Privacy Policy

1. Information We Collect

We may collect personal information that you provide to us directly, that is collected automatically through your use of our services, or obtained from third parties. This includes, for example:

• Identifiers and Contact Information: Name, email address, phone number, postal address, and similar identifiers.
• Account and Profile Data: Login credentials, profile details, and preferences if you create an account.
• Usage Data: Information on how you use our website or app (e.g., pages visited, actions taken, IP address, browser type, device identifiers, cookies, and similar technologies).
• Session Recordings: on most pages of our website, PostHog, our analytics provider, records how you use the page: what appears on screen, your clicks and scrolling, technical errors, and what you type into most form fields. We mask passwords and one-time codes, and we don’t record pages or controls that carry sign-in links or other access tokens. If you are signed in, recordings are linked to your Creatures account.
• Advertising Identifiers: when you arrive from an ad or a campaign link, we keep the campaign details and any ad click identifier (such as Google’s gclid or Meta’s fbclid) in cookies in your browser, and save a copy to your account when you sign up. Meta’s cookies on our site identify your browser to Meta. If you have opted out (see Your Privacy Choices in section 8), we don’t capture campaign details or click identifiers and we stop reporting your new activity to Meta or Google for advertising, though an event already queued before you opted out may still be sent. If your browser still has Meta’s cookies from before, a checkout copies them into the payment record, marked as opted out so they are not reported.
• Network and Location Signals: we look up the approximate location of your IP address (such as country and city) and its network (such as the internet provider, and whether it is a Tor connection) in databases we keep on our own servers. We use the approximate location to show nearby results. When you create an account, we store the country and network of the connection you signed up from and use them, with other signals, to protect members from scams (see Automated decisions & profiling in section 2).
• Text Messages: if you give us a mobile number, we keep it, the kinds of texts you turn on, and your STOP and START replies. Our text message provider, Twilio, receives your number and the content of each text, such as sign-in links and codes, reminders that name your animals and their care, booking updates and notices that you have a new message. We text you for alerts you turn on, for actions you start, for bookings where you agreed to texts, and when another member sends you an invitation, invoice or transfer through Creatures.
• Documents, Photos and Voice: files you upload or send us, such as photos, vet and lab records, pedigree papers, receipts, agreements and spreadsheets, can include details about you and other people, such as names, addresses and phone numbers. If you forward an email to a Creatures receipt address, we keep the whole email, including its sender, recipients and attachments. If you use voice input, your recording is sent to an AI provider to turn it into text. Some features read your files with an AI provider (see AI Features and AI Providers below).
• Information About Other People: when you invite someone, send someone an invoice, deposit request or transfer, add guests to a booking, or buy a gift card for someone, you give us their name, email address or phone number and any message you add. We use it to contact them for you, including on the date you choose for a gift card. Only give us someone’s details if you are allowed to.
• Directory Businesses: for businesses in our public directory that haven’t joined Creatures, we collect business details, including contact details, from publicly available sources, such as the business’s own website and public licensing and registration records. An AI provider may help write a listing’s description from those sources. We may email a listed business about its listing, for example to say how many people viewed it, and we record whether those emails are delivered, opened or clicked, and any unsubscribe.
• API and MCP usage records: when an app, assistant or partner uses our public API or MCP server, we keep daily counts per client: a hashed client identifier, which part of the API was used, response status, counts, response sizes and timing bands. Requests without a key are counted together under shared identifiers. For some MCP requests we also record the software name and protocol versions the client reports and the website it says it is calling from (the scheme, domain and optional port, with a marker instead of an IP-literal address). These records do not contain IP addresses or the text of searches. To apply rate limits, we keep temporary counters keyed by a protected hash of the network address for anonymous callers, or of the client identifier for registered clients. These counters expire within an hour. Like the rest of our services, our hosting, security and content-delivery providers process IP addresses in request logs (see Usage Data and Backups/logs).
• Marketing & Newsletter Data: your marketing preferences (subscribe/unsubscribe) and suppression status; email delivery and engagement information from our email providers (for example, whether an email was delivered, opened or clicked); and, to choose which Creatures emails to send you, how you found Creatures (campaign details, the referring site and ad audience), how you signed up, the species, breeds and services you are interested in, and whether you have used Creatures in the past year.
• Seller Email List Choices: when you choose whether to get email from a seller, join a seller’s email list or leave one, we record the choice, the seller, and when and how you made it (for example at checkout, on the seller’s signup page or from an unsubscribe link). When we ask for your permission to join a list, we also record the exact wording you were shown. When a seller tells us you agreed directly with them, we record the date, method and evidence description the seller gives us.
• Payment and Transaction Data: If you make purchases, we collect payment information (processed via secure third-party payment processors) and records of transactions.
• Connected Financial Account Data: If you choose to connect a bank, card, or other financial account through Plaid or another bank-data provider, we may collect account identifiers, institution name, account type, balances, transaction history, statement activity, merchant/payee information, dates, amounts, descriptions, categories, and related metadata needed for bookkeeping, bank review, reconciliation, marketplace payout matching, and CPA-ready records.
• Connected Calendar Data: If you choose to connect Google Calendar, we access the calendar information described in Google Calendar and Google User Data below.
• Other Information You Provide: Any personal data you choose to send us (e.g. when contacting support or filling out forms).
• Sensitive Personal Information (where needed): government ID numbers, tax IDs, precise geolocation (if you enable location), account log‑in credentials, or identity verification artifacts (e.g., images/selfies for liveness). We restrict use of SPI to allowed purposes (e.g., account security, fraud prevention, payouts/verification) and do not use it to infer characteristics.
• Seller Payout & Tax Data (for sellers): date of birth, address, taxpayer information (e.g., W‑9/W‑8 details), and payout/bank details, processed by our payment/payout providers to comply with tax, fraud‑prevention, and sanctions screening obligations.
• Identity Verification: if required for seller onboarding, we may collect government ID images and selfie/liveness checks through a verification provider.
• Biometric Information: data derived from facial geometry solely to confirm identity via our provider; we do not use it for other purposes. We obtain any required consent and delete biometric data once verification is complete or within the applicable statutory period.
• Public Content. Information you include in profiles, listings, photos, and reviews is public and may be indexed by search engines. Apps, AI assistants and partners may also read, show, cache and cite this public information through our public API and MCP server. Our Terms require them to link back to Creatures when they show or cite it. Please do not include personal data you prefer not to make public. We may monitor or scan messages for trust & safety (e.g., fraud/spam detection), consistent with this Policy.

