Privacy Policy — Createrun

1. Who we are and what this policy covers

1.1 This policy explains how Createrun Incorporated, a New York corporation ("Createrun", "we", "us") collects and uses personal information when you visit our websites, create or use a Createrun account, buy a subscription, contact us, or install and license Createrun software.

1.2 Createrun offers three kinds of service, and our role for your information depends on which one you use:

Self-hosted software. You install and run Createrun on infrastructure you control. The data inside your instance stays with you. We receive only the licensing information described in Section 5.
Createrun-hosted services. Createrun Cloud, rented virtual machines and our hosted development services (such as Editor projects, Git repositories, build artifacts and the Createrun Agent). We host these for our customers.
Our own websites, accounts and billing. The information we need to run our business.

1.3 Questions about this policy can be sent to privacy@createrun.com.

2. Our role for different kinds of information

2.1 Where we decide how information is used. Createrun decides why and how the following information is processed, and this policy applies to it:

account and organization information;
billing information;
website analytics and our own measurement of visits and sign-ups;
contact and demo requests and survey answers;
support communications;
security logs; and
licensing information sent by self-hosted instances.

2.2 Where we act for our customers. When a customer uses Createrun-hosted services, the content the customer and its users put into those services is controlled by that customer. We process it only on the customer's instructions, under our Data Processing Addendum. That content is not covered by this policy. It includes applications and their data, Editor projects, Git repositories, build artifacts, and Createrun Agent prompts and outputs. If you use an application built or run by one of our customers, contact that customer about your information. See Section 12.

2.3 Where we have no role. For self-hosted instances, Createrun does not receive, access or process the content of the instance, and we are not a processor for it. The organization that runs the instance is responsible for it. The only information that leaves a self-hosted instance for Createrun is described in Section 5.

3. Information we collect

Category	What it includes	Where it comes from
Account information	Name, email address, password (stored only as a cryptographic hash), optional phone number, email confirmation status, account status	You, when you register
Organization information	Organization name, members and their roles, organization contact details	You and your organization's administrators
Organization verification documents	Documents you submit to verify your organization, such as registration documents or evidence of authority, and our review notes about them	You, during verification
Sign-in and session information	Sign-in events, session and token records, failed sign-in attempts, multi-factor authentication status	Generated when you use your account
Billing information	Subscription and purchase records, including the history of changes to your subscription (plan, price, discounts, trials, pauses and cancellations); invoices and invoice line items; refunds; billing contact; tax details; payment status and transaction identifiers; usage of metered services (such as ORU consumption); and the notifications our payment processor sends us about these events, which may include your email address. Payment details are collected and handled by Stripe, which currently processes our payments. We do not receive or store full payment card numbers.	You and Stripe
Website analytics (Google Analytics)	Pages viewed, approximate location, device and browser type, and how you arrived at the site. Collected only if you choose "Accept analytics" in the cookie banner. See Section 13.	Your browser, through Google Analytics
Visit and sign-up attribution (our own measurement)	A random visitor identifier stored in the `cr_vid` cookie; the campaign tags in the link you followed (UTM parameters); advertising click identifiers that ad networks add to links (such as Google gclid, gbraid and wbraid, Meta fbclid, LinkedIn li_fat_id, X twclid, Microsoft msclkid and TikTok ttclid); the referring page; the first page you landed on; and the pages and actions you take on our websites, such as viewing pricing or starting a sign-up. We flag traffic that appears to come from automated bots. We do not store your IP address for this purpose. When you create an account from the same browser, we link this visitor record to your account so that we can tell which channels bring customers. Collected by default unless you opt out or your browser sends a Global Privacy Control signal. See Section 13A.	Your browser, when you visit createrun.ai
Support communications	Messages, attachments and details you send to support or other Createrun contact addresses	You
Survey answers	Your optional answer to "How did you hear about us?" and, if you cancel or skip a plan, the reason you choose and any comment you write	You
Contact and demo requests	Name, email address, company, role, message and the other details you enter in a contact or demo form, together with the IP address the request came from and the time it was sent	You, when you submit the form
Security logs	IP address, user agent, requested address, time, outcome of the request, and signals of abuse or attack	Generated automatically when you use our websites and services
Licensing information from self-hosted instances	The items listed in Section 5	Your self-hosted instance
Legal acceptance records	Which document and version you accepted, when, from which IP address and browser, and the wording of the acceptance you were shown	Generated when you accept one of our terms

3.1 Some US state laws treat two kinds of information we hold as "sensitive": your account password, which we store only as a cryptographic hash, and any government identification you include in organization verification documents. We use them only as described in Section 7A.3. We do not ask for other sensitive categories of personal information, such as health information. Please do not include it in support messages or uploaded documents unless we have specifically asked for it as evidence.

