1. Scope and responsibility
This policy applies to private.createsomething.agency and the information CREATE SOMETHING handles to operate Private. It covers our use of CREATE SOMETHING Identity for sign-in and verification. It does not describe every other CREATE SOMETHING website or an external tool you choose to use.
We are responsible for platform account, admission, security, and operational processing. Creators and company workspace owners also make decisions about their participants and content. They may have their own privacy obligations and notices. An agreed company data-processing agreement may further define responsibilities for project information.
Private is intended for adults aged 18 or older. Contact us if you believe a child has provided personal information through the service.
Invitation requests
When you introduce yourself before joining, we store your name, email, chosen learner or creator path, practice description, optional work link and referral, and permission to review and reply. Only authorized CREATE SOMETHING reviewers can see these introductions. We use them to assess fit and follow up about your request, not to subscribe you to marketing. Submission does not verify your email, create an account, or grant membership or publishing access.
Introductions and internal review notes are removed from the active database 90 days after submission by scheduled retention. Backup expiry follows the retention limits below. Request earlier deletion at privacy@createsomething.io.
2. Information we handle
- Account and verification: email address, account identifier, verified and active status, authentication and recovery records, and session tokens. CREATE SOMETHING Identity processes sign-in credentials and stores password hashes. Private receives the identity and session information needed to authorize access.
- Creator admission: display name, professional credentials and links, teaching-video URL, application revisions, decisions, review notes, and invitation sponsorship, recipient, expiry, and redemption records. These come from applicants, sponsors, and reviewers.
- Networks and content: network settings, membership email addresses and status, video files and metadata, packages and release documentation, access entitlements, and field notes. Information comes from creators, participants, and authorized workspace operators.
- Personal learning progress: your account identifier, network and lesson identifiers, saved playback position, the watched status you choose, practice-start notes, and update timestamps. These support resuming lessons across visits. They do not certify competence. Individual progress is available to you and authorized platform support, not included in creator network exports.
- Company support: the company and contact information, project needs, workspace participants, requests, status, and updates submitted during an engagement.
- Commerce, where enabled: buyer and seller identifiers, email, selected release or subscription, amount, currency, payment-provider references, and payment, refund, dispute, and payout-readiness status. Stripe collects payment instruments and any verification information required for its services.
- Operations and measurement: access receipts, playback-grant records, aggregate engagement and delivery counts, errors, and administrator-support audit records. Our infrastructure also processes request information such as IP addresses, browser information, and timestamps for delivery, rate limiting, and security.
Do not include passwords, API keys, unrelated personal records, or client information you lack permission to share in applications, videos, assets, or support requests. A professional credential submission is not a request for a government identity document.
3. Why we use information
We use this information to verify accounts, review creators, issue and redeem invitations, manage memberships and free months, deliver authorized videos and releases, operate company support, reconcile payments where enabled, prevent abuse, resolve disputes, and respond to requests. Aggregate measurements help us understand whether onboarding and delivery work.
We do not sell personal information or share it for cross-context behavioral advertising. Private does not install advertising pixels. We do not use private network content to train general-purpose AI models. Running an asset in an external agent or model service is a separate action under your control and that provider’s policies.
Where a legal basis is required, we process information as necessary to provide the requested service, pursue legitimate operational and security interests, meet legal obligations, or act on consent where required. We do not treat acknowledging this policy as blanket consent for unrelated uses.
4. Who can access information
Creators and participants: network owners manage their membership lists, content, and network reports. Participants can access material their current permissions or release entitlements allow. Reviewers can access applications and teaching-video links for admission decisions. Company-support participants and assigned approved partners can access the project information made available to their workspace.
Public material: a creator can explicitly publish previews, listings, or field notes. Public visibility is different from private membership. A Descript or other externally hosted link follows that host’s sharing settings; submitting the link does not make an already public video private.
Administrator assistance: authorized CREATE SOMETHING administrators may access information for operations, troubleshooting, security, and support. A read and write impersonation session is limited to 15 minutes and uses the target user’s permissions. It can make real workspace changes. Its audit records include administrator and target identifiers and emails, the reason, start and expiry or end times, request method and path, and response status. These request audits do not store request bodies, passwords, or URL query strings. Other service records may retain the content submitted through the underlying workflow.
