Privacy Policy

1. The short version

Kreativo stores the work and money figures you type in, so you can see them back as totals, deadlines and charts. That is all it does with them.

• No cookies. Not in the apps, not on this website. (The one exception: the sign-in of our own team's dashboard keeps a cookie for the people who work on Kreativo. No visitor ever receives it.)
• No analytics, no tracking, no advertising, no telemetry. None. We do not know how many people use Kreativo or what they do inside it.
• Your data is stored in the European Union and is bound to your account at the database level: no other account can read it.
• We never sell, rent or share your data, and we never use it to train anything.
• You can export everything as a file, at any time, in one click.

The rest of this document says the same things precisely, because a summary is not a commitment.

2. Who is responsible for your data

Edward Motfolea, resident in Italy (the "Operator", "we", "us"), is the data controller for the personal data described in section 4.

Kreativo is a personal project. There is no company behind it, and today it earns no revenue. We have not appointed a Data Protection Officer, as the processing does not meet the thresholds of Article 37 GDPR.

Contact for any privacy matter: privacy@kreativo.cc.

3. Where you use Kreativo

Kreativo is one service with one account, used through the Mac app. An iPhone app is planned and is not available yet; when it is, this policy will say so and describe anything that differs. This website, kreativo.cc, describes the product and takes sign-ups for the private beta (sections 4.7 and 14).

With an account, your data is stored on our infrastructure, as described below, and is the same on every device you sign in from.

4. What we collect, why, and on what legal basis

4.1 Account and identity

A copy of your email address is also kept with your profile, so that the server can send the reminder emails you turn on (section 4.5) without reading the authentication system.

4.2 Your profile

Display name, creative field, location, phone number, monthly income target, account currency, the share of income you want to set aside for taxes, and your notification preferences. All of it is optional and typed by you, and it exists only to personalise the interface and the figures it shows. Legal basis: Art. 6(1)(b).

4.3 What you record in the application

Everything in this list is data you type. We collect it because storing it is the service. Legal basis: Art. 6(1)(b).

• Jobs: client name, job name, start, due and completion dates, fee and its currency, status, progress, free‑text notes, deposit amount and payment dates, balance payment status and date, and whether the job repeats every month.
• Subscriptions: name, cost, billing frequency, next renewal date, category, notes.
• Fixed costs: name, amount, notes.
• Goals: title, type, target and current value, period, deadline, milestones.
• Notes: title, text, colour, whether they are pinned.

Each record also carries the moment it was created and last changed.

These are financial records about your business. Treat them accordingly, and see section 5.

4.4 What you write to KreativoAI

KreativoAI is the assistant built into the application. It answers questions about Kreativo and fills in its forms for you. To do that, what you type in the chat is sent to Google's Gemini API, together with the current conversation, the current date and your display name, and Google's reply comes back the same way.

Three things follow, and you should know all three:

• Whatever you type in the chat leaves our infrastructure. If you describe a job, the client's name and the fee go to Google along with it. Nothing else does: the assistant is given no access to your stored records.
• The assistant never saves anything. When you ask it to add something, it opens the ordinary Kreativo form, filled in. Nothing is written until you press the button yourself.
• Your conversation is not stored by us. It lives in the open window for as long as the panel is open. We keep no transcript, and the server that forwards the message to Google keeps no copy.

Google acts as our processor for this, under the data terms that apply to its paid services. On those terms Google does not use what you write to improve its products. Legal basis: Art. 6(1)(b), you asked the assistant a question. Use of the assistant is entirely optional.

4.5 Reminder emails and the calendar link

Both are off until you turn them on, in Settings.

• Reminder emails. If you turn them on, once a day our server looks for deliveries and renewals due in the next seven days and sends you one email listing them: the job or subscription name, the client, the date and the amount. It also records that a reminder was sent for that item and date, so you never get the same one twice. The emails are delivered by Resend (section 9). Turn them off at any time in Settings.
• The calendar link. Your account has a private link that calendar apps (Google Calendar, Outlook, Apple Calendar and others) can subscribe to. It lists your upcoming deliveries: job name, client, date and fee. Anyone who has the link can read it, without signing in, which is how calendar subscriptions work. Share it only with your calendar, and use Regenerate in Settings to switch the old link off at once if it ever ends up somewhere else.

