Privacy Policy

Creaflow ("Creaflow", "we", "us") provides competitor and niche analytics for YouTube creators through the website www.creaflow.com, the Creaflow dashboard and the Creaflow Chrome extension (together, the "Service").

Creaflow is the data controller for the personal data described in this policy. The Service is operated from France, and we process personal data in line with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

For any question about this policy or your data, contact us at support@creaflow.com.

Information you give us:

• Account details: your first and last name, email address and password. We never store your password itself, only a salted one-way hash of it.
• Google sign-in: if you continue with Google, Google shares your name, email address, whether that email is verified, your profile photo and your Google account identifier. We do not receive your Google password, contacts, files or YouTube account data.
• Your workspace: the channels, niches, competitors, topics, searches and analyses you create or track in the Service.
• Messages you send us, for example when you contact support.

Information collected automatically:

• Security and device information: your IP address, the type of browser and operating system you use, and when each session was created and last used. You can see this information yourself on your Account page under Devices.
• Sign-in activity: successful and failed sign-ins, verification codes sent and password resets, used to protect your account and prevent abuse.
• Cookies that keep you signed in (see Cookies below). We do not use advertising cookies or third-party analytics trackers.

Public YouTube data: to provide analytics, the Service collects information that is publicly available on YouTube about channels and videos, such as channel names, descriptions, thumbnails, view counts, subscriber counts and upload dates. This can include public information about creators.

The extension runs only on youtube.com. It reads the YouTube pages you open to show channel and video insights next to them.

• When you use a feature such as Find channels, Track or a revenue estimate, the extension sends the identifiers and public statistics of the channel or video concerned to our servers.
• Your extension settings and the channels you track in it are stored locally in your browser (Chrome storage).
• The extension does not collect your browsing history, and it does not read pages on any site other than youtube.com.

• To create and run your account and provide the Service you asked for, including sending verification codes and password reset emails. Legal basis: performance of our contract with you.
• To keep the Service and your account secure: detecting suspicious sign-ins, limiting repeated failed attempts, and letting you see and end your active sessions. Legal basis: our legitimate interest in protecting the Service and its users.
• To analyse public YouTube data and produce the insights the Service shows. Legal basis: our legitimate interest in providing analytics on publicly available information.
• To maintain, troubleshoot and improve the Service. Legal basis: our legitimate interests.
• To comply with our legal obligations and respond to lawful requests from authorities. Legal basis: legal obligation.

We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We only use cookies that are strictly necessary for the Service to work, so they do not require your consent:

• creaflow_session: keeps you signed in. It cannot be read by scripts on the page and expires after 30 days without use.
• creaflow_oauth: used only during Google sign-in to protect it against forgery. It expires after 10 minutes.

Signing out removes the session cookie. Blocking these cookies in your browser will prevent you from signing in.

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions:

• Amazon Web Services: hosting of our servers and databases, and sending of our emails (Amazon SES).
• Vercel: hosting of the website and dashboard.
• Cloudflare: storage of collected public YouTube data.
• Google: Google sign-in, if you choose to use it.
• AI model providers (Google Gemini, and models accessed through OpenRouter): they receive only public YouTube channel and video information to classify niches and languages, never your account details.

We may also disclose information if required by law, to protect the rights, property or safety of Creaflow, our users or others, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.

Our servers are located in the United States, so your data is transferred outside the European Economic Area. Where we do so, we rely on appropriate safeguards: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework for certified providers, or the European Commission's Standard Contractual Clauses.

You can ask us for more information about these safeguards at support@creaflow.com.

• Account and workspace data: for as long as your account exists. When you ask us to delete your account, we delete it within 30 days.
• Sessions: until you sign out or end them, or after 30 days without use.
• Verification codes expire after 10 minutes and password reset links after 30 minutes.
• Sign-in activity records: up to 12 months, for security.
• Backups: our database backups are overwritten on a rolling basis and kept for no more than 35 days.

We may keep some information longer where the law requires it.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing, including processing based on our legitimate interests;
• receive the data you gave us in a structured, machine-readable format (portability);
• define instructions about what happens to your data after your death, as provided by French law.

To exercise any of these rights, email support@creaflow.com from the address linked to your account. We answer within one month. You can also end your sessions yourself from the Account page.

If you believe we have not handled your data properly, you can lodge a complaint with the French data protection authority, the CNIL (https://www.cnil.fr), or with the authority of your country of residence.

We protect your data with measures appropriate to the risk, including HTTPS between your browser and our website, one-way hashing of passwords, session cookies that scripts cannot read, storing only a hash of each session token, limits on repeated sign-in attempts, and access restricted to the people who run the Service.

No system is perfectly secure. If a breach affects your personal data in a way that puts your rights at high risk, we will tell you without undue delay.

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the Service changes. If a change is significant, we will tell you by email or in the Service before it takes effect.

Questions, requests or complaints about your privacy: support@creaflow.com.