Last updated: 6 October 2026

This Privacy Notice explains how Creosy collects, uses, shares and retains personal information and how you can exercise your choices. It applies to our website, platform and beta services. The activities described depend on the features you use, the tools enabled for those features, and your privacy choices.

Privacy enquiries and requests: support@creosy.ai.

1. Who is responsible for your information

In this notice, “Creosy”, “we”, “us” and “our” mean CREOSY TECHNOLOGIES LTD, a company incorporated in Cyprus with registration number HE 497521.

Registered office and privacy correspondence address: Prodromou, 75, ONEWORLD PARKVIEW HOUSE, 4th floor, 2063 Nicosia, Cyprus.

CREOSY TECHNOLOGIES LTD is the controller of the personal information processed for Creosy's own purposes described in this notice. We determine why and how that information is used and are responsible for our account, billing, product, analytics and marketing processing. We manage privacy notices, choices, rights requests, security, provider oversight, retention, deletion, incident response and international-transfer safeguards.

Our privacy contact is support@creosy.ai.

Where we process personal information solely on a business customer's documented instructions, we act as a processor for that activity under the applicable data-processing agreement. The customer determines those purposes and instructions. If your request concerns that processing, we assist the customer in responding as required. Our own uses for Creosy's accounts, security, billing, product improvement, analytics and marketing remain subject to this notice.

2. Who this notice covers

This notice explains how we handle personal information about visitors to creosy.ai, users of the Creosy platform, people contacting us, and visitors to Creosy-hosted campaign pre-landing pages. It also covers personal information contained in business materials submitted to us, to the extent we determine its use.

An advertiser's own website, checkout and customer relationship are covered by that advertiser's privacy information. Advertising platforms and other providers may also process information for their own purposes under their notices. Creosy remains responsible for its own activities and pages.

3. Information we collect and its sources

The information involved depends on how you interact with Creosy and the features you use.

Category	Information and source
Account and authentication	The email address you provide, a securely hashed password, and account settings and status associated with your use of the service.
Business and campaign materials	Website and product URLs, business names, product descriptions and prices, photos, logos, other uploads, prompts, audience criteria, target locations, campaign goals and budgets. These come from you or material you ask us to retrieve from a specified website or product page. Generated drafts may also contain personal information.
Campaign administration	Your approvals, review communications, campaign settings, authorised budgets, launch/stop instructions, advertising-platform identifiers, spending and available performance reports. These arise from your instructions, our operation of the service and connected advertising platforms.
Billing and transactions	Subscription, advertising-payment, invoice, authorisation, payment-status, refund and reconciliation information received from you, Stripe or PayPal. Those providers handle full card or bank-account details; Creosy receives billing and transaction information.
Support and feedback	Your email address, correspondence and information you choose to provide when contacting support@creosy.ai or giving feedback.
Technical and usage information	Information generated by visits and use, such as IP addresses, browser/device information, pages and features used, event times, referring pages, clicks, cookie or similar identifiers, and security or error events. Collection depends on the tool, its configuration and your choices.
Session replays	Reconstructed interactions within the signed-in platform, including clicks, scrolling, navigation and associated page content, as described in section 7.
Preferences and advertising audiences	Your privacy and marketing choices, relevant permission records, customer email addresses used for audience matching, and interest or audience inferences associated with the advertising activities in section 6.

You choose the business materials you submit. Names, photos and details about sole traders or identifiable individuals can be personal information even when used in a business context. Do not place passwords, full payment details, sensitive personal records or third-party customer lists in prompts or uploads. Supply other people's information only with the necessary authority and disclosures, consistent with our Terms.

We need certain account, campaign and payment information to provide the requested service. If you do not supply it, the relevant feature or transaction may be unavailable. Optional marketing and non-essential tracking choices are handled separately from account registration and agreement to our Terms.

4. Why we use information and our legal grounds

Where a law such as the EU or UK GDPR requires a legal ground for processing, the following explains the purposes and grounds relevant to our own controller activities. A contractual ground applies only where processing is necessary for a contract with you, or steps you request before entering one. Where you are not personally a party to a contract with us, including where you represent a business customer, necessary account and service administration relies on our legitimate interest in providing and supporting the service requested, subject to your rights and reasonable expectations.