Legal basis: Art. 6(1)(b), features you turned on.

4.6 On your Mac

The app keeps, on your Mac only:

• a copy of your data, so it starts quickly and works offline. It is removed when you sign out;
• your sign‑in session, in the system's secure storage (the Keychain);
• the profile photo you choose, which is never uploaded;
• a small snapshot of your figures for the widgets and the menu‑bar item, in a space shared only between the app and its own widgets;
• your preferences, such as the theme.

Reminders on the Mac are built on the Mac from your deadlines, expected payments and renewals, and shown by macOS. macOS asks for your permission when you turn one on. Nothing about them is sent to us.

Calendar sync is optional. If you turn it on, macOS asks for your permission, and the app writes your deliveries and renewals into a calendar named "Kreativo" in the Calendar app. That calendar lives wherever you keep your calendars (on the Mac, or in iCloud or another account you chose), under that provider's terms. Kreativo writes only its own calendar and reads none of the others. Add to Calendar creates a file on your device; nothing is sent to us.

The app contains no analytics, advertising or tracking code.

4.7 If you joined the beta waitlist

Kreativo is in private beta, and getting in needs a place. On the beta page of this website you can leave your email address, and this is the only data we hold about someone who is not a user at all. The form sends it to a small server function at Vercel, which writes it to the list and sends you a confirmation email. Our emails are delivered by Resend (section 9).

What that entry is not used for: nothing beyond those emails; no newsletter, no profiling, no enrichment from other sources, no sharing with anyone. We do not store your IP address, your browser or where you came from; to slow down abuse, the server function keeps your IP address in its memory for up to a minute, and nowhere else. The list is stored in the same EU database as everything else, in a table no browser can read or write.

Withdrawing consent is immediate: every email we send you has a link to take yourself off the list, which deletes your entry at once, or you can write to us and we delete it.

4.8 Technical data we do not collect, but our providers log

We run no logging of our own. Our hosting provider records standard web‑server data (IP address, timestamp, requested URL, user agent) for delivery and abuse prevention, under its own policy and retention schedule. Our database and authentication provider does the same for requests reaching it, and our email provider keeps a record of each email it delivers (recipient, subject, delivery status). Legal basis: Art. 6(1)(f), legitimate interest in keeping the service available and secure.

5. Data about your clients

When you record a job, you typically enter someone else's name, and how much they owe you. That is personal data about a third party, and it changes who is responsible for what:

• You decide to record it and why. For that data, you are the controller.
• We merely store it on your instruction, and do nothing else with it. For that data, we act as your processor.

You are responsible for having a lawful basis to record information about your clients, and for answering their requests about it. We will assist you where we reasonably can.

Please do not enter special categories of personal data (health, political opinions, religious beliefs, trade union membership, biometric or sexual‑life data). Kreativo is not built to handle them.

6. What we never collect

To be explicit, because most policies are not:

• No analytics of any kind: no page views, no events, no session recording, no heat maps.
• No advertising or marketing identifiers, no remarketing, no ad networks.
• No third‑party tracking scripts, SDKs or pixels, in the apps or on this website.
• No device fingerprinting.
• No location data beyond the coarse origin of your IP address as logged by our hosting provider.
• No payment data. Kreativo charges nothing today, and has no payment mechanism. If a paid plan is introduced, this policy will say who handles the payment before anything is charged.
• No access to your contacts, files or bank. The only system features the app uses are Calendar, if you turn calendar sync on, and notifications, if you turn a reminder on (section 4.6).
• No profiling and no automated decision‑making under Article 22 GDPR. Every figure the application shows is arithmetic over numbers you typed, and the assistant decides nothing about you: it answers, and it fills in a form you then confirm.
• No use of your data to train machine learning models, ours or anyone else's.

7. Where your data lives

Because our database region is in the EU, your account data is not transferred outside the European Economic Area in the ordinary course of using Kreativo.

