Privacy Policy

This Privacy Policy applies to CreativeFly websites, applications, AI creative-production features, asset and project workspaces, subscriptions, and CreativeFly AdSignal (together, the “Services”). The Services are operated by 上海时创空际科技有限公司 (“CreativeFly,” “we,” “us,” or “our”).

This policy explains our processing of personal information and also describes AdSignal's handling of official public advertising-transparency records. Public business or advertising records are not treated as private account data, but we still preserve their source, permitted use, retention, and deletion boundaries.

Account and contact information may include your mobile number, email address, verification status, account identifier, invitation information, organization details, and communications with us.

Service and device information may include browser and device type, operating system, IP address, timestamps, page and feature interactions, authentication, security, error, and audit logs, and cookies or similar technologies.

Creative-production information may include images, video, audio, text prompts, templates, configuration, project data, generated results, download history, and other content that you choose to submit or create through the Services.

Transaction information may include order number, subscription or credit plan, amount, currency, payment status, and billing or support information. Payment providers generally process payment credentials; we do not intend to receive your payment password or full card number.

AdSignal processes documented public or licensed advertising data such as platform ad or library identifiers, advertiser or payer identity, creative text and permitted references, disclosed targeting or reach fields, market, observed dates, status, and source evidence. TikTok Commercial Content API credentials are server-side application credentials; AdSignal does not request a user's TikTok password, private account content, or private messages.

We process information to provide and secure the Services, authenticate accounts, run requested generation and analysis jobs, store projects and assets, complete purchases, prevent fraud and abuse, provide support, maintain auditability, comply with law, and improve product reliability.

Where applicable, our legal bases may include performing a contract with you, our legitimate interests in operating and securing the Services, compliance with legal obligations, and consent when required. We will provide additional notice or obtain consent if a materially new purpose requires it.

AdSignal combines separately labeled source classes: official public transparency data, advertiser-authorized first-party data, contractually licensed data, permitted public observations, and modeled estimates. It does not convert public competitor records into claims of verified sales, conversions, or return on ad spend.

For TikTok's Commercial Content API, AdSignal uses a read-only server-to-server integration to retrieve public advertising-transparency records in markets supported by TikTok. We retain structured records with source, geography, capture time, rights basis, confidence, and evidence. Access tokens and client secrets are not exposed to users or included in public responses.

Platform audiovisual media remains reference-only unless the applicable API terms or a separate written license permits byte storage. When storage is permitted, approved bytes are written to access-controlled cloud object storage. Otherwise, AdSignal keeps only permitted references, hashes or fingerprints, expiry information, and evidence metadata.

We may use providers for cloud hosting and object storage, content delivery, communications, authentication, payment, observability and security, and AI model or compute services. They may process information only as needed to provide their services to us and under applicable contractual and security controls.

We may disclose information when required by law, to protect users or the Services, in connection with a corporate transaction subject to appropriate safeguards, or with your direction or consent. We do not disclose platform credentials or sell raw API dumps that bypass a provider's access controls.

CreativeFly is developing Services for users and data sources in multiple regions, including the United States, Europe, Japan, and China. Information may be processed in a country other than the one where you reside. Where required, we use appropriate notices, contractual protections, consent, security assessments, or other lawful transfer mechanisms.

We apply reasonable technical and organizational safeguards, including access control, least-privilege service roles, transport encryption, secret isolation, audit logging, backups, monitoring, and incident response. No method of transmission or storage is completely secure.

We retain personal information only for as long as reasonably necessary for the purposes described here, our contractual relationship, security and dispute handling, and applicable legal obligations. We then delete, anonymize, or isolate it as required.

AdSignal retention is source-specific. Expiring media URLs are removed after their evidence window; hashes and provenance claims may be kept when permitted. Stored objects have a documented rights basis and retention state. Provider deletion, revocation, or licence requirements take priority over a general product retention period.

Depending on your jurisdiction, you may have rights to access, obtain a copy of, correct, delete, or restrict processing of your personal information; object to certain processing; withdraw consent; close your account; or complain to a competent authority.

Submit a request by email to yuki@spacetime.world. We may need to verify your identity and authority before acting. Some information may be retained where required by law or necessary for security, fraud prevention, or legal claims.

The Services are intended for business users and people able to enter into a binding agreement. They are not directed to children. If we learn that we collected a child's personal information without the authorization required by applicable law, we will take appropriate steps to delete or otherwise address it.

We may update this policy as the Services, providers, or legal requirements change. We will publish the updated version here and provide additional notice when a change materially affects your rights.

Privacy contact: yuki@spacetime.world. You may use this address for questions, complaints, and privacy-rights requests.