Purpose	Legal ground where required
Create and administer accounts; generate, review and deliver campaign drafts; implement approved campaigns and report results	Performance of a contract with you where we are a party to that contract; otherwise the legitimate interest in providing and supporting the requested service described above.
Administer payments, advertising allocations, refunds and invoices	Contract where we are a party to the relevant agreement; otherwise legitimate interests in necessary payment and service administration. Legal obligation for records we must keep under applicable tax or accounting law.
Respond to support requests, check quality, investigate errors and maintain the service	Contract where we are a party to the relevant agreement and processing is necessary to perform it; otherwise legitimate interests in reliable operation and resolving problems, subject to the content-use limits in section 5.
Improve campaign recommendations and draft quality through internal testing of prompts, workflows and model outputs	Legitimate interests in developing and improving Creosy, subject to necessity, individuals' reasonable expectations and rights, and the limits in section 5. Where consent is legally required for a particular use, we obtain it.
Understand platform use and improve usability, including through session replays	Consent where the tracking method requires it; otherwise legitimate interests in understanding and improving the service, after considering the impact on individuals.
Measure customer campaigns and visits to Creosy-hosted pre-landing pages	Consent for tracking requiring consent; otherwise legitimate interests in producing permitted, proportionate campaign measurements.
Send marketing emails about Creosy	Consent where required; otherwise legitimate interests in promoting our own service only where the applicable electronic-marketing rules allow this.
Advertise Creosy, match customer emails and find similar prospects	Consent where law or the relevant platform requires it; otherwise legitimate interests in promoting Creosy where permitted, subject to applicable opt-out rights.
Protect accounts, prevent misuse, investigate disputes and establish or defend legal claims	Legitimate interests in security, preventing abuse and protecting legal rights; legal obligation where processing is required by law.
Record privacy choices, respond to rights requests and comply with applicable requirements	Legal obligation where applicable; otherwise legitimate interests in respecting and documenting individuals' choices.

We do not use legitimate interests to bypass a consent requirement. You may withdraw consent or object to processing as explained in section 11. Where we rely on legitimate interests, we consider whether the purpose is necessary and whether individuals' rights and interests outweigh it.

5. Campaign content, AI and human review

We use direct LLM connections and other AI services through gateways to generate campaign recommendations and draft content. These services process relevant business information, prompts, uploaded material, and generated outputs for this purpose. Our selection of providers and models may change as the service develops.

We use your campaign content to deliver and support your service, review quality, resolve problems and improve the product. Subject to the content permissions and confidentiality commitments in the Terms that apply to you, this can include broader internal testing of prompts, workflows and model outputs to improve Creosy beyond your individual campaign. We do not require a separate opt-in for that testing where a valid non-consent legal ground applies. You may object to processing based on legitimate interests through support@creosy.ai, as explained in section 11.

We limit internal testing to information relevant to that purpose and restrict access to authorised people and service providers. We do not use private customer inputs or outputs for public promotion, case studies or unrelated marketing without separate permission. Publishing this notice does not expand a content licence, override a data-processing agreement, or authorise a new use of information collected under narrower permissions.

Creosy does not use private customer inputs or outputs to train or fine-tune its own AI models. External AI providers' retention and data-use terms can vary by service and contract; this statement about Creosy's own training is not a guarantee covering every external provider. Contact support@creosy.ai for information about relevant recipients and their processing arrangements.

Our authorised employees working within the EU may access relevant information for campaign review, support, quality checks and maintenance. Access is limited to what their work requires.

AI tools analyse the offer information, campaign goals and audience criteria you supply to recommend campaign material. Recommendations and draft content require your review; managed campaigns require your explicit approval and the review process described in our Terms. Audience-matching tools compare identifiers and use activity or interest signals to identify potential audiences for Creosy's advertising, which can affect the advertising you see. Where applicable law gives you rights concerning profiling or decisions made solely by automated means that have legal or similarly significant effects, you can request the relevant explanation, human review or opportunity to challenge a decision through the contact route in section 11.

