Privacy policy

Last updated: October 24, 2026

The short version

• This website sets no cookies and uses no tracking pixels or advertising tools.
• Fonts, images and scripts are served from our own domain. Nothing loads from Google or social networks.
• We only process the data you send us, the data needed to deliver the website, and, if we wrote to you first, your business contact details.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

CreatorAssets is a service of PMM IMPEX GmbH. We have not appointed a data protection officer because the law does not require one for us. For any privacy question, write to hello@getcreatorassets.com.

Hosting and delivery of this website

This website is hosted and delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes the connection data your browser sends with every request: IP address, date and time, the page requested, referrer, browser and operating system. This is needed to deliver the pages and to protect the site against attacks and abuse.

Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are also covered by the EU Standard Contractual Clauses. We do not keep server logs of our own. We only see aggregated traffic figures, without individual profiles.

Email

When you email us, we process your message and the contact details in it to answer you and, where relevant, to prepare or carry out a project. Legal basis: Art. 6(1)(b) GDPR for project enquiries, otherwise Art. 6(1)(f) GDPR. Emails to our domain are routed by Cloudflare (see "Hosting and delivery" above) and stored with our email provider.

Payments

The pilot is paid through Stripe. Payment details go directly to Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; we never see your full card details. Stripe acts as an independent controller for parts of this processing, such as fraud prevention and its legal obligations. We receive your name, email address, billing details and the answers you give in the checkout fields. Legal basis: Art. 6(1)(b) GDPR. Stripe's privacy policy: stripe.com/privacy.

Client projects

To produce your ads we use the materials you send us: product images, product page links, brand guidelines, claims and briefing answers. Legal basis: Art. 6(1)(b) GDPR. We produce presenters, voices and video with AI generation services, including ElevenLabs, Inc. We only send them what an ad needs: scripts, product images and our own presenter references. Please do not include personal data of third parties in your materials.

If we contacted you first

We offer our services to companies by email. For this we process business contact details: name, role, business email address, company and publicly available information about the company. We collect them from public sources such as company websites and from B2B data providers.

Purpose: offering our services to your company. Legal basis: our legitimate interest in direct marketing to businesses (Art. 6(1)(f) GDPR, Recital 47). You can object at any time, free of charge, with a short reply or an email to hello@getcreatorassets.com (Art. 21(2) GDPR). After an objection we contact you no more and keep only the minimum needed to respect it (your email address on a suppression list). If no conversation develops, we delete your contact details within 12 months.

How long we keep data

We delete personal data when it is no longer needed for the purpose above. Invoices, contracts and business correspondence are kept for the periods required by German commercial and tax law, generally six or ten years (§ 257 HGB, § 147 AO).

Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15–21 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place.

Security

All connections to this website are encrypted with TLS.

Changes

We update this policy when our services or the law change. The date at the top shows the current version.