Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account information: email address and password when you create an account.
• Business profile: business name, industry, target audience, business description, brand tone, and brand color provided during onboarding or account updates.
• Business details: website address and social media handle if you provide them.
• Content you provide: photos and videos you upload, catalog items (names, prices, descriptions, photos), text you type or speak when requesting content, and the posts and videos created for you.
• Public social media data: if you use the Growth Advisor, we retrieve publicly available information from the social profile you provide (such as public posts and engagement counts) using a third-party data service.
• Applications and inquiries: information you submit through forms such as the Growth Partner application.
• Subscription details: your plan, credits, and payment status (card details are handled by Stripe).
• Usage data: topic inputs you enter when generating content, content packages generated through the Service, and general usage patterns.
• Payment information: billing details are collected and processed directly by Stripe, our payment processor. Tomm Creative LLC does not store, access, or retain your credit card number or full payment card details — these are handled entirely by Stripe and subject to Stripe's own privacy policy.
• Device and usage data: information collected automatically through cookies and similar technologies, as described in Sections 7 and 14.

2. How We Use Your Information

We use your information to provide and improve the Service, create content tailored to your business, process payments and manage your subscription, send service-related and transactional communications, measure and improve our advertising (as described in Section 14), and comply with legal obligations. We do not sell your personal information to third parties.

Legal basis for processing (GDPR): If you are located in the European Union, we process your personal data on the following legal bases: performance of a contract (to provide the Service you subscribed to), compliance with legal obligations, and our legitimate interests in operating and improving the Service. Where we rely on legitimate interests, those interests do not override your fundamental rights and freedoms.

3. AI Content Generation and Third-Party AI Services

Generating content through the Service involves transmitting your business information and inputs to the following third-party AI providers. Each provider operates independently and has its own data handling practices:

• Anthropic (Claude) — Your business information and topic inputs are sent to Anthropic's Claude API to generate text content (captions, hooks, hashtags, and image prompts). Anthropic does not use API customer inputs or outputs to train its AI models. Prompts are processed in accordance with Anthropic's Privacy Policy.
• fal.ai (Flux Pro) — Image generation prompts are sent to fal.ai's Flux Pro API to produce the AI-generated photos used in your content graphics. fal.ai also processes photos and videos you upload to create and export video posts, and transcribes voice input when you use the voice feature. fal.ai's Terms of Service permit them to use anonymized and aggregated usage data derived from customer inputs to develop and improve their services and AI models — this is different from Anthropic's policy. Image generation is subject to fal.ai's Privacy Policy.
• PhotoRoom — Photos you upload may be sent to PhotoRoom for background removal and scene replacement when you use certain premium video features. PhotoRoom processes images under its own terms and privacy policy.

Tomm Creative LLC does not store your raw AI prompts beyond what is necessary to generate your content packages. However, Anthropic and fal.ai may retain inputs and outputs in accordance with their own respective data retention policies, which are independent of and governed by their own terms.

Third-party independence: Anthropic and fal.ai operate as independent data processors. Tomm Creative LLC discloses their practices to the best of our knowledge but is not responsible for the independent data practices of these providers beyond what is described here. Any questions or rights requests concerning how these providers individually process your data should be directed to them directly via their respective privacy policies linked above.

4. International Data Transfers

The Service relies on third-party infrastructure providers — including Supabase (database and authentication), Anthropic (AI text generation), fal.ai (AI image generation), and Stripe (payment processing) — that may process and store data on servers located in the United States or other countries outside your home country. These jurisdictions may have data protection laws that differ from those in your country. By creating an account and using the Service, you acknowledge and consent to the transfer and processing of your personal data in these jurisdictions. Where required by applicable law, we take reasonable steps to ensure that appropriate safeguards are in place.

5. Data Storage and Retention

Your account data and generated content packages are stored securely using Supabase, a cloud database provider. Data is encrypted at rest and in transit. We retain your data for as long as your account is active. Upon account cancellation, your data is retained for up to 90 days to facilitate account recovery or resubscription, after which it may be permanently deleted. You may request earlier deletion by contacting us at support@tommcreative.com.

6. Email Communications

Transactional and account-related emails (such as email confirmation, password reset, and account notifications) are delivered through Supabase's built-in email infrastructure. By creating an account, you consent to receiving these service-essential communications. We do not use third-party email marketing platforms to send promotional emails without your consent.

7. Cookies and Browser Storage

Cookies: We use essential cookies for authentication and session management. These cookies are necessary for the Service to function and cannot be disabled. We also use advertising cookies set by the Meta Pixel, as described in Section 14.

Referral attribution cookie: When you arrive at creatorforyou.com via a link that includes marketing parameters (such as utm_source, utm_medium, utm_campaign, or ref), we store those values in a first-party cookie on your browser for approximately 90 days. This cookie is written once and never overwritten on subsequent visits — we record the original source that first brought you to the Service. If you create an account, the recorded values are copied to your account record and retained as part of it. This information is used solely to understand which marketing channels are effective at introducing new users to the Service; it is never shared with advertising networks or used for behavioral targeting. Visitors arriving directly (with no marketing parameters in the URL) receive no attribution cookie.

Local and session storage:In addition to cookies, our authentication provider (Supabase Auth) may store session tokens and authentication state in your browser's local storage or session storage. This information is used solely to keep you logged in and is not used for tracking or advertising purposes.

Analytics: Other than the Meta Pixel described in Section 14 and the first-party referral cookie described above, we do not use third-party analytics services such as Google Analytics.

Do Not Track:There is no common standard for responding to browser Do Not Track signals, so we do not currently respond to them. You can manage cookies through your browser settings and Meta's ad settings as described in Section 14.

8. Your Rights

You have the right to access, correct, or delete your personal data at any time. You can update your business information through the Account page. To request full account deletion or a copy of your data, contact us at support@tommcreative.com. We will process deletion requests within 30 days.

Your specific rights regarding personal data may vary depending on your location. For example, users in the European Union may have rights under the General Data Protection Regulation (GDPR) — including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object — and California residents may have rights under the California Consumer Privacy Act (CCPA). Tomm Creative LLC will honor applicable legal rights requests to the extent required by law. If you believe your rights have not been respected, you may have the right to lodge a complaint with your local data protection authority.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at support@tommcreative.com and we will take steps to delete that information promptly.

10. Security

We implement industry-standard security measures including encrypted data transmission (HTTPS), secure password hashing through Supabase Auth, and role-based access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a data breach affecting Tomm Creative LLC's own systems that compromises your personal information, we will notify affected users via email within a reasonable timeframe of becoming aware of the breach and in accordance with applicable law. Notifications will be sent to the email address associated with your account and will include, to the extent known, a description of the nature of the breach, the categories of data affected, and the steps we are taking to address it. Tomm Creative LLC is not responsible for independent data breaches occurring on the systems of third-party providers — including Supabase, Anthropic, fal.ai, or Stripe — as these are governed by each provider's own security practices and breach notification policies. However, if we become aware of a third-party breach that may affect our users' data, we will make reasonable efforts to inform affected users in a timely manner. Our ability to do so depends on timely disclosure from the third-party provider.

12. Changes to This Privacy Policy

We may update this Privacy Policy at any time by posting a revised version on this page. We will make reasonable efforts to notify users of significant changes via email. It is your responsibility to review this Policy periodically. Continued use of the Service following any modification constitutes your acceptance of the updated Privacy Policy.

13. Voice Input and Transcription

The Service includes an optional voice input feature. When you use it, your audio recording is sent to fal.ai, a third-party service, to convert your speech to text. The resulting text is used to create your content in the same way as a typed request. We do not store your audio recordings. fal.ai processes the audio under its own terms of service and privacy policy.

14. Analytics and Advertising

Meta Pixel: We use the Meta Pixel, a tool provided by Meta Platforms, Inc., on our website to measure and improve our advertising on Facebook and Instagram. The Pixel uses cookies and similar technologies to collect information about your browser and device (such as IP address, browser type, and the pages you visit) and actions you take on our website, such as viewing pages, creating an account, and purchasing a subscription (including the plan price). We do not send your name, email address, or payment details to Meta. Meta may use this information to measure the results of our ads, to show our ads to people who have visited our website, and as described in Meta's Privacy Policy.

Your choices: You can limit how Meta uses this information through your Facebook or Instagram ad settings, block or delete cookies in your browser settings, or use a browser extension that blocks the Meta Pixel. You can also learn more about interest-based advertising at optout.aboutads.info.

15. Email Marketing and Contact Forms

If you submit an inquiry via a contact form or email us directly at support@tommcreative.com, we retain your email address and message content in order to respond to your request. We do not add you to a marketing list without your explicit consent.

Form submissions (such as Growth Partner applications) are stored in our database and sent to us by email through Resend, a third-party email delivery service, so we can respond. Billing receipts are sent by Stripe.

Transactional and service-related emails (account confirmations, password resets, billing receipts) are sent through our authentication and payment providers as described in Sections 5 and 6. We do not currently use a third-party email marketing platform to send promotional newsletters.

16. Complete List of Service Providers

We use the following third-party service providers to operate the Service. Each provider acts as an independent data processor and is subject to its own privacy policy:

• Vercel — hosting and deployment of the web application. Processes request logs and edge-network data.
• Supabase — database, authentication, file storage, and email delivery. Stores account data, business profiles, and generated content packages.
• Stripe — payment processing and subscription management. Handles all credit card and billing data; Tomm Creative LLC does not store payment card details.
• Anthropic (Claude) — AI text generation for captions, hooks, hashtags, and image prompts. Does not use API inputs to train models.
• fal.ai — AI image generation, video and audio processing, and voice transcription. May use anonymized and aggregated usage data to improve its services per its Terms of Service.
• PhotoRoom — background removal and scene replacement for uploaded photos used in certain premium video features.
• Resend — email delivery for form submissions.
• Apify — retrieval of publicly available social media profile data for the Growth Advisor.
• Sentry — error monitoring. Receives crash reports from our application; these reports do not include your email address, IP address, cookies, or request data.
• Meta (Facebook) — advertising measurement via the Meta Pixel. See Section 14 above.

17. Contact