6. Creosy's own marketing and audience matching

We send marketing emails to registered users and customers where permitted. Where prior opt-in is required, we obtain it before sending. Where an existing-customer or similar exception is available, we use it only when its conditions are met, including an opportunity to decline marketing when required at collection and an unsubscribe option in each marketing email. Necessary account, billing, security and campaign messages are handled separately.

We use permitted activity from Creosy's own website and platform to advertise Creosy to previous visitors and users. We also share customer email addresses with Meta or Google for audience matching, including helping those platforms find new people with similar profiles or interests. Where an email is hashed for matching, it remains a matching identifier and should not be treated as anonymous.

These advertising uses are subject to the required permissions and your applicable choices. Agreeing to receive marketing emails does not by itself establish permission for customer-email audience matching. We apply relevant advertising withdrawals and opt-outs to future matching uploads and audience updates as well as device-based tracking. Necessary records of your preference may remain so we can respect it.

You can unsubscribe from marketing emails using the link in the message or by contacting us. You can also contact support@creosy.ai to object to our direct marketing, including related profiling, and use the privacy choices described in section 11.

7. Cookies, analytics and platform session replays

We use technologies needed to operate and protect the service, along with optional analytics and advertising tools. Depending on the features enabled and your choices, our analytics and advertising tools include Google Analytics, Meta Pixel, Google Ads tracking, Hotjar and internal usage tools. Their deployment varies by page and purpose.

Where prior consent is required, optional tracking is used only after you opt in. You may reject optional categories and revisit or withdraw your choices through the cookie and tracking controls presented on the relevant website or platform. Where an opt-out approach is permitted, we respect the opt-outs required by applicable law. The information accompanying these controls explains the relevant technologies, purposes, providers and lifetimes. Contact support@creosy.ai if you need help changing a choice. Disabling essential technologies may prevent parts of the service from working.

Individual session replays are limited to the signed-in customer platform. We use them to understand navigation, find usability problems and improve the product. They are not used on Creosy's public marketing website or customer-campaign pre-landing pages.

Session replays may include clicks, scrolling, navigation and associated page content. We apply technical and organisational safeguards appropriate to that information, restrict staff access according to responsibilities, and respect the consent, withdrawal and opt-out rules described above.

8. Visitors to customer - campaign pre-landing pages

These pages show an advertiser's approved offer and link to the advertiser's website. They do not contain Creosy contact or lead forms collecting your name, email address or phone number. Technical visit and campaign-measurement information may still be collected as described above.

We use pre-landing visit information to measure the relevant campaign's results. We do not reuse it to retarget you for Creosy, for another customer, or for the advertiser's follow-up advertising. Customers receive combined campaign statistics rather than individual visitor records. A combined report does not mean that all underlying measurement records are anonymous.

After you follow the link, the advertiser controls its website, enquiries, purchases and customer relationship. An onward click does not by itself tell Creosy whether you purchased anything. Measurement tools and advertising platforms may also process information under their own applicable arrangements; our stated purpose describes Creosy's use.

9. Who receives information

We disclose information where necessary for the purposes in this notice, subject to applicable permissions and safeguards:

• Our authorised staff: for the functions described in sections 1 and 5.

• Technology and service providers: hosting, storage, infrastructure, email delivery, AI generation and routing, analytics, session replay, maintenance and security. Providers acting as processors receive appropriate contractual instructions and protections.

• Payment providers: Stripe and PayPal, for payments, authorisations, refunds, fraud checks and transaction administration. They may also have independent legal and regulatory responsibilities.

• Advertising and measurement platforms: including Meta and Google, to review and run approved campaigns, provide reports, measure permitted events and carry out Creosy's own advertising and audience matching. The information shared depends on the activity and your choices.

• The public and advertiser websites: approved ad content and approved pre-landing content are intended for public display. People following a campaign link reach the advertiser's website. This does not make private account information or unpublished drafts public.

• Professional advisers, authorities or parties to legal proceedings: where necessary and lawful for advice, legal duties, claims, investigations or protecting rights.

