Privacy policy

CreateWith (createwith.dev) is a trading name of a sole trader based in the United Kingdom, and is the data controller for everything described here.

For any request under this policy — a copy of your data, a correction, a deletion, or an objection — email hello@createwith.dev. We normally respond within one calendar month. If the law allows extra time, we will explain why. We may need proportionate information to verify your identity.

What we hold about you, and why:

• Your email address, because it is how an account is identified and how we can reach you about it. It is the only personal detail signing up requires. Lawful basis: performance of our contract with you.
• Sign-in records — the magic-link authentication and the timestamps of when you signed in. Lawful basis: contract, and our legitimate interest in account security.
• API key records — a key’s first few characters and a one-way hash. We never store a usable copy of your key, which is why a lost key cannot be recovered, only replaced. Lawful basis: contract and our legitimate interest in account security.
• Usage records — which endpoint was called, when, what class of call it was, what it cost, and whether it succeeded. Lawful basis: contract (we have to be able to bill correctly), and legitimate interest in preventing abuse.
• Payment and subscription records — Stripe customer, subscription and payment identifiers, amounts and currency, plan and renewal status, paid access dates, and any legacy credit balance. Lawful basis: contract, and a legal obligation to keep financial records. We never receive or store your card details; those go directly to Stripe.
• Connected AI clients — the client identifier and name, account connection, approval and revocation times, and authentication records needed to authorize MCP access. Lawful basis: contract and our legitimate interest in account security.
• Support correspondence — your contact details and the information you send us to resolve a request. Lawful basis: contract, legitimate interests in providing support, or a legal obligation when handling a data-rights request. Please do not send passwords, API keys or unnecessary sensitive information.
• A hashed IP address for keyless requests, so per-address daily caps and abuse prevention can work. Our guest telemetry associates the hash with request metadata, such as endpoint, time and outcome. These records are pseudonymous, not anonymous. Hosting and security providers may also process the source IP address. Lawful basis: legitimate interest in rate limiting.

We do not profile you, sell your details, share them for advertising, or use them to train models.

CreateWith exists to put creators in front of brands that might sponsor them. To do that we hold a record of channels, and for some of them a research summary. If you stream on Twitch, that may include you, and you did not ask for it. Here is exactly what that means.

From Twitch’s public API: your channel login and display name, your channel description, your broadcaster type, your language, and a history of your public streaming activity — what you streamed, when, the title, and how many people were watching at the moments we sampled.

From publicly accessible web pages, for a subset of channels, a research summary: a short description of what you do, an approximate location (usually country or city, only where you have said so publicly), your topics and interests, other public channels and social accounts you run, brand collaborations that have been publicly reported, a description of your audience, a confidence score, and a list of the sources we used.

Where it comes from. The Twitch public API, and pages anyone can open in a browser. We do not buy lists from data brokers, we do not access anything behind a login or a paywall, and we do not go looking for information about your health, beliefs, politics, sex life, or anything else the law treats as a special category.

Why we are allowed to. Our lawful basis is legitimate interests. The balance, stated plainly: the information is already public and is professional rather than private in nature; our purpose is to help users evaluate creator partnerships; and we limit research to relevant public information. Public availability alone does not remove your privacy rights. Profiles and research may be made available through our website, API and connected AI clients to users evaluating partnerships. AI-assisted summaries and ranking can be incomplete or wrong. We do not make decisions with legal or similarly significant effects about you solely by automated processing. You can challenge accuracy or object using section 4.

Email hello@createwith.dev and tell us your channel URL. We may ask for reasonable evidence that you control the channel. You can ask us to:

• Show you everything we hold on the channel, as a file.
• Correct anything we got wrong. Research is compiled from public sources and public sources are sometimes wrong about people.
• Delete the research summary we hold about you.
• Object to the processing altogether, under Article 21. You can explain your particular situation, and we will stop unless we demonstrate compelling legitimate grounds that override your interests and rights, or need the data for legal claims.

Account holders and creators can also request access, correction, erasure or restriction of their personal data, and portability where applicable. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. Requests are normally free. Some rights have legal exceptions; we will explain any refusal and how to complain.

• Account usage records: our usage ledger has a 24-month retention period. Guest request telemetry has a 90-day retention period. Temporary request and rate-limit records have shorter operational lifetimes.
• Payment records: kept as long as UK tax and accounting law requires. For UK self-employment tax records this is normally at least five years after the 31 January filing deadline for the relevant tax year, and longer if an enquiry or other obligation requires it. Necessary financial records survive account deletion.
• Account details: until you close the account. On closure the email is replaced with a placeholder, the login is deleted, and the keys are revoked.
• Channel and streaming data: for as long as the service runs, while needed to provide historical creator metrics and research, subject to valid deletion and objection requests and applicable data-source requirements. We assess requests against any legal grounds for retaining particular records.

We use service providers for hosting, authentication, payments, communications and research. Their roles depend on the service: some process data on our behalf, while payment and connected-client providers can also act as independent controllers.

• Supabase — the database and the login system. Hosted in the EU (Ireland).
• Vercel — website and API hosting.
• Stripe — payments. Stripe is the controller of your card data, under its own privacy policy.
• Resend — transactional email delivery, including sign-in emails. Cloudflare — domain services and support-email routing. Google Workspace — the support mailbox that receives forwarded messages and is used to handle your request.
• Anthropic and OpenRouter — the AI models that compile research summaries from public sources.

Providers may process data outside the United Kingdom or European Economic Area, including in the United States. Applicable transfer protections depend on the provider and destination, such as an adequacy decision or approved contractual safeguards. Contact us for information about the safeguards relevant to your data.

We have no advertising, no analytics product, and no third-party trackers on this site. There is nothing here selling your behaviour to anyone.

When you authorize an AI client to use CreateWith, it can send tool requests on your behalf and receive the requested creator information, research and relevant usage or error responses. Requests can consume your account allowance. We receive the requests sent to our service, not automatically the rest of your conversation with that client.

The client provider handles information it receives under its own terms and privacy policy, including its retention and model-training settings. Review those settings before connecting. You can revoke a connection in your account; contact the client provider to remove copies it already holds.

We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. Creator information is provided to service users for partnership research as described above.

We use essential browser storage for sign-in, authorization and access control. Depending on the features you use, this includes:

• A sign-in cookie set by Supabase when you log in, so the site knows it is still you, together with cookies needed to complete the authentication flow. Some authentication cookies may be split into more than one cookie.
• createwith_ui, which records that a browser has access to the internal board. It lasts 30 days and cannot be read by JavaScript.

These cookies support the service you request and are not advertising cookies. Browser controls let you delete or block cookies, but sign-in and protected features may then stop working. Display preferences may also be stored locally in your browser.

Access to the database is server-side only and row-level security is on with no public policies, so the anonymous and signed-in database roles can read nothing directly. API keys are stored as one-way hashes. Card data never reaches our servers.

No system is perfect. If you find a security problem, email hello@createwith.dev and we will take it seriously and credit you if you would like us to.

Tell us first if you can — it is usually faster. If we do not resolve it, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to your local supervisory authority if you are in the EU.

When this policy changes, the date at the top changes with it. If a change materially affects how we handle your data, account holders get an email about it rather than a silently edited page. The terms of service cover the commercial side of the same relationship.