1. Information We Collect

When you sign up for CreatorRM, we collect your name, email address, organization name, and organization type. Subscription payment information is collected and processed by our subscription payment processor (not stored as full card numbers on CreatorRM systems). Paying CreatorRM for a plan is a different rail than optional charges your workspace collects from its customers. See Workspace payments.

We also collect usage data to improve the service, including pages visited, features used, and performance metrics.

Location & Network Data: When you access CreatorRM, we automatically collect your IP address, approximate geographic location (country, region, city, timezone, and coordinates), and device information (browser type, operating system) from request headers provided by our infrastructure provider. This data is used for security enforcement (blocking high-risk regions, detecting unauthorized access), device session management (limiting concurrent logins), platform analytics, and fraud prevention.

2. How We Use Your Information

We use your information to: provide and maintain the CreatorRM service, process payments, send service-related communications, and improve our platform. We do not sell your personal information to third parties.

3. Data Storage & Security

Your data is stored on an enterprise cloud infrastructure provider's global edge network, across managed SQL, object-storage, and key-value services. All data is encrypted in transit via TLS and at rest. Workspace data is isolated per-tenant, so no other customer can access your workspace. A current list of our infrastructure subprocessors is available on request at privacy@creatorrm.com.

Authentication is handled by a zero-trust access layer with signed-token verification on every request.

4. AI Processing

CreatorRM uses AI models to provide features like content suggestions, transcription, and automated workflows. House (included) inference runs on our platform cascade. You may optionally use Bring Your Own Key (BYOK) so prompts go to a provider under your account. A separate, flag-gated platform-pack frontier path (when enabled) uses CreatorRM's provider account and is not the same as BYOK. See our AI Use Policy.

Your content is never used to train other companies' AI models.

4a. Optional AI Training

Off unless you opt in. We use a workspace's content to improve our AI only if someone with authority over that workspace says yes, either with the separate, unchecked checkbox at sign up or in Settings, AI Memory, under "Help improve CreatorRM AI". Accepting our Terms and this Privacy Policy is not consent to AI training. Accounts created before this option existed are not included unless they opt in.

What we use. Prompts you send to CreatorRM's AI features, the results those features produce, and edits you make to those results.

Why. To train, fine-tune, and evaluate CreatorRM's own AI models and features, including custom model adapters for your workspace. The legal basis is your consent.

De-identification. Before content is used in a training run, we remove or mask common personal identifiers such as names, email addresses, phone numbers, payment card numbers, and street addresses. Automated de-identification is not perfect, so please only opt in for content you are comfortable sharing for this purpose.

No sale, no outside training. We do not sell this content and we do not use it to train other companies' AI models. It is processed only by CreatorRM and the infrastructure subprocessors that host our service.

Withdrawing. Turn the setting off at any time. New collection stops right away, and content collected earlier is not used in any new training run while consent is off. Models trained before you withdrew may keep what they already learned. To have the examples we collected deleted, email privacy@creatorrm.com.

Record of your choice. We keep a record of each yes or no: when it was made, who made it, and which version of this policy it was made under.

4b. Google Workspace & Google Drive Integration

CreatorRM integrates with Google Workspace APIs (Google Drive, Docs, Sheets, Slides, and Forms) to enable document import, creation, and management within your workspace. When you connect your Google account:

Scopes Requested: We request access to Google Drive (browse and manage files), Google Docs (create and edit documents), Google Sheets (create and edit spreadsheets), Google Slides (create and edit presentations), Google Forms (create forms and read responses). For the file picker only, we request read-only access to Google Drive.
Purpose: These permissions allow you to import files from Google Drive into your workspace for AI-powered analysis, generate documents (SOPs, strategies, reports) directly to your Google Workspace, and manage content production workflows.
Token Storage: Your Google OAuth access tokens and refresh tokens are encrypted using AES-256 encryption before being stored in our database. We never store your Google password.
Data Access: We only access Google files that you explicitly select through the file picker or that are created by CreatorRM on your behalf. We do not scan, index, or access other files in your Google account.
No Third-Party Sharing: Your Google data is never shared with third parties, used for advertising, or transferred to any entity outside of CreatorRM. Our use of Google data complies with the Google API Services User Data Policy, including the Limited Use requirements.
Retention: Google-imported files are stored in your workspace for the duration of your account. Documents created by CreatorRM in your Google account remain in your Google account and are not affected by CreatorRM account deletion.
Revocation: You can disconnect your Google account at any time from your workspace settings. This immediately revokes our access and deletes stored tokens. You can also revoke access from your Google Account permissions page.

5. Data Retention

We keep your data until you delete it. Deleting a workspace archives it, and we can restore it if you ask. We permanently erase your data when you send us a verified erasure request under privacy laws such as GDPR or CCPA.

5b. Data Retention: Visitor Logs

Visitor location logs (IP address, geographic location, pages visited) are automatically deleted after 30 days. Audit logs containing geographic data are retained for the lifetime of your account for security compliance purposes.

6. Your Rights

You have the right to access, correct, or delete your personal data. You can export your data at any time through the dashboard. To exercise these rights, contact us at support@creatorrm.com.

7. Cookies & Tracking

We use essential cookies for authentication and session management. We use a privacy-preserving, cookieless web analytics provider. No personally identifiable information is collected by our analytics.

Device & Session Tracking: We track active device sessions per account (limited to 6 concurrent devices) using a fingerprint derived from your IP address and browser type. Session data is automatically purged after 24 hours of inactivity.

Geographic Access Controls: We block access from certain high-risk countries for security purposes. Your country of origin is determined at the network edge by our infrastructure provider, not by GPS or precise device location.

8. SMS & Text Messaging

If you opt in on our signup form or affiliate application, we process your phone number and consent record to send the specific kind of SMS described at the point you opted in (account/booking notifications, or affiliate-program updates). We do not currently offer a general marketing SMS program. We never send SMS without your prior express consent, and consent is never a condition of purchasing any goods or services.

No sharing of opt-in data: Mobile information and phone numbers collected for SMS, including your consent, are never sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. We share this information only with the messaging service providers strictly as needed to deliver the messages you requested.

For the exact consent text and full program details, see our SMS Terms.

9. Do Not Sell or Share

We do not sell your personal information. Some affiliate or advertising cookies, if ever used, would be treated as “sharing” under CPRA; honor Global Privacy Control and contact privacy@creatorrm.com to request opt-out. Named subprocessors are listed at /legal/subprocessors.

9b. Children's Privacy

CreatorRM is a business service for adults. It is not directed to children, and we do not knowingly collect personal information from children under 13, or from anyone under 16. Account holders who start a workspace or subscribe must be at least 18; invited team members must be at least 16, and we ask every new account to confirm their age. If you believe a child has given us personal information, email privacy@creatorrm.com and we will delete it and close the account.

10. Contact

For questions, contact us at privacy@creatorrm.com.

CreatorRM Tech, LLC
8400 W Sunset Road, Las Vegas, NV 89113
(702) 576-9399 · support@creatorrm.com