Privacy Policy

The controller responsible for the processing of your personal data under the GDPR is:

2.1 When Visiting Our Website

When you access our website, your browser automatically transmits technical information to our servers, which is stored temporarily:

• IP address of the requesting device
• Date and time of access
• URLs accessed and volume of data transferred
• Referrer URL
• Browser type, operating system, and language

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security). Log files are automatically deleted after 30 days.

2.2 Registration and Account Use

• Email address (mandatory)
• Password (stored encrypted, not in plain text)
• First and last name (optional)
• Company name and industry (optional)
• Profile picture (optional)
• Confirmation that you are at least 18 years old and accept the Terms of Service (mandatory checkbox), with time and version of the Terms as proof of the contract

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.3 AI Generation and Platform Use

• Text prompts and inputs: Your instructions for AI generation
• Uploaded reference files: Images, logos, fonts, audio files
• Generated content: Images, videos, audio, and other AI outputs
• Brand assets: Logos, colors, typography you save in the Studio
• Usage history: Generations, projects, favorites, credit consumption
• Payment data: Subscription status, billing information (no credit card data)
• Chat histories: Your messages to our AI assistants (Creative Agent, Support Agent) and the corresponding replies. They allow the conversation to continue, make enquiries traceable and help us improve answer quality. Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for quality improvement Art. 6(1)(f) GDPR.

Important: Your uploaded and generated content is visible only to you and to the people you add yourself: members of your team and people you share a project with. A work becomes public only if you create a share link or submit it to Inspiration yourself. Downloads use time-limited links (24 hours at most). Our administrators can view content where this is necessary for support, security or fixing errors; access via the admin view is logged. We do not use your content to train our own AI models. Legal basis: Art. 6(1)(b) GDPR.

2.4 Instagram and Meta Integration

freycreate offers Instagram automation (Comment-to-DM funnel and DM auto-responder) on the freycreate operators' own Instagram Business accounts. If, as a third-party user, you message a freycreate-linked account on Instagram or comment on a post there, the following data is processed in accordance with the principles set out below:

Data Minimization Principles

• No full-text storage: The content of incoming direct messages (DMs) is processed exclusively in volatile memory to generate an automated reply, and discarded immediately afterwards. There is no persistent storage of the full DM text in our database.
• Metadata only: Only metadata is stored in our database — specifically the Meta-internal sender ID, timestamps, event type ("message" / "comment"), keyword rule match (e.g., "tier_beta"), and the success status of the outgoing reply. No profile pictures, phone numbers, email addresses, or similar personal data are stored.
• Comment text: For Instagram comments, a keyword analysis of the comment text is performed solely for tier classification; the full text is not persisted either — only the comment ID and media reference for reply delivery.
• Retention period: The above metadata is automatically deleted after a maximum of 30 days via TTL index. No retention beyond that takes place.
• No cold outreach: freycreate only sends replies within the official Meta 24-hour reply window or as a direct response to a public comment under one of our own posts. No unsolicited messages are sent to users who have not contacted us themselves.

Purpose of processing: Automated replies to third-party user interactions (DMs, comments on ads / posts) with relevant onboarding links, as well as conversion tracking (anonymized via Meta IDs) for funnel optimization.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in an automated, timely initial response to contact initiated by users themselves. Data processing is limited to the absolute minimum (anonymous sender ID + success metadata); no full-text processing of message content takes place.

Data deletion & access: You can request deletion of your meta data (sender ID + funnel metadata) at any time. Since no message full-text is stored, the deletion request is technically limited to the funnel lead entries associated with the sender ID. Requests to: [email protected] or via the Data Deletion endpoint. Via the official Instagram Privacy Center, you can also end the connection to freycreate at any time — we will then no longer receive any webhook events on your part.

Technical safeguards: Incoming webhook requests are cryptographically verified via X-Hub-Signature-256 HMAC-SHA256 (shared key with Meta), rate-limited to 100 requests/minute per IP, and transmitted exclusively over HTTPS with an up-to-date TLS certificate.

Note: freycreate uses the official Meta Graph API. The privacy policies of Meta Platforms Ireland Ltd. additionally apply: facebook.com/privacy/policy

2.5 Emails from freycreate

We send you two kinds of emails.

Service emails about your account: for example about sign-up, password and security, payments and finished jobs. This includes, at most once, a note if your brand has not been set up yet or is incomplete, with instructions for setting it up. Legal basis: Art. 6(1)(b) GDPR (performance of contract). You can object to the setup note at any time via the link in the email or in your settings.

