Privacy Policy
Version 2025-10-01 · Last updated 2025-10-01
Your specification is yours. This policy explains exactly what we collect, why, who helps us process it, and how you stay in control.
1. Who we are
CREAH is operated by Xenford Internet Private Limited. We are the data controller for personal data processed through creah.ai and the CREAH app. Questions about this policy: privacy@creah.ai.
2. Data we collect
We collect only what we need to build your specification and run your account:
- Account data — name, email address, sign-in identifiers, and consent choices you make (terms, marketing and attribution).
- Project data — your brief, project name, spaces and platforms, legal and brand details you enter, interview answers, design and visual preferences, brand colours, and attachments or reference images you upload.
- Billing data — billing name and address, GSTIN if you provide one, payment status and invoice details. Card and UPI details are collected by our payment processor, not by us.
- Support data — tickets and messages you send us, and reviews you leave.
- Technical data — IP address (used to detect your country for pricing and for security), device and browser information, and service logs.
3. How we use your data
We use your data to provide the service — to run Stage 0 and the interview, generate and quality-check your documents, deliver your package, process payments and invoices, send transactional notifications, and provide support. We also use it to keep CREAH secure, to prevent fraud and abuse, and to meet legal and tax obligations.
Usage analytics. We record aggregate usage metrics — such as project counts, delivery timings and platform token consumption — linked to your account for service operation and improvement. Your specification content is not analysed or stored for this purpose.
AI training. Your interview answers are sent to Anthropic's API to generate your documents. They are not used to train CREAH's models.
4. Third-party processors
We share data only with the service providers below, only as needed for the purpose listed, and under contracts that require them to protect it:
- Anthropic — AI generation. Your interview answers and project context are sent to generate questions and documents. Not used to train CREAH’s models.
- Clerk — Authentication — sign-in, sessions and account security.
- Razorpay — Payment processing for individual payments. Card and UPI details are handled by Razorpay, not stored by CREAH.
- SendGrid — Email delivery — receipts, project updates and support replies.
- Google Cloud Storage — Storage of generated documents, packages and images you upload, including reference images used only for your own package.
- Firebase / Firestore — Interview state — a read copy of your interview so it loads quickly and resumes on any device.
We do not sell personal data. We may disclose data if required by law, to protect the rights and safety of users, or as part of a transfer of the CREAH business under equivalent protections.
5. Data retention
User data is kept while your account is active and for 30 days after a project's access expires or your account closes, so you can return and download your work. Project archives stored in Google Cloud Storage are retained for 12 months for legal purposes and then permanently deleted. Financial records such as invoices are kept for the period required by tax law.
When you delete your account, personal identifiers are anonymised and your sessions are revoked immediately.
6. Security
Data is encrypted in transit and at rest. Access to production systems is restricted to authorised staff, every administrative action is recorded in an audit log, secrets are held in a managed secret store, and AI provider keys never reach your browser.
7. India — Digital Personal Data Protection
We process personal data in line with the Digital Personal Data Protection Act, 2023. We collect data for the specific purposes described here, with your consent where required, and you can withdraw consent at any time — withdrawal does not affect processing already carried out.
You can contact our Grievance Officer at legal@creah.ai. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
8. European Union — GDPR
If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of our contract with you (providing CREAH), legitimate interests (security, fraud prevention and improving the service), legal obligation (tax and accounting), and consent (marketing references to your brand name).
Our providers may process data outside your country. Where they do, transfers are protected by appropriate safeguards such as standard contractual clauses. You may lodge a complaint with your local data protection authority.
10. Your rights
You can access, correct, export and delete your data. Most of this is self-service: download a copy of your data or delete your account from Settings → Data, and update your details from your profile. You can also turn off optional notifications from Settings → Notifications.
For anything else — including objecting to processing or asking about a specific use — write to privacy@creah.ai. We respond within 30 days.
11. Children
CREAH is not intended for children. You must be at least 18 years old to create an account, and we do not knowingly collect data from children.
12. Changes to this policy
We update this policy when our practices change. The version at the top of the page changes with each update, and if a change is material we will ask you to review it the next time you sign in.