Privacy policy

This policy explains which personal data CreatorRates processes, for what purpose and what rights you have. The controller is the CreatorRates team, based in Spain, reachable at soporte@creatorrates.app.

1. Data we collect

• Account data: name, email address, hashed password or magic link, and authentication metadata managed by Supabase.
• Profile and business data: professional name, handle, company, tax ID, niche, main platform, currency and brand colour you choose to add.
• Client and quote data: names, emails and notes of the brands you enter, together with your quote lines, amounts and dates.
• Brand enquiries: if you write from the brand form, your name, company or agency, work email, whether you write as brand or agency, the package and budget you mention and your message.
• Payment data: Stripe customer and subscription identifiers, plan status and receipts. We never store card numbers or security codes.
• Technical data: IP address, user agent, visited pages, error events and security logs needed to run the service.
• Aggregate measurement: daily counters of page views and actions (calculator used, sign-up, checkout started, PDF downloaded) with device class, the referring domain and — only if the link carries utm_source, utm_medium or utm_campaign — a short campaign label. This measurement stores no IP addresses, no visitor identifiers, no user agents and not the full URL or its other parameters, and it is not shared with third parties.

2. Purpose and legal basis

We process your data to provide the service and perform the contract you accept when creating an account (Art. 6.1.b GDPR), to comply with legal and tax obligations (Art. 6.1.c), to prevent fraud and protect the platform (legitimate interest, Art. 6.1.f) and, where applicable, with your consent for advertising cookies (Art. 6.1.a).

Brand enquiries are used only to answer you and assess the collaboration. The legal basis is the consent you give by sending it, and the contract if you hire us.

We do not use your quotes or your clients' data to train models, and we do not sell it to third parties.

3. Processors and third-party services

• Supabase hosts the PostgreSQL database and manages authentication. Data is stored in the region configured for the project.
• Stripe processes payments and subscription billing. Stripe is an independent controller for payment data.
• Hosting provider: serves the application and keeps technical access logs.
• Google AdSense is not serving advertising: the site shows no third-party ads today and does not download its script, so there are no advertising cookies and no reserved ad slots. If ad units are activated in the future, Google will act as an independent controller for advertising and may set its own cookies — and no ad will be shown before you consent to that category.

Where a provider is outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses or on adequacy decisions.

4. Retention

We keep account data while the contractual relationship exists and for the legal periods that apply. If you ask for deletion, we erase your profile, clients and quotes within 30 days, except for information we must keep for tax or fraud prevention.

5. Your rights

You can request access, rectification, erasure, objection, restriction and portability by writing to soporte@creatorrates.app. We answer within one month. You can also complain to the Spanish Data Protection Agency (AEPD) or to the supervisory authority in your country.

6. Cookies

The necessary cookies are your session, to keep you signed in and protect authentication, your currency preference and the cookie-notice flag. There are no advertising cookies: while there are no live ad units there is nothing to consent to and no visit is used for advertising. Your advertising preference is still stored with the rest of your decision, because that record is what lets you change it. If you delete or block the necessary cookies in your browser, some panel features will stop working. The detail is in the cookie policy.

7. Security

We enforce per-user access control, encryption in transit, database row-level policies and signature verification on payment webhooks. No system is infallible: if we detect an incident affecting your rights, we notify the competent authority and the people affected as the GDPR requires.

8. Minors

The service is aimed at people over 18, or minors with the authorisation of their legal guardian. We do not knowingly collect data from minors without that authorisation.

9. Changes

We may update this policy to reflect legal or technical changes. The new version is published with its date and, if the change is substantial, we notify you by email or inside the app.