Skip to content

Privacy Policy

Last updated: July 12, 2026

This Privacy Policy explains how Aspargo LLC ("Company," "we," "us," or "our") collects, uses, stores, and discloses information in connection with CreatorCX (the "Service").

This Service is a private content-management tool for individual creators. We are not a public platform — your account and content are not visible to other users unless you choose to share access (a feature not currently offered).

1. Information We Collect

1.1 Information you provide directly

  • Account information: email address, display name, creator name, password (handled by our authentication provider; we do not store raw passwords).
  • Profile information: timezone, brand notes, and any other profile fields you fill in.
  • Content you upload: photos, videos, GIFs, audio, titles, descriptions, notes, tags, and any other metadata you attach to your content.
  • Planning and tracking data: posts you draft or log, platforms you configure, captions, scheduling information, and performance metrics you manually enter (such as views, revenue, or subscriber counts you report from third-party platforms).
  • Communications: anything you send us, such as support requests.

1.2 Information collected automatically

  • Usage data: pages/features accessed, actions taken within the Service, timestamps.
  • Device/technical data: IP address, browser type, operating system, collected through standard web request logs and our hosting/infrastructure providers. We also record the IP address associated with a media upload and retain it for safety, fraud prevention, and legal compliance (including any child-safety report we are required to make).
  • Cookies: we use cookies or similar technologies strictly necessary to operate the Service (such as maintaining your login session). We do not currently use advertising or cross-site tracking cookies.

We do not currently use third-party analytics or advertising trackers. If this changes, we will update this Policy and, where required by law, request your consent.

2. How We Use Information

We use the information described above to:

  • provide, operate, and maintain the Service (including storing and displaying your content back to you);
  • authenticate your account and enforce access controls so that only you can access your content;
  • generate thumbnails, previews, and derived files necessary for the Service to function;
  • respond to support requests and communicate with you about the Service;
  • maintain the security and integrity of the Service, including detecting and preventing abuse;
  • comply with legal obligations.

We do not sell your personal information or Your Content. We do not use Your Content to train any artificial intelligence or machine learning model. We do not share Your Content with any third party except as described in Section 4 below.

Our current practice is not to use Your Content to train AI or machine-learning models. We reserve the right to change our AI practices in the future if our business needs change — for example, to offer optional AI-powered features. If we do, we will update this Policy and provide notice before the change takes effect, and where a change would involve using Your Content to train a model, we will not do so without a lawful basis and, where legally required, your consent or an opportunity to opt out.

3. How Information Is Stored and Protected

  • Your account data and content metadata are stored in a managed Postgres database operated by our infrastructure provider, Supabase, Inc. ("Supabase").
  • Your uploaded media files are stored in private object storage operated by Supabase. Files are not publicly accessible; access requires an authenticated, time-limited signed link generated by the Service on your behalf.
  • Access to your data is restricted using row-level security so that, under normal operation, only your authenticated account can read or write your own records.
  • The Service's application code is hosted by Vercel Inc. ("Vercel").
  • Encryption in transit: data transmitted between you and the Service is encrypted using industry-standard TLS (HTTPS).
  • Encryption at rest: data stored in our providers' managed database and object storage is encrypted at rest by those providers.
  • Access controls: we use access controls — including row-level security and limited, role-based administrative access — so that access to your data is restricted to what is necessary to operate the Service.
  • Administrative safeguards: we limit who can access production systems, and we use reputable infrastructure providers that maintain their own security programs.
  • No method of storage or transmission is perfectly secure. While we use industry-standard practices to protect your information, we cannot guarantee absolute security.

4. How Information Is Shared

We disclose information only in the following circumstances:

