Controller within the meaning of Art. 4 (7) GDPR is:
rawlenses media, proprietor Filip Nies
Am Sonnenhang 20, 57223 Kreuztal, Germany
Postal address: Königstraße 18, 70173 Stuttgart, Germany
VAT ID: DE362309606
Email: hello@creatifs.com

We have not appointed a statutory Data Protection Officer as the mandatory thresholds under § 38 BDSG are not met. Data-protection inquiries reach the controller directly at the address above.

• Account data: name, email, password hash and role.
• Business & billing data: company name, VAT ID, billing address and, for creators we pay, the bank details and tax information needed for payment.
• Creator directory data: publicly available social handles, portfolio media, niches, and self-declared availability, collected from public sources or provided by the Creator during application.
• Request & project data: the answers in your concierge request (project type, formats, locations, dates, usage, budget, brief, references), creators you shortlisted, status updates, notes our team shares with you, proposals, invoices and delivered files.
• Usage & log data: IP address, user-agent, timestamps, referrer, and technical error logs kept for security and abuse prevention.
• Communications: emails between you and our team, request confirmations, creator discovery notices, and delivery events such as bounces or complaints reported by our email provider. Creator discovery email has no open-tracking pixel.

• Providing the website and accounts, handling your concierge request, researching and contacting creators for it, preparing proposals and running the booked project — Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual steps at your request).
• Invoicing, paying creators and tax retention — Art. 6 (1) (b) and (c) GDPR (contract + legal obligation under § 147 AO / § 257 HGB).
• Operating creator-owned profiles and connected portfolios — Art. 6 (1) (b) GDPR (account and platform service); where a separate permission is required, Art. 6 (1) (a).
• Curating unclaimed creator listings from public professional sources and informing their owners by email — Art. 6 (1) (f) GDPR (legitimate interest in operating a B2B directory). This may include a handle, location, category, niches, follower count, selected public Instagram works and professional links; contact details are not published. Creators may object at any time (Art. 21) and unsubscribe from outreach separately. See the Art. 14 directory notice.
• Security, fraud and abuse prevention — Art. 6 (1) (f) GDPR.
• Marketing emails and product updates separate from the directory notice — Art. 6 (1) (a) GDPR (consent, revocable at any time) or, where its requirements are met, § 7 (3) UWG for existing customers. Directory outreach is described separately above; the GDPR basis does not override applicable rules on unsolicited email under German law.
• Cookies and similar technologies that are not strictly necessary — § 25 (1) TDDDG (consent).

We share personal data only with carefully selected processors under written agreements pursuant to Art. 28 GDPR:

• Supabase (via Lovable Cloud) — hosting, authentication, database, storage. Servers in the EU (Frankfurt).
• Cloudflare, Inc. — CDN, DNS, DDoS protection, image proxy and R2 object storage for files creators upload. EU-US Data Privacy Framework certified.
• Resend — transactional email delivery, including request confirmations.
• Google Ireland Ltd. — OAuth sign-in (when you use "Continue with Google") and Google Maps / Places for location search in the directory and the request form.
• Our bank and accounting providers — invoicing and payments for booked projects.
• Technical logging providers — error and security monitoring, where enabled.
• Meta Platforms Ireland — for Instagram sign-in, connected-portfolio sync and links to public Instagram posts in the directory.

When we research a request, we share the brief details creators need to judge the project (company, project type, dates, location, scope and usage) with the creators we contact. Your personal contact details are passed on only once a project is booked and only where needed to carry it out. Creators we book receive what is needed to deliver; clients receive the booked creator's name and professional details. Access to request data on the website is restricted to you and our team by row-level security.

Where processors act outside the EU/EEA (e.g. Cloudflare US infrastructure), or where a creator you request is based outside the EU/EEA, transfers rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses (Art. 46 (2) (c) GDPR) with additional safeguards. Copies are available on request.

• Account and profile data: while needed to provide the service; following deletion, removed or anonymised where possible, subject to backups and legally necessary records. Open projects and invoices must be settled first.
• Concierge requests and project notes: for the duration of the request or project and up to 3 years afterwards to handle follow-up questions and claims, unless you ask us to delete them earlier.
• Invoices, accepted proposals and tax-relevant records: for the applicable statutory retention period (which may be up to 10 years), then deleted unless needed for a legal claim.
• Unclaimed listings and discovery outreach: until claimed, objected to, removed, or no longer needed. Suppression information needed to honour an objection or unsubscribe may be retained.
• Server and security logs: up to 90 days, longer if required for incident investigation.
• Marketing consent records: until consent is withdrawn plus 3 years to evidence lawful processing.

