Privacy policy
Last updated: 9 November 2026
Creator Space ("the service", "we") is a workspace for creators and small teams, run by Abhinav Agrawal in Bhopal, India. This page explains what we keep, why, who helps us, how long we keep it, and the rights you have. We wrote it in plain words on purpose. It follows India's Digital Personal Data Protection Act, 2023 (DPDP Act) and, for people in the EU and UK, the GDPR.
Who is responsible: Abhinav Agrawal, Bhopal, Madhya Pradesh, India, is the data fiduciary (GDPR: controller). Contact and grievance officer: see "Contact and complaints" below.
Who can use Creator Space
Creator Space is for people aged 18 or over. We ask you to confirm this when you create an account. We do not knowingly collect data from anyone under 18; if we find an account that belongs to someone under 18, we delete it.
What we collect, and why
| Data | Why we need it | Basis |
|---|---|---|
| Account: email address, and a password (stored only as a salted hash by our sign-in provider). With "Continue with Google": your email, name and profile picture from Google. We never see your Google password. | To create your account and sign you in. | Your consent and the contract to provide the service |
| Your work: ideas, notes, tasks, posts, clips, files, deals, invoices, boards, team details you enter, and settings. | To save, sync and show your work on your devices and to the people you share it with. | Contract |
| Connected channels: if you link YouTube, Instagram, Facebook, TikTok or X, the access token that account gives us (kept encrypted on the server) and the numbers we read with it, such as followers, views and revenue figures. | To show your audience numbers. | Your consent, which you can withdraw by disconnecting |
| AI connections: which AI apps you allowed, what each may do (add, review), and what they added to your workspace. For manual keys, only a one-way hash of the key. | To let the AI app you chose work with your workspace, and to show you what it did. | Your consent |
| Sign-up answers: what describes you and how you heard of us, if you answer. | To fit the app to what you do and to learn what works. | Your consent (optional) |
| Plan and payment status: which plan you have and whether it is paid. Card or UPI details are handled only by the payment provider. | To give you the right features. | Contract |
| Technical data: request time, error details, and security logs, kept by our hosting and database providers. | To run and secure the service and fix problems. | Legitimate use (security) |
We collect only what a feature needs. We do not sell your data, show ads, or use your work to train AI models. We do not read your work except when you ask for help or when it is needed to keep the service running and secure.
Who helps us (sub-processors)
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Mumbai, India (AWS ap-south-1) |
| Cloudflare | Serves the website and app, protects against attacks | Global network |
| Google (sign-in, YouTube) | Only if you use "Continue with Google" or connect YouTube | Global |
| Meta (Instagram, Facebook) | Only if you connect those accounts | Global |
| TikTok, X | Only if you connect those accounts | Global |
| Razorpay | Payments, once paid plans open | India |
| AI apps you choose (for example Claude, ChatGPT) | Only if you connect one. What it reads of your workspace is limited to what you allowed, and is sent to that provider under its own terms. | Provider's choice |
Fonts and scripts are served from our own site, not from third parties. We do not use analytics or advertising trackers.
Transfers outside India. Our main database is in India. Cloudflare, and any service you choose to connect, may handle data in other countries, under their own security commitments.
How long we keep it
| Data | Kept |
|---|---|
| Account and your work | Until you delete it or your account |
| Deleted ideas, notes, tasks, posts and clips | 30 days in Trash, then removed |
| Channel tokens and pulled numbers | Until you disconnect the channel, which deletes the token |
| AI app access | Until you revoke it, which stops access immediately |
| Account you delete in the app | Removed at once; copies in provider backups age out on the provider's normal cycle |
| Account deleted by email request | Removed within 30 days; copies in provider backups age out on the provider's normal cycle |
| Payment records (when billing opens) | As long as tax and accounting law in India requires |
| Security and server logs | For the short period our providers keep them |
| Record that you accepted the Terms and Privacy policy | As long as your account exists, and afterwards where needed to show consent |
On your device: cookies and local storage
We set no advertising or tracking cookies. The app stores your work, your settings, your sign-in session and an offline copy of the site in your browser's local storage and a service worker. These are strictly needed for the app to work, so there is no cookie banner. Clearing site data in your browser removes them.
Your rights
You can ask us to:
- Access what we hold about you, and get a copy (you can also export everything yourself from Data and backup, or as Markdown and CSV from Import and export).
- Correct anything that is wrong.
- Delete your data or your whole account. You can delete your account yourself in Settings, Security. See how to delete your data.
- Withdraw consent at any time, for example by disconnecting a channel or an AI app, or by closing your account. This does not undo what was done before.
- Object or restrict certain use, and move your data (GDPR).
- Name someone to act for you if you cannot (DPDP Act).
- If you live in California: know what we collect, ask us to delete it, and not be treated worse for asking. We do not sell or share personal data.
Write to the address below. We reply to every request within 30 days, and acknowledge it within 3 working days.
Connected platforms
- YouTube. Creator Space uses YouTube API Services. By connecting YouTube you agree to be bound by the YouTube Terms of Service, and Google's Privacy Policy applies to data Google handles. We use what Google gives us only to show you your own numbers. You can revoke our access at any time at Google security settings or by disconnecting in Audience, which also deletes the token and the data we pulled. Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use rules.
- Instagram, Facebook, TikTok, X. We read only the profile and public or insight numbers you allow, only to show them to you, and delete them when you disconnect. You can also remove our access in each platform's own app settings.
AI apps
If you connect an AI app (for example Claude), it can read and add to your workspace only as far as the switches you set allow, and anything it adds can be held for your review first. You can see what it did under Settings, AI, and revoke it at any time. Data you let an AI app read goes to that app's provider and is covered by their terms, not ours.
Keeping it safe
Data is encrypted in transit; access to each account is limited by database rules; tokens are encrypted or stored as hashes on the server. No online service can promise perfect security, so please use a strong, unique password. If a breach puts your data at risk, we will tell you and the authorities (including the Data Protection Board of India, and EU/UK regulators where the law requires) as soon as we can and within the legal time limits, saying what happened and what to do.
Plans and payments
When paid plans open, a payment provider handles your card or UPI details. We never store them, only which plan you have and whether it is paid. See refunds and cancellation.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect and ask you to accept the new version. Each accepted version is recorded against your account.
Contact and complaints
Grievance officer: Abhinav Agrawal, Bhopal, India. Email: cashteaates009@gmail.com. We acknowledge within 3 working days and resolve within 30 days.
If you are not happy with our answer, you may complain to the Data Protection Board of India, or, if you are in the EU or UK, to your local data protection authority.
This is a plain-language document for a small service. It is not legal advice.