CreatorAgent Privacy Policy

This policy explains how CreatorAgent handles information when creators use its Gmail-connected brand collaboration workspace.

1. Introduction

CreatorAgent provides content creators with tools to organize brand communications, identify possible collaboration opportunities, manage replies, prepare supported agreements, and coordinate supported campaign activities. CreatorAgent is operated by Austin Taylor. In this policy, “CreatorAgent,” “we,” “us,” and “our” refer to Austin Taylor as operator of the service.

2. Information we collect

Google account information

Your Google account email address and OAuth authorization information, including an encrypted OAuth refresh token used to maintain the connection you authorize.

Gmail information

CreatorAgent retrieves message bodies, subject lines, sender information, timestamps, headers, and conversation information live from Gmail when needed for a user-facing feature. Active application database storage retains limited message and thread identifiers, timestamps, classification results, synchronization cursors, automated-reply deduplication records, and workflow state. It does not retain message bodies, subject lines, sender fields, or generated reply text from new synchronization.

Creator preferences

Creator name, per-video rates, commission preferences, expected video count, product-sample requirements, reply-template settings, and related collaboration requirements.

Collaboration information

Brand names and contacts, campaign terms, deliverables, deadlines, usage terms, agreements, electronic-signature records, payment references, and campaign status where those workflows are used. Records created independently or confirmed by a user are handled separately from Gmail content.

Shipping information

Shipping addresses and address-verification details that creators provide. Saved addresses are encrypted before storage.

Payment information

Stripe customer and connected-account identifiers, checkout and payment references, payment and refund status, transaction amounts, and financial-ledger records. CreatorAgent’s current code uses Stripe for payment processing and does not itself collect or store full payment-card numbers.

Technical information

Session and security information and, for contract signatures, the signer’s IP address and user-agent string.

3. Google OAuth permissions

You grant permissions through Google’s authorization system. CreatorAgent currently requests:

4. How we use Google user data

CreatorAgent processes Google user data to provide user-facing features: synchronizing recent Gmail messages; displaying conversations; applying rules that identify possible brand collaboration opportunities; preparing and sending supported replies; providing conversation context; flagging negotiation signals for creator review; and supporting related collaboration workflows.

Some configurations support automated replies. When enabled, eligible incoming messages may receive template-based replies without a separate approval for each message. The current implementation restricts that workflow using deployment settings, a recipient allowlist, a start date, a daily limit, and review rules.

CreatorAgent’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including their Limited Use requirements.

5. Data storage and security

CreatorAgent runs on Cloudflare Workers. Authorized backend logic retrieves Gmail content directly from Google and processes it temporarily to provide the service. Active Cloudflare D1 storage contains limited Gmail identifiers, timestamps, classification results, synchronization cursors, automated-reply deduplication records, and workflow state; it does not contain legacy Gmail bodies, subjects, sender fields, or generated reply text. OAuth refresh tokens and saved shipping addresses are encrypted before storage.

Historical Gmail content removed from active D1 storage may remain in protected SQL recovery backups or Cloudflare-managed recovery mechanisms. Recovery copies are separate from the active application database and are not used for ordinary CreatorAgent features. We do not promise a fixed backup-retention period or claim safeguards for those copies beyond those actually provided by the applicable storage and recovery systems.

Signed, HttpOnly, Secure, SameSite session cookies protect authenticated sessions. Mutating API requests use origin and CSRF checks, and account-specific database queries limit access to the authenticated account. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

6. Third-party service providers

• Google provides account authorization and Gmail connectivity. CreatorAgent retrieves and sends Gmail data through Google APIs.
• Cloudflare provides Worker infrastructure and D1 database hosting and therefore processes application and Gmail information on our behalf.
• Stripe provides payment processing, Checkout, refunds, and creator payout onboarding where supported. CreatorAgent sends transaction and account information needed for these workflows; the current implementation does not routinely send Gmail message bodies to Stripe.
• USPS and Geoapify may process address information for supported address validation or lookup. The current implementation does not routinely send Gmail message bodies to these providers.