What apps and AI assistants can see

Our public API (creatures.com/developers) and our connector for AI assistants such as Claude and ChatGPT (creatures.com/ai-assistants) return only information that is already public on Creatures:

• the names and profile photos of sellers, animal owners, event organizers, service providers, breeders and article authors, including the business names in our public breeder and service directories, some of which we compiled from public sources for businesses that have not joined Creatures;
• city, state or region, and country;
• listing, animal, breeder, service, event and article details, such as prices, ratings, verification badges and the text and photos people post (text is shown as written, so it includes anything its author chose to put in it);
• the websites and social media links that directory businesses list publicly (through the API; the AI assistant connector leaves out every link except the Creatures page link).

Structured API and connector responses exclude account email addresses, phone numbers, street addresses, postal codes and map coordinates. Public titles, descriptions and other text are shown as written and may include contact details their authors chose to make public. The API can return public photos; the AI assistant connector returns text and Creatures page links, without image URLs. Neither returns information that is private or hidden on Creatures. When you ask an assistant about a place, such as “near Austin, TX”, the place is used to run that search and is not kept in our API usage records.

We do not knowingly collect data from children under 13. Our services are intended for general audiences. If we learn we have collected personal information from a child under 13 without parental consent, we will delete it as required by law.

Our Services are directed to the United States. We do not offer goods/services to individuals in the EEA or UK or intentionally monitor their behavior.

For California residents, see our Notice at Collection for a table of categories we collect, purposes, whether we sell/share, and our retention periods.

The table below lists the categories of personal information we collect, purposes, whether we sell or share it for advertising, and typical retention.

Category	Examples	Purposes	Sold/Shared?	Typical Retention
Identifiers	name, email, phone, IP	account, support, security	Shared for advertising (you can opt out)	life of account + 2 yrs
Commercial/Txn	orders, transaction totals	provide service, receipts, tax	Shared for advertising (you can opt out)	7 yrs (tax)
Internet activity	pages visited, device/ID	security, analytics	Shared for advertising (you can opt out)	13–24 mo
Geolocation	approximate, from your IP address; precise only if you enable it	nearby search, fraud	No	sign-up country and network: with your account record; precise: up to 24 mo
Payment data	last 4, billing address (via processor)	checkout, fraud	No	per processor records
KYC/verification (sellers)	DOB, address, tax IDs	payouts, fraud/AML	No	verification + up to 5 yrs
Biometric (only if used)	selfie/liveness	identity verification	No	per published retention schedule
Sensitive PI	gov’t ID, precise location, login credentials	security, payouts/verification	No	see above by type

We keep data no longer than necessary for the purposes described and then delete or de‑identify it, and we commit not to re‑identify de‑identified data.

