Privacy Policy

This policy describes what CreateThings collects, why, and how it's handled. The short version: we collect what's needed to run the product, we don't sell your data, and your documents stay yours.

What we collect

• Account data — your email address, name, and authentication records, managed through our auth provider (Supabase).
• Your content — templates you design, files you upload as sources, and the documents generated from them.
• Usage and diagnostics — logs of product actions (e.g. a generation run's status and timing), IP-level request metadata used for security and rate limiting, and error reports.

How we use it

• To operate the product: storing templates, running generations you request, and rendering exports.
• To process your sources with AI models when you start a generation. Model providers process that content to serve the request; we don't permit them to train on it.
• To secure the Service: abuse prevention, rate limiting, and audit trails.
• To send transactional email (confirmations, password resets). No marketing email without consent.

What we don't do

• We don't sell your personal data or your content.
• We don't use your documents or sources to train AI models.
• We don't show ads.

Where it lives

Content and account data are stored with our infrastructure providers (Supabase/Postgres, object storage, Vercel, Trigger.dev) in access-controlled environments. Data in transit is encrypted, and access is scoped to your workspace.

Retention and deletion

Your content stays until you delete it or your account. Deleting a source, template, or document removes it from the product immediately and from backups on a rolling basis. To delete your account and all associated data, email us.

Your rights

You can request a copy of your data, correction, or deletion at any time. Depending on where you live (e.g. GDPR/CCPA regions) you may have additional statutory rights — we honour reasonable requests regardless of region.

Contact

Privacy questions or requests: hello@avoice.co.