Privacy Policy

This Privacy Policy describes how Creala LLC ("Creala", "we", "us", "our") collects, uses, shares, and protects your personal information when you visit crea.la, use app.crea.la, or use any of our services (together, the "Service").

Creala runs on Stripe Connect. Stripe processes payments and sends payouts to sellers directly to their connected accounts; Creala does not store your full card data and only earns a commission for the use of the Service. Where applicable, other payment processors or banking partners also act as processors.

By accessing or using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

Who we are and scope

Creala LLC is the controller of the personal information processed through the Service, except for the information that sellers process on their own behalf as independent controllers. This Policy applies to buyers, sellers, and visitors of the Service.

Information we collect

Information you provide. Account data (name, email, password), your profile and product information, identity verification (KYC) data that our payment processor may require, billing and payout details (such as your bank account, managed through Stripe), and the content of your communications with support.

Information we collect automatically. Device and connection data (IP address, browser type, operating system), usage and interaction data, and data collected through cookies, pixels, and analytics tools such as Google Analytics.

Information from third parties. Data we receive from Stripe and other payment processors, from fraud-prevention and sanctions-screening providers, and from social login services when you choose to use them.

We do not collect or store full credit or debit card numbers. That information is handled directly by our payment processor under its own security standards (PCI-DSS).

How we use your information

We use your information for the following purposes:

To provide, maintain, and improve the Service, and to administer your account.

To facilitate payment processing and payouts through Stripe Connect and other processors.

To prevent fraud, comply with anti-money-laundering (AML) obligations, and screen against sanctions lists.

To provide support, respond to inquiries, and resolve disputes.

To comply with legal obligations and enforce our terms.

To send service communications and, with your consent where the law requires it, marketing communications that you can opt out of at any time.

Legal bases for processing

For users in the European Economic Area and the United Kingdom, we process your data on the following legal bases: performance of a contract (providing the Service), our legitimate interests (security, fraud prevention, and improving the Service), compliance with legal obligations, and your consent where applicable (for example, certain cookies and marketing).

How we share your information

We share personal information only in the following cases:

Payment processors. With Stripe and other processors, to charge buyers and pay sellers. Their handling of your data is governed by their own privacy policies.

Service providers. With providers that supply hosting, email, analytics, support, and fraud-prevention services, under confidentiality obligations.

Between sellers and buyers. To complete a purchase, we share with the seller the buyer information needed for the transaction (such as name, email, and purchase details), and we show the buyer the seller's public information and product.

Legal compliance and safety. When necessary to comply with the law, respond to requests from authorities, or protect the rights, safety, and property of Creala, our users, or third parties.

Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information.

Payments and Stripe Connect

Charging buyers and paying sellers are processed through Stripe Connect. By using the Service to charge or get paid, you also agree to the Stripe Connected Account Agreement and Stripe's Privacy Policy. Creala receives limited transaction data from Stripe (such as amounts, payment status, and identifiers), but not the full payment instrument data.

Cookies and similar technologies

We use cookies and similar technologies to make the Service work, remember your preferences, measure usage, and, where applicable, for marketing. You can control cookies from your browser settings. Some cookies are necessary for the Service to function and cannot be disabled.

International transfers

Creala operates from the United States and works with providers in different countries. Your information may be transferred, stored, and processed outside your country of residence, including the United States, where data-protection laws may differ from those in your jurisdiction. Where required by law, we apply safeguards such as Standard Contractual Clauses.

Data retention

We retain your personal information for as long as your account is active and for as long as reasonably necessary for the purposes described in this Policy, or for the period required by the legal, accounting, tax, or fraud-prevention obligations that apply to us.

Security

We apply reasonable technical and organizational measures to protect your information. However, no system is completely secure, so we cannot guarantee the absolute security of your information.

Your rights

Depending on your jurisdiction, you may have the right to access, rectify, delete, restrict, or object to the processing of your data, to data portability, and to withdraw your consent.

EEA and United Kingdom. You may exercise the rights granted by the GDPR and, if you consider it necessary, lodge a complaint with your supervisory authority.

California. California residents may exercise their CCPA/CPRA rights, including the right to know, to delete, and to opt out of the sale or sharing of their information. Creala does not sell personal information.

How to exercise them. Write to us at support@crea.la and we will respond within the timeframes required by applicable law. We may ask you to verify your identity before acting on your request.

Minors

The Service is intended for people aged 18 and over. We do not knowingly collect data from minors. If we detect data from a minor collected without the appropriate legal basis, we will delete it, unless the law requires us to retain it.

Third-party sites and services

The Service may contain links to third-party sites or services that have their own privacy policies. We are not responsible for the privacy practices of those third parties and recommend that you review them.

Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the Service or by other means. Continued use of the Service after the changes take effect constitutes your acceptance.

How to contact us

If you have questions about this Policy or about how we process your data, write to us at support@crea.la.