2. Purpose of Collection and Use

We use personal information for the following purposes, and only when we have a valid legal basis to do so in accordance with applicable law:

• To Provide and Maintain Services: We process data to create and manage user accounts, allow you to use our website/app features, and deliver the services or products you request.
• Connected Account Bookkeeping: We use connected financial account data only to provide customer-directed bookkeeping features, including importing bank activity, categorizing income and expenses, matching marketplace payouts, reconciling accounts, preparing financial reports, and supporting CPA-ready records. Creatures does not use connected account data to make lending or credit decisions, sell financial data, initiate payments, or automatically post accounting transactions without user review and approval.
• To Communicate with You: We use contact information to respond to inquiries, send service-related announcements, and provide customer support.
• Personalization and Improvements: We analyze usage data to understand user preferences, customize your experience, and improve our services and content.
• Marketing and Newsletter: If you create an account or provide your email while using the Platform, we may send you marketing and promotional communications (including the Creatures newsletter). We may add your email to our newsletter list when you sign up or later. You can unsubscribe at any time via the link in our emails or by contacting support; opting out of marketing does not affect service or transactional emails. Where a law requires express consent before sending marketing emails, we will only send marketing if you have provided that consent (see Terms §2.7).
• Seller Email Lists: to ask, on a seller’s behalf, whether you want that seller’s emails, to keep a record of your answer, to share it with that seller and any email service the seller connects, to keep your choice in step with that service, and to honor your unsubscribes (see Sellers and Their Email Lists below).
• Advertising: to measure how our ads perform and to show Creatures ads to people who may be interested (see Advertising and Analytics below). You can opt out at Your Privacy Choices.
• Compliance and Legal Obligations: We process personal data as needed to comply with our legal obligations.
• Protecting Rights and Security: We may use data to protect the rights, property, or safety of Creatures LLC, our users, or others.
• Trust & Safety / KYC: verify identity, prevent fraud and abuse, comply with sanctions and tax requirements, and protect buyers and sellers.
• Automated decisions & profiling. We use automated systems (e.g., fraud/risk scoring, integrity checks) to protect our users and platform. In some states you can opt out of profiling used to make decisions with legal or similarly significant effects; see Sec. 8 for how to exercise this right. For example, while an account is new, the messages, comments, offers and applications it sends can be held before they are delivered, based on signals such as the country and network of the connection it signed up from, the browser’s time zone, whether it arrived from an ad, and patterns in the text. Held items stay hidden from their recipients until the hold ends or our team releases them. Our team can review held items, and the text of an account’s first held item is sent to our internal chat tool. New profiles that link to other websites but don’t mention animals may be kept out of search engines until we review them.

We will not use personal information for new, incompatible purposes without updating this Policy and, if required, obtaining your consent.

3. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area (EEA) or United Kingdom, we ensure that each use of your personal data is supported by a legal basis under the General Data Protection Regulation (GDPR). Depending on the context, one or more of the following legal bases apply:

• Consent: You have given clear consent for us to process your personal data for a specific purpose. You can withdraw it at any time.
• Contractual Necessity: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, except where overridden by your interests or fundamental rights.

Marketing legal bases. For marketing emails, we rely on: (i) your consent where required by law (for example, in the EEA/UK and certain other countries), or (ii) our legitimate interests to promote our services (for example, in the United States). You may withdraw consent or opt out of marketing at any time.

If you have questions about the specific legal basis we rely on for any particular processing activity, feel free to contact us.

4. Disclosure of Personal Information

We do not sell personal information for money. We do share some personal information with our advertising partners, Meta and Google, to measure our ads and to show them to people who may be interested. California and some other states treat this as “sharing” for cross-context behavioral advertising, or as targeted advertising. You can opt out at Your Privacy Choices (creatures.com/privacy-choices), and we honor Global Privacy Control signals from your browser (see Advertising and Analytics below, and section 8 for how each works).

However, we may share personal information in the following circumstances:

• Service Providers: We share data with trusted third-party service providers who need the information to perform services on our behalf, for example cloud hosting and storage, payment processing (Stripe), site search (Algolia), email delivery (SendGrid) and our newsletter (Beehiiv), text messages (Twilio), product analytics and session recordings (PostHog and Google Analytics), performance monitoring (Better Stack), AI models (see AI Features and AI Providers below), support chat (Crisp), and printing and shipping printed Creature Cards (The Game Crafter).
• Security and Bot Protection: Our website is delivered through Cloudflare, which protects it from attacks and automated abuse. To do this, Cloudflare processes request information such as your IP address, browser details and cookies. When you ask us to text you a sign-in code, ask us to email you a link to confirm joining a seller’s email list, or ask for a code to see your email lists, Cloudflare Turnstile checks that the request comes from a person and not an automated program. Turnstile uses technical signals such as your IP address and browser information, and it does not read what you type into the form. Cloudflare may also use this information to improve its bot detection. For details, see the Cloudflare Turnstile Privacy Addendum. When someone signs up with a new email address or sends a form as a guest, we also send a one way (MD5) hash of the email address to StopForumSpam, a public spam database, to check whether the address is listed. Like other hashes of an email address, it can be matched against a known address.
• Email & Newsletter Providers: We share your name, email address, subscription status and engagement with our email service providers to deliver email and manage preferences, unsubscribes and suppression lists. Our newsletter provider, Beehiiv, also receives the details we use to choose which emails to send you (see Marketing & Newsletter Data in section 1), the kind of member you are (for example a host or transporter), and whether you have a conversation with our team on Creatures.
• Affiliates and Business Transfers: We may share information with our corporate affiliates or as part of a merger, acquisition, financing, due diligence, reorganization, or sale of assets.
• Legal Compliance and Protection: We may disclose personal information to government authorities or other third parties if required by law, or to protect the rights, property, and safety of our company, our users, or the public.
• With Your Consent: We will share your personal data with others for purposes outside of this Policy only when we have your explicit consent to do so.
• Marketplace sharing: If you create listings or a seller profile, certain information (e.g., display name, city/region, listings, reviews, and the content you post) is public and may be indexed by search engines and made available through our public API (see Public Content). We also share limited data with other users during messages, offers, and transactions as needed to complete the transaction (e.g., name, preferred contact method, city/region). When you do business with a seller, that seller also receives the contact details you gave for that interaction or that it needs, such as your email address and phone number; see Sellers and Their Email Lists below.
• Payments & payouts: We share data with payment processors and payout partners for checkout and seller payouts (e.g., billing address, last four digits, transaction amounts, tax forms, and, if needed, identity verification results). We do not store full card numbers; processors handle that.
• Bank Data Providers: If you connect a financial account, we share information with Plaid or similar providers as needed to authenticate the connection, retrieve user-permissioned account data, maintain the connection, and support troubleshooting. We do not sell connected financial account data.
• Maps and Address Lookup: when you type an address, Google Maps suggests matches as you type. When an organization saves its address, we send it to OpenStreetMap’s Nominatim service to find its location on the map. To estimate travel and delivery distances, we send Google the start and end locations.

