Privacy Policy

The controller of the data described below is the operator of the Creatype service, reachable at [email protected]. The Service is available at https://creatype.cc.

The Research product analyzes data made public on TikTok and YouTube: public comments, usernames, avatars, account and video statistics. This data is collected via technical providers (Apify for TikTok) and the public YouTube Data API, then aggregated by our models to produce audience summaries (“Creatypes”).

This processing may involve data of individuals who are not our users (authors of public comments). Our legal basis is the legitimate interest in providing an aggregated audience-analysis tool. We do not sell this data and do not use it to individually re-contact or target these individuals. Anyone may exercise their right to object by writing to [email protected].

When you use the Publishing product, you may connect your social media accounts (for example TikTok, YouTube). With your explicit authorization through each platform’s official mechanism (OAuth), we receive and store: the technical connection credentials (access and refresh tokens), stored in encrypted form, as well as account metadata (identifier, username, avatar).

We use these authorizations solely to perform the actions you request: publishing, scheduling or uploading content on your behalf. You also entrust us with the content intended for publication (videos, images, titles, descriptions, schedules). You can revoke our access at any time, from Creatype or from the settings of the relevant platform.

Creatype’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Likewise, our use of the TikTok APIs complies with the TikTok Developer Terms of Service and applicable rules. Data obtained from these APIs is used only to provide the features you requested; it is neither sold, used for advertising, nor transferred to third parties other than the processors necessary to provide the Service.

We use processors to provide the Service. Each accesses only the data necessary for its task:

Some of these providers are located outside the European Union, in particular in the United States. These transfers are governed by appropriate safeguards (European Commission Standard Contractual Clauses and/or Data Privacy Framework certification). We do not sell your personal data.

We keep your account data as long as your account is active, then for the period necessary to comply with our legal obligations (in particular billing). Access tokens to your social accounts are deleted as soon as you disconnect an account or delete yours. Analyzed public data is kept in aggregated form to ensure continuity of the Service.

Your activation card details (brand, last four digits, country, type) and the history of your activation attempts are deleted along with your account.

One exception, which we flag explicitly. When you delete your account, we keep the technical fingerprint of your activation card for two months, in hashed form (SHA-256), together with the month of deletion and nothing else. That record is linked to no account, no identifier and no email address: it cannot identify you, recover your card number, or be used to contact you. Its only use is to verify that a card which has already opened a free plan does not open another one by deleting and re-creating an account. The legal basis is our legitimate interest in preventing abuse, as every free analysis is a real cost we bear. After those two months, the fingerprint is deleted and has no further effect: the same card can then activate a new free plan. For any question about this fingerprint, write to us at [email protected].

We implement appropriate technical and organizational measures: encryption in transit (HTTPS/HSTS), httpOnly session cookies, encryption at rest of sensitive tokens, a strict Content Security Policy (CSP) and restricted access to data.

Under the GDPR, you have the rights of access, rectification, erasure, objection, restriction and portability, as well as the right to withdraw your consent at any time.

Our main audience measurement (Umami) works without cookies. Google Analytics, Microsoft Clarity, and LogRocket are only enabled after your consent, collected through the banner shown on your first visit and changeable at any time. After a refusal, you can still authorize LogRocket only for the 30 minutes following a support request; this sharing can be stopped from Settings or the indicator shown during the diagnostic.

The Service is not intended for individuals under the age of 15. If you believe a minor has provided us with personal data, contact us so we can delete it.

We may update this policy. In case of a significant change, we will inform you by an appropriate means. The date of last update appears at the top of this page.

For any question or request regarding your personal data: [email protected]. You may also lodge a complaint with the French data protection authority (CNIL, www.cnil.fr).