Privacy Policy

This policy explains how Creatin Web handles personal data. Creatin Web is a service that designs and builds a website for your business and gives you a dashboard and mobile app to keep it up to date yourself. It is operated by CREATIN GROUPS PRIVATE LIMITED ("Creatin", "we", "us").

Who we are

The service is operated by:

Our two roles

We handle personal data in two different capacities, and your rights differ depending on which applies:

• As the data fiduciary — for the accounts of our clients (the business owners and their staff who sign in to the dashboard), and for enquiries people send us through this marketing site (the "Get a free quote", Contact and account-deletion forms). We decide how that data is used, and this policy governs it.
• As a data processor, on our client's behalf — for the enquiries that visitors submit on a client's own website (a contact message, a quotation request, a room booking enquiry, a school admission enquiry). That data belongs to the client whose website received it. We only store it and show it to that client in their dashboard; we do not use it for our own purposes. If you sent such an enquiry, please also see the privacy policy of the business whose website you used, and direct access or deletion requests to that business (we will help them action it).

What we collect

Account data (client owners, staff and admins)

• Email address — your sign-in identity. Accounts are created by Creatin during onboarding or by a website owner inviting staff; there is no public self-sign-up.
• Mobile number — optional, used only for one-time-code (OTP) sign-in by SMS. A code is only ever sent to a number already on an account.
• Google sign-in — if you sign in with Google, Google confirms your account ID and verified email to us so we can match it to your account. Google may also pass your name and profile photo; we store what Google returns but do not use the name or photo.
• Your role and permissions on each website, and sign-in timestamps.

Content you upload

Whatever you put on your website through the dashboard: text, photos, files, prices, and business details. This can include the names and photos of your own team or faculty and testimonials you add. This is your business content; you are responsible for having the right to publish it.

Website-visitor enquiries (processed for our client)

When a visitor submits a form on a client's website, we store what they typed so the client can respond: typically their name, phone number, email, and message, plus context such as the room or the course they asked about. School admission forms may include a prospective student's and parent's details. We do not store the visitor's IP address.

Usage analytics

On client websites we record simple, first-party analytics events — for example a page view or a form submission, with the page path and referrer — so the client can see how their site is doing. These are not tied to a named person, we do not store IP addresses, and we honour your browser's "Do Not Track" setting. We do not use third-party advertising or cross-site tracking.

Notifications

If you use the mobile app and allow notifications, we store a device push token so we can alert you to a new enquiry. The alert contains the enquiry sender's name and a short snippet; it never contains their email or phone number.

Payments and invoices

When you pay for your yearly plan, payment is handled on Razorpay's hosted checkout. Your card, UPI or bank details are entered directly with Razorpay and never reach our servers. We store the payment record (amount, status, Razorpay order/payment IDs) and the GST invoice we raise for it.

Optional Google connections

If a website owner connects Google Search Console or Google Analytics, we store an encrypted access token and read aggregate search/traffic numbers to show on the Analytics page. If they connect a Google Business listing, we import its rating and reviews (including the reviewer's name and public profile) to show as testimonials.

Emails we send

To run the service we send transactional emails (sign-in instructions, renewal reminders, receipts, quotations, and internal alerts). We keep a log of these, including the recipient and the message content, so we can confirm delivery and resend if needed.

How we use it

• To sign you in and keep you signed in, and to decide what you are allowed to see and do.
• To publish and serve your website, and to let you manage it.
• To pass visitor enquiries to the client whose website received them.
• To take payment for the service and issue GST invoices.
• To send service messages (sign-in help, renewal reminders, receipts) and, if you opt in, push notifications.
• To provide support, keep the service secure, prevent abuse, and meet our legal and tax obligations.

We do not sell your personal data, and we do not use it for advertising.

Cookies & sessions

We use only the cookies needed to run the service: a secure, http-only sign-in cookie from our authentication provider, and small first-party cookies that remember which website you have open and, for the demo, that your browser started a demo. On the mobile app, your sign-in tokens are held in the device's secure storage (iOS Keychain / Android Keystore), never in plain storage. We do not use advertising or cross-site tracking cookies.

Service providers (sub-processors)

We use a small number of trusted providers to run the service. Each receives only the data it needs:

Some providers are used only when a feature is enabled (Resend when email is configured; Google Search Console/Analytics/reviews only if an owner connects them; Razorpay when you make a payment).

Where your data is stored

Our main database, sign-in system and file storage are hosted with Supabase in Australia (Sydney). Some providers above process data in the United States, India or on a global network. Where we transfer personal data outside India, we do so to provide the service you have asked for and require those providers to protect it. If you would prefer your data be handled differently, contact our Grievance Officer.

How long we keep it

• Account data — while your subscription is active, and for 12 months after your account is closed, unless you ask us to delete it sooner.
• Invoices and payment records — for 8 years, because tax law (Income Tax and GST) requires us to keep them; these are retained even after account closure.
• Website content — until you delete it, or until your website is deleted.
• Visitor enquiries — kept for the client while their website is active, and deleted together with the website or account.
• Analytics events — kept for a rolling 25 months; older events are deleted automatically every day.
• Email delivery logs — kept for 24 months; older entries are deleted automatically every day.

When a website or account is deleted, the data linked to it in our database is removed automatically. Backups and provider logs may retain copies for a short period before they age out.

Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct or complete data that is wrong or out of date (you can edit most of it yourself in Settings).
• Erase your data, subject to records we must keep by law (such as invoices). Use our account & data deletion page, or Settings in your dashboard.
• Nominate another person to exercise your rights if you are unable to.
• Grievance redressal — raise a complaint with our Grievance Officer (below), and, if unsatisfied, with the Data Protection Board of India.
• Withdraw consent where our processing relies on your consent; this does not affect processing already carried out.

To make a request, use the forms linked above or contact our Grievance Officer. We may need to verify your identity first.

Children's data

Creatin Web is a tool for businesses and is not intended for children. We do not knowingly collect data directly from children. Where a client is a school and uses an admission-enquiry form, any details about a prospective student are provided by a parent or guardian and are processed on the school's behalf as described in "Our two roles". Direct requests about that data to the school; we will help them action it.

Security

All traffic is encrypted in transit (HTTPS/TLS, with HSTS). Access to data in our database is enforced row-by-row so a signed-in user can only reach the websites they are a member of. Optional Google tokens are stored encrypted, and mobile sign-in tokens live in the device's secure storage. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the authorities of a breach as required by law.

Changes to this policy

We may update this policy as the service changes or the law requires. We will change the "Last updated" date above, and for significant changes we will tell you in the dashboard or by email.

Grievance Officer

If you have a question or complaint about how your personal data is handled, contact our Grievance Officer. We will acknowledge your grievance and respond within the timelines under the Digital Personal Data Protection Act, 2023 and its rules.

Grievance Officer: Sumanth Deshani, Founder & CEO
CREATIN GROUPS PRIVATE LIMITED
Email: support@creatintechsolutions.com
Phone: +91 98448 66615