Privacy Policy
Last updated: 28 October 2026
The short version
- We collect what we need to run your account: your email address, what you create, your credits and your payments.
- We record which tools you use in the app so we can improve it and understand how it's used.
- To generate content, we send your prompts and uploads to the AI providers listed below.
- We don't sell your data, and we don't use advertising or tracking cookies.
- We only send you marketing emails if you agree to them, and every one has an unsubscribe link.
1. Who we are
Creation AI (creationai.app) is run by MundusGate AI ("we", "us"). We are the data controller for the personal data described here, which means we decide how it is used and are responsible for protecting it.
Contact us about privacy at support@mundusgateai.com.
2. What we collect
Information you give us
- Your email address, when you sign in. We email you a one-time code; there is no password.
- What you create: the prompts, topics and settings you enter, any images, audio or video you upload, the content we generate for you, and the projects you save.
- Feedback you send us through the app.
Payments
Payments are handled by Stripe. We never see or store your full card number. We keep a record of your plan, your subscription status, the credits you have bought and used, and the Stripe reference numbers that link your account to your payments.
How you use the app
- Activity on your account: when you sign in, which tools you open, when you start a generation and whether it succeeds, and when you view pricing or start a checkout. This is linked to your account.
- Sign-in times: when you signed in and when you were last active, so you stay signed in and we can see how many people are using the app.
- Visits to our home page before you sign in are counted without identifying you.
- Usage counts of each feature per day, which do not identify you.
Technical information
- Your IP address, used for a short time to limit how often requests can be made and to block abuse. These counters are not linked to your account.
- Our hosting provider keeps standard server logs, which include IP addresses and the pages requested.
3. Why we use it, and our legal basis
UK data protection law requires us to have a legal basis for each use of your data.
| What we do | Legal basis |
|---|---|
| Create and run your account, sign you in, generate your content, save your projects, and manage your credits and subscription | Contract: we need it to provide the service you signed up for |
| Take payments and keep financial records | Contract, and legal obligation (tax and accounting law) |
| Protect the service: rate limits, fraud and abuse prevention, checking uploads for harmful content | Legitimate interests: keeping the service safe and working |
| Understand how the app is used and improve it, using your account activity | Legitimate interests: making the product better. You can object at any time (see section 7) |
| Send you service emails, such as sign-in codes and payment receipts | Contract |
| Send you news, offers and tips about Creation AI and our other products | Consent, or for existing customers, legitimate interests with an unsubscribe link in every email. You can opt out at any time |
4. Who we share it with
We use trusted service providers to run Creation AI. They only use your data to provide their service to us, under contracts that require them to protect it.
| Provider | What they do |
|---|---|
| Supabase | Our database and sign-in system. Stores your account, credits, projects and activity, and sends your sign-in codes. |
| Netlify | Hosts the website and runs the app's servers. |
| Stripe | Processes payments and subscriptions. |
| Anthropic | Generates text, such as ebooks, captions and listing copy, from your prompts. |
| fal.ai and WaveSpeed | Generate and edit images and video, including background removal, from your prompts and uploads. |
| HeyGen | Creates talking-avatar videos from your script and chosen avatar. |
| OpenAI | Checks scripts and prompts for harmful content before we turn them into video. |
| Google Fonts and Cloudflare (cdnjs) | Supply the fonts and code libraries the website loads, so they receive your IP address as part of a normal web request. |
The AI providers receive only what is needed to generate your content: your prompt, settings and any file you upload. They do not receive your payment details.
We may also share data if the law requires it, or with a buyer if our business is sold, in which case this policy would continue to protect your data.
We do not sell your personal data.
5. International transfers
Some of our providers are based in, or store data in, the United States and other countries outside the UK. When your data is transferred, we rely on safeguards approved under UK law, such as the UK–US Data Bridge, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Account, projects and activity: while your account is open. When you ask us to delete your account, we delete or anonymise this data within 30 days, except where we must keep it as set out below.
- Payment and tax records: 6 years, as UK law requires.
- Sign-in sessions: up to 30 days, or until you sign out.
- IP-based rate-limit counters: a few minutes.
- Content held by AI providers: each provider keeps inputs and outputs for a limited time under its own terms, typically to run the service and detect abuse.
7. Your rights
Under UK data protection law you have the right to:
- get a copy of the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use your data, including our use of your activity to improve the product
- receive your data in a portable format
- withdraw your consent to marketing at any time
To use any of these rights, email support@mundusgateai.com from the address on your account. We will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to sort it out with you first.
8. Cookies and storage on your device
- One essential cookie (
creation_session) keeps you signed in. It cannot be read by the app's scripts, and it expires after 30 days or when you sign out. Because it is needed for the service to work, it does not need your consent. - Your browser's local storage keeps your colour theme, your recently used tools and, if you open a shared preview link, its access code. This stays on your device and is not sent to us.
- The app can be installed on your device. It keeps a copy of its own files so it loads quickly.
We do not use advertising, analytics or tracking cookies.
9. Security
Data is encrypted in transit. Your sign-in session tokens are also encrypted where we store them, and access to our systems is restricted. No system is perfectly secure, but we work to protect your data and will tell you and the regulator about a serious breach as the law requires.
10. Children
Creation AI is a paid service for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children.
11. Changes to this policy
We will update this page when our practices change, and change the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.