Privacy Policy

1. Introduction

Welcome to CreatorHyve ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered content creation platform, including our Agent Studio (AutoFlow), AI Content Generator, AI Image Generator, AI Video Generator, Content Calendar & Scheduling, Brand Kit, Media Library, Social Publishing (YouTube, Instagram, X/Twitter, LinkedIn, Facebook, and other supported platforms), and Credit System (collectively, the "Services").

By accessing or using CreatorHyve, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. Information We Collect

2.1 Personal Information

When you register for an account, we collect:

• Name and email address
• Password (stored only in hashed form by our authentication provider)
• Profile information (optional profile picture, bio)
• Billing and payment information (processed securely through third-party payment processors)

2.2 Content and Usage Data

To provide our AI-powered services, we collect:

• Content Calendar Data: Your scheduled posts, content ideas, publishing dates, and platform preferences
• Generated Content: AI-generated images, video clips, text captions, and other media you create using our platform
• Brand Assets: Logos, brand colors, fonts, and style guides you upload to your Brand Kit
• Content Prompts: Text inputs and instructions you provide to our AI models
• Agent Studio Configurations: Flow settings including target descriptions, platform selections, posting schedules, duration, content tone, and generated post content from AutoFlow runs
• Credit Transaction Data: Records of credit usage and grants per action (model used, description, timestamp, resulting balance) and subscription billing events
• AI Assistant Chat History: The messages you exchange with the AI assistant and short AI-written summaries of those conversations, which are used as context in later chats. We keep your 10 most recent conversations
• Media Library: Images and videos you upload to your media library, stored in Cloudflare R2
• Usage Analytics: Features used, generation requests, content performance metrics
• Newsletter Signups: If you subscribe to product news through the website footer, we store the email address you enter and the date. You can ask us to remove it at any time by emailing [email protected]
• Platform Connections: Information about your connected social media accounts (for example YouTube, Instagram, X/Twitter, LinkedIn, Facebook, Pinterest, Threads, Bluesky, Mastodon, Telegram, Discord, Dev.to, Hashnode, and WordPress) including encrypted OAuth access and refresh tokens and, for services that do not use OAuth, the encrypted app password, access token, bot token, or webhook URL you provide, together with non-secret connection details such as your handle, instance URL, or chat ID

2.3 Technical Information

• Device information (browser type and operating system)
• IP address and approximate location (country) derived from it
• Cookies and browser storage used to keep you signed in and remember your preferences (we do not use advertising or cross-site tracking cookies)
• Log data (access times, pages viewed, errors encountered)
• Page performance metrics (Vercel Speed Insights)

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery

• Generate AI-powered images, video clips, text captions, and content via Agent Studio flows
• Manage and schedule your content calendar across the social and blogging platforms you connect
• Execute automated publishing workflows via Agent Studio (AutoFlow) on your behalf at scheduled times
• Store and apply your brand assets consistently across generated content
• Track and deduct credits for AI usage; maintain your credit transaction history
• Provide personalized content recommendations based on your usage patterns

3.2 AI Model Training and Improvement

We do not use your content, prompts, or outputs to train our own AI models. We send them to the third-party AI providers listed in Section 4.1 only to produce the output you request, and those providers' own terms and privacy policies apply to that processing.

3.3 Communication

• Send service-related notifications and updates
• Respond to your inquiries and provide customer support
• If you subscribe to our newsletter, use your email address to send you product news (you can unsubscribe at any time by emailing [email protected])

3.4 Security and Compliance

• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations and enforce our Terms of Service
• Monitor and analyze usage trends to improve service reliability
• Conduct internal audits and quality assurance

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Third-Party Service Providers

We work with trusted third-party providers to deliver our Services:

• AI Processing: OpenAI, Google AI, and Anthropic (Claude, which powers the AI assistant) for text generation, OpenAI and Google AI also for image and video generation; Fal.ai and Replicate for additional video models. We send them your prompts, any reference images you provide, and the brand and scheduling context needed to personalize output (such as brand voice, keywords, audience, and recent post titles)
• Database & Authentication: Supabase for user data, content storage, and authentication
• File Storage: Cloudflare R2 for storing your uploaded media, AI-generated images, videos, and autoflow-generated images
• Payment Processing: Dodo Payments for billing and subscription management; your payment card details are handled directly by Dodo Payments and are never stored on our servers
• Scheduled Publishing: Supabase (scheduled jobs) for delivering scheduled social media posts
• Hosting and Security: Vercel for hosting, server logs, and Speed Insights performance monitoring (anonymized); Cloudflare Turnstile for bot protection on sign-up, sign-in, and password reset
• Email: Account emails (such as sign-up confirmation and password reset) are sent through our authentication provider, Supabase; billing emails are sent by Dodo Payments

Each provider's own terms and privacy policy apply to the data it handles.

