Privacy Policy

Last updated: November 1, 2026

1. Information We Collect

1.1 Information you give us

Account details: name, username, email address, password, profile photo, and any bio or links you add.
Founder and startup details: idea descriptions, startup stage, target customer, validation notes, goals, and other information you enter while building.
Workspace content: prompts, AI chats, saved outputs, startup planning notes, uploaded files, waitlist drafts, PMF inputs, MVP scope, GTM plans, and related materials.
Community and messaging data: posts, comments, reactions, direct messages, mentor conversations, booking requests, and co-founder or angel matching activity.
Payment and subscription details: billing contact details, subscription status, transaction records, and credit usage data. Card details are processed by our payment provider, not stored by us in full.
Support communications: emails, feedback, bug reports, and other messages you send to us.

1.2 Information we collect automatically

Device and connection data: IP address, browser type, operating system, device identifiers, and approximate location derived from IP.
Usage data: pages viewed, routes visited, searches, clicks, session activity, referral source, and feature usage across tools like BizMap AI, Insighta, community, and messaging.
Diagnostic data: logs, crash information, performance signals, failed requests, and security events.
Cookies and similar technologies: data used to keep you signed in, remember preferences, secure sessions, and understand product usage.

1.3 Information from third parties

Authentication providers: basic profile information if you sign in through an external provider.
Payment providers: payment confirmations, subscription status, and fraud-prevention signals.
Service providers: analytics, email delivery, infrastructure, scheduling, and similar vendors that help us operate the platform.

1.4 Google Calendar and Google Meet data

For Discovery Calls, our dedicated platform organizer account uses Google Calendar to create and update company-owned calendar events. After a call, we may use Google Meet conference records to derive attendance information. We retain only the conference start and end time, participant count, maximum concurrent participants, qualifying overlap duration, verification result, and resolution source.

We do not retain Google Meet participant names, email addresses, Google user IDs, recordings, transcripts, or raw Meet API responses. Founders and mentors do not connect their personal Google accounts for this feature.

2. How We Use Your Information

We use personal information to operate, secure, and improve the platform, including to:

Create and manage user accounts and profiles.
Provide the Startup Development Cycle experience and related tools, including BizMap AI, ICP Builder, Demo Studio, PMF Lab, MVP Builder, Tech Stack, GTM Strategist, Directories, Focus Funnel, Prompt Library, and Insighta features.
Save your workspace progress, startup materials, and tool outputs.
Enable community participation, direct messaging, mentor outreach, co-founder matching, angel discovery, and booking workflows.
Create and update company-owned Google Calendar events for confirmed Discovery Calls and derive attendance verification from Google Meet timing and participant-count metadata.
Process subscriptions, payments, credits, invoices, and refunds.
Send service communications such as security alerts, product updates, account notices, booking confirmations, and support replies.
Monitor abuse, enforce our Terms of Service, prevent fraud, and protect platform integrity.
Analyze usage patterns so we can improve reliability, UX, onboarding, and feature quality.
Comply with legal obligations and respond to lawful requests.

3. Legal Bases for Processing

Where UK GDPR or EU GDPR applies, we rely on one or more of the following legal bases:

Contract: to provide the services you request, maintain your account, process payments, and deliver platform functionality.
Legitimate interests: to improve the product, secure the platform, prevent misuse, support users, and operate our business responsibly.
Consent: where you opt in to marketing or other optional processing.
Legal obligation: where we must keep records, respond to valid legal requests, or satisfy regulatory obligations.

4. AI, Workspace Content, and Your Startup Information

Creatives Takeover is built to help founders, indie hackers, and builders move from scratch to execution. That requires us to process the information you enter into the platform so features can work.

We process your prompts, files, notes, and tool inputs to generate outputs, save progress, and personalize your experience.
Your private workspace content is not made public unless you choose to share it through a public or community feature.
Community posts, public profile fields, mentor listings, and similar public-facing materials are visible to other users as part of the service.
We do not sell your private startup materials or business ideas to third parties.
Because no online system can promise absolute security, you should use reasonable judgment before sharing highly sensitive information that you are not comfortable storing digitally.

5. When We Share Information

We do not sell personal information. We share data only in limited situations such as the following:

5.1 Service providers

We work with vendors that support hosting, authentication, databases, email delivery, payment processing, analytics, AI features, scheduling, and customer support.

These providers process information on our behalf under contractual or legal safeguards appropriate to their role.

5.2 Public and social features

Profile details you choose to make visible may be seen by other users.
Community posts, comments, co-founder listings, and similar submissions may be visible within the relevant area of the platform.
Messages and bookings are shared with the intended recipient or participant as part of the service.

5.3 Legal and safety reasons

To comply with law, court orders, or lawful requests from competent authorities.
To investigate suspected abuse, fraud, security incidents, or violations of our Terms.
To protect the rights, safety, and property of Creatives Takeover, our users, or others.

5.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, relevant information may be transferred as part of that transaction, subject to applicable law.

6. Cookies and Similar Technologies

We use cookies and similar technologies (such as browser storage) to operate and improve the platform. Some always run because the service needs them; analytics that store anything in your browser only run if you allow them.

