Who the data controller is
Your personal data is processed by Create Go LLC, 7901 4th St N STE 300, St. Petersburg, FL 33702, USA, EIN 36-4985740, which operates Crelto: the crelto.com website and the Crelto mobile apps. For any question about your data, or to exercise your rights, write to us at support@creatego.net.
This policy applies to all Crelto Services. For some data — student data entered by teachers and data sent through the forms of websites built with Crelto — the controller is the user who collects it, and we process it on their behalf (see the section “Data processed on behalf of other users”).
What data we collect
Data you give us
- Account: your name, email address, password (stored only as a hash, never in plain text), preferred language, country and locality, what you want to do on Crelto and, if you add one, your phone number confirmed by SMS.
- Sign-in with Google, if you choose it: your name, email address, profile photo and Google account identifier.
- Profiles, services and requests: display name, professional title, descriptions, skills, experience, education, languages spoken, locality, photos and videos, links to websites and social networks, prices, schedule and budget preferences and, if you fill it in, the age of the learner.
- Communication: messages exchanged with other users, confirmed orders (price, currency, status), reviews and ratings, the accounts you follow and the listings you save.
- Reports and blocks: what you report with the “Report” button and whom you block. The details are in the “Reports and blocks” section.
- What you create with Crelto tools: websites and blog posts, conversations with the AI assistant and what it generates, uploaded files (with their name, type and size), classes, boards, added students and their progress in exercises.
- Social media accounts, if you connect them: the account identifier, name, username and picture, the permissions granted, access tokens (stored encrypted) and publishing results.
- Messages you send us, for example to support.
Data collected automatically
- Technical data: IP address, browser and device type, date and time of access and pages visited, in server logs and in your sign-in session.
- Approximate locality, derived from your IP address, to show you listings near you. We do not use your device's GPS location. To avoid repeating the detection, we keep a cryptographic fingerprint (hash) of the IP address, not the address itself. You can change your locality at any time.
- Statistics: the daily number of views of each service and request, without knowing who viewed them, and the use of AI features per account, to apply usage limits.
- Log of confirmation SMS messages: the masked number (for example +373•••456) and a cryptographic fingerprint of it, the provider, delivery status and date. The code sent is not kept in the log.
- Cookies and similar technologies, described in the Cookie Policy.
Data about other people
If you give us data about other people — for example the names of your students, the age of the child you are looking for a tutor for, or photos showing other people — you must have the right to share it. Do not give us sensitive data (about health, religion, political opinions and the like) unless it is strictly necessary.
Why we use data and on what legal basis
We process data only for clear purposes and only on a legal basis, in accordance with the General Data Protection Regulation (GDPR) and Law No. 195/2024 of the Republic of Moldova:
- To provide the Services (performance of a contract): creating and managing your account, publishing profiles, services and requests, messages, reviews, websites, tools for teachers and publishing to social networks. AI features that send your content to OpenAI — the assistant, the generation and editing of texts, images and websites, automatic translations, automatic selection of service categories and checking of screenshots — rely instead on your consent (Article 6(1)(a) GDPR). We ask for it once per account, and you can withdraw it at any time in Settings → Crelto AI, without affecting the processing carried out before. While your consent is in place, we keep the date on which you gave it, so that we can demonstrate it.
- For safety and abuse prevention (our and our users' legitimate interest in a safe platform): email address and phone number confirmation, password resets through a link sent by email, account protection, rate limiting, automatic detection of contact details and links in messages, reviewing reports and enforcing the rules.
- To show you relevant results (legitimate interest): detecting your locality from your IP address and ranking search results, including with the help of an AI model. For ranking, the model receives only the search text, the chosen locality and the public data of the listings found (title, tags, category and locality), with no information about who is searching; this is why we do not ask for your consent for it, and search works the same without it.
- To improve Crelto (legitimate interest): aggregated usage statistics and troubleshooting errors. In addition, only with your analytics consent, we record navigation sessions on Crelto: pages, clicks, scrolling and screen dimensions. When you are signed in, the session is linked to your account; otherwise we use a random visitor identifier. Recordings remain on Crelto servers, accessible only to the super administrator, for 30 days. Entered values are masked; private messages, sign-in, account settings, student tools and websites built by users are excluded. Mobile apps are not recorded. You can withdraw consent through Cookie settings.