• Parties to a proposed or completed business transaction: where necessary for a merger, financing, reorganisation or sale, subject to appropriate confidentiality and other safeguards and any notice or permission required by law.

Some recipients act on our instructions; others determine their own purposes for particular activities. We assess those roles by activity. You can request information about recipients of your personal information by contacting us. A change of provider does not remove our obligations to protect your information or provide notice of a material change in its use.

10. International processing

Creosy is established in Cyprus. Our authorised employees access customer information from within the EU. Hosting and service-provider processing may involve the United States, the EU and other countries where the relevant providers operate. This notice does not promise that all information stays in the EU.

These countries may have data-protection laws different from those in your country. For transfers requiring protection under EEA or UK law, we rely on an applicable adequacy decision where it covers the recipient and processing. Otherwise, the relevant transfer must be covered by appropriate contractual safeguards, such as approved standard contractual clauses and applicable UK safeguards, together with any necessary assessment and additional protections, or another transfer ground permitted by law. The safeguard depends on the recipient and destination. Acceptance of our Terms is not blanket consent to restricted international transfers.

Contact support@creosy.ai for information about the safeguards for transfers of your personal information and how to obtain a copy, subject to permitted redactions protecting other information.

11. Your choices and privacy rights

Depending on the law that applies to you and the activity, you may have rights to:

• Know whether we process your information, obtain access and receive a copy.

• Correct inaccurate information and request deletion or restriction of processing.

• Receive certain information in a portable format.

• Withdraw consent without affecting the lawfulness of processing before withdrawal.

• Object to processing based on legitimate interests, and to direct marketing including related profiling.

• Opt out of targeted advertising, sale or sharing where those rights apply.

• Receive applicable protections concerning automated decisions, including explanation, human review or the ability to challenge a decision where required by law.

• Complain to the relevant supervisory or enforcement authority.

How to make a request. Contact support@creosy.ai or write to CREOSY TECHNOLOGIES LTD at the address in section 1. Describe the request and the account or interaction it concerns. We may request information reasonably necessary to verify identity or authority, proportionate to the request. You do not need to create an account to submit a privacy request. Authorised agents may act where permitted by law, subject to appropriate evidence of authority.

We respond without undue delay and within the applicable legal deadline. For requests governed by the GDPR, this is generally within one month, subject to permitted extensions. We explain any permitted extension or reason for declining a request as required. Requests are generally free, subject to lawful exceptions. We do not unlawfully discriminate or retaliate against you for exercising privacy rights.

Appeals. US residents, and anyone else entitled to appeal under applicable law, may ask us to reconsider a refusal by emailing support@creosy.ai with the subject “Privacy appeal” and identifying the request. We review the appeal, explain the outcome within the applicable period and provide any further complaint route required by law.

Advertising choices. Where applicable, contact support@creosy.ai to record an opt-out of targeted advertising or sale/sharing. We honour recognised opt-out preference signals, including Global Privacy Control, where required by law. Their application to a browser, device or identifiable account follows the applicable rules. We apply relevant withdrawals and opt-outs to the related matching and audience workflows. You may still see advertising that is not based on the opted-out uses.

Do Not Track. Creosy currently does not respond to traditional browser Do Not Track signals. This does not change how we handle consent requests or legally recognised opt-out signals where those rules apply.

US residents. Creosy offers access, correction, deletion, portability, objection/opt-out and appeal routes to all US residents, subject to lawful exceptions, identity or authority verification and applicable response deadlines. Our advertising disclosures of email or online identifiers and associated activity can qualify as a “sale,” “sharing” or targeted advertising under some state laws, even without payment for the information. Sections 3, 4, 6 and 9 describe the categories, purposes, sources and recipients; section 12 describes retention. Where a state law gives additional rights or protections—including rights concerning sale/sharing, sensitive information or automated decisions—we apply those requirements when they cover the activity and Creosy. The customer-email and online-activity disclosures described above concern Creosy advertising; they do not authorise advertising reuse of private campaign materials, passwords or payment details. Operating primarily for businesses does not by itself remove privacy rights.