Always on

Essential cookies: required for sign-in, session management, security, and core functionality.
Functional cookies: used to remember preferences and improve usability.
Anonymous visit counting: we count visits with PostHog in cookieless mode. Nothing is stored in your browser; PostHog's servers derive a daily-changing identifier from your IP address and browser details and do not keep your IP address. This tells us how many people visit, which pages, where they came from, and how quickly each page loads and responds (timings only, such as how long the page took to appear), without identifying you or linking your visits across days.
Product usage records (signed-in accounts): when you are signed in, our own database records which sections and tools of the platform you open each day and the actions you take in them, such as saving a result, sending a message, booking a call, or publishing a post. We use this to run the service, show your progress, and understand which parts of the platform are useful, under our legitimate interests. It uses no cookies and is not shared with analytics providers.

Only if you choose “Accept All”

Analytics cookies: PostHog and Amplitude store an identifier in your browser so your visits can be linked over time and, when you are signed in, to your account, and Vercel Web Analytics measures page visits and performance. We use this to understand journeys and fix usability problems, and we may record sessions for that purpose.
Time spent in each section: when you are signed in, we measure how long you actively use each section and tool, so we can tell which parts of the platform are genuinely useful.

If you choose “Reject All”, none of the optional items above run; the always-on items continue. You can change your choice at any time from Cookie settings in the site footer or in your account settings. We ask again when this policy changes in a way that affects your choice, and at least every 12 months.

You can also manage cookies through your browser settings, but disabling essential cookies may reduce or break parts of the service.

7. Google API Services Data

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

We use Google Calendar data only to create, update, and manage the company-owned calendar events required for Discovery Calls.
We use Google Meet data only to derive Discovery Call attendance verification and to resolve attendance-related support or disputes.
We do not use Google API data for advertising, sell it, or allow it to be used for advertising purposes.
We do not transfer Google API data to third parties except where necessary to operate the service, comply with law, or protect against security incidents, and then only under appropriate safeguards.
Access to Google API data is limited to authorized systems and personnel with a need to operate, secure, or support the Discovery Call workflow.

The organizer may revoke Creatives Takeover's Google access through the Google Account security settings. Users may contact admin@creatives-takeover.com with questions about this processing.

8. Data Security

We use reasonable technical and organizational safeguards designed to protect personal information, including:

Encryption in transit.
Authentication and access controls.
Logging, monitoring, and abuse detection.
Backups, vendor management, and operational security practices.
Restricted internal access based on role and need.

Even with these measures, no platform can guarantee absolute security.

9. Data Retention

We retain information for as long as reasonably necessary to operate the service, comply with law, resolve disputes, and enforce our agreements.

Account and workspace data: generally retained while your account is active and for a reasonable period afterward unless deletion is required sooner by law.
Billing and tax records: retained for the period required by applicable accounting and tax rules.
Security and diagnostic logs: retained as needed for platform reliability, abuse prevention, and investigations.
Discovery Call attendance evidence: derived timing and count metadata is retained with the booking record only as long as reasonably necessary for support, disputes, financial administration, and legal obligations.
Public content: may remain visible until removed by you, by us, or as part of ordinary platform moderation.

10. International Transfers

We are based in the United Kingdom and may use service providers in other countries, including the United States and the European Economic Area.

Where required, we rely on appropriate safeguards for international transfers, such as contractual protections and vendor commitments designed to meet applicable data protection standards.

11. Your Rights

Creatives Takeover Ltd is the controller of the personal information described in this policy.

Depending on where you live, you may have rights such as the right to access, correct, delete, restrict, object to, or export certain personal information.

You may also withdraw consent where processing depends on consent, at any time and as easily as you gave it; for analytics, use Cookie settings. Some rights are subject to legal exceptions.

To make a request, email admin@creatives-takeover.com with the subject “Privacy request”. We may ask you to confirm your identity before acting on it.

We respond within one month of receiving your request. If a request is complex, or you send several, we may extend this by up to two further months; if we do, we will tell you within the first month and explain why.

You have the right to lodge a complaint with a data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). If you live in the EU or EEA, you can contact the supervisory authority in your country. We would appreciate the chance to address your concern first, so please consider contacting us before you do.

12. Children's Privacy

The platform is intended for adults and is not directed to children under 18.

If you believe a child has provided personal information to us, contact us and we will review the matter and take appropriate action.

13. Third-Party Services

Our services may integrate with or link to third-party tools and websites, including payment processors, scheduling tools, authentication providers, and external resources.

Those third parties operate under their own terms and privacy notices. We are not responsible for their independent practices.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the platform, law, or our practices.

When changes are material, we may notify you by email, in-product notice, or by updating the effective date above.

15. Contact Information

If you have questions about this Privacy Policy or would like to exercise your privacy rights, contact us:

Founder & CEO

Email: javier@creatives-takeover.com

General Support

Email: admin@creatives-takeover.com

Registered Office

Creatives Takeover Ltd Company No. 16741912 71-75 Shelton Street Covent Garden London, WC2H 9JQ United Kingdom

Privacy note: We built Creatives Takeover to help people build startups from scratch, and that requires trust. We aim to handle personal information responsibly, keep private workspace content private by default, and be clear about where data is used to deliver the service.