Sellers and Their Email Lists

What sellers receive. When you buy, book, reserve, sponsor, enter, apply, pay an invoice or otherwise do business with a seller on Creatures, that seller receives the contact details they need to complete it and contact you about it, such as your name, email address and phone number. These are the details you gave for that order, booking or form; if you didn’t give an email address there, the seller receives your account email address. They also receive your address when it is needed for delivery or paperwork. This applies however you found the seller, including through the seller’s own website or link. When you fill in a form addressed to a seller, such as a booking request, an application or the contact form on a seller’s site, the seller receives what you enter. Sending a seller a message on Creatures, following them, watching a listing or joining a waitlist without giving contact details does not share your email address or phone number with them; the seller sees only your name and profile. Sharing your details with a seller you choose to do business with, or whose email list you join, happens at your direction and is not a sale of your personal information.

Sellers’ customer lists. Each seller can see a list of the people who have done business with them on Creatures, and can download it. Creatures can’t recall copies a seller has already downloaded.

Seller email lists. A seller may send you marketing email only if you agreed to receive it from that seller. You can agree in three ways:

• By ticking “Email me news and offers from” that seller at checkout. The box is optional, starts unticked and is never a condition of your purchase. Your choice takes effect only when your purchase or booking is complete.
• By joining the seller’s email list on Creatures, for example from their profile or their signup page. If we haven’t verified your email address, we first email you a link to confirm, and you are added only after you confirm.
• By agreeing directly with the seller, for example on a sign-up sheet at their farm. The seller can then add you, and must confirm that you agreed and record when and how.

Creatures asks for your choice on the seller’s behalf and keeps a record of it (see Seller Email List Choices in section 1). Your choice applies only to the seller you chose it for, and only to your own email address: choosing at checkout never covers your guests or gift recipients.

Leaving a list. Emails we send you about your orders and bookings with a seller include a link to your email preferences and, if you are on that seller’s list, a link to unsubscribe. You can leave any seller’s list, or every seller’s list at once, at Your email lists (creatures.com/email-preferences). If you leave every list, sellers can’t add you back by importing your address; you can still join a seller’s list again yourself. Leaving a seller’s list does not stop emails about your orders and bookings.

Email services a seller connects. If a seller connects an email service such as Mailchimp, Creatures sends that service the email address and first and last name of each person on that seller’s email list, with labels showing how they know the seller (for example “Creatures: Booking”). We send only people who agreed to receive that seller’s emails. If the seller turns on double opt-in for the connection in Creatures, the service emails you to confirm before adding you, even if you already agreed through Creatures.

To keep choices in step, Creatures reads subscription details from the seller’s audience in that service: each person’s email address, subscription status, when it last changed, labels and profile fields (names and any other fields the seller has set up in that audience, such as an address or phone number). These reads can include people who never came from Creatures. We use them only to find the people on the seller’s Creatures list; we don’t keep details about anyone else, add them to Creatures or treat them as having agreed. For each person on the seller’s Creatures list, we keep their status in that service (for example pending, subscribed, unsubscribed or undeliverable), when it last changed, and any new email address they switch to there. When you unsubscribe through Creatures, we tell the service. When you unsubscribe through the seller’s emails from that service, or the service reports that your address can’t receive email, the service tells us and we update our records for that seller.