Our team may add an unclaimed professional profile before its owner joins, including up to six of their own public Instagram posts as a showcase and a short professional description. We collect these details from publicly available professional profiles, then may send a discovery email to a professional contact address. We give an Art. 14 notice at first contact and provide claim, unsubscribe and removal choices. An unclaimed listing does not mean that its creator has endorsed créatifs.

Creators can verify ownership with Instagram, complete or update their profile and choose their showcase. Claiming does not grant us permission for off-platform promotion. An owner may object to an unclaimed listing via the directory notice; account holders can manage or delete their account in settings. Email privacy@creatifs.com for privacy requests.

Creators connect their Instagram account through Meta's official login. This verifies ownership and, where authorised, keeps the connected portfolio up to date. The login dialog describes the permissions requested; the connection can be revoked in Instagram or in the app.

• We receive: account id, username, account type, media list (caption, media type, permalink, timestamp) and media links.
• Instagram-sourced media stays on Meta's own content delivery network. To keep the site fast, image requests pass through our Cloudflare image proxy, which resizes them on the fly and holds them only in a temporary edge cache — we never store Instagram images or videos in our database or object storage, and cached copies expire automatically.
• Separately, a Creator may upload their own files to their profile. Those uploads are stored by us (Cloudflare R2) because the Creator chose to upload them; they are not Instagram data.
• Access tokens are stored encrypted, refreshed automatically and used only to keep the connected portfolio current.
• Disconnecting in Instagram (Settings → Apps and websites) stops future syncs and triggers our deauthorisation process. For a full account or data deletion request, use our deletion page; Meta-initiated deletions receive a confirmation code to check the status at creatifs.com/data-deletion.
• We do not sell Instagram data or use a connected creator's private account data for advertising. Public professional posts may be used in an unclaimed listing as described above; separate off-platform promotion requires optional permission.

Creators can separately allow us to feature their work in créatifs marketing. This permission is optional, is not part of the Terms of Use, and can be withdrawn at any time in the profile settings or by writing to hello@creatifs.com.

• Data processed: the work shown on the créatifs profile (posts from the connected social profile and own uploads), name, social handle, profile picture and the Creator's likeness where it appears in that work.
• Purpose: promoting the Creator and the créatifs platform on our own and third-party channels, including collaborator tagging on Instagram, newsletters, press and event material.
• Legal basis: consent, Art. 6 (1) (a) GDPR and § 22 KUG. Selection and publication may be automated and recurring.
• Recipients: the social and advertising platforms on which the material is published, and our newsletter and design service providers.
• Storage: for as long as the profile is active and the permission stays switched on. We log when the permission was given or withdrawn, and which version of the Profile Promotion Terms applied, to be able to prove it.
• Withdrawal: effective for the future; we stop new publications immediately and remove existing organic posts within 14 days where the platform allows it. Declining or withdrawing has no effect on the account, ranking or visibility.

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• rectification (Art. 16);
• erasure ("right to be forgotten", Art. 17), subject to statutory retention;
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on Art. 6 (1) (f) at any time (Art. 21);
• withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7 (3));
• lodge a complaint with a supervisory authority — for us the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

Signed-in users can use their account settings to request a data export or delete their account. Invoices and other records we must keep by law cannot be erased immediately; see our deletion notice.

Requests: privacy@creatifs.com. See also our Data Deletion instructions.

Browsing créatifs works without consent. Strictly necessary cookies and local storage cover authentication, session security and remembering your cookie choice (§ 25 (2) TDDDG — no consent required). Fonts are served from our own servers, post thumbnails are proxied through our own image domain (img.creatifs.com), and the map basemap tiles set no cookies, so all of that is shown to everyone. Payment processing and file delivery are necessary for the performance of our contract. Your request draft is kept in your own browser storage until you send it.

The only content that requires your consent is an embedded Instagram post: opening one loads a frame from instagram.com, which lets Meta set its own cookies and receive your IP address. We ask before that frame loads and you can always open the post on Instagram instead. Address autocomplete contacts Google Maps only once you start typing into a location field. We do not run advertising or cross-site tracking cookies; should that change, they would likewise load only after explicit consent. You can change your choice at any time by clearing site data in your browser.

We use algorithmic search and ranking to display Creators. Which creators we propose for a request is decided by our team, not by an automated system, and we do not carry out automated decision-making within the meaning of Art. 22 GDPR that produces legal effects for you.

We apply appropriate technical and organisational measures under Art. 32 GDPR: TLS in transit, encryption at rest for storage buckets, row-level security in the database, principle of least privilege for staff access, and audited third-party processors. No system is fully secure — we cannot guarantee that unauthorised access will never occur, but we treat every incident with priority and notify affected users and authorities where legally required.

We update this Privacy Policy when our processing changes. Material updates are announced by email or in-app notice. The current version is always available at creatifs.com/data-protection.