These providers may process information under their own terms and privacy policies.

7. Data retention

Gmail message content is retrieved on demand and is not retained in active D1 storage after the request completes. Limited identifiers, synchronization cursors, classifications, automated-reply deduplication records, and active workflow state are retained only while needed to provide connected features or prevent duplicate processing. Historical Gmail content may remain in protected SQL recovery backups or Cloudflare-managed recovery mechanisms as described above.

Independent or user-confirmed contractual, signature, payment, financial-ledger, security, and dispute records may be retained when reasonably necessary to provide the service or meet legal, accounting, security, or dispute-resolution obligations. CreatorAgent does not treat a Gmail-derived record as independent merely because it was transformed or classified. CreatorAgent does not promise a fixed backup-retention period.

8. Revoking Google access

You may revoke CreatorAgent’s Google authorization through Google’s third-party connections page. Revocation stops future authorized access after Google processes it, but is separate from asking CreatorAgent to delete data already stored. Logging out or disconnecting the local session does not revoke Google consent or delete D1 records.

9. Data deletion

Authenticated users can request deletion from the account controls in CreatorAgent. The request requires a signed-in session, the application’s normal CSRF and origin checks, and an exact confirmation phrase. CreatorAgent first attempts to revoke the connected Google authorization. If revocation fails, local deletion does not proceed.

After successful revocation, CreatorAgent deletes eligible account credentials, Gmail message records, message drafts, creator preferences, conversation state, review records, automated-reply jobs, and saved shipping information. This prevents scheduled synchronization and automated replies because the connected account credential no longer exists. Contractual and payment records that must be retained are separated from the deleted account by replacing the creator email with a non-email pseudonymous identifier and removing linked Gmail thread identifiers. A non-content audit receipt records completion without storing the account email or Gmail content.

We target completion of verified deletion requests within 30 days, except for information legitimately retained for legal, accounting, security, or dispute purposes. Users who cannot access the self-service control may email creatoragentsupport@gmail.com; we will verify account ownership before acting.

10. Data sharing and Limited Use restrictions

We share information with service providers only as necessary to operate authorized, user-facing CreatorAgent features. Collaboration information may be presented to creators, brands, signers, and payment participants as needed to prepare and carry out a collaboration.

• CreatorAgent does not sell Google user data or transfer Gmail data to data brokers or information resellers.
• CreatorAgent does not use Gmail data for advertising, retargeting, interest-based advertising, or advertising profiles.
• CreatorAgent does not use Gmail data to create, train, or improve general-purpose or unrelated machine-learning or AI models.
• CreatorAgent does not permit routine human inspection of private Gmail messages. Human access is permitted only with the user’s documented consent to view specific data, when necessary for security or abuse investigation, or when required by applicable law.
• Service providers may process Google user data only as necessary to provide authorized CreatorAgent functionality.

CreatorAgent’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including the Limited Use requirements.

Information may also be disclosed when reasonably necessary to comply with law, protect rights and safety, or investigate abuse, subject to Google’s policies and applicable law.

11. Your choices and rights

Depending on where you live, you may have rights to request access, correction, or deletion of personal information and to object to or restrict certain processing. You can update creator preferences in the application and revoke Google authorization through Google. To exercise other rights, email creatoragentsupport@gmail.com. We may need to verify your identity before acting on a request.

12. Children’s privacy

CreatorAgent is intended only for adults age 18 or older and is not directed to children. If we learn that information was collected from a child contrary to applicable law, we will take appropriate steps to delete it.

13. Changes to this policy

We may update this policy as the service and our practices change. We will update the effective date and provide any notice or consent required by applicable law or Google policy before using Google user data for a materially different purpose.

14. Contact

Operator: Austin Taylor
Product: CreatorAgent
Privacy and support: creatoragentsupport@gmail.com
Website: https://creatoragent.pro