While a seller is connected, we store an encrypted access key for their account with that service, plus the account and audience identifiers and the audience’s name. When the seller disconnects, we delete the access key, the connection’s audience selection and the sync records for each person. We keep limited operational records about the connection, including the service’s identifier for the seller’s account, which we use to pace requests to that account. If you delete your Creatures account, we ask the service to archive you in each connected seller’s audience. Archiving takes you off the seller’s active audience, but it is not a permanent deletion of the seller’s copy in that service. The seller’s use of that service is covered by the seller’s own privacy practices and their agreement with that service.

Sellers’ own tools. Sellers send their own marketing email with their own tools; Creatures does not send it for them. Each seller is responsible for how they use your details in their own tools and for honoring your choices there, including in copies they have downloaded.

Advertising and Analytics

Product analytics. We use PostHog and Google Analytics to understand how people use Creatures and to find and fix problems. They receive information about the pages you visit and what you click, your browser and device, and your IP address, from which they work out an approximate location. If you are signed in, PostHog links this to your Creatures account number, not your name or email address. PostHog also makes the session recordings described in section 1.

Advertising partners. We advertise Creatures on Meta (Facebook and Instagram) and Google. To measure which ads work, and to show our ads to people who may be interested:

• The Meta Pixel runs in your browser on most pages of our website. It tells Meta which pages you view and when you take steps such as viewing a listing, contacting a seller, applying, starting checkout, signing up, subscribing or starting a trial, along with Meta’s own cookies. When you sign up, subscribe or submit some forms, it also sends a one way (hashed) form of your email address and, once you have an account, your Creatures account number. It can also hash and send contact details you type into forms on our site: email address, name, phone number, date of birth, gender, city, state, ZIP code and country. We may also send Meta your signups, subscriptions, trials and purchases (with the purchase value and item IDs) from our servers through Meta’s Conversions API, with your hashed email address and Creatures account number, Meta’s cookies, your IP address and browser details.
• Google Analytics runs with Google’s advertising features, so Google can use your activity on Creatures to measure and improve Google ads. When you sign up, we send Google a hashed form of your email address. When an account that came from a Google ad adds its first animal, we send Google the ad click identifier.
• When you pay through Stripe Checkout, we attach Meta’s cookies, your IP address and browser details to the payment record so we can report the purchase to Meta.

Meta and Google use this information under their own terms and privacy policies, which can include using it to improve their advertising services.

Your choices. You can opt out at Your Privacy Choices (creatures.com/privacy-choices) or by sending a Global Privacy Control signal; section 8 explains how each works and what changes. Pages that carry sign-in links or other access tokens, and visits from known bots, don’t load these tools. Websites members build on Creatures don’t load our analytics or advertising tools, though a member can add their own Google Analytics.

AI Features and AI Providers

Some Creatures features use AI models from outside providers: Anthropic (Claude), OpenAI, Google (Gemini) and xAI (Grok). This section explains what they receive.

What goes to AI providers. When you use an AI feature, we send the provider what that feature needs. That can include:

• text you type or dictate into an AI feature, such as a draft to polish, notes to turn into records, or a question for Ask Creatures, along with related details from your account, such as your animals, records and groups;
• voice recordings, which we send to a provider to turn into text;
• files you ask us to read, such as vet and lab records, pedigree papers, receipts, agreements, spreadsheets and photos, and pages from websites you ask us to import from. These often include the names, addresses and phone numbers of you and other people;
• photos used for a Creature Card, which we send to a provider to find the animal in the photo and frame the card;
• for a Crestimate, details about the animal and comparable sales, with your city and state but without names or contact details.

Before some AI features run, we send the text you typed to OpenAI’s moderation service to check it for abuse. Sellers who receive applications can choose to have an AI provider summarize an applicant’s answers and point out possible concerns; the seller makes the decision. For businesses in our public directory that haven’t joined Creatures, an AI provider helps write the listing description from the business’s public information, which can include the name of the person who runs it.

How providers handle it. Providers process this information to return results to us. Under their terms they may keep it for a limited time, for example to monitor for abuse, and files we upload to a provider so it can read them can stay in our account with that provider until we delete them. We do not use your content to train or fine-tune AI models, and we never send Google Calendar data to an AI provider. AI results are drafts; see Section 24 of our Terms.

Google Calendar and Google User Data

You can choose to connect your Google Calendar to Creatures. This section explains what we access from your Google account, how we use it, who can see it, and how you can remove it. It adds to the rest of this Policy. If anything elsewhere in this Policy conflicts with this section, this section controls for information we receive from Google.

Information we access. When you connect, Google asks you to allow two read-only permissions:

• See the list of your calendars. We store each calendar’s name, ID and time zone so you can choose which calendars Creatures uses. Every calendar starts turned off.
• See the events on your calendars. For each calendar you turn on, we read each event’s start and end time, its status, whether it is marked busy or free, and the IDs and change markers Google uses to keep events in sync. We read an event’s title and location only if you choose to show that calendar in Today. We receive attendee response statuses to determine whether you declined an event. We keep only whether you declined, not other attendees’ response statuses.