4. How we use information

Purpose	Information used
Creating and operating your account and organization	Account, organization, sign-in information
Verifying organizations	Organization information, verification documents, support communications
Billing, invoicing, tax, refunds and collections	Billing, account and organization information
Measuring and reporting our revenue, subscriptions, usage and renewals, and forecasting our business	Billing information, in our own internal reporting
Understanding which websites, campaigns and channels bring visitors and customers, and improving our websites and sign-up process	Visit and sign-up attribution, survey answers, Google Analytics (if you accepted it)
Understanding why customers cancel and improving our products	Survey answers, billing information
Answering contact and demo requests and following up on them	Contact and demo requests
Licensing, activation, update delivery and preventing misuse of licenses	Licensing information from self-hosted instances, account and organization identifiers
Providing support	Support communications, account information, relevant logs
Operating, securing and improving the efficiency of our services	Service data, including limited samples of inputs and outputs, in de-identified or aggregated form (see Section 6.4)
Keeping our services secure and preventing fraud, abuse and automated traffic	Security logs, sign-in information, bot signals in visit records, IP address in contact and demo requests
Sending service messages, such as security alerts, billing notices and changes to our terms	Account information
Sending product news and offers, if you asked for them	Name and email address
Keeping evidence of accepted terms, meeting legal obligations and handling legal claims	Legal acceptance records and other relevant information

4.1 Service messages are part of running your account and cannot be switched off while the account exists. Product news and offers are commercial email: we send them only if you asked for them, every message identifies Createrun and includes a simple way to unsubscribe, and we stop sending within 10 business days of your request.

4.2 Verification decisions are made by a person, not solely by automated means. Some checks that inform the decision are automated, such as detecting duplicate or conflicting organization names. If you think a decision about your organization was wrong, write to legal@createrun.com and ask for another review.

5. Self-hosted instances: what we receive

5.1 When you register, activate or update a self-hosted Createrun instance, the instance sends Createrun the following licensing information:

an instance identifier;
the organization identifier, and the account identifier and email address of the user who registered the instance;
the hostname of the machine and the installation path;
the operating platform;
the versions of the product and its components;
the edition (for example, Community, Pro or Enterprise);
periodic health requests, which include the instance identifier, running time and version; and
update-check requests.

5.2 As with any network request, we also receive the IP address the request comes from, and it is recorded in our security logs.

5.3 We use this information to license and activate the instance, to deliver updates, and to prevent abuse of licenses. We do not use it for advertising.

5.4 Operational telemetry and observability data from your instance is off by default. Createrun receives such data only if your organization explicitly turns it on and configures where it is sent, and only the data your organization enables.

5.5 Apart from the items above, Createrun does not receive the content of your instance. This includes your applications, your databases, your users' information and your files.

6. The Createrun Agent and AI

6.1 The Createrun Agent uses AI models selected by Createrun. These may be models operated by Createrun or models provided by third-party cloud model providers. Today, the Createrun Agent uses a model that Createrun operates.

6.2 If we use a third-party model provider, we will list it on our Subprocessors page before it receives any customer content.

6.3 Prompts, files and outputs you send through the Createrun Agent in Createrun-hosted services are customer content. We process them under our Data Processing Addendum, as described in Section 2.2.

6.4 Service improvement. We may use service data, including limited samples of inputs and outputs, in de-identified or aggregated form and under restricted access, to operate, secure and improve the efficiency of our existing services. Where a business customer uses Createrun-hosted services, we use its customer content only as our Data Processing Addendum allows. We will give prominent notice before we use information for a materially different purpose.

6.5 You may also connect your own AI tools to Createrun, for example through the Model Context Protocol (MCP). In that case, your AI provider receives data under your own agreement with that provider. Createrun does not control that provider and is not responsible for how it handles your data.

7. How we share information

7.1 We share personal information only as needed for the purposes in Section 4:

Service providers that host infrastructure for our services, provide website analytics or deliver website assets. They act on our instructions. The current list is on our Subprocessors page.
Stripe, which currently processes our payments. Payment details are collected and handled by Stripe. Stripe also uses some information as an independent controller to meet its own legal obligations and to prevent fraud, under its own privacy policy.
Professional advisers, such as lawyers, accountants and auditors, where they need the information to advise us.
A successor in a merger, acquisition or sale of all or part of our business. We will tell you before your information becomes subject to a different privacy policy.
Authorities and others where the law requires it, or where it is necessary to protect the rights, property or safety of Createrun, our users or the public.

