Privacy Policy

In short. This Policy explains how CreatorStore processes personal data when operating its SaaS platform, how independent Creators may process Customer data, and how users can exercise privacy rights. Different privacy roles and legal obligations may apply depending on the activity. See Sections 4, 5, 6, and 11.

Welcome to CreatorStore ("CreatorStore," "we," "us," or "our"). CreatorStore is a platform that enables content creators ("Creators") to monetize their digital goods, content, services, consultations, and subscriptions ("Creator Content"), and enables Creators' fans and followers ("Customers") to discover and purchase such Creator Content. Our platform includes our website at https://creatorstore.co/ and related services (collectively, the "Service").

This Privacy Policy explains the personal information we collect from Creators and Customers (collectively, "you") via our Service, how we use and share that information, and your choices and rights concerning our information practices.

CreatorStore Labs LLC acts as a controller when it determines the purposes and means of processing personal information for its own accounts, subscriptions, security, support and platform operations. For some data processed to provide services on a Creator's instructions, CreatorStore may act as a processor, subject to applicable data-processing terms. A Creator may be an independent controller for their own customer-facing business activities. The applicable role depends on the specific processing operation. For questions contact [email protected] .

PLATFORM NATURE — IMPORTANT NOTICE. CreatorStore supplies storefront and commerce software to independent Creators. CreatorStore does not sell Creator products or provide their coaching, consulting, or other independent services. Creators determine their own offerings and may independently determine how they use Customer information for fulfillment, support, and lawful marketing. CreatorStore remains responsible for personal-data processing performed in its own capacity and for obligations imposed on it by applicable law. Where CreatorStore processes Customer information on a Creator's instructions, the parties' respective obligations depend on the applicable data-processing arrangement. See Section 4.

1. Personal Information We Collect

Personal Information You Provide

Account and Profile Information: Your name, email address, phone number, address, profile photo, username, password, and any additional information you provide when creating an account or using the Service. When you contact us, we also collect the content of your communications.

Financial Information: Payment details needed to process a transaction are collected and handled by the relevant payment provider under its own applicable terms and privacy notice. CreatorStore may receive payment-related metadata needed for billing, account administration, transaction records, fraud prevention, and support. The particular categories depend on the integration used.

Billing Metadata: Depending on the payment integration, CreatorStore may receive transaction amounts, currency, payment status, receipt or transaction references, billing details and limited payment-method identifiers needed for billing, fraud prevention and support. The relevant payment provider independently processes payment credentials under its own notice. CreatorStore does not request full card numbers or card security codes through its application.

Communication Information: Information you provide when you contact us or respond to questionnaires, surveys, or feedback requests. Providing this is optional.

Commercial Information: A history of the Creator Content you browse, make available, and/or purchase.

Other Information: Other information not specifically listed here, which we will use as described in this Policy or as disclosed at the time of collection.

Information Collected Automatically

Log Information: IP address, browser type and settings, date and time of your request, and how you interacted with the Service.

Cookies Information: See our Cookie Policy at https://creatorstore.co/cookies for details.

Device Information: Device name, operating system, and browser. May depend on device type and settings.

Usage Information: How you use the Service, including content viewed, features used, actions taken, and the time, frequency, and duration of activities.

Location Information: Approximate location data based on your IP address.

2. How We Use Personal Information

To Operate and Deliver the Service. We rely on performance of our contract with you and our legitimate business interests to: provide, operate, maintain, and secure the Service; provide support, assistance, and troubleshooting; send updates about administrative matters such as changes to our terms or policies; facilitate transactions between Customers and Creators.

To Improve, Personalize, and Protect the Service. Enrich your user experience and customize your relationship with us; protect the security of the Service; prevent and detect security threats, fraud, or other criminal or malicious activities.

Research and Development. It is in our legitimate business interest to develop, analyze, and improve the Service. We may create or use aggregated, de-identified, or anonymized data for internal research and product improvement, as further described in Section 3.

To Comply with Legal Obligations and Defend Legal Claims: comply with applicable laws, lawful requests, and legal process; protect our, your, or others' rights, privacy, safety, or property; audit our compliance with legal and contractual requirements; enforce the terms that govern the Service; prevent, identify, investigate, and deter fraudulent, harmful, or illegal activity.

For Marketing. We may contact you about products or services we believe may interest you.

Direct marketing: We may send special offers by email. You may opt out at any time.

Legal basis for marketing. Where marketing messages require prior consent under applicable law, we will seek that consent. You can withdraw consent or object to direct marketing by using any unsubscribe mechanism made available or by contacting us. Other lawful bases may apply depending on the jurisdiction and circumstances. Our use of tracking technologies and any advertising-related disclosures are described in the Cookie Policy and applicable privacy choices. Any sale, sharing or targeted advertising activities must be disclosed and supported by the required controls under applicable law.

To Facilitate Corporate Transactions. We may use your personal information in connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider.

3. Sharing and Disclosure of Personal Information

We may share the categories of personal information described above with:

Creators (for Customer purchases): We make information relevant to a transaction available to the applicable Creator so they can fulfill purchases and manage their customer relationship. Depending on the processing activity, the Creator may act as an independent controller while CreatorStore may act as a controller or a processor. See Section 4.

Vendors and Service Providers: Hosting and cloud providers, IT services, email and marketing providers, payment processing, customer support, and web analytics. These parties process personal information solely to perform their duties to us, under contract.

Professional Advisors: Lawyers, accountants, auditors, where necessary.

Business Transfers: In a merger, acquisition, due diligence, reorganization, bankruptcy, sale of assets, or service transition.

Legal Requirements: Where required by law or where we believe in good faith disclosure is necessary to comply with law, protect rights or property, prevent fraud, protect personal safety, or protect against legal liability.

Aggregated/Statistical Information: De-identified and aggregated information that cannot reasonably be used to identify you, shared for internal research, product improvement, and public reporting (such as blog posts about creator earnings trends). We do not sell aggregated information to third-party advertisers.

4. Personal Information You Make Available to Creators

This section is important. Please read carefully.

When you purchase from or contact a Creator using the Service, that Creator may receive information relevant to the transaction or inquiry, such as your name, email address, product purchased, booking details, and purchase records. The information shared depends on the feature used; payment providers may handle additional payment information separately.

A Creator generally determines how they use Customer personal information for their independent business activities, including fulfilling orders, providing support, handling purchase-related questions and complying with applicable laws. Creators are responsible for a lawful basis and appropriate notices for their independent marketing. Requests for refunds for Creator products or services should be directed to the relevant Creator. Refunds and payment disputes are subject to applicable law, the Creator's terms and the payment provider's procedures. CreatorStore is not the seller of the underlying Creator offering.

Creators may make their own Terms & Conditions and privacy notices available to Customers. CreatorStore provides an editable Terms & Conditions template, but each Creator is responsible for the accuracy, legality and implementation of their own terms and notices. Where CreatorStore processes personal data on behalf of a Creator, applicable data-processing terms govern that activity. Customers should review the notices presented for the relevant transaction.

Creators are responsible for their independent data-handling decisions and practices. CreatorStore does not control those independent decisions, but remains responsible for its own processing activities and any duties it cannot lawfully exclude. For concerns about a Creator's independent use of personal information, contact the Creator; you may also contact CreatorStore about data handled through our Service.

4A. Platform Role and Limitation of Our Responsibility

CreatorStore provides technology infrastructure that enables Creators to sell and Customers to buy. CreatorStore is not a party to any transaction between a Creator and a Customer, does not deliver Creator Content itself, and does not provide the services offered by Creators (including coaching, consulting, education, or any other professional services).

Creators are solely responsible for: the quality, legality, and delivery of their content and services; interactions with their Customers (including messaging, sessions, and post-purchase support); compliance with the professional licensing, tax, consumer protection, and privacy laws that apply to their specific business and jurisdiction; and the terms of any agreement they enter into with their Customers.

Customers are responsible for: reviewing the Creator's Terms & Conditions before purchase; interacting with the Creator directly regarding the Creator's services; and reporting any concerns about a Creator's conduct or content-handling to us at [email protected] .

Creators and Customers are responsible for their independent conduct and the obligations they undertake to one another. CreatorStore does not guarantee Creator performance or take over a Creator's obligations under a sale contract. This does not exclude liability or duties arising from CreatorStore's own conduct, its role in processing personal data, or mandatory law.

5. Google API Services — User Data and Limited Use

CreatorStore uses Google API Services to provide scheduling and video conferencing features. This section discloses how we access, use, store, and share Google user data, in accordance with the Google API Services User Data Policy , including the Limited Use requirements.

Google APIs we use:

Google Calendar API — to read your free/busy availability and create, update, or cancel calendar events for confirmed bookings.

Google Meet integration (via Calendar API) — to automatically attach a Google Meet video conference link to bookings.

What Google user data we access:

The precise Google Calendar information accessed depends on the permissions granted and the scheduling features enabled. Calendar availability, event identifiers and booking-related information may be processed to coordinate bookings. Our implementation and granted OAuth scopes determine what other fields, if any, are accessible. We do not use Google user data for advertising.

How we use Google user data:

Only to provide and improve the scheduling and video call features visible in our app. Not for advertising. Not shared with third parties, except service providers under contract (e.g., hosting providers) and only as necessary to operate the Service.

How we store Google user data:

We may store OAuth credentials or tokens and booking-related identifiers needed to maintain a connected calendar and manage bookings. Access is limited to operational needs and protected using technical and organizational security measures. Exact retention and deletion behavior depends on system configuration and applicable requirements.

How users can revoke access:

You may revoke CreatorStore's access to your Google account using Google Account permissions . Where a disconnect control is available within CreatorStore, it may also be used. Revocation stops future API access using the revoked authorization; data already processed is handled under our retention obligations.

Human review:

We do not allow humans to read or access your Google user data, except: (a) with your explicit consent for support purposes, (b) for security investigations (e.g., abuse), (c) to comply with applicable law, or (d) when data is aggregated and anonymized for internal operations.

Limited Use compliance:

CreatorStore's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy , including the Limited Use requirements.

5A. Confidentiality of Coaching Calls, Sessions, and Live Events

Coaching calls, 1:1 sessions, live webinars, and video meetings booked through CreatorStore take place on third-party video services (Google Meet, Zoom, Whereby, or any other provider chosen by the Creator). CreatorStore is not a participant in these calls.

What we do NOT do:

CreatorStore provides scheduling and booking tools rather than a built-in video-meeting service. Video calls take place through providers chosen or connected by the Creator. CreatorStore does not offer a built-in call recording or transcription feature. Recording, storage or access by the third-party provider or by a Creator are subject to their separate settings, practices and legal obligations.

What we DO have:

Booking metadata only: your name, email, the time and date of the call, the product purchased, and the video link. This is what makes the booking work — nothing about what happens on the call.

How video links work:

Video links are provided in one of two ways: (a) the Creator connects their own Google account, and CreatorStore auto-generates a Google Meet link inside the Creator's calendar via the Google Calendar API — the Meet room lives on the Creator's Google account, not ours; or (b) the Creator manually enters their own video link from any provider (Zoom, Whereby, personal Meet, or any other service). In both cases, the call takes place entirely on the Creator's video account. CreatorStore does not host, join, record, or transcribe the call.

What the Creator does after the call:

Anything the Creator does during or after the call — taking notes, saving recordings on their own device or account, keeping a session log, sharing the recording with third parties — is the Creator's independent responsibility as a separate controller of your personal information, governed by any agreement you have with the Creator directly. CreatorStore has no visibility into and no control over these activities. See Section 4.

Third-party providers. Google Meet, Zoom, and other video services collect data under their own privacy policies. Please review the policy of the specific service used by your Creator.

Not for licensed medical practice. CreatorStore is not HIPAA-certified. The Service is designed for coaches, consultants, educators, and creators — not for licensed medical or mental-health practitioners transmitting Protected Health Information (PHI) as part of clinical care. If you are a licensed therapist, psychologist, dietitian, or other healthcare provider billing insurance for your services, please use a HIPAA-compliant platform with a Business Associate Agreement.

6. Your Rights and Choices

Depending on where you are based, and subject to applicable law, you may have the right to: access; correct; erase; restrict processing; data portability; opt out of the sale or sharing of your personal information for interest-based advertising; opt out of profiling that produces legal or similarly significant effects on you (such as credit decisions, hiring, or access to essential services) — we do not engage in profiling for such decisions; object to processing; and withdraw consent where we rely on it.

To exercise these rights, contact us at [email protected] . We may require you to verify your identity. You may use an authorized agent where your jurisdiction allows. We will respond to your request within thirty (30) days for GDPR and UK GDPR requests, or forty-five (45) days for CCPA/CPRA requests, except where the law permits a reasonable extension. You are entitled to exercise these rights free from discrimination. We may have valid legal reasons to refuse a request and will inform you if so.

Limits on Your Rights and Choices. Your choices may be limited where fulfilling a request would impair the rights of others, our ability to provide a requested service, or our ability to comply with legal obligations.

Opt Out of Direct Marketing. Follow the unsubscribe instructions in any marketing message. You will continue to receive non-marketing emails (service updates, account notifications).

Limit Online Tracking. You can manage cookies through your browser settings and any privacy controls actually made available on the Service. Where optional cookies require consent, they must not be activated before the required consent is obtained. The availability of a particular on-site settings control depends on the deployed implementation. See the Cookie Policy for further information.

"Do Not Track" and Global Privacy Control. Browser "Do Not Track" signals are not governed by a single universal standard. Where applicable privacy law requires recognition of opt-out preference signals, including Global Privacy Control, we will handle such signals as required by law. The implementation of automated signal handling must be verified against the deployed website.

7. Data Retention

We keep personal information only for as long as necessary for the purposes described in this Policy, after which we delete or de-identify it. Our retention criteria include the duration of your account, the time needed to provide the Service, and applicable legal, tax, and accounting requirements. As general guidance:

Account and profile data: generally retained while an account remains active and thereafter for periods reasonably necessary for deletion processing, security, disputes or legal compliance. Exact retention periods depend on the data category and applicable requirements.

Transaction, billing, and tax records: retained for the period required by applicable tax and accounting law (commonly up to 7 years).

Support and communications: retained for as long as needed to handle your request and for a reasonable period afterward.

Marketing data and consents: until you withdraw consent or opt out, plus a record of the opt-out itself.

Logs and security data: retained for a limited period for security, fraud-prevention, and troubleshooting purposes.

Where data is no longer needed but cannot yet be deleted (for example, in backups), we isolate it and protect it from further processing until deletion is possible.

8. Children

Our Service is not intended for children. CreatorStore accounts should be created only by users meeting the minimum age and contractual-capacity requirements set out in the Terms of Service. We do not intentionally offer services to children or knowingly collect children's data in violation of applicable law. Because we do not routinely request date of birth during registration, possession of a payment card should not be treated as proof of age. If you believe a child provided information in violation of these rules, contact [email protected] .

9. Links to Other Websites

The Service may contain links to other websites we do not control, including Creator-owned websites and social media services. Information you share with these third parties is governed by their policies, not this one. Please contact them directly for information on their practices.

10. Data Storage, Sub-Processors, and International Transfers

CreatorStore uses cloud infrastructure and sub-processors that operate globally, including in the United States, the European Union, and other regions. Depending on the specific service and provider, your personal data may be stored and processed in any of these regions.

For users in the EEA and the United Kingdom: When an international transfer is subject to GDPR or UK GDPR requirements, we use a valid transfer mechanism where required, which may include an adequacy decision, applicable standard contractual clauses or other legally recognized safeguards. The specific transfer mechanism depends on the recipient, country and processing arrangement. Contact us for details about applicable providers and safeguards.

For users elsewhere (including the United States): your data may be stored and processed in the United States and other countries that provide our service infrastructure. Data protection laws in those countries may differ from the laws where you reside.

Where personal data is transferred internationally, we will apply any legally required transfer mechanisms, notices and safeguards. Merely using the Service does not replace a transfer mechanism or consent where a valid legal basis is required.

11. Security

You use the Service at your own risk. We implement commercially reasonable technical, administrative, and organizational measures to protect personal information. However, no internet or email transmission is ever fully secure or error-free. Please consider what information you share via the Service or email.

11A. Data Breach Notification

If we become aware of a Personal Data Breach as defined by the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, or comparable data protection laws — meaning a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information we hold — we will act as follows.

a. Notification to Supervisory Authorities. Where the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority (for example, the UK Information Commissioner's Office, or the applicable Data Protection Authority in the EEA) without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of it. Where we are unable to provide complete information within seventy-two (72) hours, we will provide the information in phases without further undue delay.

b. Notification to Affected Users. Where the breach is likely to result in a high risk to the rights and freedoms of affected users, we will communicate the breach to affected users without undue delay in clear and plain language, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address the breach. Communication may be by email, in-Service notification, or, where individual notification would involve disproportionate effort, by public communication or equivalent effective measure.

c. Notifications Under U.S. State Laws. Where a breach affects U.S. residents whose personal information is subject to state data breach notification laws (including but not limited to California Civil Code §§ 1798.29 and 1798.82), we will provide notifications in accordance with the timing, content, and method requirements of those laws.

d. Notification to Creators. When a personal-data breach involves information we process for a Creator, we will notify or assist the affected Creator as required by our applicable role, data-processing agreement and law. Each party is responsible for the notifications required of it by applicable law; these responsibilities depend on whether it acts as controller or processor for the affected data.

e. Records. We maintain internal records of all Personal Data Breaches, including the facts of the breach, its effects, and the remedial action taken, in accordance with Article 33(5) GDPR.

f. Cooperation. Where a Creator suffers a Personal Data Breach affecting personal data processed on their behalf by CreatorStore, we will cooperate reasonably with the Creator's investigation and provide the assistance required by the Data Processing Addendum incorporated into the Creator agreement.

