Privacy Policy

KreaTivLab is a product of XtraLynk Technologies LLC ("XtraLynk," "KreaTivLab," "we," "us," or "our").

This Privacy Policy explains how we collect, use, disclose, store, and protect information when you access or use KreaTivLab, including our websites, applications, AI creation tools, creator-management tools, connected-platform features, analytics, and related services (collectively, the "Services").

By using KreaTivLab, you acknowledge the practices described in this Privacy Policy.

The information we collect depends on the features you use.

A. Account and profile information. When you create or maintain an account, we may collect:

• name and display name
• email address
• profile photo or avatar
• account identifiers and authentication information
• workspace and team membership information
• creator profile information, niche or content categories
• preferences, brand voice settings, language and application settings

Passwords are handled by our authentication provider (Supabase Auth, operated for us through Lovable Cloud). We never store passwords in plaintext and our application code has no access to raw passwords.

B. Creator and business information. When you use KreaTivLab's creator-business features, you may provide:

• creator biography, social profiles and website
• media-kit information, services and rates
• past collaborations, brand contacts and sponsorship opportunities
• campaign information, deliverables and deal compensation
• invoices, payment status and manually entered revenue
• business goals, notes and related business records

KreaTivLab does not independently verify manually entered financial information.

C. User content. You may upload, create, edit, store, or publish content through KreaTivLab, including images, videos, audio, voice recordings, prompts, scripts, captions, documents, thumbnails, templates, project files, generated content, brand assets, creative briefs, contracts or campaign files, and other files submitted to the Services. We process this content as necessary to provide the features you request.

D. AI interaction data. When you use AI-powered features, we may process:

• prompts, uploaded inputs and reference images
• audio and video inputs
• generation settings and contextual information
• AI outputs and generation history
• model and provider selections
• usage information and technical information necessary to complete generation requests

Relevant inputs are transmitted to AI or media-processing service providers when necessary to perform the requested operation.

E. Connected platform information. If you connect a third-party account or platform, KreaTivLab receives information authorized by you through that provider. For our YouTube integration this may include channel identifiers and profile information, subscriber counts, video and content metadata, views, watch time, engagement metrics, publishing status, and the authorization tokens necessary to maintain the connection. We only request access appropriate to the features offered through the relevant integration.

F. Usage and technical information. We may automatically collect information such as IP address, browser type, device type, operating system, pages or features accessed, timestamps, application events, generation activity, credit consumption, error logs, performance information and security events. This information helps operate, secure, troubleshoot and improve KreaTivLab.

G. Subscription, credit and transaction information. When you purchase a subscription or AI credit pack, we may process or receive subscription plan, transaction identifiers, payment status, amount, currency, billing-related metadata, purchased credits, credits consumed, refunds and subscription status.

Payment card information is processed by our payment processor, Stripe. KreaTivLab does not store complete payment card numbers.

We may collect information:

• directly from you
• automatically when you use KreaTivLab
• from accounts you choose to connect
• from service providers acting on our behalf
• from APIs and integrations you authorize
• from content you create, upload, publish or manage through the Services

We may use information to:

• create and manage accounts, authenticate users and operate workspaces
• provide AI generation and editing tools, and generate images, video, audio and text
• provide creator-management features and personalize outputs using creator profiles and brand voices
• store projects and generated content, and operate content calendars and campaigns
• publish content when you authorize it and retrieve authorized platform analytics
• provide Creator Analytics, calculate Growth metrics and Creator Scores, and provide AI coaching
• manage sponsorship opportunities and Brand Deals, generate media kits, and manage invoices and user-entered revenue records
• calculate and maintain AI credit balances and process subscriptions and purchases
• prevent fraud and abuse, protect users and the Services, and troubleshoot technical issues
• monitor application performance, communicate service-related information and comply with legal obligations
• improve KreaTivLab

We do not use connected-account permissions to perform actions that you have not authorized.

KreaTivLab uses artificial intelligence and media-processing technologies to provide certain features. Depending on the feature selected, relevant content and instructions may be processed by third-party service providers.

This may include prompts, images, video, audio, scripts, generation parameters and relevant project context. Only information reasonably necessary to perform the requested feature is sent to the applicable provider.

The AI and media-processing providers currently used are:

• Lovable AI Gateway — routing for text and reasoning models used by Copilot, Studio, campaigns, growth coaching, translation and other text features
• Google Gemini — image generation and character generation, and text/vision features routed through the gateway
• Runway — text-to-video and image-to-video generation
• ElevenLabs — voice generation and speech-to-text used for transcription, captions and highlights
• Shotstack — video rendering and export for Clips

KreaTivLab may use different providers or models over time based on functionality, reliability, availability, quality, safety and cost. We will keep this section current.

AI outputs may be inaccurate, incomplete, or unsuitable for a particular purpose. You are responsible for reviewing generated content before relying on or publishing it.

We do not send your content to AI providers for any purpose other than fulfilling your requested generation. We do not make a blanket representation that no provider ever uses submitted data for model improvement; each provider's own terms govern its handling of data it receives.

