Your data serves the services you ask us for.

last updated October 21, 2026

This policy explains how we collect, use, store, and disclose your information when you use the Creaboost platform.

• Introduction
• 1. Scope and Roles
• 2. Information We Collect
• 3. How We Use Information
• 4. Third-Party & OAuth
• 5. Sharing of Information
• 6. Data Retention
• 7. Security
• 8. Your Rights
• 9. International Transfers
• 10. Tracking Technologies
• 11. Third-Party Links
• 12. Updates
• 13. Contact

Introduction

Creaboost, operated by DEEPCASTR SAS (“Creaboost”, “we”, “us”, “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, and disclose information when you:

• use our platform at https://app.creaboost.com (the “Services”),
• visit https://creaboost.com (the “Website”),
• interact with us as a customer, prospect, partner, or job applicant,
• or otherwise communicate with us.

This Privacy Policy should be read together with our Terms of Service.

1. Scope and Roles

1.1 Data Controller vs. Data Processor

Depending on the context:

• Creaboost acts as a data processor when processing data on behalf of our clients through the Services.
• Creaboost acts as a data controller when processing data for its own purposes (e.g., website visitors, marketing, support).
• Clients are responsible for ensuring they have a lawful basis to share data with us.

1.2 Anthropic, a provider chosen by the client

Neo, the AI agent of the Services, runs on Claude Code with the client’s own Claude subscription. The client contracts directly with Anthropic. The prompts and the data processed by the Claude model are handled by Anthropic as the client’s own provider, under the client’s agreement with Anthropic and the terms of the client’s Anthropic plan; Anthropic is not a subprocessor of Creaboost. Creaboost never sees or stores Claude credentials.

2. Information We Collect

We may collect and receive information in the following ways:

2.1 Data Processed on Behalf of Clients

When providing the Services, we may process:

• advertising performance data (impressions, clicks, spend, conversions);
• campaign, ad group, keyword, product, and creative data;
• engagement and attribution signals;
• commerce data from connected stores (orders, products, customers, inventory, locations, discounts, sessions, and payouts);
• technical identifiers provided by third-party platforms.

This data is obtained:

• directly from clients;
• via integrations with platforms such as Google Ads, Meta, TikTok, and Shopify;
• via APIs authorized by the client (OAuth or similar).

We do not independently collect end-user data for our own marketing purposes.

2.2 Data You Provide Directly

We may collect personal data when you:

• create an account;
• subscribe to a plan;
• contact support;
• subscribe to communications;
• apply for a job;
• participate in surveys or events.

This may include: name; email address; company name; job title; billing information (processed via third-party providers); login credentials; and communication content.

2.3 Automatically Collected Data

When you use the Website or Services, we may collect: IP address; browser and device information; operating system; usage data (pages visited, actions taken); timestamps and referring URLs.

2.4 Data processed by Neo

For each brand, Neo processes:

• the performance data and settings of the connected ad accounts (Meta, Google Ads, TikTok Ads, Microsoft Advertising and the other connected platforms);
• the aggregated figures of the connected store and site sources (sales, orders, sessions, by product, channel or country);
• the statistics and posts of the connected organic accounts;
• the documents the client drops into the brand memory (brand book, catalog, surveys, customer-service exports, P&L, marketing calendar);
• customer reviews and survey answers, quoted without names;
• the brand memory and the deliverables Neo writes.

Neo works on aggregates. The brand memory and the deliverables hold no personal data of the client’s customers: no names, contact details or photos.

3. How We Use Information

We use personal data strictly to:

• provide, operate, and maintain the Services;
• generate analytics, dashboards, and reports;
• authenticate users and manage accounts;
• provide customer support;
• ensure security and prevent fraud or abuse;
• comply with legal obligations;
• communicate with you (service-related or, where permitted, marketing).

Important Restrictions (Core Positioning). Creaboost explicitly commits that:

• we do not sell personal data;
• we do not use data from Google, Meta, Shopify, or other APIs for advertising targeting, profiling, or resale;
• we do not use Customer Data to train any generalized AI or machine learning models;
• we only process data to provide the Services requested by the Client.

3.1 Legal bases

• Providing the Services, managing accounts and billing: the performance of the contract, and our legal obligations.
• Answering your messages and organizing demos: pre-contractual steps and our legitimate interest.
• Measuring the Website’s audience: your consent.
• Securing the Services and preventing abuse: our legitimate interest.

4. Third-Party Platforms and OAuth

4.1 OAuth Authorization

Clients may authorize Creaboost to access third-party platforms (e.g., Google Ads, Meta, Shopify). Access is granted via OAuth or similar mechanisms. Access can be revoked at any time. Upon revocation, we stop accessing the relevant data.

4.2 Google API Services Compliance

If we access Google APIs:

• we comply with the Google API Services User Data Policy, including Limited Use requirements;
• data is used only to provide analytics and reporting;
• data is not used for advertising or AI training.

4.3 Meta and Other Platforms

If we access Meta, TikTok, or similar APIs: data is used strictly in accordance with platform policies; prohibited uses (e.g., surveillance, discrimination) are not permitted.

