Privacy policy

Martin Gustafsson is the data controller for personal data processed by Creator Format and determines how and why that data is processed.

Your images stay on your device

Image decoding, resizing, cropping and export take place in your browser. We do not upload or store your image files on our servers. Signed-in processing records a processing identifier for credit accounting, not the image content.

Data we process and why

• Account information, such as email address, authentication details and information provided by Google sign-in: to create and manage your account (performance of a contract).
• Subscription identifiers, plan, payment status, billing period, credit grants and processing identifiers: to provide paid access and account for image credits (performance of a contract).
• Technical information, such as IP address, device information and error records: for security, reliability and troubleshooting (legitimate interests).
• Support correspondence, if you contact us: to respond to your request (performance of a contract or legitimate interests).

Payments and providers

Paddle.com is the Merchant of Record and processes purchases, payment details, tax, invoicing and subscription management under its own privacy policy. We receive subscription and transaction information, not your full card details.

Hosting, account and database providers process data needed to operate Creator Format. We may also share information with professional advisers or authorities where legally required. Google processes information for Google sign-in under its own policies if you choose that option.

International transfers

Providers may process personal data outside the EU/EEA. Where required, transfers use appropriate safeguards, such as European Commission standard contractual clauses or an adequacy decision.

Retention

We keep personal data while it is needed to provide your account and the service. Data is deleted or anonymized when it is no longer needed, unless accounting, legal obligations or dispute handling require longer retention.

Your rights

Under applicable data protection law, including the GDPR, you may request access, correction, deletion, restriction or portability of your personal data, object to processing, and withdraw consent where processing relies on consent. Requests should be addressed to the data controller, Martin Gustafsson. We respond within one month, subject to legally permitted extensions. You can complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Security

We use appropriate technical and organizational safeguards, including encrypted connections and account-based access controls. No system can guarantee absolute security.

Browser storage

Necessary browser storage supports sign-in and the two-image visitor allowance. Browser language is used to estimate your display currency. Creator Format does not currently run ads, a referral system or marketing cookies. Paddle and Google may use storage necessary for their payment and sign-in services.