Skip to content
CreatorsBrains
Sign in
← Back to home

Privacy Policy

Last updated:

Lire cette page en français

CreatorsBrains ("we", "us") provides a workspace where professional content creators and the team members they authorize view the statistics of the creator's own social media accounts and run the creator's sales: booking forms, scheduled calls, call recordings, and the messages sent to the people who book. This policy explains what data we handle, why, and the rights you have over it. For any question: [email protected].

1. Data we collect

We handle data about three groups of people: the creators and team members who use CreatorsBrains, the people whose conversations appear on an account a creator connected, and the prospects who fill in a creator's booking form or book a call with the creator's team.

1.1 Creators, team members and connected accounts

  • Account data — when you create a CreatorsBrains account: name, email address, and authentication data.
  • Connected platform data — when a creator connects one of their own social accounts (YouTube, Instagram, TikTok) through the platform's official login, we receive: the account's identity (ID, username, display name, avatar), content metadata (titles, descriptions, publication dates, permalinks), and statistics (views, watch time, followers, likes, comments and similar metrics).
  • Conversations on the connected account — comments on the creator's own content and, on Instagram, the direct messages of the connected professional account: the message text, the time it was sent, and the public identity of the person who wrote it (their platform ID, username, display name and avatar). These people are third parties who have no account with us. We display these conversations to the creator and to the team members the creator has authorized — the same people who can already read them on the platform itself.
  • OAuth tokens — the access and refresh tokens that let us read the data above. They are encrypted at rest (AES-256-GCM) and are never exposed to anyone, including workspace members.
  • Team profile and activity — for each team member: phone number, time zone, roles, the hours they take calls, and a log of the actions they take in the workspace (who did what, and when).
  • Google Calendar used for scheduling — the workspace connects a Google account for scheduling. We read the busy times of the team members who take calls, so that only free slots are offered, and we create, move and cancel the event of each call booked through CreatorsBrains, with its time, the attendees' names and email addresses, and a Google Meet link. Google sends the invitations to the host and to the prospect. The tokens of this connection are protected like the OAuth tokens above.

We do not collect data from accounts that were not explicitly connected by their owner.

On the permissions we request. We only ever READ. We never publish, never send a message, never reply, never delete anything on a connected account. For most of what we read, the platform offers a permission that is read-only, and that is the one we ask for. For Instagram direct messages and comments there is no read-only permission: Meta only offers instagram_business_manage_messages and instagram_business_manage_comments, which also allow sending and deleting. Asking for them is the only way to read those conversations at all, so the consent screen will show you the word "manage". We say it here plainly rather than let you discover it there: the permission grants more than we do, and what we do is read.

Google Calendar is the one place we write, and it is not a social account. Scheduling a call means creating its event, moving it when the call is rescheduled and cancelling it when the call is cancelled. For the calendar the workspace connects for scheduling, we therefore ask for a permission that allows writing events, and we use it only to read busy times and to manage the events of calls booked through CreatorsBrains. The messages we send to prospects (section 1.2) never go through a connected social account.

1.2 Prospects who fill in a booking form or book a call

These people have no account with us. A creator's workspace collects their data through CreatorsBrains:

  • Form answers — what you type in a booking form (for example your name, email address, phone number, and your answers to the creator's questions). Each answer is saved as soon as you enter it, so it is kept even if you leave the form before the end.
  • Contact details — your name, email address and phone number, used to confirm and remind you of your call and for the creator's team to reach you.
  • Bookings — the time you chose, your time zone, the team member assigned to the call, and any reschedule or cancellation with the reason you give.
  • Visit data — a random identifier kept in a first-party cookie on the booking page, so that answers given over several visits stay together, and the campaign parameters (UTM) of the link you followed. Public forms are protected by Cloudflare Turnstile, which checks that a person and not a bot is filling them in; for this check Cloudflare processes technical data about your browser and your IP address.
  • Call recordings and transcripts — when a call takes place on Google Meet, a recording bot operated by Recall.ai joins the call as a visible participant, records it, and produces a transcript.
  • AI-written call notes — from the transcript, an AI model provided by Anthropic writes notes on the call: a summary, the objections raised, and the next step.
  • Messages — the emails, SMS and WhatsApp messages sent to you (confirmations, reminders, follow-ups), with their recipient, time and delivery status, and your opt-out if you reply STOP to an SMS. Emails are sent through Resend, SMS through Twilio, and WhatsApp messages from a WhatsApp number the creator's team links to CreatorsBrains, through WhatsApp's own service.
  • Notes and history — notes the creator's team writes about you, and the dated history of what happened (answers, bookings, calls, messages).