4.2 Social Media Platforms

When you connect your social media and blogging accounts (such as YouTube, Instagram, X/Twitter, LinkedIn, Facebook, Bluesky, Mastodon, or WordPress), we share content according to your publishing schedule and Agent Studio flow configurations. We store encrypted OAuth tokens or, where a platform uses an app password or access token instead, that credential (encrypted) to perform publishing on your behalf. We only access the permissions you explicitly grant during the OAuth authorization flow and follow each platform's data policies. You may disconnect an account at any time from your Connected Accounts settings, and you can also remove CreatorHyve in that platform's own connected-apps settings.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety, or that of our users.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new owner, subject to this Privacy Policy.

4.5 TikTok

If you connect a TikTok account, you sign in with TikTok and authorize CreatorHyve to publish videos that you choose to that account. This section describes what we do with TikTok data:

• What we receive and store: your TikTok open ID, display name and profile picture, and the access and refresh tokens TikTok issues (stored encrypted). We use the name and picture to show which account is connected.
• What we ask TikTok for: each time you prepare a post, which privacy, comment, Duet and Stitch options your account allows, so we only offer choices TikTok permits.
• What we send to TikTok: only the video you selected and the title and settings (who can view it, whether comments, Duet and Stitch are allowed, and any commercial content disclosure) that you confirmed.
• What we do not do: we do not read your TikTok videos, followers, messages or other account content, we do not post anything you have not confirmed, we do not use TikTok data to train AI models, and we do not sell it or share it with anyone other than the infrastructure providers listed in Section 4.1.
• Your control: you can disconnect TikTok at any time in Integrations, after which we delete the stored tokens (see Section 6), and you can remove CreatorHyve in your TikTok account's connected-apps settings.

TikTok's own handling of your data is described in TikTok's Privacy Policy.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit using TLS/SSL
• Encryption of stored data at rest by our database and file storage providers
• Additional AES-256-GCM encryption, applied by us, of connected-account tokens and credentials before they are stored
• Passwords stored only in hashed form by our authentication provider
• Row-level security in our database, so that account records are restricted to the account that owns them

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to provide our Services and comply with legal obligations:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Personal data deleted within 30 days of account deletion (some data may be retained for legal compliance)
• Generated Content (images and videos): Retained while your account is active. If an account has had no paid subscription for 90 consecutive days (counted from account creation if it never subscribed), the images and videos stored in it are permanently deleted. Post text, captions and settings are kept. See Section 4.7 of our Terms of Service
• Brand Assets: Retained until you remove them from your Brand Kit
• AI Assistant Chat History: Your 10 most recent conversations are kept; older ones are deleted automatically
• Disconnected Accounts: When you disconnect an account we stop using it and remove its refresh token. Other stored connection details remain until your account is deleted. To end access completely, also remove CreatorHyve in that platform's own connected-apps settings
• Backup Data: May persist in backups for up to 90 days after deletion
• Billing Records: Retained for 7 years for tax and accounting purposes

7. Your Rights and Choices

Depending on your location, you may have the following rights:

7.1 Access and Portability

Request a copy of your personal data by contacting us (see Section 7.6).

7.2 Correction and Update

Update your account information, profile, and preferences anytime through your account dashboard.

7.3 Deletion

Request deletion of your account and associated data (see Section 7.6). Note that some information may be retained for legal compliance.

7.4 Opt-Out Options

• Unsubscribe from our newsletter by emailing [email protected]
• Control cookies and browser storage through your browser settings (blocking the cookies needed for sign-in will stop you from signing in)
• Disconnect social media platform integrations

7.5 Object and Restrict

Object to certain data processing activities or request restrictions on how we use your data.

7.6 How to Make a Privacy Request

To request access to or a copy of your personal data, correction, or deletion, or to exercise any other right described in this section, email [email protected] from the email address on your account. Our support team handles these requests by email. We may ask you to confirm your identity before acting on a request.

8. Children's Privacy

CreatorHyve is not intended for users under 13 years of age (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at [email protected].

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your jurisdiction. We use appropriate safeguards, such as Standard Contractual Clauses, to ensure your data is protected in accordance with this Privacy Policy.

10. Third-Party Links and Services

Our Services may contain links to third-party websites or integrate with third-party services (e.g., YouTube, Instagram). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the version number and "Last Updated" date
• Notify you via email or in-app notification
• Maintain a change log of significant updates (available upon request)
• Provide a 30-day notice period for material changes

Your continued use of CreatorHyve after changes become effective constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: