Privacy policy

This policy explains what personal information Creos LLC ("Creos", "we") collects through wecreos.com and the Creos client portal, why we collect it, who we share it with, and the choices you have. We keep it short on purpose. If anything is unclear, email hello@wecreos.com.

What we collect

When you contact us

Your name, email address, company, the project details you type into the form, and the time you sent it. If you email us directly, we keep the email.

When you use the client portal

• Account details: your name, email address and the business account you belong to. There are no passwords; we send a one-time sign-in link to your email.
• Project content: milestones, messages you and our team write, and files you upload, including any personal information those files contain.
• Sign-in records: when sign-in links were requested and used, and active sessions, so we can keep your account secure.
• Billing: your invoices and their payment status. Payments are handled by Stripe; we never see or store your full card or bank details.

Automatically

Our hosting provider, Cloudflare, records standard server logs (IP address, browser type, pages requested, timestamps) to keep the site running and protect it from abuse. We do not run advertising trackers or third-party analytics cookies on this site.

Cookies

The portal sets one cookie, creos_session, which keeps you signed in for up to 30 days. It is essential for the portal to work and is removed when you sign out. The public site sets no cookies of its own. If we turn on Cloudflare Turnstile to protect the contact form from bots, Turnstile may set a cookie for that purpose.

Why we use it

• To reply to your enquiry and prepare a proposal.
• To run your project: share work, track milestones, exchange files and messages, and answer questions.
• To invoice you and record payments.
• To keep the site and portal secure and to fix problems.
• To send you emails about your project and account, such as sign-in links, new-message notifications and invoices. We do not send marketing email unless you ask for it.

Where data-protection law requires a legal basis, we rely on the contract we have with you (or the steps you ask us to take before entering one), our legitimate interest in running and securing our business, and your consent where we ask for it.

Who we share it with

We do not sell personal information. We share it only with the providers we need to run the service, each of which processes it on our behalf under their own security commitments:

• Cloudflare: hosting, database and file storage for the site and portal, and DNS.
• Stripe: invoicing and payment processing. Stripe's own privacy policy applies to the payment page.
• Resend: sending transactional email such as sign-in links and notifications.
• Professional advisers, or authorities, where the law requires it.

These providers may store data in the United States or other countries. Where required, we rely on their standard contractual safeguards for international transfers.

How long we keep it

• Contact-form enquiries: up to 2 years, so we can follow up.
• Portal accounts, messages and milestones: for as long as you are a client, and up to 3 years after your last project, for our records.
• Uploaded files: for the life of the project and up to 12 months after it ends, unless you have an active hosting or care plan.
• Invoices and payment records: 7 years, as required for tax and accounting.
• Sign-in links expire after 15 minutes; sessions after 30 days.

Your choices and rights

You can ask us to show you the personal information we hold about you, correct it, delete it, or send you a copy, and you can object to or restrict certain uses. Depending on where you live you may have these rights under law (for example the GDPR, UK GDPR or the California Consumer Privacy Act); we honour them for everyone regardless. Email hello@wecreos.com and we will respond within 30 days. You can delete files you uploaded to the portal yourself at any time. We do not discriminate against anyone for exercising their rights.

If you think we have handled your information badly, tell us first and we will try to put it right. You also have the right to complain to your local data-protection authority.

Security

Data is encrypted in transit and at rest with our providers. Portal access is per account: people can only see the projects, files, messages and invoices of the business they belong to, and Creos staff can see all accounts they work on. Sign-in links are single-use and expire quickly. No system is perfectly secure; if we learn of a breach affecting your information we will tell you without undue delay.

Children

Our services are for businesses and are not directed at children under 16. We do not knowingly collect their information.

Changes

We may update this policy as the service changes. The date at the top shows the last change. Material changes will be sent to active clients by email.

Contact

Creos LLC
United States
hello@wecreos.com