We do not request attendee names or email addresses, event descriptions or attachments, and the connection does not ask for your Google profile. Creatures never creates, changes or deletes anything in your Google Calendar.

How we use it. We use Google Calendar data only for the features you turn on:

• Show in Today: your events appear in your own Today planner and, if you turn it on, in your Your day morning email.
• Protect bookings: your busy times block booking times for the booking account, offering or person you choose, so no one can book you when you are busy.
• Calendar alerts: when a calendar protects bookings, we let you and the owners and co-owners of that booking account know if the calendar needs attention or if its busy times affect sessions that are already for sale.

We do not sell Google user data or use it for advertising. We do not use it to develop, improve or train generalized artificial intelligence or machine learning models, and we do not send Google Calendar data to any AI provider.

Who can see it. Event titles and locations are visible only to you. When a calendar protects bookings, people booking with you only see that some times are unavailable. Owners and co-owners of the booking account you protect can see that a time is blocked, and can receive connection-status notices and counts of affected sessions, but not your event titles or locations. If you choose to share your busy times with a host you work with, only the times are shared. Creatures staff and service providers do not read your Google Calendar data unless you give us permission to view specific data for support, it is necessary for security, or it is required to comply with the law.

Sharing. We do not transfer Google user data to anyone else, except: (a) service providers that operate Creatures on our behalf, such as our hosting and backup storage providers and our email delivery provider; (b) when necessary for security or to comply with applicable law; or (c) as part of a merger, acquisition or sale of assets, and only with your explicit prior consent. Our email delivery provider sends calendar connection and booking-protection alerts according to your notification settings. If you turn on the Your day morning email, it also processes the event titles included in that email. Google Calendar data, including event details and schedule information derived from it, is excluded from our product analytics and session recordings.

Limited Use. Creatures’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and protection. Your Google access and refresh tokens are encrypted with a dedicated encryption key that is not stored in our database. Calendar data travels over encrypted HTTPS connections. Only the parts of Creatures that refresh your calendar, show it to you, protect your bookings and send the alerts described above use this data.

Refresh and retention.

• We normally sync events overlapping a window from about one month in the past to about 13 months ahead. We aim to refresh calendars that protect bookings about every 5 minutes, and calendars shown only in Today about every 30 minutes. A full refresh normally updates the window about once a day.
• Deleted events stop appearing and blocking time after the next successful refresh. We may keep event identifiers to process deletions.
• If refreshes fail or you remove access in your Google Account, previously synced data can remain until refreshing resumes or you turn the calendar off or disconnect.
• Stopping display removes titles and locations from our synced calendar records immediately. Turning a calendar off deletes its synced events.
• Disconnecting deletes that connection’s synced events, its stored Google tokens, and its calendar names and Google calendar IDs. Existing bookings stay in place.
• Temporary copies of event titles in queued morning emails remain until the queue processes or discards them. Messages are rebuilt from your current settings before sending, and emails already delivered are not recalled.
• Limited connection and delivery records, such as calendar time zones, refresh history and alert delivery records, remain after you disconnect. You can ask us to delete them by contacting info@creatures.com.
• If you ask us to delete your account (see Data Deletion), we also delete your calendar connections and the remaining records described above, along with the rest of your personal data. Backup copies follow the backup retention described in Data Retention.

Removing access. You can change which calendars Creatures uses, or disconnect, at any time in Creatures under Calendar settings, Connected calendars. You can also remove Creatures’ access from your Google Account at myaccount.google.com/permissions. Removing access in Google stops further reading. Disconnect in Creatures as well to delete the synced events, stored Google tokens, calendar names and Google calendar IDs for that connection. Queued copies and remaining records are handled as described in Refresh and retention above.

Questions about Google user data can go to info@creatures.com.

5. International Data Transfers

Creatures LLC is based in the United States. If you are located outside the U.S., your personal information may be transferred to and processed in the U.S. or other jurisdictions. These locations may have data protection laws different from those in your country. We take appropriate safeguards when transferring personal data across borders to ensure it remains protected in accordance with this Privacy Policy.

Where EEA/UK/Swiss personal data is transferred to the U.S. or other non‑EEA countries, we use one or more of the following transfer mechanisms:

• EU‑U.S. Data Privacy Framework (and, where applicable, the UK Extension / UK‑U.S. Data Bridge); if our U.S. entity or relevant provider is self‑certified.
• Standard Contractual Clauses (SCCs) adopted by the European Commission, including supplementary measures as appropriate. We will disclose the specific mechanism(s) applicable to your data upon request.

6. Data Security Measures

We employ reasonable and appropriate security measures to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the Internet or method of electronic storage is 100% secure, so we cannot guarantee absolute security.

Security Breach Notification

In the event of a data breach that affects your personal information, we will promptly notify you and any relevant supervisory authorities as required by law. We maintain an incident response plan and will take all necessary steps to mitigate the impact of any data breach.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes we collected it for, unless a longer retention period is required by law. We consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and our legal obligations.