4.4 Shopify

When you connect a Shopify store, we access your store data through Shopify’s official API in read-only mode:

• orders (including orders older than 60 days);
• products;
• customers;
• inventory;
• locations;
• discounts;
• sessions;
• Shopify Payments payouts.

This data is used solely to produce the analytics and reports you request inside Creaboost. It is never used for advertising, resale, or AI training.

When a merchant uninstalls the app or requests erasure, we process the request through Shopify’s mandatory privacy webhooks and delete or anonymize the data within 30 days.

4.5 Read-only access and isolated tokens

Neo reads the connected ad accounts without being able to change them: no campaign, budget, audience or creative is modified. Access tokens stay in an isolated Creaboost service, never exposed to the agent, and connected sources are tied to the brand, never to a user. The client may send a connection link to the person who holds an access; that person authorizes it through the platform’s own login, without a Creaboost account, and can revoke it at any time.

4.6 Work tools connected to Claude

Slack, Gmail, Google Drive, Slides, Sheets and Docs, Notion and the other work tools are Claude connectors that the client connects with its own accounts. The summaries, alerts and exports Neo sends through them go to the client’s accounts and are processed under the client’s agreements with those providers. Creaboost never sees their credentials, and does not store exports, apart from the pages the client publishes.

5. Sharing of Information

We do not sell your personal data.

We may share information only in the following cases:

5.1 Service Providers

We may share data with trusted providers for: hosting and infrastructure; payment processing; analytics; customer support; security. They act under our instructions and only for defined purposes.

5.2 Legal Obligations

We may disclose data: to comply with law or regulation; to respond to legal requests; to protect rights, safety, or security.

5.3 Business Transfers

In case of merger, acquisition, or sale: data may be transferred with appropriate safeguards.

5.4 Aggregated Data

We may use and share aggregated or anonymized data that does not identify individuals.

5.5 Our providers

• Vercel, for hosting the Website;
• HubSpot, for the demo booking calendar;
• Intercom, for the support chat;
• Cookiebot, for collecting your cookie consent;
• an AI model provider, for the reading of Meta creatives (images and videos).

The full list of the subprocessors of the Services is in the Data Processing Agreement, sent on request. Anthropic is not on it (1.2).

6. Data Retention

We retain personal data only as long as necessary to: provide the Services; comply with legal obligations; resolve disputes; enforce agreements.

Unless required otherwise:

• client data is retained during the subscription;
• data is deleted or anonymized within 30 days after termination or disconnection.
• for connected Shopify stores, uninstall and erasure requests received through Shopify’s mandatory privacy webhooks are processed on the same 30-day basis.

6.1 Brand machines and workspace machine

Each brand has a dedicated machine, which stores its memory and its deliverables. Each workspace has one machine, where the users’ Claude Code sessions run. When a brand is deleted, its machine, memory, deliverables and uploaded files are deleted within 30 days; the workspace machine follows the same rule when the workspace is closed or the subscription ends. Invoices are kept for the period the law requires; sales exchanges that led nowhere are deleted three years after the last contact.

7. Security

We implement industry-standard technical and organizational measures to protect data. However: no system is completely secure; users must protect their credentials.

7.1 Neo’s safeguards

• one dedicated machine per brand, and one machine per workspace;
• ad platform tokens in an isolated service, out of the agent’s reach;
• each machine and each scheduled run gets a narrow Creaboost access and only the tools it needs;
• the credentials of work tools appear nowhere: not in conversations, files, deliverables or logs;
• uploaded files stay private;
• everything Neo reads (ad copy, files, emails, web pages) is treated as data, never as instructions.

The Security and access page details who sees what, and where each piece of data lives.

8. Your Rights

Under applicable laws (including GDPR), you may: access your data; correct inaccurate data; request deletion; restrict or object to processing.

If we process data on behalf of a client: requests must be directed to that client. We will assist as required by law.

8.1 Exercising your rights

You may also receive your data in a readable format and withdraw your consent at any time. Write to privacy@creaboost.com: we answer within one month. You may lodge a complaint with the CNIL, or with the data protection authority of your country.

9. International Data Transfers

Data may be processed in different jurisdictions. Where required, we implement safeguards such as: contractual protections; equivalent data protection standards.

9.1 Transfers outside the European Union

Some providers may process data outside the European Union, in particular in the United States. These transfers rely on the European Commission’s standard contractual clauses or on the EU-U.S. Data Privacy Framework. Transfers made by Anthropic follow the client’s agreement with Anthropic.

10. Tracking Technologies

We use limited tracking technologies such as: cookies; analytics tools; security-related tracking.

These are used to: improve the Services; understand usage; ensure security.

We do not use tracking technologies for behavioral advertising based on Customer Data.

10.1 Cookie consent

Cookies needed for the Website to work are set without your consent. The others (audience measurement, the booking calendar embedded on the demo page) are set only after you agree, through the consent tool shown on your first visit. You can change your choices at any time from the same tool.

11. Third-Party Links

Our Services may include links to third-party websites. We are not responsible for their privacy practices.

12. Updates

We may update this Privacy Policy. Material changes will be notified; continued use implies acceptance.

13. Contact

For any questions or requests:

privacy@creaboost.com, Attn: Data Protection Officer, DEEPCASTR SAS