We may disclose information when legally required, to protect rights and security, or to service providers performing the functions below. Private access controls are not end-to-end encryption or a promise that authorized administrators and infrastructure providers cannot process content.
5. Service providers and external tools
- Cloudflare: application hosting, databases, private package storage, video processing and signed delivery, traffic protection, and operational analytics. It processes content and request information to provide those services. Cloudflare privacy policy.
- Resend: verification and recovery email delivery used by CREATE SOMETHING Identity. This includes recipient addresses, message contents, and delivery information. Resend privacy policy.
- Stripe, when payment features are used: checkout, billing, connected seller or partner accounts, fraud prevention, refunds, disputes, and payouts. Private stores transaction references and status, rather than full card numbers or bank-login credentials. Stripe may also act under its own legal and regulatory obligations. Stripe privacy policy.
Descript is an optional creator tool, not a requirement to use Private. Opening a Descript, repository, model-provider, or other external link sends a request to that provider and is subject to its privacy practices. Package permissions and installation instructions should explain external services a release uses. We do not control how a creator or external tool handles information outside Private.
7. Retention and deletion
We retain account, application, membership, content, entitlement, support, and audit records while needed to provide the service, preserve authorized release access, protect security, handle disputes, or meet legal obligations. Review history and expired or redeemed invitation records can remain after an application or invitation changes status. Payment and provider records may have separate legal retention requirements.
The aggregate engagement and package-delivery tables use a 90-day cleanup window. Cleanup runs on a daily schedule and when those records are written; it is not a promise that every system record is erased at exactly 90 days. Playback events, security audits, account records, and provider logs are separate from those aggregates and do not share that automatic cleanup rule.
Personal learning progress is removed by scheduled cleanup after 365 days without an update to that lesson’s progress. Saving progress is a functional account feature; Do Not Track and Global Privacy Control suppress optional aggregate engagement measurement, not your saved position.
Archiving a session or listing, revoking membership, and ending a subscription restrict availability but are not deletion requests. Contact us to request deletion. We review what can be removed, identify any information that must be retained, and respond under applicable law. Copies held by recipients, external video hosts, payment providers, or backups may require separate handling. We do not promise immediate erasure from every copy.
8. Your choices and rights
Email privacy@createsomething.io to request access, correction, deletion, or a portable copy of your personal information, or to raise a concern. Include your account email and relevant network; do not send your password or a government identity document. We may verify account control and ask for information proportionate to the request.
Depending on your location and applicable law, you may also have rights to object to or restrict processing, withdraw consent where processing relies on it, appeal a decision about a privacy request, use an authorized agent, or complain to a regulator. We will respond within the period applicable to your request and explain any permitted limitation. Exercising a privacy right does not itself result in discriminatory treatment.
Network owners can export supported network metadata. That export is not a complete personal-data export and does not include original video or package files. Contact us for broader requests. A creator may also need to handle information they independently control; we can help identify the appropriate contact.
9. Security and international processing
We use authenticated access, current membership checks, private storage, signed video delivery, and audit records to protect the service. No system can guarantee absolute security. Tell us promptly if you suspect unauthorized access, and never share a sign-in or recovery link.
CREATE SOMETHING and its providers may process information in the United States and other locations where the service operates. Private does not promise a particular data-residency region. Contact us before submitting project information that requires a specific residency, transfer safeguard, or regulated-data agreement.
10. Changes and contact
We will update the effective date when this policy changes and provide appropriate notice of material changes. We will seek consent where required before using previously collected information for a materially different purpose.
Privacy requests: privacy@createsomething.io. Contract or content-rights questions: legal@createsomething.io. See the Private Terms of Service for participation and content rules.
Remote-support records
PRIVATE stores session participants, method, agreed task, consent version, budget, status changes, meeting links, outcome notes, server-timed intervals, billing-period boundaries, and buyer confirmations or disputes. Timer and receipt changes retain an audit record. These records are visible to the session participants; authorized administrative access follows the controls described above. Never enter device passwords or API keys. RustDesk or Zoom processes the remote connection under its own policies. PRIVATE does not record screens or store remote-access passwords. Ending a PRIVATE record does not disconnect RustDesk or Zoom.