Security
Security and your data
What Creatif Space stores, where it lives, how you and your clients sign in, what a connected AI assistant can do, and how to take your data with you or delete it.
What we store
- Your account: name, email address, username and time zone.
- Your work: the photos, videos and captions you upload, the posts you schedule and the Spaces you build.
- Connected social accounts: the access each network gives us when you connect it, so we can publish for you. Disconnect an account and we stop using that access.
- Approval records: who approved or asked for changes, on which post, when, and their note.
- Payments: Creem, our merchant of record, processes them. We never see your full card number.
The full list, and why we keep each item, is in the Privacy policy.
Where it lives
- Photos and videos: Cloudflare R2.
- The app and its database: our servers, hosted by Hostinger.
- Publishing: Outstand, our publishing provider, receives each post and the access it needs to publish it.
- Email: Resend sends sign-in codes, approvals and reminders.
- Product analytics: PostHog Cloud (United States), counting how the site and app are used, never the content of your posts.
Every page and every API call uses HTTPS. Your data is not for sale and is not used to train AI models.
Signing in
- You sign in with Google, an email code or a password. An account belongs to one person.
- Your client doesn't need an account: on an approval link they sign in with Google or a one-time email link, so every answer carries a real name and address.
- Only the person the link was sent to can approve or ask for changes.
AI assistants (MCP)
Connecting an AI assistant is optional. You sign in with OAuth and choose what it may do:
- read: see your connected accounts, posts and their status, files and Credits balance.
- draft: create and edit drafts.
- approve: create client approval links and check their status.
- publish: schedule approved posts or publish now, always after you confirm.
Nothing is published or sent without your confirmation, and posts that need your client's yes wait for it. API keys are stored only as a one-way hash. Each action is logged for 90 days.
Revoke access any time in Settings → Connected apps (or Settings → API keys for a key). Access stops at once. Setup and details: MCP docs.
Export your data
To get a copy of your data, email support@creatif.space from the address on your account. A person handles every request. You can also download the approval history of a link as a CSV.
Delete your account
Open Settings › Account & Security and press Delete account. Your account is deleted 30 days later; until then you can sign in and cancel. Steps, and what is deleted and kept.
What we don't claim
Creatif Space is a young product built by a small team. We don't hold security certifications such as SOC 2 or ISO 27001, and we won't say we do. This page describes how things work today; we update it when that changes.
Report a problem
Found a security issue? Email support@creatif.space. A person reads every message and we reply as soon as we can.