We may retain backup copies of data for a limited period as part of routine archival practices. When personal information is no longer needed, we will delete or anonymize it in a secure manner.

We keep personal information no longer than necessary for the purposes described above, or as required by law. Typical periods:

• Account & profile: life of account + 2 years
• Transaction & receipts: 7 years (tax/accounting)
• Connected financial account records: retained while needed to provide bookkeeping, tax, audit, reconciliation, fraud-prevention, dispute, legal, and accounting-record features, unless you request deletion and no legal, tax, fraud-prevention, dispute, or accounting-retention obligation requires us to keep them.
• Connected calendar data: retention depends on your settings, successful refreshes and the type of record, as described in Google Calendar and Google User Data.
• KYC/verification: until verification is complete + up to 5 years (fraud/records)
• Support tickets: 2 years
• Analytics identifiers: 13–24 months
• Session recordings: normally 30 days, under the retention setting we have chosen with PostHog.
• Email newsletter contact & engagement: until you unsubscribe or your account is deleted; we retain a suppression record as needed to honor opt‑out requests.
• Seller email list records: kept for as long as the seller’s account exists, including after you unsubscribe, so we can honor your choice and show when and how you agreed. A checkout choice whose purchase or booking never completes is deleted after 30 days. If you delete your Creatures account, we delete your seller contact and email list records. We keep a one way (hashed) form of each of your email addresses and your deleted account’s internal ID so you aren’t added back to sellers’ lists; the hash can still be matched against an address, so it is not anonymous. If a seller has connected an email service, we keep your address and its sync record for that seller only until the service confirms it has archived you, and we retry if the service is unavailable.
• Advertising identifiers: campaign details and ad click identifiers stay in cookies in your browser for up to 90 days; the copy saved to your account when you sign up is kept until your account is deleted. When we report a conversion to Google, we keep a record of it, including the ad click identifier; that record has no fixed deletion date and is kept after an account is deleted. Meta and Google keep what they receive under their own policies.
• Sign-up network and country details: kept with your account record, including after your account is deleted, to help prevent fraud and abuse.
• Forwarded receipt emails: if nothing from a forwarded email is saved to your records, we delete it after 30 days; otherwise we keep it with your financial records.
• Backups: 12 months (security/continuity). When retention ends, we delete or de-identify the data and commit not to re-identify it.
• Activity logs and email logs (records of activity on Creatures, including messages held for review, and of the emails we sent and to whom): kept while we need them for security, fraud prevention, support and our records, without a fixed deletion date for now. When you delete your account, we delete your email log entries.
• API and MCP daily usage tables: 13 months

8. Your Rights and Choices

You have rights and choices regarding your personal information. You can make any request related to your data by contacting us at info@creatures.com. We will respond within the timeframes required by law.

Your Privacy Choices

We share some personal information with Meta and Google for advertising, as described in Advertising and Analytics. You can opt out of this sharing, and of any disclosure a state law may treat as a sale, at Your Privacy Choices (creatures.com/privacy-choices). If you are signed in, your choice there is saved to your account and applies on every device and to events we create later on our servers; otherwise it is saved in that browser. We also honor Global Privacy Control: while your browser sends the signal, we treat each request from that browser as opted out, and a purchase you start from it is marked as opted out. We don’t yet save a Global Privacy Control signal to your account, so for now it doesn’t cover your other devices or other events we create later on our servers. Opting out stops the Meta Pixel and new Conversions API events (an event already queued before you opt out may still be sent), tells Google not to use your activity for advertising, and stops us sending ad click identifiers to Google. Product analytics and session recordings keep running. We do not use sensitive personal information beyond permitted purposes. You can always email info@creatures.com with any request.

Marketing Preferences & Unsubscribe

You can opt out of marketing emails at any time using the unsubscribe link in our emails or by contacting support@creatures.com. We maintain suppression lists to ensure you do not receive marketing after you unsubscribe. Unsubscribing from marketing will not stop service or transactional communications (e.g., receipts, order/auction updates, security alerts).

Sellers’ email lists are separate from the Creatures newsletter. To leave one seller’s list or all of them, use the Unsubscribe or Email preferences link at the bottom of emails we send you about that seller, or go to Your email lists (creatures.com/email-preferences). Emails a seller sends from their own email service carry that service’s unsubscribe link.

Data Deletion

All users, regardless of location, may request deletion of their personal data at any time. To request deletion:

1. Email info@creatures.com with the subject line “Data Deletion Request.”
2. Include the email address associated with your Creatures account so we can locate your data.

We will verify your identity and process your request within 30 days. Upon deletion, we close your account, remove your sign-in details, name, email address, phone number and profile details, and delete or clear most other records tied to your account. We keep records we must keep by law or need to complete a pending transaction (for example tax and transaction records); records we need to prevent fraud and abuse, such as the sign-up network and country details described in section 1 and copies of messages that were held for review; records of ad conversions we reported to Google (see Data Retention); and messages, posts and other content you sent to others, which stay stored but are no longer shown on Creatures. Copies held by our service providers follow the retention described in this Policy, and backups follow Data Retention. We will confirm deletion by email once the process is complete.