2. How we use data

Connected platform data is used for exactly one purpose: displaying the creator's own statistics inside their private CreatorsBrains workspace, to the creator and to the team members the creator has explicitly authorized. We do not use this data for advertising, we do not sell it, we do not share it with third parties, and we do not use it to train machine-learning models.

Prospect data and team data are used to run the creator's sales: to book, confirm, remind, reschedule and hold calls, to record and transcribe them, to write call notes, to send the messages the creator's funnel plans, and to show the creator's team who to follow up with. They are visible only to members of that creator's workspace, each according to their role; a call's recording and transcript, for example, are visible to the call's host and to members whose role includes reviewing calls. We do not use this data for advertising, we do not sell it, and we do not use it to train machine-learning models. We share it only with the service providers listed in section 5, each for the part of the service it performs.

For prospect data, the creator's organization decides why and how it is collected; we process it on that organization's behalf and on its instructions. Account and team data are processed to provide the service the creator's organization signed up for.

3. YouTube API Services

CreatorsBrains uses YouTube API Services to retrieve the data described above for connected YouTube channels. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. You can revoke CreatorsBrains' access to your YouTube data at any time via the CreatorsBrains dashboard or via Google security settings. Data retrieved from YouTube API Services is stored no longer than 30 days without refresh, is refreshed only while your connection is active, and is deleted when you disconnect the channel.

4. Instagram and TikTok

Instagram data is retrieved through the Instagram API with Instagram Login (Meta Platforms) and TikTok data through the TikTok Display API, in both cases with scopes granted by the account owner — read-only for TikTok and for Instagram insights, and, for Instagram messages and comments, the "manage" scopes described in section 1, which we use for reading only. Access can be revoked at any time from the CreatorsBrains dashboard, from Instagram's "Apps and Websites" settings, or from TikTok's "Apps and services" settings. Revocation triggers deletion of the corresponding stored tokens and data, as described in our data deletion instructions.

5. Service providers

We use these providers, each only for the part of the service named next to it:

  • GoogleGoogle Calendar and Google Meet: free and busy times, call events, invitations, video calls.
  • Recall.aiThe bot that joins Google Meet calls, records them and produces their transcript.
  • AnthropicThe AI model that writes call notes from the transcript.
  • TwilioSending SMS and receiving replies, including STOP.
  • ResendSending emails.
  • WhatsApp (Meta)Carrying WhatsApp messages sent from the number the workspace links to CreatorsBrains.
  • CloudflareThe bot check on public forms (Turnstile) and the hosting of this website.

Some of these providers are based in the United States and may process data there. When they do, the transfer relies on the safeguards the GDPR provides, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.

6. Storage and security

Data is stored in the European Union. OAuth tokens are sealed with authenticated encryption before touching the database. Access to a workspace's data is enforced server-side on every request: only members of the creator's organization, with the appropriate role, can view it. Security-relevant events (connections, revocations) are logged.

The providers in section 5 hold, on their own systems, the data their part of the service needs. Every action a team member takes in a workspace is logged with who took it and when.

7. Retention and deletion

  • Disconnecting an account deletes its stored tokens immediately; its cached statistics are deleted within 30 days.
  • Deleting a CreatorsBrains account, or emailing [email protected] from the workspace's registered address, removes all associated data within 30 days.
  • See Data Deletion for step-by-step instructions, including deletion requests initiated from Meta platforms.
  • Prospect data (form answers, including partial ones, contact details, bookings, recordings, transcripts, call notes and messages) is kept while the creator's workspace uses it, and deleted within 30 days when the workspace is deleted or when we receive a deletion request from the person concerned (see Data Deletion, section 4).
  • A person who replies STOP to an SMS receives no more SMS from that workspace; the opt-out itself is kept so that it keeps being honoured.

8. Your rights

Under the GDPR and similar laws, you can request access to, correction of, or deletion of your personal data, and you can object to or restrict its processing. Write to [email protected]; we answer within 30 days.

If you are a prospect, you can also write to the creator whose form you filled in; we help them answer. You can also lodge a complaint with your data protection authority (in France, the CNIL).

9. Cookies

This website (creatorsbrains.com) sets no cookies and loads no tracking script. The app at app.creatorsbrains.com sets a session cookie to keep you signed in. Booking pages set the first-party visitor cookie described in section 1.2.

10. Changes

If this policy changes materially, we will announce it in the product and update the date above. Continued use after a change means acceptance of the new version.