7.2 We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7A. Summary for US state privacy laws

7A.1 This section describes the personal information we have collected in the last 12 months, using the categories defined in the California Consumer Privacy Act and similar state laws. The sources, purposes and retention periods are described in Sections 3, 4 and 9.

Category (state-law term)	Examples from Section 3	Disclosed for a business purpose to	Sold or shared?
Identifiers	Name, email address, account and organization identifiers, random visitor identifier (`cr_vid`), IP address in security logs and in contact and demo requests, advertising click identifiers	Hosting and service providers; Stripe; professional advisers	No
Customer records and commercial information	Subscriptions, purchases, invoices, refunds, usage of metered services	Stripe; hosting providers; professional advisers	No
Internet or other electronic network activity	Pages viewed, referring page, landing page, campaign tags, actions on our websites, security logs	Hosting providers; Google (analytics, only if you accepted it)	No
Approximate geolocation	Estimated from your IP address by Google Analytics (only if you accepted it)	Google	No
Professional information	Organization, role, and company in demo requests	Hosting providers	No
Survey responses and correspondence	"How did you hear about us?", cancellation reasons, support messages	Hosting providers	No
Sensitive personal information	Account sign-in credentials (password stored only as a hash); government identification if included in organization verification documents	Hosting providers	No

7A.2 We do not sell personal information, and we do not share it for cross-context behavioral advertising (targeted advertising). We have no actual knowledge of selling or sharing personal information of consumers under 16.

7A.3 We use sensitive personal information only to provide our services, verify organizations, keep accounts secure and meet legal obligations. These are purposes for which the law does not give a right to limit its use. We do not use it to infer characteristics about you.

7A.4 We do not use personal information for decisions that produce legal or similarly significant effects based solely on automated processing (see Section 4.2).

8. Where we process information

8.1 Createrun is based in the United States. We process data on servers operated by us or our service providers, primarily in the United States. Where data of users in other regions is transferred, we rely on appropriate safeguards as required by applicable data protection laws.

9. How long we keep information

Information	How long we keep it
Account and organization information	While the account is active, and for a limited period after it is closed so that we can answer questions about the closure and reverse a closure made by mistake
Organization verification documents	For a limited period after the verification decision, so that the decision can be evidenced if it is questioned, then deleted
Subscription history, invoices, invoice line items, refunds and other billing and financial records	As long as required by law, including tax and accounting law
Payment-processor event notifications (which may contain your email address)	400 days
Security logs	Up to 180 days, or longer where needed to investigate a specific security incident
Licensing information from self-hosted instances	While the license is active, and for a limited period after it ends
`cr_vid` visitor cookie	Expires 13 months after it is first set; we do not extend it when you return
Visit and page-event records	25 months from the event, then deleted or aggregated so that they no longer identify a visitor
Attribution linked to your account (the campaign, source and click identifier that led to your sign-up)	25 months from when it was collected
Survey answers	25 months from when you gave them
Contact and demo requests, including the IP address	24 months from when you sent the request
Website analytics (Google Analytics)	Up to 14 months, according to the retention setting of our analytics service
Support communications	As long as needed to resolve the matter and to understand recurring issues
Legal acceptance records	As long as needed to evidence the agreement, including any period in which a claim could be brought under it
Customer content in Createrun-hosted services	Governed by the Data Processing Addendum: deleted 30 days after the customer's service ends
Backups	Information deleted from our live systems is removed from backups as they roll off in the ordinary course

9.1 When a retention period ends, we delete the information or make it anonymous.

10. Security

10.1 We use technical and organizational measures designed to protect personal information against unauthorized access, loss and misuse. These include encrypted connections, access limited to people who need it, logging of security-relevant events, and backups. More detail is on our Security page.

10.2 No system is perfectly secure. If a security incident affects your personal information, we will notify you where the law requires it.

10.3 To report a vulnerability, write to security@createrun.com.

11. Your rights

11.1 Your US privacy rights. Depending on the state you live in (for example California, Colorado, Connecticut, Oregon, Texas or Virginia), you may have the right to:

know the categories and specific pieces of personal information we hold about you, where it came from, why we use it and to whom we disclose it, and receive a copy in a portable format;
correct inaccurate personal information;
delete personal information we collected from you;
opt out of the sale or sharing of personal information and of targeted advertising (we do neither today; see Section 7A), and opt out of profiling in furtherance of significant decisions (we do not do this); and
not be discriminated against for exercising these rights. We will not deny you service, charge you a different price or give you a different quality of service because you exercised a right.

11.2 How to make a request. Email privacy@createrun.com from the address on your account, or use your account settings for profile and notification changes. To opt out of our own visit measurement, use "Do not track me" (Section 13A); no account is needed.

