Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our marketing website at https://createen.pl ("Website") and when you use the Createen application (the "Service"). It also describes your rights under the GDPR.

1. Data Controller

The controller of your personal data is Dawid Zbiński, ul. gen. Władysława Sikorskiego 15/15, 34-400 Nowy Targ, Poland (NIP 7352921429, REGON 528114982). You can contact us about privacy matters at hello@createen.pl.

2. Data We Collect

2.1 Marketing website

Our marketing website collects almost no personal data on the server side. With your consent, we use Google Tag Manager and Google Analytics to understand how the Website is used (see our Cookie Policy). Analytics only run after you opt in via the cookie consent banner. We also store, locally in your browser, a consent-preference entry (createen-consent) and a theme preference (createen-theme); these stay on your device and are not transmitted to us.

2.2 The Service (application)

When you use the Createen application, we process the data you and your team provide and generate, including:

• Account data — your email address, name, and authentication credentials (passwords are stored hashed, never in plain text).
• Workspace data — clients, projects, tasks, schedules, notes, and related records you create.
• Uploaded files — media assets and invoice documents you upload, stored on our object-storage provider.
• Invoice data — fields extracted from uploaded invoices using an AI provider, plus payment records you enter.
• Communications — transactional emails we send you (e.g. verification, review notifications) via our email provider.
• Technical data — authentication cookies and limited server logs necessary to operate and secure the Service.

3. Purposes and Legal Bases

We process personal data on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) — to create and manage your account, provide the Service, process your workspace and uploaded data, and provide support.
• Consent (Art. 6(1)(a)) — for non-essential cookies and analytics on the Website, and for any optional communications. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — to secure our systems, prevent fraud and abuse, maintain service integrity, and improve the Service, where these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)) — to comply with accounting, tax, and other legal requirements.

4. Subprocessors and Sharing

We do not sell your personal data. We share data with carefully selected service providers ("subprocessors") who process it on our behalf under data processing agreements. The principal subprocessors are:

Subprocessor	Purpose	Data involved
Cloudflare (R2)	Object storage for uploaded media and invoice files	Uploaded files
MailerSend	Transactional email delivery	Email address, message content
Anthropic	AI-assisted extraction of fields from uploaded invoices	Invoice document contents
Google (Tag Manager / Analytics)	Website analytics (consent-based only)	Usage and device data
netcup GmbH (Germany)	Server infrastructure hosting the application and database (self-managed via Dokploy, PostgreSQL)	All Service data at rest

We may also disclose data where required by law, to enforce our agreements, or to protect the rights, safety, and security of Createen, our users, or the public.

5. International Transfers

Some subprocessors may process data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision.

6. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. After account closure we delete or anonymize personal data within a reasonable period, except where we must retain certain data to comply with legal obligations (for example, invoicing and tax records) or to resolve disputes.

7. Your Rights

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erasure ("right to be forgotten") in certain circumstances;
• Restrict or object to certain processing, including processing based on legitimate interests;
• Data portability — receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at hello@createen.pl. You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO / PUODO), uodo.gov.pl.

8. Cookies

The Website uses cookies and similar local-storage technologies. Non-essential cookies (analytics) are set only after you opt in. For full details and to manage your preferences, see our Cookie Policy.

9. Children

The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, please contact us and we will delete it.

10. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and tenant isolation between client workspaces. No method of transmission or storage is completely secure, but we work to protect your data and to address vulnerabilities promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date above and, where appropriate, by additional notice. Please review this page periodically.

12. Contact

For any privacy questions or requests, contact Dawid Zbiński at hello@createen.pl or at ul. gen. Władysława Sikorskiego 15/15, 34-400 Nowy Targ, Poland.