If you created your Creatures account using a third-party service (such as Facebook or Google), you may also request deletion of your data through that platform. We will honor the request in the same manner described above.

EU/EEA (GDPR) Rights

• Right of Access: Request confirmation of whether we process your personal data and obtain a copy.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data.
• Right to Erasure: Ask us to delete your personal data under certain conditions.
• Right to Restrict Processing: Request that we limit our processing of your data in certain circumstances.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: Request a machine-readable copy of certain data you provided and have it transferred to another controller.
• Right to Withdraw Consent: If we rely on your consent, you may withdraw it at any time.
• Right to Lodge a Complaint: You can file a complaint with your local Data Protection Authority.

California (CCPA/CPRA) Rights

• Right to Know: Request the categories and specific pieces of personal data we have collected, sources, purposes, and third parties we share with.
• Right to Deletion: Request deletion of personal information we have collected about you, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: You can opt out of the sharing of your personal information for cross-context behavioral advertising, and of any disclosure treated as a sale, at Your Privacy Choices (creatures.com/privacy-choices) or with a Global Privacy Control signal, as described in Your Privacy Choices above.
• Non-Discrimination: We will not discriminate against you for exercising your rights.
• Right to Limit SPI: If we ever use your sensitive personal information beyond permitted purposes, we will provide a “Limit the Use of My Sensitive Personal Information” control and honor requests within the statutory timeframe. (At launch, we do not use SPI beyond permitted purposes.)
• Minors (California): We do not sell or share the personal information of consumers under 16. If our practices change, we will first obtain opt‑in consent from consumers ages 13–16, and parental consent for children under 13.

U.S. State Privacy Rights (Va., Colo., Conn., Utah, Ore., Tex., Del., N.J.)

If you reside in one of these states, you may have some or all of the following rights, subject to limits: access, correction, deletion, portability, and the right to opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects (e.g., eligibility, access to essential features, or fraud‑related account actions). Use Your Privacy Choices and/or send a request to info@creatures.com.

Appeal process. If we deny your request, you may appeal by replying to our decision email or contacting info@creatures.com with “Privacy Appeal” in the subject. We will respond in 45–60 days with our decision and, if we continue to deny, how to contact your state Attorney General.

Canadian (PIPEDA) Rights

• Right to Access: Request information about the existence, use, and disclosure of your personal data and obtain a copy.
• Right to Correction: Request correction of any inaccurate or incomplete data.
• Consent and Withdrawal: Withdraw your consent at any time, subject to legal or contractual restrictions.

How to submit & verify. You can submit requests by web form or email. We will take reasonable steps to verify your identity (e.g., email verification, logged‑in checks). Authorized agents may submit requests with proof of authorization and, if needed, we may ask you to verify your identity directly with us. You don’t need an account to opt out of sale or sharing, and we won’t ask you to verify your identity to do it; we ask only for what we need to apply your choice.

9. Updates to This Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our practices or relevant laws. The updated version will be indicated by an updated “Last Updated” date at the top of the Policy. Any changes will become effective when we post the revised Policy on our website.

Your continued use of our services after the updated Policy is posted constitutes your acceptance of the changes, to the extent permitted by law.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us at:

Creatures LLC (Privacy Office)
Email: info@creatures.com
Mailing Address: 108 5th St SE, Ste 206A, Charlottesville, VA 22902, USA

If you are an EU resident, Creatures LLC is the “data controller” of your personal data. You may also lodge a complaint with your local Data Protection Authority. Similarly, Canadian residents may contact the Office of the Privacy Commissioner of Canada, and California residents can reach out to the California Privacy Protection Agency, but we invite you to contact us first so we can address your concerns.

11. Governing Law and Dispute Resolution

By using our services or providing personal information to us, you agree that any dispute or claim arising out of or relating to this Privacy Policy or our handling of your personal data will be governed by the laws of the Commonwealth of Virginia, USA, without regard to its conflict of law principles.

Arbitration: You further agree that all disputes or claims relating to privacy or the use of personal data must first be submitted to confidential binding arbitration in Virginia (or another location mutually agreed upon) before a single neutral arbitrator, prior to initiating any formal lawsuit. Arbitration shall be conducted in English in accordance with the rules of a reputable arbitration organization. Each party will bear its own arbitration costs, except as required by law. The arbitrator’s decision will be final and binding, and may be entered as a judgment in any competent court.

Class Action Waiver: To the fullest extent permitted by law, you and Creatures LLC agree that any dispute resolution will be conducted on an individual basis only, and not in a class, consolidated, or representative action.

You have the right to opt out of this arbitration agreement by sending us written notice within 30 days of first accepting this Policy. If you opt out, only the governing law and venue provisions (Virginia law, and state or federal courts in Virginia) will apply to any disputes.