11B. U.S. State Privacy Rights (California, Virginia, Colorado, Connecticut, Utah, and Others)

This Section provides additional disclosures required by U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), and comparable state laws.

a. Categories of Personal Information We Collect. Depending on the Service features used, the categories described in Section 1 may include identifiers, commercial information, internet or other electronic network activity, approximate location inferred from IP address, and billing or account records. Additional categories, including professional information or information required for identity verification, may be processed by applicable payment providers independently. We do not represent that we ourselves collect identity documents or biometric data unless and to the extent such processing actually occurs.

b. Purposes. We use these categories for the purposes described in Section 2 (operating the Service, security, marketing, legal compliance, and corporate transactions).

c. Categories Sold or Shared. The application of state-law definitions of "sale," "sharing" and "targeted advertising" depends on how a particular service and any tracking technologies are configured. CreatorStore does not authorize Creators to sell Customer data through the Service in violation of applicable law. Where our own processing constitutes a sale, sharing or targeted advertising under applicable law, we will provide required notice and opt-out mechanisms. Our actual practices, including any relevant advertising or analytics integrations, must be reflected accurately in the Cookie Policy and privacy choices. We do not knowingly sell or share personal information of consumers under sixteen (16) years of age.

d. Sale, Sharing and Targeted Advertising Choices. If an applicable state privacy law provides a right to opt out of sale, sharing or targeted advertising, you may send the request to [email protected] . Any additional controls on the Service apply only where made available. We will process qualifying requests and preference signals as required by applicable law.

e. Sensitive Personal Information. Where applicable law grants individuals a right to limit certain uses or disclosures of sensitive personal information, we will honor qualifying requests and provide required notices and controls. Whether that right applies depends on the categories of sensitive information and the actual purposes for which it is processed.

f. Rights of Residents. Depending on the state where you reside, you may have the right to (i) know what personal information we hold about you; (ii) receive a copy in a portable format; (iii) correct inaccurate personal information; (iv) delete personal information (subject to permitted exceptions); (v) opt out of sale, sharing, or targeted advertising as described in (d); (vi) opt out of profiling that produces legal or similarly significant effects (we do not currently engage in such profiling); and (vii) not be discriminated against for exercising these rights. To exercise these rights, contact [email protected] . We may require you to verify your identity before responding.

g. Authorized Agents. You may use an authorized agent to submit privacy requests on your behalf in states that permit this, subject to identity verification of the agent and, in some cases, of you.

h. Appeals. Virginia, Colorado, and Connecticut residents may appeal any refusal to act on a privacy rights request by emailing [email protected] (Subject: "Privacy Rights Appeal"). We will respond to the appeal within the timeframe required by applicable law.

i. Retention. Our retention practices are described in Section 7.

j. Shine the Light (California). Under California Civil Code § 1798.83, California residents may request information about our disclosure of personal information to third parties for those third parties' direct marketing purposes during the immediately preceding calendar year. We do not disclose personal information to third parties for those third parties' own direct marketing purposes.

k. Users in Other U.S. States. Privacy rights and obligations vary by U.S. state and may change over time. We will honor applicable statutory rights and will consider requests from other users under our general privacy-request process, subject to identity verification, lawful exceptions and technical feasibility. This section does not imply that any particular U.S. state lacks an applicable privacy statute.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will publish the revised version and update the Date of Last Revision. Where notice, prior consent or other steps are required by applicable law, we will follow those requirements before applying the relevant changes.

13. Contact Us

CreatorStore Labs LLC
30 N Gould St, STE R, Sheridan, WY 82801, USA
Email: [email protected]

EU and UK Representative. Whether CreatorStore must designate a representative in the EEA or United Kingdom depends on the scope and nature of its activities and applicable exemptions. Users may contact [email protected] for privacy matters. If a representative is legally required, the applicable representative details must be provided once appointed.

If you wish to lodge a complaint, please contact us first. Depending on where you reside, you may also have the right to complain to a data protection regulator: in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EEA, your local Data Protection Authority (a list is maintained by the European Data Protection Board at edpb.europa.eu); in California, the California Attorney General's office at oag.ca.gov/privacy.