KreaTivLab allows you to connect Google or YouTube accounts using Google OAuth. Depending on the permissions you grant, KreaTivLab may access Google or YouTube data for features such as:

• identifying the connected YouTube channel
• retrieving channel and content information
• retrieving authorized analytics and performance metrics
• displaying channel and content performance within KreaTivLab
• publishing or uploading videos when specifically requested by you

KreaTivLab currently requests the following Google OAuth scopes: youtube.readonly (view your YouTube account and channel information), youtube.upload (upload and manage videos you publish through KreaTivLab), and yt-analytics.readonly (view your YouTube Analytics reports). Google sign-in additionally uses basic profile and email information.

KreaTivLab uses Google user data only to provide or improve user-facing features that are visible and relevant to you. Google user data is not sold, and is not used for advertising or unrelated profiling.

Access to Google user data is limited to providing the functionality you request, maintaining and securing that functionality, complying with applicable law, and other uses permitted under applicable Google API policies.

KreaTivLab's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including applicable Limited Use requirements.

You may disconnect your Google/YouTube account from KreaTivLab in Settings → Channels, which deletes the stored connection and its tokens. You may also manage or revoke KreaTivLab's access through your Google Account permissions. Revoking access may prevent connected-channel analytics, publishing or other Google/YouTube functionality from continuing to work.

Authorization tokens for connected channels are stored encrypted at rest using AES-256-GCM.

KreaTivLab supports connections with third-party platforms. YouTube (via Google OAuth) and Meta platforms (Instagram professional accounts and Facebook Pages) are the platform integrations currently offered; other platforms may be added over time.

When you connect a platform, information exchanged between KreaTivLab and that platform is governed by the permissions you grant, the functionality requested, this Privacy Policy, and the applicable third-party platform's terms and privacy policies.

Meta integrations: when you connect an Instagram professional account, KreaTivLab receives the account identifier, username, account name where available, account type, profile picture, the permissions you granted, and an authorization token used to keep the connection working. We request only the permissions needed for the features you use: reading your basic professional-account details and publishing content that you explicitly send to Instagram. KreaTivLab does not post anything unless you direct it to.

Facebook Pages: when you authorize Facebook, KreaTivLab receives the list of Facebook Pages you chose to authorize, and for each connected Page its identifier, name, profile picture where available, the permissions you granted, and a Page authorization token. We request only pages_show_list, pages_read_engagement and pages_manage_posts, which let KreaTivLab list your Pages, confirm the connection is still valid, and publish content to a Page at your direction. KreaTivLab connects only the Pages you select, does not publish to personal Facebook profiles, and does not read your personal Facebook profile information, friends, messages or advertising data.

Authorization tokens for connected accounts are encrypted before storage, are held only on our servers, and are never sent to your browser or shown in the KreaTivLab interface.

KreaTivLab requests only permissions reasonably necessary for the selected integration. You can disconnect supported integrations at any time in Social connections inside KreaTivLab, or through the third-party provider's own app settings. Disconnecting removes the stored authorization and stops future publishing; your KreaTivLab-created media is not deleted. To request deletion of data associated with a connected account, contact kreativlab@xtralynk.com or delete your account in Settings.

You may connect supported social platforms, currently Instagram professional accounts, Facebook Pages and YouTube channels, and authorize KreaTivLab to perform the functions you request, such as publishing content you create in KreaTivLab. KreaTivLab stores the authorization for each connected account, encrypted and server-side only, together with basic account details such as the account identifier, name, handle where available and profile picture.

Disconnecting social accounts: you can disconnect any connected account at any time in Social connections inside KreaTivLab. Disconnecting attempts to revoke KreaTivLab's authorization with the provider, deletes the stored authorization credentials for that connection, and stops KreaTivLab from publishing to that account. Content you created in KreaTivLab remains in your library.

Deletion of social integration data: instructions for removing your Facebook or Instagram connection and requesting deletion of the associated integration data are available at https://kreativlab.dev/data-deletion. If you remove KreaTivLab from your Facebook or Instagram settings, Meta sends us a deletion request and we delete the corresponding connection and its stored credentials; you receive a confirmation code and a status page for that request. Records of publishing activity may be retained as operational history with Meta-derived identifiers removed.

We may disclose information to service providers that help us operate KreaTivLab, including providers of cloud hosting, databases, authentication, file storage, artificial intelligence, media generation and processing, payment processing, email delivery, analytics, error monitoring, security, infrastructure and connected-platform APIs.

These providers may process information only as appropriate to provide their services to us and subject to applicable contractual and legal obligations.

We may also disclose information:

• when directed by you
• when you intentionally publish or share content
• when necessary to comply with law or valid legal process
• to protect rights, safety and security
• in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to applicable law

KreaTivLab does not sell personal information for monetary consideration.

KreaTivLab does not currently sell personal information or share personal information for cross-context behavioral advertising. We do not run advertising or cross-site tracking technologies in the application.

If these practices change, we will update this Privacy Policy and provide any legally required privacy choices before enabling them.

Certain KreaTivLab features allow you to intentionally make information public, such as community templates, public media kits, shared creator profiles and publicly shared content.

Information designated as public may be visible to other users or visitors and may be copied or shared by others. Do not publish information you want to remain confidential.