  • Infrastructure subprocessors: Supabase (database, authentication, file storage), Vercel (application hosting), Sentry (error monitoring — receives technical error reports; we configure it not to collect IP addresses, to mask text, and to block media in any error recording), and Twilio SendGrid (transactional email delivery). These providers process data on our behalf, under their own security and privacy commitments, solely to provide the underlying infrastructure for the Service. A current list of subprocessors is available on request by contacting us at legal@creatorcx.app.
  • Automated safety screening: uploaded images and video are automatically screened against known child-sexual-abuse-material (CSAM) hash databases (such as PhotoDNA or a comparable provider) before being made available in your library. This is a legal and safety requirement of operating the Service, not optional, and applies to all uploads regardless of content type.
  • Legal and safety reporting: where we have actual knowledge of apparent CSAM, we are required by 18 U.S.C. § 2258A to report it, and to preserve associated content and account information, to the National Center for Missing & Exploited Children (NCMEC) via its CyberTipline, and/or to law enforcement. We do not provide advance notice to the account holder in these circumstances.
  • Legal requirements: if required to do so by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.
  • Business transfers: if the Company is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.
  • With your direction: if you explicitly direct us to share specific information (for example, a future feature allowing you to export or share data with a third-party tool).

We do not otherwise share your personal information or Your Content with any third party, including advertisers.

5. Data Retention

We keep your information only for as long as we need it to provide the Service and for the limited additional periods described below.

  • Active accounts: we retain your account information and content for as long as your account is active.
  • Lapsed subscriptions: if your subscription or free trial ends without renewal, we retain your account and content for a limited window so you can resubscribe and pick up where you left off — thirty (30) days after a free trial that did not convert to a paid subscription, and sixty (60) days after a paid subscription ends. We send warning emails to your account address before the window closes. After the window, your account and content are permanently deleted following the Account deletion process below. You can download a full export of your data at any time before then.
  • Deleted content: when you delete a piece of content, we mark it as deleted and remove it from normal use immediately. The stored file is purged from active storage within thirty (30) days, and residual copies in encrypted backups are generally purged within ninety (90) days. Content we are required to preserve (see Legal holds below) is retained regardless of deletion.
  • Account deletion: when you request deletion of your account, we will delete or anonymize your personal information and content within thirty (30) days, except for information we are permitted or required to retain as described below. Copies in encrypted backups are generally overwritten within ninety (90) days.
  • Billing and transaction records: records we need for tax, accounting, and legal compliance (including records held by our payment processor, Stripe) may be retained for up to seven (7) years.
  • Legal holds: we may retain information longer where required by law, or where necessary to comply with a legal obligation, preserve evidence, resolve disputes, or enforce our agreements — including content and account information we are required to preserve in connection with a CSAM report, as described in our Acceptable Use Policy and Section 4 above. Information subject to a legal hold is retained until the hold is lifted.

6. Your Choices and Rights

  • Access and correction: you can access and update most of your account and content information directly within the Service.
  • Deletion: you may request deletion of your account and associated data by contacting legal@creatorcx.app. We will process deletion requests as described in Section 5.
  • Data portability: you may request an export of your content and data by contacting us.

6.1 Legal bases for processing (EEA/UK)

Where the EU or UK GDPR applies, we process your personal information on the following legal bases:

  • Performance of a contract — to provide the Service you signed up for, authenticate your account, and process payments.
  • Legitimate interests — to secure, maintain, and improve the Service and to detect and prevent abuse, where those interests are not overridden by your rights and freedoms.
  • Legal obligation — to comply with laws that apply to us, including CSAM screening and reporting obligations.
  • Consent — where we ask for it (for example, if we introduce optional features that require consent). Where we rely on consent, you may withdraw it at any time.

6.2 California and other US state privacy rights

If you are a California resident (or a resident of another US state with a comprehensive privacy law), you have the right, subject to legal exceptions, to request to know or access the personal information we hold about you, to request correction of inaccurate personal information, to request deletion of your personal information, and to request a copy of your information in a portable format. We do not sell your personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights. To exercise any of these rights, contact us at legal@creatorcx.app; we may need to verify your identity before responding.

If you are located in a jurisdiction that provides additional statutory privacy rights (such as the EU/UK GDPR or US state privacy laws), you may also have rights to object to or restrict certain processing, or to lodge a complaint with a supervisory authority. Contact us at legal@creatorcx.app to exercise any of these rights.

7. Children's Privacy

The Service is not directed to, and may not be used by, anyone under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from someone under 18, we will delete it promptly.

8. International Data Transfers

Our infrastructure providers may process or store data in regions other than your own. By using the Service, you understand that your information may be transferred to and processed in a country with different data protection laws than your own.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (such as by email or in-app notice) before the changes take effect.

10. Contact

Questions about this Privacy Policy can be sent to legal@creatorcx.app.