Complaints. In the EEA, you may complain to the competent authority, including in the country where you live or work or where an alleged infringement occurred. The EDPB directory includes the Cyprus Commissioner for Personal Data Protection and other EEA authorities. In the UK, you may contact the Information Commissioner's Office. You do not have to complain to Creosy first where the law allows direct complaints.

12. Retention and deletion

We retain personal information for the purposes described in this notice and remove it when it is no longer needed, subject to necessary legal retention. Relevant factors include whether an account or campaign is active, whether support or payment reconciliation is ongoing, the period for which a privacy choice must be respected, and applicable accounting, tax and claim requirements.

Information	Retention period or criteria
Account, business and ordinary campaign content	While your account exists and the information remains necessary for the disclosed purposes. On account deletion, we delete ordinary content, including internal quality-review and product-testing copies, without undue delay, subject to the limited exceptions below.
Identifiable product usage analytics and session replays	Up to 12 months after collection, followed by deletion or irreversible anonymisation.
Campaign pre-landing visitor events	For the period needed to measure and reconcile the relevant campaign and resolve related reporting issues, then deleted or irreversibly anonymised. Customer-linked reports and minimum campaign evidence follow their separate rules below.
Minimum campaign approval, approved-budget, spending and delivery evidence	Five years after the campaign ends. This covers only the evidence necessary to establish what was approved, charged and delivered, rather than all private drafts or uploads.
Minimum billing, transaction, refund and accounting records	Five years after the relevant subscription ends or, for a standalone advertising payment, after final payment reconciliation, unless applicable law requires a different period.
Support correspondence and privacy-request records	Three years after the issue or request is resolved. Unnecessary attachments and verification material are removed sooner.
Consent and privacy-choice evidence	While we rely on the permission, then three years after it ends. Evidence of a request to change or withdraw a choice is kept for three years after that request is fulfilled.
Marketing suppression and advertising opt-out records	The minimum identifier and preference for as long as necessary to respect the choice, with an annual necessity review.
Security, diagnostic and AI-request metadata	For the period necessary to investigate the relevant issue, maintain secure operation or reconcile service usage. Retention is limited according to the incident, service requirement and applicable provider arrangements, with narrowly necessary evidence retained for unresolved matters.
Backups	Until deleted or replaced through the applicable backup cycle. Information due for deletion is kept beyond ordinary use pending removal, and deletions are reapplied before a restored backup returns to service.

We may retain specific records longer where required by law or necessary for an unresolved dispute, chargeback, investigation or legal claim. Such retention is limited to relevant records, restricted to that purpose and reviewed when the reason ends. Shorter mandatory periods and valid erasure rights take priority where they apply. These exceptions do not allow us to keep an entire account for marketing or product testing after deletion.

An open account does not justify keeping information indefinitely if it is no longer needed. Truly anonymous statistics may be retained while useful; information that can still reasonably be linked to a person is not treated as anonymous.

Account deletion and subscription cancellation are different, as explained in our Terms. Deletion requests campaign stops and ends account access; subscription cancellation alone can leave an approved, funded campaign running. Necessary payment, approval and dispute records may remain, but this does not permit unrelated reuse of the rest of your campaign content. A retention period is not a promise that materials remain downloadable after account access ends.

We address information held by processors and notify other recipients of relevant requests where required. Independent controllers may retain information for their own lawful purposes; we explain any material limits applicable to your request.

13. Security

We use encryption for connections and stored data, securely hashed passwords, access restrictions for employees and two-step verification for administrators. Safeguards are applied according to the system and information involved. No service can guarantee absolute security. Please protect your credentials and report suspected account misuse to support@creosy.ai.

14. Children

Creosy customer accounts are intended for adults aged 18 or over. Do not create an account if you are under 18. If you believe a child has provided personal information through our service, contact support@creosy.ai so we can investigate and take the appropriate action. The age requirement for customer accounts does not mean we can determine the age of every person visiting a public advertising page.

15. Changes to this notice

We update this notice when our practices or applicable requirements change. The date at the top identifies the latest revision. For material changes, we provide additional notice where required and obtain any new permission required for the changed use. Publishing a revised notice does not itself supply that permission.