- To communicate with you (performance of a contract or legitimate interest): messages about your account, security and changes to the Services, and answers to your questions. We do not send you marketing messages without your consent.
- To comply with the law and protect our rights (legal obligation or legitimate interest): responding to authorities, keeping evidence in a dispute, and establishing, exercising or defending legal claims.
- With your consent: the app's access to your camera, microphone or photo library, which you can withdraw in your phone's settings, and any other purpose for which we ask for your consent.
Your name, email address and password (or Google account) are required to create and use an account; without them we cannot provide the Services. All other data is optional. When we rely on legitimate interest, we have weighed our interest against your rights, and you can object at any time.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Automatic flags on messages are reviewed by a person before any action is taken.
What other users can see
- Published profiles, services, requests and published websites are public and may be indexed by search engines.
- Reviews show the author's first name, the initial of their last name, the rating and the comment.
- Messages are visible only to the participants in the conversation, including approved members of a group request.
- We do not display your email address publicly. Your profile phone number is private and is shown publicly only if you choose that option. If you write contact details in a listing or a message, they will be visible to those who have access to that content.
Reports and blocks
When you report something with the “Report” button, we keep: your account, what you reported (the profile, service, request, review, conversation, message or website) and the account it belongs to, the reason you chose, the details you write, the page you reported it from, and a copy of the reported text as it was when you reported it. After the review we add the decision (the report is dismissed, the content is removed or the account is suspended), when it was made and who on the Crelto team made it. When we suspend an account, we also keep the date of the suspension.
Reports are seen only by the members of the Crelto team who handle moderation. To review a report, they can read the reported content, including a private message or conversation reported by one of its participants. We do not tell the reported person who reported them. We pass reports on to the authorities only when the law requires it or someone is in danger.
When you block someone, we keep who blocked whom and when, so that you can no longer write to each other and neither of you sees the other's listings in Explore. The blocked person is not notified, and no other user can see the list of accounts you blocked; you find it in Settings.
We process this data on the basis of our and our users' legitimate interest in a safe platform and, for reports of illegal content, the legal obligation to receive and act on such reports under Regulation (EU) 2022/2065, the Digital Services Act (DSA). How long we keep it is explained in the “How long we keep data” section.
Transfers outside the European Union
Data is stored in the European Union. Create Go LLC is a US company, and some providers, such as OpenAI and Resend, process data in the USA or in other countries outside the European Economic Area and the Republic of Moldova.
For these transfers we use the safeguards provided by law: the Standard Contractual Clauses approved by the European Commission, the Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework where applicable, or, as the case may be, the transfer being necessary for the performance of our contract with you. You can ask us for a copy of the relevant safeguards.
How long we keep data
- Your account and content: for as long as you have the account. What you delete disappears from Crelto, and deleted files are then also removed from storage.
- After your account is deleted: we delete the account and its associated content. Conversations that other users started with you remain with them, without your name.
- Sign-in session (including IP address and browser): for as long as you stay signed in; a session expires after 30 days without activity or when you sign out.
- SMS log: no more than 90 days, as evidence in a delivery dispute.
- Server logs: a short period, as needed for security and troubleshooting.
- View and visit statistics: only in aggregated or pseudonymized form, for as long as the listing or website exists. Navigation session recordings: no more than 30 days; recordings linked to an account are also deleted when that account is deleted.
- Reports: for as long as they are needed for the platform's safety and our legal obligations, as a rule no more than 3 years after the decision; longer only if the law or an ongoing dispute requires it. If you or the reported account delete your account, the report remains but is no longer linked to that account.
- Blocks: until you unblock the person or until either of the two accounts is deleted.
- Data needed to comply with the law or to defend ourselves in a dispute: for as long as the law requires or until the dispute is resolved.
Some copies may remain briefly in system backups until they are overwritten in the normal cycle.
Your rights
Depending on the law that applies to you, including the GDPR and Law No. 195/2024 of the Republic of Moldova, you have the right:
- to know what data we hold about you and to receive a copy of it (right of access);
- to correct inaccurate data (right to rectification); you can change most of it directly in your account;
- to request the deletion of your data (right to erasure);
- to request the restriction of processing;
- to receive the data you gave us in a structured, commonly used format and to transmit it to another controller (right to data portability);
- to object to processing based on our legitimate interest;
- to withdraw your consent at any time, without affecting the processing carried out before;
- not to be subject to a decision based solely on automated processing that produces legal effects concerning you.
