Draft v0.4 · Sole proprietorship, Tampa, Florida · Retention periods and a postal address must be confirmed before publication. This language needs client and legal approval before publication. It is a structured working draft, not a final legal guarantee.
Who is responsible for your data
Make Creati is a sole proprietorship operating from Tampa, Florida, United States, and is the controller of the personal data described here.
For any privacy question, request, or complaint: info@makecreati.com. A postal address for formal correspondence is available on request.
The short version
Your PDFs are processed in your own browser and are not uploaded to our servers. We do not read, scan, sell, or train anything on your documents.
We collect the minimum needed to run an account and take payment: an email address, order records, and basic technical logs. Card details go to our payment processor and never reach us.
Your documents
Documents you open in the editor are read and edited entirely inside your browser using local processing. They are stored in your browser's local storage (IndexedDB) on your own device.
That means: we cannot see them, they are not backed up by us, and clearing your browser data or switching browser or device removes them. If you need a copy, download it.
If a future feature requires server-side processing, it will be clearly labelled and optional, and this policy will be updated before it is switched on.
Account information
If you create an account we store the email address you provide and a securely hashed password. We use it to sign you in, show your purchase history, and contact you about your account or a support request.
We do not send marketing email unless you separately opt in, and every marketing message includes an unsubscribe link.
Payments
Payments are handled by PayPal. When you pay, you are on PayPal's own payment pages and enter your card or PayPal details there. Make Creati never receives, sees, or stores your full card number.
We receive a confirmation that a payment succeeded, the amount, the plan, and a transaction reference, which we keep as your order record and for tax and accounting purposes.
PayPal processes your data as an independent controller under its own privacy policy at paypal.com. If you pay by card as a guest, PayPal still handles those details, not us.
Cookies and similar technologies
Strictly necessary: a session cookie to keep you signed in, and an entitlement cookie recording what you have paid for. The site cannot work without these and they are not used for advertising.
Local storage: your documents, cart contents, order history, and support requests are held in your browser's own storage rather than on our servers.
Visitor measurement: we count visits ourselves, on our own server, without any cookie and without sending anything to a third party. See the next section for exactly what is counted.
Advertising: where we run advertising campaigns we may use cookies or similar identifiers from advertising partners, including Google, to measure whether an advert led to a visit or a purchase. These are only set where required consent has been given.
You can clear or block cookies in your browser. Blocking the strictly necessary ones will stop sign-in and purchases from working.
How we count visitors
We keep a count of how many people visit, which pages they open, and which country of website sent them, so we know whether the service is being found and used. This is measured by our own server. No third-party analytics service is used, no tracking cookie is set, and nothing about your visit is sent to another company.
We do not store a record of your individual visit. To count one person once per day without identifying them, we combine your IP address, your browser's user agent, a secret held only on our server, and today's date, and convert that into an irreversible code. Because the date forms part of it, the same person produces an unrelated code tomorrow, so there is no way for us to follow anyone from one day to the next, or to work backwards from a code to a person.
What is kept is a daily total: how many visits, which page addresses were opened, which website referred them, and whether the device was a phone, tablet or computer. Web addresses are recorded without anything after the question mark, and any document identifier in the address is removed before the address is stored. No document, document name, or document content is ever recorded.
Because this involves no cookie and no personal data, there is nothing here for you to consent to or opt out of. If you use an ad or tracker blocker it will most likely stop the count anyway, and the site works exactly the same either way.
Advertising and Google
We advertise this service, including through Google Ads. Third-party vendors, including Google, use cookies to serve adverts based on a person's prior visits to this website.
Google's use of advertising cookies enables it and its partners to serve adverts based on your visit to this and other sites. You can opt out of personalised advertising by visiting Google's Ads Settings, and out of third-party vendor cookies via aboutads.info/choices.
We do not share your documents, document contents, or file names with any advertising partner. Advertising measurement is limited to page visits and whether a purchase occurred.
Technical logs
Our hosting provider records standard server logs: IP address, timestamp, page requested, browser and operating system. These are used to keep the service running, investigate faults, and detect abuse.
Logs are retained for a short operational period and then deleted. They are not used to build a profile of you.
Who we share data with
Service providers who make the product work: our hosting provider, our payment processor (PayPal), and our email provider (Postmark) for transactional messages such as receipts and password resets. Each is bound to use the data only to provide that service.
Legal requirements: we may disclose information where we are required to by law, or to establish, exercise, or defend legal claims.
We do not sell personal information, and we do not share it with data brokers.
How long we keep things
Documents: on your device only, until you delete them or clear your browser data. We hold no copy.
Account records: while your account is open, and for a reasonable period afterwards to handle disputes.
Order and payment records: retained for the period required by tax and accounting law in the jurisdiction we operate in.
Support requests: kept while they are relevant to helping you, then deleted.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can also object to certain processing and withdraw any consent you have given.
Florida residents: the Florida Digital Bill of Rights applies to larger businesses and does not currently cover an operation this size, but we honour access and deletion requests from anyone who asks, regardless of where they live.
Depending on where you live you may have additional rights, including under the UK and EU GDPR, and under US state privacy laws such as the CCPA/CPRA. Californian residents have the right to know, to delete, to correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined.
To exercise any of these, contact info@makecreati.com. We will respond within the period the applicable law requires. You may also complain to your local data protection authority.
Children
This service is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact us and we will delete it.
Security
Traffic to and from the site is encrypted in transit. Passwords are stored hashed, never in plain text. Access to systems holding personal data is limited to those who need it.
Because documents stay on your device, the most important security control is your own: use a device and browser you trust, and do not leave sensitive documents in a shared browser profile.
Changes and contact
If we change this policy materially we will update the date on this page and, where the change affects how your data is used, tell you directly.
Questions, requests, or complaints: info@makecreati.com. Please do not send passwords, card numbers, or identity documents by email.