Ideas and news by email — only with your consent: suggestions for what you could create with your brand next, and notes about new workflows. We send at most one such email every two weeks. Legal basis: Art. 6(1)(a) GDPR in conjunction with § 7(2) no. 2 of the German Act against Unfair Competition (UWG).

• Consent: at sign-up (checkbox, unchecked by default), via a question in the app or in your settings. As proof we store your answer, the date, where you answered and the version of the consent text (Art. 7(1) GDPR).
• Withdrawal: at any time with effect for the future via the »Keine solchen Mails mehr« (no more emails like this) link in every email, without logging in, or in your settings under »Ideen und Neuigkeiten per Mail«. You will still receive service emails about your account.
• Personalisation: The suggestions refer to the details of your brand (name, industry, description, website, product names) and to the topics of your recent works. To write the texts we send these details to an AI provider (OpenAI, with Google as fallback, see section 4). Your email address, your name and your credit balance are not sent; we remove phone numbers and email addresses from the work topics beforehand. We review and approve every email before it is sent.
• Delivery: via Google Workspace (Google Ireland Limited).

To provide our services, we transmit your inputs (text prompts, reference images) to the AI providers listed below. The legal basis for transfers to third countries is Art. 46(2)(c) GDPR (Standard Contractual Clauses, SCCs) unless otherwise stated.

AI providers (processing also outside the EU)

Providers from China (contracts via Singapore) – Notice on Third-Country Transfer

Infrastructure, Storage and Operations

5. Cookies and Tracking

We always set technically necessary cookies (login, security, your cookie choice). Google Analytics 4 (Google Ireland Limited) loads only if you agree in the cookie banner; it then sets the cookies _ga and _gid (legal basis: Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). We currently use no marketing cookies. You can change your choice at any time via "Cookie-Einstellungen" (cookie settings) in the footer. Without cookies, but transmitting your IP address to the respective provider, we load: fonts from Google Fonts, Google's sign-in script (Google Sign-In), icons via cdnjs (Cloudflare), default profile images via ui-avatars.com (the first letter of your name is transmitted) and embedded YouTube videos in the video builder. Legal basis: Art. 6(1)(f) GDPR (display and operation of the platform). Details are in the cookie policy.

6. Your Rights

Under the GDPR, you have the following rights:

To delete your data please use our deletion form.

To exercise your other rights, please contact: [email protected] – we will respond within 30 days.

Competent supervisory authority in Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. Users in the EU may also lodge a complaint with the data protection authority of their country of residence (Art. 77 GDPR).

7. Retention Period

8. Data Security

We implement technical and organizational security measures:

• TLS/SSL encryption for all data transmissions (HTTPS)
• Encrypted password storage (bcrypt hashing)
• Cookie-based session authentication (no localStorage for tokens)
• Storage in the EU: files at Supabase (Ireland), database at MongoDB Atlas (Frankfurt), application server at Hostinger (Frankfurt), compute jobs in Google Cloud Run (Belgium). For AI generation, inputs go to the providers in section 4, some of them outside the EU.
• Access control on a least-privilege basis
• Regular security updates of the infrastructure
• Tenant separation: every record is tied to a user account

9. Account Deletion and Data Export

9.1 Account Deletion

You may delete your account at any time via your account settings or the deletion form. As a team owner, first remove the active members. After deletion:

• Immediately: Your account is deactivated and all sessions become invalid
• 30-day grace period: Your data is retained for 30 days (recovery period)
• After 30 days: Final deletion of all content of your account including files: brands, characters, products, projects, works, uploads, chats, notifications, access credentials (API keys, connected accounts) and team data. A file is kept only if it is also part of another account's content or of our public library.

Technical implementation: Deletion runs automatically every day. Logs (costs, security, errors, login attempts) are anonymised: account ID, email and IP address are removed, figures and timestamps remain. We retain invoice and payment data for 10 years (Art. 958f Swiss Code of Obligations). We keep the record of your deletion request.

9.2 Data Export

For a data export (access pursuant to Art. 20 GDPR), please contact: [email protected] – you will receive your data within 30 days in machine-readable JSON format.

10. Children and Minors

freycreate is intended exclusively for persons aged 18 or older, or for businesses. We do not knowingly collect personal data from minors. Should such data be reported to us, we will delete it without undue delay.

12. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes to our services or legal requirements. The version published on this page applies. The date of the most recent change is always shown at the top.