Who is responsible
heyCreatr is operated by SitePoint Systems ApS, CVR 39299739, Rådhusstræde 15, 1466 Copenhagen, Denmark ("we"). We are the data controller for the data described here. Contact: [contact email to be confirmed].
This website
heycreatr.io is a static website. It sets no cookies, runs no analytics and loads no third-party scripts. Our hosting and network provider logs technical request data (IP address, time, requested page) to deliver and protect the site.
What we collect in the app
| Data | Why | Legal basis |
|---|---|---|
| Name, email address and a hashed password | To create and secure your account | Contract |
| Organisation and team membership | To separate your workspace from everyone else's | Contract |
| What you create: ideas, scripts, prompts, characters, images, clips, audio, captions and renders | To provide the service | Contract |
| Photos and video footage you upload, which can show faces and contain voices | To make character cards and performances you ask for | Contract, and your confirmation that you have the depicted person's consent |
| Your AI provider API keys | To run generations on your own accounts. Keys are stored encrypted | Contract |
| Usage records: which job ran, on which model, and what the provider charged | To show you your costs and to troubleshoot | Contract and legitimate interest |
| Technical logs and a session cookie | To keep you signed in and keep the service secure | Legitimate interest |
Who receives data
- AtlasCloud (atlascloud.ai). When you generate, your prompts, scripts, reference images and footage are sent to AtlasCloud using your own API key. You hold that account yourself, and AtlasCloud's own terms and privacy policy govern what they do with the data.
- ElevenLabs (elevenlabs.io), only if you connect it. Narration text is sent to ElevenLabs using your own key, under your own agreement with them.
- Hetzner Online GmbH hosts the app, its database and your files on servers in Helsinki, Finland (EU), as our processor.
- Cloudflare provides DNS and network protection for our domains, as our processor.
We don't sell personal data and we don't use your content to train AI models.
How long we keep it
- Your account data and content are kept while your account is active.
- Deleted projects and characters stay in the trash for 30 days so they can be restored. After that they are removed, together with any files nothing else references.
- When you close your account, we delete your data unless the law requires us to keep it, for example accounting records.
Your rights
You have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent where processing relies on it. Write to us at the address above. You can also complain to the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk).
Changes
If we change this policy in a way that matters, we'll say so in the app before the change applies.