Privacy Policy

The controller responsible for personal data processed in connection with Crea Services is:

Crea Services is the creative production ecosystem: companies and creative operators use it to run projects end to end. Listings and booking, project workspaces, milestones, files, in-platform messaging, and invoicing, in a single product instead of a patchwork of tools.

Depending on how you use the platform, we may process the following categories of personal data:

• Account & identity data: name, email address, password (stored as a secure hash), and your role (freelancer or company).
• Profile & professional data: biography, skills, portfolio links, availability, day rate, equipment, social media links, company name, and other information you voluntarily add to your profile.
• Project & transactional data: job postings, applications, messages exchanged on the platform, milestones, deliverables, and related operational records.
• Payment data: subscription status, transaction IDs, and billing details processed via Stripe. We do not store full card numbers — payment processing is handled entirely by Stripe.
• Technical & usage data: IP address, browser type, device information, approximate location derived from IP, page views, timestamps, and diagnostic logs necessary to keep the platform secure and functional.
• Support communications: content of any messages or emails you send to our support team.

• Performance of a contract (Art. 6(1)(b) GDPR): providing and operating your account, matching freelancers and companies, processing job flows, messaging, invoicing, and payments.
• Legitimate interests (Art. 6(1)(f) GDPR): securing the platform, preventing fraud and abuse, improving usability, and product development — balanced against your rights and interests.
• Consent (Art. 6(1)(a) GDPR): for optional cookies or marketing communications where required. You may withdraw consent at any time without affecting prior lawful processing.
• Legal obligation (Art. 6(1)(c) GDPR): retaining records for tax, accounting, or other regulatory requirements, or responding to lawful authority requests.

We use cookies and similar technologies that are strictly necessary for the operation and security of the platform (for example session management and authentication via our hosting and database providers). Disabling essential cookies in your browser may impair core functionality such as staying logged in.

Where we offer optional performance analytics (Vercel Speed Insights), we only enable these technologies if you accept them in our cookie banner. Your choice is stored locally in your browser (localStorage) so we can respect it on future visits.

We do not use third-party advertising cookies. You can change optional analytics at any time via the "Cookies" link in the site footer.

We use trusted third-party providers to operate the platform. They process data only on our behalf and under appropriate contractual safeguards (including data processing agreements under Art. 28 GDPR where required):

• Supabase — database, authentication, and backend infrastructure (data stored within the EU where possible).
• Vercel — hosting and deployment of the platform.
• Stripe — payment processing and subscription management.
• Resend — transactional email delivery (e.g. account confirmation, password reset).

Other users of the platform may see information you place on public or shared areas (e.g. your freelancer profile, job postings, or applications).

Some of our subprocessors may process data outside the European Economic Area (EEA). Where this occurs, we rely on mechanisms recognised under GDPR — such as Standard Contractual Clauses approved by the European Commission — to ensure an adequate level of protection. You may request further information by contacting us.

We retain your personal data only as long as necessary for the purposes described in this policy, unless a longer period is required by law (e.g. tax or accounting obligations). When you delete your account, we will delete or anonymise your data within a reasonable period, subject to any applicable legal retention obligations.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration — including encrypted data storage, secure authentication flows, and access controls. No method of Internet transmission is completely secure; we cannot guarantee absolute security.

Under applicable law, and in particular GDPR, you may have the right to:

• Access your personal data and receive a copy (Art. 15)
• Rectify inaccurate data (Art. 16)
• Request erasure in certain circumstances (Art. 17)
• Restrict processing in certain circumstances (Art. 18)
• Data portability where applicable (Art. 20)
• Object to processing based on legitimate interests or for direct marketing (Art. 21)
• Withdraw consent at any time where processing is consent-based
• Lodge a complaint with a supervisory authority — in Germany, the relevant authority is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

To exercise any of these rights, contact us at hello@creaservices.de. We may need to verify your identity before responding.

Crea Services is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date above. For material changes, we will provide additional notice where required by law (e.g. via email or an in-platform notification).

For any privacy-related questions or requests, please contact us at: hello@creaservices.de