Privacy Policy (GDPR)

This policy is based on the European General Data Protection Regulation (GDPR). For users outside the EU, these protections apply to you as well.

1. Data controller

• JD_Shop – Micro-entreprise
• 3 impasse de Bourgogne, 37000 Tours, France
• contact: contact@creatikk.io

2. Data collected

Creatikk only collects the data necessary for the service to work:

• email, first name, credentials
• connection data (truncated IP, logs)
• imported videos, generated content
• analytics data (cookies, with consent)
• if you connect a Google account: basic profile information (email, name) and the YouTube data described in section 5

3. Purposes

• provide and improve the service
• prevent abuse
• account management and billing
• product communications (if you consent)

4. Sharing, transfer, and disclosure of data

Creatikk does not sell, rent, or trade any personal data. Your data is only shared with the processors strictly necessary for the service to operate, who act on our instructions and are bound by data processing agreements:

• Application hosting: Vercel (USA)
• Database and media storage: Supabase (PostgreSQL)
• Payment: Stripe (where applicable)
• Analytics: if accepted (e.g. Google Analytics)

Your videos or content are only published to a third-party platform (YouTube, TikTok, Instagram…) when you explicitly request it.

We may disclose data if required by law (request from a competent judicial or administrative authority). In the event of a merger or acquisition, users would be informed before any transfer of their data.

5. Google user data (Google / YouTube APIs)

If you sign in with Google or link your YouTube channel, Creatikk accesses the following data through the Google APIs:

• basic profile information: email address and name
• read-only information about your YouTube channel (channel name, status, published videos) — to display your connected account and the status of your publications
• publishing videos to your YouTube channel — only at your explicit request

This data is never sold, is not used for advertising purposes, and is not shared with any third party, except for our hosting processors listed in section 4 (technical storage only) and disclosures required by law. No human reads this data, except with your explicit consent, for security reasons, or to comply with the law.

Creatikk's use of information received from Google APIs complies with the Google API Services User Data Policy, including the “Limited Use” requirements.

You can revoke Creatikk's access to your Google data at any time by disconnecting your account from the dashboard (the tokens are then revoked with Google and deleted) or via your Google account security settings.

6. Processors

• Hosting: Vercel (USA) — protective contractual clauses
• Database and media storage: Supabase
• Payment: Stripe (where applicable)
• Analytics: if accepted (e.g. Google Analytics)

7. Retention period

• Account data: as long as the account is active
• Uploaded videos: for the time necessary for the service / deletion on request
• Google/YouTube access tokens: as long as the account is connected; deleted and revoked as soon as the account is disconnected
• Cookies: according to the standard duration of the tools used

8. User rights

• ☑️ Right of access
• ☑️ Right to rectification
• ☑️ Right to erasure
• ☑️ Withdrawal of marketing consent
• ☑️ Revocation of access to connected accounts (Google, etc.)

contact: contact@creatikk.io

9. Security and protection of sensitive data

Creatikk implements the following mechanisms to protect your data, in particular sensitive data such as Google API access tokens:

• Encryption in transit: all communications use HTTPS/TLS
• Encryption at rest: OAuth tokens (Google/YouTube and other platforms) are encrypted with the AES-256-GCM algorithm before being stored in the database
• Strict access control: data is partitioned per user (row-level security) and is only accessible to authorized people, following the principle of least privilege
• Keys and secrets stored in secure environment variables, never in the source code
• Revocation and deletion of access tokens as soon as a connected account is disconnected

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL (the French data protection authority) and the affected users in accordance with the GDPR.

10. Transfers outside the EU

Some processing may be carried out in the United States by Vercel or Stripe.

These transfers are legally framed (standard contractual clauses).

11. Deletion of your data

You can have your data deleted at any time. Depending on what you want to remove, the procedure is as follows:

• A connected social account (TikTok, YouTube, Facebook, Instagram): open Dashboard → Cross-platform publishing → My accounts and click “Disconnect” on the relevant account. The corresponding access tokens are revoked with the platform and deleted from our servers.
• Creatikk's access to your Facebook account: you can also remove it from Facebook, in Facebook Settings → Apps and Websites by selecting Creatikk and then “Remove”.
• Your Creatikk account and all associated data (profile, imported videos, generated content, publication history): write to contact@creatikk.io from your account's email address, with the subject “Deletion of my data”. We will then delete the account and associated data, except for what the law requires us to keep (for example accounting records related to payments).