1. Scope
This Policy applies to creatu.io, the app.creatu.io workspace and Creatu features used to prepare and publish social-media content. A user instructs Creatu to interact only with the platforms the user selects.
2. Data we process
- Creatu account email, name, organization and sign-in data;
- connected profile, Page, group and channel identifiers;
- OAuth tokens and granted-permission records;
- text, images, video, schedules and publication settings;
- publication identifiers, delivery results and API errors;
- connected account and media metrics, including follower count, reach, views, likes, comments, shares, saves and replies;
- IP address, request time, browser and security logs;
- Instagram Direct messages and comments on posts of a connected Instagram Professional account: text, time, the name and identifier of the sender or commenter, attachment links, and replies sent from Creatu;
- support requests.
Creatu does not ask for or store social-platform passwords. A password is entered only on the platform's own authorization page.
3. Purposes
- operate accounts and sessions;
- connect a user-selected platform;
- create, store, schedule and send user-created publications;
- show organic-content analytics to the owner of the connected account;
- show Direct messages and comments of the connected Instagram account to the owner and their team in the Messages inbox, and send their replies;
- show results, diagnose errors and provide support;
- protect the service, maintain backups and comply with law;
4. Legal bases
Processing is based on the service agreement, the user's instruction and consent to connect an external platform, legitimate interests in service security, and the operator's legal obligations.
5. Social platforms
When connecting Meta, Google/YouTube, VK, TikTok, LinkedIn or another selected platform, that platform's own terms and privacy policy also apply. Creatu sends only the data needed to carry out the user's instruction.
For an Instagram Professional account, Creatu receives basic profile data, publishes organic content only on the user's command or schedule, and shows account and media insights to that account owner.
When the owner connects Instagram, Creatu also receives Instagram Direct messages sent to that account and comments on its posts (Meta permissions instagram_business_manage_messages and instagram_business_manage_comments). They are shown only to the owner and their team members in Creatu, in the Messages inbox. Creatu sends a Direct message or a comment reply only when a team member presses "Send" or when the owner has turned on their own auto-reply rule (for example, a reply to the keyword "price"). Creatu follows Meta's rules, including the 24-hour messaging window, and does not message people who have not contacted the account or commented on its posts. Messages and comments are not sold, not shared with third parties, and not used for advertising or to train artificial-intelligence models. Creatu does not store message attachments; they open via a Meta link.
Creatu uses YouTube API Services when a user connects a YouTube channel. Creatu accesses the connected channel name and identifier, available video details and analytics, and stores the OAuth token needed for access. It uses this data to show the channel and analytics to its owner and to upload a video the user selects. YouTube data is not sold or used for advertising. Use is subject to the YouTube Terms of Service and the Google Privacy Policy. Google access can be revoked on the Google security permissions page.
6. Sharing and service providers
Data is shared with the user-selected social platform, hosting infrastructure and support email provider to the extent needed for the feature. Creatu does not sell personal data or share it with advertising data brokers.
The current workspace also loads browser components from Stripe and the jsDelivr CDN. Requests to these providers expose technical connection information, such as the IP address, browser details and potentially the page address. Stripe components are present although payments are not enabled; no payment card is requested. These providers process requests under their own privacy policies.
Browser and device data
The Creatu workspace stores and reads cookies and similar browser storage to keep users signed in, remember the selected organization, language and interface preferences, and protect and operate the service. These records may contain session identifiers and technical information about the browser and device. The workspace also loads Stripe components and the jsDelivr CDN; these providers may receive the IP address, browser details and page address, and Stripe may set its own cookies even though payments are not enabled. Google handles its own cookies on Google authorization pages. A connected YouTube channel avatar may also load from Google servers, which can receive technical browser and connection data. Creatu does not receive a Google password.
Separately, the creatu.io website uses Yandex Metrica, including Webvisor, to measure visits and page use. This website analytics is not a YouTube feature and is not used to access YouTube data. Yandex may receive technical information from the browser and use its own identifiers or cookies. Users can clear or block cookies and browser storage in their browser settings; blocking essential session storage may prevent sign-in or saved preferences.
7. Retention and deletion
Account, content and analytics data is retained while needed to provide the service and meet legal obligations. Disconnecting YouTube in Creatu stops its access, revokes the Google authorization and removes active channel records; if Google is temporarily unavailable, the channel stays disabled while revocation is retried. Other social platforms may require separate revocation in their security settings. Restricted backups are checked daily: YouTube API data for disconnected channels is selectively erased, and YouTube API data in backups older than 29 days is erased. User-uploaded files are reviewed separately after a full deletion request.
Active YouTube data is deleted within 7 calendar days after a user disconnects YouTube in Creatu or submits a verified deletion request, whichever happens first. Disconnecting does not require a support email for active YouTube data deletion. Instagram Direct messages and comments are kept while the account is connected to Creatu. When the owner disconnects Instagram in Creatu, removes Creatu in Instagram settings, or Meta sends a data deletion request, Creatu immediately stops receiving messages and comments and deletes the stored ones within 7 calendar days. Other active data is deleted or anonymised within 30 calendar days unless law requires longer retention. Restricted backups must not be used to return deleted data to active use. See the Data Deletion Instructions.
8. User rights
Users may request access, correction, restriction, withdrawal of consent or deletion by emailing info@lemon-media.ru from the Creatu account email. The operator may verify control of the email to prevent deletion of another person's account.
9. Security
Creatu uses HTTPS, server-side secret storage, restricted external network access, backups and health checks. No system is absolutely secure; suspected incidents should be reported to the support address.
10. Children
Creatu is intended for adults and organization representatives and is not directed to children.
11. Changes
A new version is published with its effective date. Material changes affecting user rights are announced before they apply when required by law.
12. Contact
Ivan Tumakov, Individual Entrepreneur, Tax ID 262811988477, OGRNIP 320265100009043, Kislovodsk, Stavropol Krai, Russian Federation. Email: info@lemon-media.ru.