Privacy Policy

At CreatoHub Digital Studio ("CreatoHub", "we", "our", or "us"), we are committed to safeguarding the personal privacy, data sovereignty, and security of everyone who visits our website (www.creatohub.com) or interacts with our digital creative services.

This Privacy Policy explains what personal information we collect, how it is processed and protected, your legal rights under the European Union General Data Protection Regulation (EU GDPR), the UK Data Protection Act, and the California Consumer Privacy Act (CCPA), and how you can exercise control over your data.

We collect only the minimum necessary personal information required to deliver high-quality digital solutions and respond to your requests:

• Direct Inquiry & Contact Data: When you complete our Contact Form, Get a Quote, or Trial Application, we collect your name, business email address, phone or WhatsApp number, company/brand name, website URL, and project specifications.
• Career Application Data: When applying for open positions, we collect your full name, email, phone number, portfolio/GitHub links, resume/CV uploads, and professional background details.
• Technical & Usage Data: When you browse our site, we automatically collect basic non-identifying telemetry: IP address, approximate geographical region, browser type and version, operating system, referring URL, time spent on pages, and navigation patterns.
• Communication Records: Records and transcripts of any correspondence or customer service inquiries sent via email, WhatsApp, or contact forms.

Under the EU General Data Protection Regulation (Art. 6 GDPR), we process personal data strictly under valid legal grounds:

• Performance of a Contract: Processing is necessary to execute project agreements, scope creative deliverables, deliver trial prototypes, or prepare formal proposals requested by you.
• Consent: Where you have explicitly opted in (for example, consenting to analytical or marketing cookies, or submitting trial/job application forms). You may withdraw consent at any time.
• Legitimate Interests: To optimize our website performance, prevent fraudulent inquiries, ensure network security, and analyze digital studio traffic patterns without infringing on individual rights.
• Legal Obligations: Compliance with applicable accounting, tax, and regulatory record-keeping laws.

We utilize collected personal information exclusively for legitimate studio operations:

• Evaluating project requirements and delivering customized price estimates.
• Conducting creative trials, design reviews, and engineering sprints.
• Communicating project updates, design revisions, and milestone invoices.
• Evaluating job applicants for talent recruitment.
• Monitoring Core Web Vitals and diagnosing technical website issues.
• Ensuring cybersecurity, defending against spam bot submissions, and safeguarding server integrity.

We will never sell, rent, trade, or monetize your personal data to third parties or advertising brokers under any circumstances.

Our website utilizes modern cookie technologies to provide essential functionality and understand visitor interactions:

• Strictly Necessary Cookies: Required for the core technical operation of our Next.js frontend (e.g. security tokens, currency preference persistence, and cookie consent state). These cookies cannot be turned off and do not track personal identities.
• Analytical & Performance Cookies (Google Analytics 4): Anonymized telemetry that helps us understand aggregated page views, bounce rates, and traffic sources so we can improve user experience. IP addresses are anonymized.
• Marketing & Campaign Cookies (Meta Pixel): Used only upon explicit consent to measure the performance of our social media campaigns and measure conversion inquiries.

You have full control over non-essential cookies. You can accept, decline, or modify your cookie preferences at any time using our EU Cookie Consent Banner or by clearing your browser cache.

We only share data with trusted infrastructure providers bound by strict confidentiality and GDPR-compliant Data Processing Agreements (DPAs):

• Hosting & Edge Networks: Cloud edge infrastructure providers (Vercel, Cloudflare, AWS) that host and serve our Next.js web application securely.
• Analytics Providers: Google Analytics (configured with IP anonymization enabled).
• Communication & Workflow Tools: Secure corporate email gateways, Make.com automation webhooks, and direct WhatsApp Business API for client communication.

We implement comprehensive technical and organizational measures to safeguard your personal data:

• End-to-end 256-bit TLS/SSL encryption for all data transmitted across our website and APIs.
• Restricted, authenticated access controls limiting data visibility only to designated studio personnel.
• Regular security reviews, vulnerability patching, and sanitized input validation on all form endpoints.
• Where data is transferred internationally outside the European Economic Area (EEA), transfers are governed by European Commission Standard Contractual Clauses (SCCs) to ensure equivalent protection.

If you reside in the European Economic Area (EEA), UK, or California, you possess comprehensive legal rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your personal data when it is no longer needed for its original purpose.
• Right to Restrict Processing: Request temporary suspension of processing while a dispute is resolved.
• Right to Data Portability: Obtain your personal data in a structured, commonly used, machine-readable format.
• Right to Object & Withdraw Consent: Object to processing based on legitimate interests or withdraw consent at any time without retroactive penalty.

To exercise any of these rights, please email us at contact@creatohub.com. We respond to all verified requests within thirty (30) days free of charge.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• General Inquiries: Retained for twelve (12) months after the last communication if no project commences.
• Client Project Records: Retained for the duration of the active engagement and up to five (5) years following final delivery for warranty, legal defense, and tax compliance.
• Career Applications: Retained for six (6) months for talent consideration unless you request earlier deletion.

If you have questions, feedback, or data privacy requests regarding this Privacy Policy or our GDPR compliance protocols, please contact our designated Data Protection Officer: