Privacy
Privacy Policy
What we collect, how AI features handle your work, and who processes your data.
1. Overview
Creative Haven is a creative home for independent audio immersive creators. This Privacy Policy explains what personal data we collect, how we use it, who processes it on our behalf, how AI features handle your work, and the choices you have. It applies to creativehaven.cre8rite.studio and related Cre8rite Studio subdomains.
2. Data we collect
Account data: email address, display name, and authentication identifiers. Subscription data: plan tier, billing status and processor identifiers (we never see or store your full card number). Creative data: scripts, notes, casting calls, audition submissions, recordings, multitrack sessions, markers and workspace autosaves. Technical data: device and browser information, IP address, and error logs needed to keep the Service secure and working.
3. How we use your data
We use your data to authenticate you across Cre8rite Studio subdomains, save and restore your creative work under your profile, deliver subscription features, provide AI assistance you explicitly request, prevent abuse and secure the platform, and communicate essential service notices. We do not sell your personal data and we do not run advertising profiling.
4. Legal basis for processing
Where the GDPR or similar laws apply, we process data to perform our contract with you (providing the Service), on the basis of legitimate interests (security, abuse prevention, service improvement), to comply with legal obligations (tax and accounting), and with your consent where consent is required — for example optional features you turn on.
5. AI features and AI training
AI features run only when you trigger them. When you use the dramaturg, inspiration, or transcription tools, the relevant text or audio is sent through our server-side AI proxy to our AI provider so a response can be generated. We do not use your scripts, recordings, or other creative work to train our own models, and we ask our AI providers to process your prompts solely to return your result and not to train their models on it. We do not share your work with AI providers except when you invoke an AI feature.
6. Recordings, transcripts and storage
Audio takes are stored in a private storage bucket that is not publicly listable. Playback and download use short-lived signed links (15 minutes) minted only for you. Transcripts are generated only when you request them and are stored alongside the take under your profile. Deleting a take removes the stored audio file and its related database rows.
7. Data processors we use
We rely on a small set of sub-processors: our managed database, authentication and storage provider (Lovable Cloud, backed by Supabase infrastructure); our payment processor (Stripe) for subscriptions; our AI model provider for AI-assisted features; and hosting/CDN infrastructure that serves the site. Each processes data under a data-processing agreement and only for the purposes described here.
8. International transfers
Our providers may process data in countries outside your own, including the United States. Where required, transfers rely on standard contractual clauses or equivalent safeguards offered by those providers.
10. Session cookies across subdomains
So that one sign-in works across cre8rite.studio and creativehaven.cre8rite.studio, your session is stored in a cookie scoped to .cre8rite.studio, marked Secure with SameSite=Lax. This cookie is strictly necessary to keep you signed in; it is not used for advertising or tracking. Signing out clears it.
11. Retention
We keep account and creative data for as long as your account is active. If you delete your account, we delete or anonymize your personal data and creative content within 30 days, except records we must retain for legal, tax or fraud-prevention reasons. Backups roll off on a limited schedule.
12. Your rights
You can request access to your data, correction of inaccurate data, deletion, restriction of processing, portability of your creative work, and objection to processing based on legitimate interests. You may also withdraw consent for optional features at any time. Write to privacy@cre8rite.studio and we will respond within 30 days.
13. Security
Access to your data is enforced at the database level with row-level security so records are scoped to their owner. Recordings live in private storage, privileged operations run only on the server, and administrative functions require a verified admin role. No system is perfectly secure, so please report suspected issues to security@cre8rite.studio.
14. Children
The Service is not directed at children under 16. If we learn that we have collected data from a child under the applicable age of digital consent without guardian permission, we will delete it.
15. Changes to this policy
We may update this policy as the Service evolves. Material changes will be posted here with a new effective date and, where appropriate, announced in-app before they take effect.
16. Contact
For any privacy question, data request, or concern, email privacy@cre8rite.studio. For legal matters see our Terms & Conditions or write to legal@cre8rite.studio.
For the rules of using the studio, see our Terms & Conditions. Privacy requests go to privacy@cre8rite.studio.