Three exceptions to be honest about:

1. If you choose Google sign‑in, your interaction with Google is governed by their own privacy policies and may involve processing outside the EEA.
2. Resend, which delivers our emails, is a United States company. Emails are sent through its European region, and transfers rely on Standard Contractual Clauses.
3. Our providers may access data from outside the EEA for support and maintenance, under the safeguards in their own data processing agreements (Standard Contractual Clauses).

8. Cookies and browser storage, and why there is no cookie banner

Kreativo sets no cookies for visitors, and the app sets none at all. The app keeps what it needs on your Mac, as described in section 4.6.

This website uses your browser's session storage for two things, and nothing else. Both disappear when you close the tab, and neither is ever sent to us:

Both are strictly necessary to provide what you asked for (a page that behaves the way you left it), which is the condition under Article 5(3) of the ePrivacy Directive (and Article 122 of the Italian Privacy Code) for storage that does not require consent. Neither is used for analytics, profiling or advertising.

The only cookie is the sign‑in of our own team's dashboard, set on the dashboard's pages for the people who work on Kreativo. No visitor receives it.

This is why Kreativo shows you no cookie banner. There is nothing to consent to. Should we ever introduce storage that is not strictly necessary, we will ask you first.

9. Who else processes your data

That is the complete list.

About the typeface. The app and this website carry their typeface inside them and make no request to a font service.

We do not disclose your data to anyone else, except where a legal obligation compels us, in which case we will tell you, unless we are legally prohibited from doing so.

10. How your data is protected

What is actually in place:

• All traffic is encrypted in transit (HTTPS/TLS). Data is encrypted at rest by our database provider.
• Row‑level security. Every row in the database carries your user identifier, and a database policy makes it invisible to any other account. This is enforced by the database itself, not by application code.
• We never handle your password. It is sent directly to the authentication provider, which stores only a hash.
• Google sign‑in uses the PKCE flow.
• The calendar link is a long random code, unrelated to your account identifier, and can be replaced at any time.
• A minimum password length of 8 characters is required at sign‑up.

What is not in place, stated plainly so you can judge the risk:

• No two‑factor authentication. If someone obtains your password, they have your data.
• No session or device management. Signing out ends only the session on the device you are using.
• No breach‑detection or intrusion‑monitoring system of our own. We rely on our providers'.

No system is perfectly secure. Choose a password you use nowhere else.

11. How long we keep your data

As long as your account exists. Kreativo does not delete data automatically after a period of inactivity, and we do not silently expire accounts.

When you delete your account, the deletion cascades through the database, taking your profile, every record attached to it, the calendar link and the record of reminders sent. This is enforced by the database schema itself. Deletion is immediate: there is no grace period and no copy retained for you.

Two honest qualifications:

1. Backups. Our infrastructure provider keeps its own backups on its own rotation. Deleted data may persist in those backups for a limited period before being overwritten.
2. Provider logs. Logs at our hosting, database and email providers are retained under their own policies, independently of your account.

Data kept on your Mac by the app is removed when you sign out. Waitlist entries are kept until the private beta ends, and deleted within a reasonable time after it does. You can take yourself off the list earlier, with the link in any of our emails, or by writing to us.

12. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format.

Several of these you can exercise yourself, immediately, in the application:

For anything else, write to privacy@kreativo.cc. We will respond within one month, as Article 12(3) requires.

Right to complain. If you believe we have handled your data unlawfully, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it (opens in a new tab), or with the authority of the EU country where you live.

13. Children

Kreativo is not intended for anyone under 18, and our Terms require that age. We do not knowingly collect data from children. If you believe a child has created an account, write to privacy@kreativo.cc and we will delete it.

14. This website

kreativo.cc presents Kreativo and takes sign‑ups for the private beta (section 4.7). It sets no cookies for visitors (only our team's dashboard signs people in with one), runs no analytics and loads nothing from third parties: fonts, images and scripts all come from the site itself. It is hosted by Vercel, which logs standard request data as described in section 4.8. You can read it without giving us anything.

15. Changes to this policy

If we change this policy, the "Last updated" date above changes. For any change that materially affects how your data is handled, we will notify you in the application or by email before it takes effect. We will never make a change that retroactively reduces the protection of data already collected without asking you first.

16. Contact

Edward Motfolea, Italy Email: privacy@kreativo.cc