To exercise your rights, write to support@creatego.net, preferably from your account's email address. We will reply free of charge within one month; in complex cases this may be extended by two further months, and we will let you know. We may ask for additional information to confirm that the request comes from you.
You can lodge a complaint with the data protection authority of the country where you live or work, or where the alleged infringement took place: in Romania, the National Supervisory Authority for Personal Data Processing; in the Republic of Moldova, the National Center for Personal Data Protection; the list of authorities in the European Union is on the European Data Protection Board website. Please contact us first so that we can try to resolve the issue.
Deleting your account
You can delete your account at any time, without giving us a reason: in Account settings, on the website or in the Crelto app, using the “Delete account” option, or by writing to support@creatego.net from your account's email address — including when you can no longer access it. The steps are also described on the How to delete your Crelto account page.
Deletion in Settings takes effect immediately; a request received by email is confirmed and carried out within 30 days. Together with the account we delete your profiles, services, requests, the conversations you started (with the messages, orders and reviews in them), the reviews you wrote of profiles and services, websites and blog posts, classes, added students and boards, connected social media accounts and the posts written in Crelto, conversations with the AI assistant, the accounts you follow, saved listings, your membership in group requests, your invitation program data and uploaded files. Conversations other users started with you and other people's group chats stay with them, with everything in them, but without your name; only the automatic notices in group chats about who joined or left the group keep your first name and the initial of your last name. Posts already published on social networks stay on those platforms; you can delete them there. The data described in “How long we keep data” also remains, for example the SMS log, for no more than 90 days.
Deleting your account does not necessarily revoke access granted through other services: you can also revoke it in the settings of your Google, Facebook, Instagram, Threads or TikTok account.
Children
Crelto accounts are intended for people aged 18 or over. We do not knowingly collect data directly from children under 16 (under 13 in the USA), except through the tools for teachers described below.
A teacher can create accounts for their students, with a name or nickname and a password, and can see their progress in exercises. The teacher decides what data to enter and is responsible for obtaining the consent of parents or guardians where the law requires it; we process this data only on the teacher's behalf. The student portal shows no ads and uses no tracking cookies.
If you are a parent or guardian and believe we hold data about your child without the necessary consent, write to us at support@creatego.net and we will delete it.
Data processed on behalf of other users
Sometimes our users decide what data they collect and why, and we process it only for them, as a processor:
- teachers, for the data of their students and of the guests on shared boards;
- owners of websites built with Crelto, for the data visitors send through forms (name, phone, message) and for visit statistics.
If you have sent data to such a user, please address requests about your data to them first. If you write to us, we will pass your request on and help them respond.
Website statistics are calculated without cookies and without storing the IP address: a visitor is recognized by a cryptographic fingerprint that changes every month. To limit the messages sent through forms, we keep a fingerprint of the IP address, not the address itself.
Data security
We protect data with appropriate technical and organizational measures: encrypted connections (HTTPS), passwords stored only as hashes, encrypted access tokens, private files accessible only through signed links with limited validity, restricted access to data, and data minimization — for example, we keep fingerprints of IP addresses instead of the addresses.
No system is perfectly secure. If a security breach occurs that may affect your rights, we will notify you and the authorities as required by law.
Mobile apps
The Crelto apps for iOS and Android display the crelto.com website, so this policy applies to them as well. The app asks for access to your camera, microphone or photo library only when you choose to take a photo, record a video or a voice message, or upload a file; you can refuse or revoke access at any time in your phone's settings.
The apps do not use GPS location, do not access your contacts, do not use advertising identifiers and do not track you across other companies' apps or websites.
Third-party links and content
Crelto may contain links to other websites and videos embedded by users (for example from YouTube, Vimeo or Loom). When you open or play them, those services may collect data under their own policies, for which we are not responsible.
Changes to this policy
We may update this policy when the Services or the law change, and the date of the last update appears at the top of the page. We will notify you of important changes in Crelto or by email before they take effect.
Contact
Create Go LLC, 7901 4th St N STE 300, St. Petersburg, FL 33702, USA. Email: support@creatego.net. You can write to us in Romanian, English or Russian.