Privacy Policy
Version 2026-10-20.
the operator of the CREOS service (the "Company", "we") is the data controller for the CREOS service at stage-x7pk5m.creos.si. Data questions: support@creos.si.
1. What we process
- Account data: login, email address, password hash, language, time zone, Telegram identifier when signing in through it.
- Payment data: amounts, dates, status of payments and refunds, Stripe identifiers. We do not receive the card number: Stripe processes it.
- Usage data: requests to models and their parameters, generation results, task history, gallery publications, support requests.
- Technical data: IP address, device and browser type, request times, a device fingerprint for abuse protection, error logs.
- Data from a external platform, when the account was created through one: external identifier, login, language, confirmation of consent to the terms.
2. Purposes
Performance of the contract (access, generations, payment, support); security and abuse prevention (limits, moderation, account protection); legal obligations (tax, accounting, responses to authorities); improvement of the Service on aggregated metrics. Marketing emails are sent only with your consent, with an unsubscribe link in each one.
3. Who receives data
Providers processing data on our instructions: Stripe (payments, tax), cloud file storage, artificial intelligence model providers (they receive the request text and uploaded materials needed for the generation, without your name or email), the email notification service, the error monitoring service (without request content). The external platform through which the account was created receives notifications about credits it issued being granted and spent, but not the content of your requests. Authorities, upon a lawful request. Data is not sold.
Providers may be located outside your country, including in the USA; transfers rely on contracts with data protection terms.
4. Retention
Generation results — 30 days, then files are deleted (works published in the gallery — until unpublished). Request logs and technical data — up to 12 months. Account and payment data — while the account exists and afterwards for the periods set by tax law (generally up to 7 years for payment records). After account deletion the record is anonymised, files are deleted and unused credits expire.
5. Your rights
You can: view and change data in settings; request a copy of your data; correct inaccurate data; delete the account in settings (executed after 30 days, during which the request can be cancelled); object to processing for marketing; lodge a complaint with the supervisory authority of your country. California residents have rights under the CCPA; residents of the European Economic Area and the United Kingdom under the GDPR and UK GDPR; we fulfil requests within 30 days. Write to support@creos.si from the address linked to the account.
6. Data protection
Passwords are stored as hashes (argon2id), sessions as token hashes, files are available only via signed links of limited duration, staff access is role-based and logged, the admin interface is protected by a second factor and an address allowlist. We notify affected users and authorities of a significant breach within the periods set by law.
7. Cookies
Only technical cookies are used: session, form protection, chosen theme and language. There are no analytics or advertising cookies.
8. Children
The Service is not intended for persons under 18; a child's data that comes to our attention is deleted.
9. Changes
A new version is published here with its date. Material changes are announced by email.