected platforms
• Communication: Send technical notices, support messages, and notifications (per your preferences)
• Security: Detect, prevent, and address security issues, fraud, and unauthorized access
• Analytics: Monitor and analyze trends and usage (with consent)
• Compliance: Meet legal obligations, respond to legal requests

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal bases:

• Contract: To provide our services (account management, financial tracking, CRM)
• Consent: For non-essential processing (analytics cookies, marketing emails)
• Legitimate Interest: For security, fraud prevention, service improvement
• Legal Obligation: To comply with tax, accounting, and legal requirements

You can withdraw consent at any time via your settings.

5. Data Sharing

We do not sell your personal information. We may share your information with:

• Service Providers: Clerk (authentication), Stripe (payments), Vercel (hosting) - under strict confidentiality agreements
• Platform APIs: Twitch, YouTube, TikTok (via OAuth with your consent) - for data synchronization
• Analytics Providers: PostHog, Sentry (with your consent) - for service improvement
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice)

All third-party service providers are required to maintain appropriate security measures and use data only for specified purposes.

6. Data Security

We implement comprehensive security measures to protect your personal information:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (database encryption)
• Sensitive Data: OAuth tokens encrypted with AES-256-GCM
• Authentication: Industry-standard authentication via Clerk
• Access Control: User data isolation, role-based access for admins
• Monitoring: Security event logging, suspicious activity detection
• Audit Logs: Comprehensive audit trail for compliance
• Regular Audits: Security audits and penetration testing

7. Your Rights (GDPR & CCPA)

You have the following rights regarding your personal data:

8. Data Retention

We retain your personal data only as long as necessary:

• Active Accounts: Data retained while account is active
• Deleted Accounts: 30-day grace period, then permanent deletion
• Audit Logs: 2 years (compliance requirement)
• Financial Records: 7 years (tax compliance requirement)
• IP Addresses: 90 days, then anonymized
• Analytics: 1-2 years (per provider policy, with consent)

After retention periods expire, data is permanently deleted or anonymized.

9. Cookies and Tracking

We use cookies and similar tracking technologies:

• Essential Cookies: Required for service functionality (session management) - no consent required
• Analytics Cookies: Used for service improvement (PostHog, Sentry) - requires consent
• Preference Cookies: Store your settings (theme, preferences) - no consent required

You can manage cookie preferences via your browser settings or our cookie consent banner. Essential cookies cannot be disabled as they are required for the service to function.

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the supervisory authority within 72 hours (if required)
• Notify affected users without undue delay (if high risk)
• Provide details of the breach, data affected, and remediation steps
• Document the breach and our response for compliance

11. International Data Transfers

Your data may be processed in the United States and other countries. For EU users, we ensure adequate safeguards (Standard Contractual Clauses) with US-based service providers to protect your data in accordance with GDPR requirements.

12. Children's Privacy

Our service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@creatorbench.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification (for material changes)
• Displaying a notice in the application (for significant changes)

Continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact Us & Data Protection Officer

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

For GDPR requests, please include "GDPR Request" in the subject line and specify which right you wish to exercise.

15. Supervisory Authority

If you are an EU resident and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority. Find your authority at EDPB Members.