Private workspace content remains private unless you choose to share or publish it.

KreaTivLab includes tools for managing creator-business activities.

Brand Deal information, compensation, contacts, contracts, invoices and related private business information remain private to the authorized user or workspace unless you intentionally share it. Access is enforced by row-level security in our database.

Public Media Kits contain only information you have selected for public display. Private deal compensation never automatically appears in a public Media Kit.

Payments for subscriptions and credit purchases are processed by Stripe. Stripe collects payment card, billing and transaction information directly.

KreaTivLab receives transaction metadata necessary to activate subscriptions, allocate credits, confirm payments, process refunds, maintain billing records and prevent fraud.

Stripe's privacy policy governs information it collects directly.

KreaTivLab uses cookies and browser storage only for essential application functionality. Specifically, we use browser storage for:

• your authentication session, so you stay signed in
• your theme preference (light or dark mode)
• your language preference
• dismissal state for the install prompt and the in-app guided tour

We do not use advertising or cross-site tracking cookies. See the KreaTivLab Cookie Policy for details. If we introduce non-essential cookies, we will provide appropriate controls where required by law.

Your data is stored in a managed PostgreSQL database and object storage operated through Lovable Cloud (built on Supabase), hosted in the United States.

We use reasonable administrative, technical and organizational safeguards designed to protect personal information, including:

• encrypted network connections (HTTPS/TLS)
• authentication controls, including optional multi-factor authentication
• workspace-level authorization and row-level security on database tables
• restricted service credentials and secret management
• private file storage with signed, time-limited access URLs
• encryption at rest for connected-platform authorization tokens
• rate limiting, security headers, monitoring and error logging

No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your account credentials and promptly notifying us of suspected unauthorized access.

We retain information for as long as reasonably necessary to provide the Services, maintain your account, fulfill the purposes described in this policy, maintain legitimate business records, prevent fraud or abuse, resolve disputes, enforce agreements and comply with applicable legal obligations.

Retention periods may vary depending on the type of information and applicable requirements. Content you create is retained until you delete it or delete your account.

When information is no longer reasonably necessary, we may delete or anonymize it. Backups and records required for legal, security or fraud-prevention purposes may remain for a limited period after account deletion.

You may delete supported content directly in KreaTivLab.

You may delete your entire account from Settings → Delete account. Confirming deletion permanently removes your profile, preferences, projects, content, media files in storage, connected-platform tokens, workspaces you own, billing and credit records, and your authentication identity. Workspaces owned by others are not affected; you are simply removed as a member.

You may also request deletion by emailing kreativlab@xtralynk.com.

Deletion may not immediately remove information from encrypted backups or records that must be retained for legitimate legal, security, accounting or fraud-prevention purposes.

Depending on where you live and applicable law, you may have rights concerning your personal information, which may include the right to:

• request access and obtain information about processing
• request correction or deletion
• obtain a copy of certain information
• object to or restrict certain processing
• opt out of certain sale, sharing or targeted-advertising practices where applicable
• withdraw consent where processing relies on consent
• appeal certain privacy-request decisions where applicable
• receive non-discriminatory treatment for exercising applicable privacy rights

KreaTivLab provides self-service access and portability: Settings → Export my data downloads a machine-readable copy of your profile, preferences and workspace records. You can edit your profile and preferences at any time.

These rights are subject to applicable laws, exceptions and verification requirements. To submit a privacy request, contact kreativlab@xtralynk.com. We may need to verify your identity before fulfilling certain requests.

Residents of certain U.S. states may have additional privacy rights under applicable state law. Where applicable, these may include rights to access personal information, correct inaccuracies, delete personal information, obtain a portable copy, opt out of certain sales, targeted advertising or profiling, limit certain uses of sensitive personal information, and appeal certain privacy-request decisions.

KreaTivLab will process applicable requests in accordance with applicable law. Whether a specific state privacy statute applies to XtraLynk Technologies LLC depends on thresholds set by that law.

KreaTivLab is not intended for children under 13, and our Terms require users to meet the minimum age stated there.

We do not knowingly collect personal information from children under 13 without authorization required by applicable law. If we learn that personal information from a child under 13 was collected in circumstances requiring deletion, we will take appropriate steps to delete it.

KreaTivLab is operated by XtraLynk Technologies LLC in the United States.

If you access the Services from outside the United States, information may be processed or stored in the United States or other locations where our service providers operate. Where required, appropriate safeguards are used for international transfers of personal information.

KreaTivLab may contain links to or integrations with third-party websites, platforms and services. Their privacy practices are governed by their own policies, and KreaTivLab is not responsible for the privacy practices of unaffiliated third parties.

We may update this Privacy Policy as KreaTivLab evolves. When we make material changes, we may provide notice through the Services, by email, or through another appropriate method.

The "Last updated" date at the top identifies when this Privacy Policy was most recently revised.

For questions, requests or concerns regarding this Privacy Policy or KreaTivLab's privacy practices, contact:

XtraLynk Technologies LLC — KreaTivLab Privacy Team

Email: kreativlab@xtralynk.com

Website: https://kreativlab.dev