Last updated September 30, 2025

This Privacy Notice for Creato AI ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at Creato AI.cc or any website of ours that links to this Privacy Notice

• Download and use our mobile application (Creato AI), or any other application of ours that links to this Privacy Notice

• Use Creato AI, an all-in-one AI platform that enables creators to generate images and efficiently manage their fan communities

• Engage with us in other related ways, including any sales, marketing, or events

 Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our services.

Creato AI is the data controller of your personal data for the purposes of the Platform. Our data protection contact is: rrollingkwok@gmail.com

SUMMARY OF KEY POINTS

(This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.)

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

• Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Learn more about sensitive information we process.

• Do we collect any information from third parties? We may collect information from third parties such as referral information, identity verification and fraud prevention services, and advertising or analytics platforms.

• How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

• In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. Learn more about when and with whom we share your personal information.

• How do we keep your information safe?  We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

• What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

• How do you exercise your rights?  The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us at rollingkwok@gmail.com. We will consider and act upon any request in accordance with applicable data protection laws.

• Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

1. WHAT INFORMATION DO WE COLLECT?

We collect and process the following categories of personal data depending on how you use the Platform:

Data you provide directly

• Identity data (e.g. name, date of birth, nationality)

• Contact data (e.g. email address, phone number)

• Payment data (e.g. card or bank details, billing address)

• Creator verification documents (e.g. ID, liveness scans)

• Communications (e.g. support messages, complaints)

Data we collect automatically

• Usage data (e.g. login times, clicks, viewed Content, messages)

• Technical data (e.g. IP address, browser type, device model)

• Location data (based on IP or device permissions)

• Session activity (e.g. navigation, interactions)

Data from third parties

• Referral information

• Identity verification and fraud prevention services

• Advertising or analytics platforms

We may combine this data to improve our services, protect users, and detect misuse.

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we may also process sensitive personal information such as biometric data for verification purposes.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases. All payment data is handled and stored by secure payment processors like Stripe. You may find their privacy notice link(s) here:: https://stripe.com/privacy.

CHILDREN'S PRIVACY

Our Services are not intended for use by children under the age of 18 ("Children"). We do not knowingly collect personal data from Children. If you are under 18, you must not use our Services or provide any personal data to us. If you become aware that a Child has provided us with personal data without parental consent, please contact us immediately at rollingkwok@gmail.com.If we learn that we have collected personal data from a Child without verification of parental consent, we will take steps to delete that information from our servers.

AGE VERIFICATION DATA

To comply with global age verification laws, we process additional data for users in regulated jurisdictions. This includes government ID details, biometric matching data, and verification documents for creator verification purposes. Age verification is performed by approved third-party providers under strict data processing agreements. We store only the minimum data necessary for compliance, such as verification status (pass/fail) and timestamp. For Creative Users, we may retain document data as required by applicable laws (e.g., USC 2257 requirements). Age verification data is processed based on legal obligation and legitimate interest, retained for the duration required by law or your account status, subject to enhanced security measures, and never used for marketing purposes.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal data for the following purposes: