Privacy Policy

Effective date: September 28, 2026

1. Introduction and Scope

This Privacy Policy explains how "NOVA BITS STUDIOS" LLC, a company incorporated under the laws of Uzbekistan ("Creostar", "we", "us", "our"), collects, uses, shares, and protects personal data in connection with the Creostar platform (the "Service") and our website at creostar.pro.

This Policy applies to three groups of people whose personal data we may process, and is written to be read together with our Terms of Service:

• Visitors of our website;
• Customers and their Authorized Users — the businesses that subscribe to the Service and the individuals who use it on their behalf; and
• Creators — the social media creators and influencers that our Customers discover, contact, and negotiate with using the Service. Creators are not our customers and typically do not have an account with us; Section 3.4 describes how we handle their data specifically.

2. Who We Are and Our Data Protection Roles

Creostar acts as the data controller for personal data of website visitors, Customers, and Authorized Users used to administer and operate its business and the Service. Creostar also acts as a data controller for the creator discovery database it collects, organizes, and maintains to make creator information searchable through the Service. For creator correspondence and related campaign data processed on Customer's instructions, Creostar acts as a data processor on behalf of Customer. Customer determines whom to contact, approves messages or follow-up sequences, and determines the purposes of its campaign; Customer is responsible for a lawful basis for its own processing and outreach. These roles apply whether Customer uses a connected email account or an account provided by Creostar. Creostar remains responsible for processing for which it determines its own purposes, such as account administration, security, and compliance with its legal obligations.

Contact details: "NOVA BITS STUDIOS" LLC, 1229-UY, Mustaqillik ko'chasi, Istiqlol MFY, Zafar. Privacy questions: support@creostar.pro.

3. Personal Data We Collect

3.1 Customer Accounts and Authorized Users. When a Customer registers for the Service, we collect the name, work email address, phone number (optional), job title, and company details of its Authorized Users, together with any information exchanged with our support team.

3.2 Data From Our Website. Like most websites, creostar.pro uses cookies and similar technologies to recognize visitors, remember preferences, and understand how the site is used, including for marketing purposes (for example, to measure the performance of a campaign that brought a visitor to our site). See Section 10 for more detail and how to control this.

3.3 Usage and Product Data. When Customers and Authorized Users use the Service, we collect data about that use, including search queries and filters, campaign configuration, in-product actions, log data, device and browser information, and IP address. For email features, we also process the email address and account identifiers, connection and authorization information where applicable, and sending and reply records needed to operate accounts connected by Customer or provided by Creostar.

3.4 Data About Creators (Third-Party Data). This is the category of personal data most specific to how Creostar works, and we want to be transparent about it. The Service helps Customers find and contact social media creators. To do this, we process personal data from publicly available sources and information exchanged during creator outreach:

• Source: publicly available profile, content, contact, and engagement information obtained through the official APIs of TikTok, YouTube, and Instagram, together with information exchanged in creator correspondence through the Service. Customer and its Authorized Users manage this correspondence using email accounts they connect or accounts provided by Creostar. The Service sends individual messages or follow-up sequences approved by Customer in advance; approved sequences may be sent automatically according to Customer's settings. The description of publicly available information relates to creator discovery sources, not to the privacy of email correspondence.
• Categories: public profile information (username, display name, bio, publicly listed contact details such as a business email), audience and engagement metrics (follower count, average views, engagement rate), publicly posted content used to evaluate fit for a campaign, and the content of outreach emails, creator replies, and commercial terms exchanged between Customers and creators through the Service.
• We do not purchase creator data from third-party data brokers. We use publicly available creator information to build, maintain, and provide the creator discovery database. We process correspondence and related campaign data on the relevant Customer's instructions to provide its email and campaign features. We also process data where needed to comply with law and for the limited purposes described in Section 4, including aggregated, de-identified benchmarking, subject to our respective roles described in Section 2.

3.5 Payment Data. Subscription payments are handled by our payment processors. Creostar does not collect or store full payment card numbers; our payment processors provide us with limited billing information (for example, name, billing address, and the last four digits of a card) needed for invoicing and support.

4. How We Use Personal Data

4.1 Core Purposes. We use personal data described in Section 3 to: provide, operate, and maintain the Service, including the creator discovery database and Customer-directed correspondence; process payments and manage subscriptions; provide customer support; secure the Service and prevent fraud or abuse; communicate with Customers and Authorized Users about the Service, including service and billing notices; and comply with our legal obligations.

4.2 AI Features. The Service uses artificial intelligence to suggest relevant creators and help Customers and their Authorized Users prepare draft messages, follow-up sequences, offers, and negotiation suggestions. Customer manages the correspondence using connected email accounts or accounts provided by Creostar and approves individual messages or follow-up sequences in advance. Approved sequences may be sent automatically according to Customer's settings. Depending on the task, the AI Features process relevant Customer Content (for example, brand and campaign information) and creator data described in Section 3.4, which may include profile and contact information, correspondence, and commercial terms.

4.3 Aggregated and De-Identified Data. We may create aggregated, de-identified statistics from Customer and creator data (for example, typical integration pricing by region and content category) to improve and market the Service. Once data is aggregated and de-identified in this way, it no longer identifies any individual Customer, Authorized User, or creator.

4.4 Marketing. We may use website visitor and Customer contact data to send product updates and marketing communications. Recipients can opt out at any time using the unsubscribe link in any marketing email or by contacting us at the address in Section 14.

5. Legal Bases for Processing (GDPR)

Where the GDPR applies and Creostar acts as a controller, we rely on the following legal bases. Where we act as a processor for Customer-directed correspondence and campaign data, we process data on Customer's instructions; Customer is responsible for identifying the applicable legal basis for its processing.

• Performance of a contract — to create and administer Customer accounts, provide the Service, and process payments;
• Legitimate interests — to operate, secure, and improve the Service; to generate aggregated benchmarking data; and to collect, organize, maintain, and make searchable publicly available creator information for business collaboration discovery, subject to balancing these interests against creators' rights and interests. This does not itself establish a lawful basis for every message a Customer chooses to send; Customer is responsible for the requirements applicable to its own outreach;
• Consent — for non-essential cookies and, where required by law, for certain marketing communications; consent can be withdrawn at any time; and
• Legal obligation — where we must retain or disclose data to comply with applicable law, a court order, or a competent authority.

6. How We Share Personal Data

We do not sell personal data. We share it only as follows:

• Service providers: cloud hosting and infrastructure, analytics, email hosting and delivery, customer support tooling, our payment processors, and, where used, AI providers supporting the features in Section 4.2. We share relevant data as needed for their functions. Providers acting as our processors or subprocessors are subject to contractual confidentiality and data-protection obligations. Email providers also process data under the terms and privacy policies applicable to the connected or Creostar-provided email accounts.
• Third-Party Platforms: the Service interacts with the official APIs of TikTok, YouTube, and Instagram to retrieve publicly available creator information as described in Section 3.4, in accordance with the applicable API terms. Those platforms process data under their own privacy policies. Creator correspondence is conducted by email through accounts connected by Customer or provided by Creostar. Relevant creator discovery information is made available to Customers using the search features, and correspondence and campaign information is made available to the Customer and Authorized Users managing that campaign.
• Professional advisers: lawyers, auditors, and accountants, where necessary and under confidentiality obligations.
• Legal and safety reasons: where required by law, regulation, legal process, or a competent authority, or to protect the rights, property, or safety of Creostar, our Customers, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality safeguards.

7. International Data Transfers

Personal data may be transferred to, and processed in, countries outside of Uzbekistan or the European Economic Area (EEA) — for example, where a service provider's infrastructure is located outside the EEA. Where this happens, we use recognized safeguards, such as the European Commission's Standard Contractual Clauses, or rely on an adequacy decision, to ensure the data receives a comparable level of protection to that required under the GDPR.

8. Data Retention

• Customer account data: retained for as long as the Customer maintains an active subscription, and for 30 days afterward, after which it is deleted or anonymized, except where we must keep it longer to comply with law (for example, billing and tax records) or to resolve disputes.
• Creator discovery data: publicly available information in the creator discovery database is retained for as long as reasonably necessary to provide and maintain the discovery features, subject to periodic review of its relevance and requests under Section 9. Information no longer needed for these purposes is deleted or anonymized.
• Creator correspondence and campaign data: retained only for as long as reasonably necessary to support the relevant Customer's campaign and, in any event, no longer than 12 months after the last contact with the relevant creator, unless there is an active, ongoing negotiation or collaboration with Customer. For data processed on Customer's behalf, we follow Customer's applicable deletion instructions, subject to legal retention requirements. Limited records may be retained where needed to comply with law or give effect to an objection to further contact. Aggregated, de-identified statistics are addressed in Section 4.3.
• Website and cookie data: retained according to the retention periods of the specific cookie or tool involved — see Section 10.

9. Your Rights

Subject to applicable law, Creators, Customers, Authorized Users, and website visitors have the right to:

• access the personal data we hold about them and receive a copy of it;
• correct inaccurate or incomplete personal data;
• request deletion of their personal data;
• restrict or object to certain processing, including processing based on legitimate interests or for direct marketing;
• receive certain personal data in a portable format; and
• withdraw consent at any time, where processing is based on consent, without affecting processing that already took place.

To exercise these rights, contact us at support@creostar.pro. Creators do not need a Creostar account to make a request and may also object to further outreach through the Service. Please identify the relevant profile or email address and, where possible, the campaign or message concerned. We will handle requests concerning processing for which we are controller and, where we act as a processor, refer the request to the relevant Customer and assist it in responding. We will take the steps required by applicable law to give effect to objections, including stopping relevant further sending through the Service where required; this includes scheduled follow-up messages. We may retain limited information needed to respect an objection. We will respond within the time required by applicable law (generally one month under the GDPR).

10. Cookies and Similar Technologies

We use cookies and similar technologies on creostar.pro and within the Service for: essential functionality (for example, keeping you logged in); analytics (to understand how the site and Service are used); and, on the website, marketing and attribution (to understand which channels bring visitors to our site). Where required by law, we will ask for your consent to non-essential cookies through a cookie banner, and you can change your preferences at any time through that banner or your browser settings.

11. Children's Data

The Service is intended for business use by adults acting on behalf of a company or other organization, and is not directed at, or knowingly used to collect personal data directly from, individuals under 18 in connection with account registration.

12. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal data, including encryption of data in transit, access controls, and regular review of our security practices. No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting personal data, we will notify affected individuals and any relevant authority as required by applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by email or through a notice within the Service before the changes take effect. The effective date at the top of this Policy shows when the current version takes effect. The current version of this Policy is always available at creostar.pro/privacy.

14. Contact Us

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to support@creostar.pro.