11.3 Verification. To protect you, we verify requests to know, delete or correct by matching them to your account, normally by asking you to confirm from the account's email address or while signed in. For specific pieces of information or for deletion we may ask for additional confirmation. We use the information you give us for verification only for that purpose. Requests to opt out do not need verification.

11.4 Authorized agents. You may use an authorized agent. We will ask the agent for your signed permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

11.5 Timelines. We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to another 45 days), we will tell you why. We act on opt-out requests within 15 business days.

11.6 Appeals. If we decline your request, we will explain why. You may appeal by replying to our decision; a different person will review it and answer within the time your state's law requires. If you are not satisfied, you may contact your state Attorney General (or, in California, the California Privacy Protection Agency).

11.7 We may keep some information despite a deletion request, for example where the law requires us to keep it or where we need it to establish or defend a legal claim. If so, we will tell you what we are keeping and why.

11.8 If you live outside the United States, Section 17 describes additional rights you may have.

12. Information controlled by our customers

12.1 If your information is held in an application, project or repository that one of our customers runs on Createrun-hosted services, that customer controls it. Please send your request to that customer.

12.2 If you send the request to us, we will forward it to the customer and tell you that we have done so. We will help the customer respond as described in our Data Processing Addendum.

12.3 We cannot act on requests about self-hosted instances, because we do not have access to their content. Please contact the organization that runs the instance.

13. Cookies and similar technologies

13.1 We use cookies and browser storage that are needed for our websites to work, such as session and security cookies.

13.2 Our own measurement (on by default). On createrun.ai we measure visits and sign-ups ourselves, as described in Section 3 ("Visit and sign-up attribution"). We do this with first-party cookies that our own servers set for the createrun.ai domain and its subdomains. The information stays with Createrun and our hosting providers and is not given to advertising networks.

13.3 Google Analytics (off by default). We load Google Analytics only if you choose "Accept analytics" in the cookie banner. Advertising storage, advertising user data and ad personalization are always set to "denied".

13.4 We do not use advertising cookies. The full list of cookies is in our Cookie Notice.

13A. Your choices: "Do not track me", Global Privacy Control and Do Not Track

13A.1 Do not track me. Select "Do not track me" at the bottom of any page on createrun.ai. We then stop our own measurement for that browser: we do not set or read the cr_vid cookie, record visits or link your browser to an account, and we remember your choice in the cr_consent cookie. The same choice also switches Google Analytics off. If you later delete the cr_consent cookie, our measurement starts again unless your browser sends Global Privacy Control.

13A.2 Global Privacy Control. If your browser or an extension sends the Global Privacy Control (GPC) signal, we treat it as a request to opt out: we do not set the cr_vid cookie, and we do not record your visit or link it to an account. We apply the signal to the browser that sends it, and we honor it even if you previously allowed measurement.

13A.3 Do Not Track. Browser "Do Not Track" (DNT) signals have no agreed standard, so our websites do not change their behavior when they receive one. Use Global Privacy Control or "Do not track me" instead; we honor both.

13A.4 If you opt out, records made before you opted out remain subject to the retention periods in Section 9. You can also ask us to delete them (Section 11).

14. Children

14.1 Our services are intended for adults, both individuals and businesses, and are not directed to children. You must be at least 16 years old, or the age of legal capacity where you live if that is higher, to create an account. We do not knowingly collect personal information from children under 16, and we do not sell or share personal information of anyone under 16. If you believe a child has given us personal information, write to privacy@createrun.com and we will delete it.

15. Changes to this policy

15.1 We may update this policy. The date at the top shows when it was last changed.

15.2 If we make a material change, we will tell account holders by email or in the product before the change takes effect. Earlier versions are available on request.

16. Contact us

Topic	Contact
Privacy questions and requests	privacy@createrun.com
Security reports	security@createrun.com
Legal notices	legal@createrun.com
General support	support@createrun.com

17. If you are in the European Economic Area, the United Kingdom or Switzerland

17.1 If the data protection laws of the European Economic Area, the United Kingdom or Switzerland apply to our processing of your information, the legal bases we rely on are: performance of our contract with you (account, billing, licensing, support and service messages); our legitimate interests (security, fraud and bot prevention, license enforcement, measuring our websites and marketing channels with our own first-party measurement, and business reporting); legal obligations (tax, accounting and legal claims); and your consent (Google Analytics and product news), which you can withdraw at any time without affecting earlier use.

17.2 In addition to the rights in Section 11, you may object to or ask us to restrict certain uses of your information, and you may complain to your data protection authority. Transfers of your information to the United States rely on appropriate safeguards as required by those laws.

17.3 Where those laws require it, we will appoint representatives in the European Union and the United Kingdom and publish their contact details on this page. Until then, please contact privacy@createrun.com.