mohammadjavad Barzegar is the controller of personal data processed for Creavax, except where a third-party provider acts independently. This policy covers accounts, prompts, uploads, generated assets, payments, support, public creator features and API use.
Service operator
Section 01
mohammadjavad Barzegar operates Creavax. The registered identity and contact details configured for the service are shown above.
Payment gateways, model providers and other services may act as processors for Creavax or as separate controllers under their own privacy notices, depending on the transaction and provider terms.
Section 02
Section 03
| Purpose | What we do | Typical legal basis |
|---|---|---|
| Provide the contract | Create accounts; run generations and workflows; store assets; manage teams, credits, payments and support. | Performance of a contract or steps requested before a contract. |
| Security and reliability | Prevent fraud and abuse; enforce limits; investigate incidents; monitor queues, providers and storage. | Legitimate interests, contract performance and legal obligations. |
| Payments and records | Confirm payments, issue credits, reconcile webhooks, process refunds and keep accounting records. | Contract performance and legal obligations. |
| Optional analytics | Understand aggregate product usage and reliability without collecting prompt bodies unless separately disclosed. | Consent where required; otherwise a documented legitimate interest. |
| Marketing | Send optional product communications or measure campaigns. | Consent or another lawful basis permitted in your location. |
| Legal compliance | Respond to lawful requests, preserve evidence and establish or defend legal claims. | Legal obligation and legitimate interests. |
Section 04
The prompt, file, settings and metadata needed to complete a request may be sent to the selected model, infrastructure or storage provider. Do not upload data you are not authorized to process.
Creavax maintains a service-provider list describing the purpose and conditional use of integrated providers. Actual providers depend on the model, payment method and deployment configuration you select.
View the subprocessor listSection 05
Some providers may process data outside your country. Where transfer rules apply, Creavax should use an adequacy decision, approved contractual safeguards or another lawful transfer mechanism and assess supplementary protections where required.
Section 06
Private assets are intended to be available only through authenticated or signed access. When you publish a feed item, template or creator profile, the selected content and metadata become public and may be indexed, shared, downloaded or copied by others.
Removing public content stops new access through Creavax, but copies, search indexes, provider logs and backups may persist for a limited period.
Section 07
| Data category | Typical retention |
|---|---|
| Active account and private project data | While the account or feature requires it, then generally up to 24 months unless you delete it earlier or law requires longer retention. |
| Deleted account data | Deletion or anonymization normally begins promptly; recoverable copies may remain for up to 30 days before scheduled removal. |
| Backups | Encrypted or private operational backups are retained for approximately 14 days unless an incident or legal hold requires longer. |
| Security and audit logs | Generally up to 180 days, with longer retention for active investigations or legal claims. |
| Support conversations | Generally up to 24 months after closure, unless a shorter request or longer legal need applies. |
| Billing, tax and payment records | Generally up to 7 years or the period required by applicable accounting and tax law. |
Section 08
Depending on your location, you may request information, access, correction, deletion, restriction, objection, portability or withdrawal of consent. You may also have the right to complain to a data-protection authority and to protections concerning certain decisions based solely on automated processing.
Requests can be made electronically. Creavax may verify identity and will respond within the period required by applicable law; where the GDPR applies, the usual period is one month, subject to permitted extensions.
Submit a privacy requestSection 09
Essential cookies support authentication, CSRF protection, language, consent and secure sessions. Optional analytics or marketing storage must remain disabled until the required choice is recorded.
Review cookie details and preferencesSection 10
Creavax uses access controls, encrypted transport, private storage routes, signed download links, rate limits, queue separation, audit records, backups and operational monitoring. No system is completely secure. Protect your credentials and report suspicious activity promptly.
Section 11
Creavax is not intended for children under 16, or a higher minimum age required by local law. If the operator learns that a child’s data was collected without valid authorization, it will take reasonable steps to delete or restrict it.
Section 12
Contact the privacy address shown above for questions or rights requests. You may also complain to the competent supervisory authority where applicable; you do not need to contact Creavax first before using a statutory complaint right.
Material changes will be posted with a new effective date and additional notice or consent where required.
Contact privacy support