Privacy Policy

CreativeArc ("we", "our", "us") operates the CreativeArc platform available at creativearc.ai and app.creativearc.ai-an AI-powered design suite for architects, designers, and creative studios.

For data protection purposes, CreativeArc is the data controller. You can reach us at support@creativearc.ai.

Account information-your name, email address, and profile details provided when signing up via Clerk. If you sign in with Google or another OAuth provider, we receive basic profile data from that provider.

Generated content-images, 3D files, videos, and immersive world scenes (gaussian splat data, panoramas) you produce using CreativeArc tools. These are stored in Cloudflare R2 object storage, linked to your account.

Prompts and inputs-text prompts you type to guide AI generation, and any uploaded reference images or source images you provide. These are transmitted to the relevant AI provider to fulfil your request and are also stored as part of your generation history. Prompts may incidentally contain personal information; we treat them accordingly and do not use them to train AI models.

Session and usage data-design sessions, generation history, credit balance and transaction records, and tool preferences (e.g. selected models, canvas settings).

Payment information-billing details are processed and stored by Stripe. We do not store card numbers or payment credentials directly.

Technical data-IP address, browser type, device type, and access logs, retained for security monitoring and debugging.

Cookies-arc_analytics_consent and sidebar_state are first-party cookies set directly by CreativeArc to remember your analytics choice and sidebar preference. Our servers do not read or act on these values. If you accept analytics, we use PostHog to collect anonymised usage data. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details, or use the Cookie Preferences link in the footer to change your choice at any time.

• To provide, operate, and improve the CreativeArc platform.
• To authenticate your identity and manage your account (via Clerk).
• To process payments and manage credit subscriptions (via Stripe).
• To send AI generation requests to our model providers (Google, OpenAI, Black Forest Labs, BytePlus, Kling, Dreamina, Replicate, Tripo3D, Meshy, World Labs) on your behalf.
• To store and serve your generated images and files (Cloudflare R2).
• To calculate and deduct credits for each generation.
• To respond to support requests and communications.
• To detect and prevent fraud, abuse, or unauthorised access.
• To comply with legal obligations.

We do not sell your personal data. We do not use your generated content to train AI models.

Staff access. A small number of authorised CreativeArc staff can view account details (such as your name and email), usage and credit records, and, where needed, prompts and Agent conversations, through a private admin tool. Access is limited by role, protected by sign-in, and recorded in an audit log. We use it to provide support, investigate errors and abuse, and handle billing, under the legitimate-interests and contract bases below.

Legal basis for processing (GDPR / UK GDPR) — Where data protection law requires us to identify a legal basis, we rely on the following:

• Contract performance (Article 6(1)(b)) — processing necessary to provide the CreativeArc service you have signed up for: account management, generation requests, credit billing, and storing your files.
• Legitimate interests (Article 6(1)(f)) — security monitoring, fraud prevention, abuse detection, error diagnostics, and platform improvement, where our interests do not override your rights.
• Legal obligation (Article 6(1)(c)) — retaining financial records for the period required by applicable tax and accounting law.
• Consent (Article 6(1)(a)) — marketing communications, where required. You may withdraw consent at any time.

CreativeArc works with the following third-party processors, which are contractually obligated to protect your data in accordance with applicable data protection law:

• Clerk — user authentication and account management (clerk.com)
• Clerk — sign-in and account authentication (clerk.com)
• PostHog — product analytics, only if you accept analytics cookies (posthog.com)
• Stripe — payment processing and billing (stripe.com)
• Neon — managed Postgres database hosting user account, session, and credit data (neon.tech)
• Cloudflare R2 — object storage for uploaded and generated images (cloudflare.com)
• Railway — backend server hosting and infrastructure (railway.app)
• Vercel — frontend hosting and edge delivery (vercel.com)
• Sentry — error monitoring and crash diagnostics; may receive anonymised stack traces (sentry.io)
• Google — AI image and video generation and editing, e.g. Nano Banana Pro/2, Gemini Omni Flash (ai.google.dev)
• OpenAI — AI image generation and prompt enhancement, e.g. GPT-Image 2, GPT-6.1 Sol (openai.com)
• Black Forest Labs — AI image and video generation, upscaling, and object removal, e.g. Flux-2 Pro/Max, Flux-3, Flux Erase, Flux Deblur (bfl.ai)
• BytePlus — AI image generation, e.g. Dola Seedream 5.0 Pro (byteplus.com)
• Recraft — AI vector and raster image generation (recraft.ai)
• Magnific — AI image upscaling (magnific.ai)
• Replicate — AI model inference for upscaling, background removal, and video, including Kling and Dreamina models (replicate.com)
• Tripo3D — AI 3D model generation (tripo3d.ai)
• Meshy — AI 3D model generation and retexturing (meshy.ai)
• World Labs — AI world generation via the Marble API (worldlabs.ai)

What each provider receives, and in what role. Hosting, storage, authentication, error-monitoring and AI providers act as our processors: they handle personal data only on our instructions to provide their service to us. Stripe acts as a processor for taking payment and as an independent controller for its own fraud-prevention and legal obligations, under its own privacy policy. In summary:

• Payment details and billing information-Stripe (we never see or store full card numbers).
• Email, name and sign-in details-Clerk.
• Account, session and credit data-Neon, Railway and Vercel; uploaded and generated files-Cloudflare R2.
• Prompts and images you submit for a generation-only the AI provider that runs that model.
• Error diagnostics-Sentry.
• Usage analytics-PostHog, only with your consent.

Some of these providers are based outside the UK and EEA; see section 10 for how those transfers are protected.

Your prompt and any uploaded images are transmitted to the relevant AI provider solely to fulfil your generation request, in accordance with each provider's published data handling terms. We do not permit providers to use your content for their own model training.

• Account data-retained for the lifetime of your account.
• Generated images and session files-retained for a minimum of 12 months from creation.
• Credit transaction records-retained for up to 7 years for financial compliance purposes.
• Server and technical logs-retained for up to 90 days.
• Agent conversations-deleted automatically after 90 days of inactivity (or immediately when you delete your account).
• Generation usage logs (which model ran, when, and whether it succeeded)-kept while your account exists; when you delete your account they are anonymised and no longer linked to you.
• Staff action audit records (who made a change in our admin tools)-kept for security and accountability.
• On account deletion-removal of all personal data and stored files is initiated immediately upon your request and completes as part of that process in most cases. In rare circumstances where a step cannot complete immediately (for example, due to a temporary issue with a storage provider), any remaining data will be fully removed within 30 days. Financial records may be retained longer as required by law.

Depending on your location, you have the following rights regarding your personal data:

• Access-request a copy of the data we hold about you.
• Correction-request that inaccurate data be corrected.
• Erasure-request deletion of your account and associated data.
• Portability-request your data in a machine-readable format.
• Restriction-request that we limit how we process your data.
• Objection-object to processing based on legitimate interests.

To exercise any of these rights, email support@creativearc.ai with the subject line Data Request. We respond within 30 days.

Right to complain. If you are unhappy with how we handle your personal data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or to the data protection authority in your own country.

EU and UK users are protected under the GDPR. California users are protected under the CCPA. We honour data subject requests regardless of location.

You may request permanent deletion of your account and all associated data at any time by emailing support@creativearc.ai with the subject line Account deletion request.

Deletion is initiated immediately upon your request. All personal data, sessions, and stored images are removed as part of that process; in rare cases where a step cannot complete immediately (e.g. a temporary issue with a storage provider), any remaining data will be fully removed within 30 days. Credit transaction records required for financial compliance may be retained in anonymised form for up to 7 years. This action is irreversible.

We implement the following technical and organisational measures to protect your data:

• All data transmitted over HTTPS/TLS.
• Bring-your-own-key (BYOK) API keys are AES-256 encrypted at rest.
• Images in Cloudflare R2 are encrypted at rest and served via time-limited signed URLs.
• Authentication session cookies are HttpOnly and set on your account domain.
• Access to production databases is restricted to authenticated services.
• Sensitive values (API keys, payment secrets) are never logged.

CreativeArc sets a small number of first-party cookies directly:

• sidebar_state-stores your sidebar open/closed preference. Category: functional.
• arc_analytics_consent-stores your analytics consent choice. Category: functional.

We do not use advertising or cross-site tracking cookies. If you accept analytics, PostHog sets its own cookies to collect anonymised usage data-you can withdraw consent at any time via the Cookie Preferences control on the Cookie Declaration page. Authentication session cookies are managed by Clerk and are set on your account subdomain only. See our Cookie Policy for the full breakdown.

CreativeArc is operated from the United Kingdom. Some of our third-party processors — including Stripe, Cloudflare, Neon, Google, OpenAI, Black Forest Labs, Replicate, Recraft, Magnific, Tripo3D, Meshy, World Labs, Railway, and Vercel — may process data in the United States or other countries outside the UK and EU/EEA. Where this occurs, transfers are covered by appropriate safeguards, primarily the UK International Data Transfer Agreement or Addendum to the European Commission's Standard Contractual Clauses (SCCs), or an equivalent transfer mechanism recognised under applicable data protection law. You may request a copy of the relevant safeguards by contacting us at support@creativearc.ai.

CreativeArc is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, please contact us immediately at support@creativearc.ai.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or via an in-app notice at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

Where a change affects processing that requires your consent under applicable law, we will ask for your explicit acknowledgment before it takes effect. For other changes, continuing to use CreativeArc after the effective date indicates you have read and understood the updated policy.

For privacy questions, data requests, or to report a concern:

• Email: support@creativearc.ai
• Subject line for data requests: Data Request
• Subject line for account deletion: Account deletion request