Your data. Your privacy choices.

1. What We Collect

We collect information to provide our services and, if you choose, measure our campaigns. First-party analytics and Meta marketing have separate privacy choices. We do not use data brokers.

1.1 Session Data

When you log in, we create a session to maintain your authenticated state:

• Session identifier (random token)
• Authentication timestamp
• Last activity timestamp

1.2 Page Views

We collect minimal analytics to understand how our content serves you:

• Page URL visited
• Referrer (how you arrived)
• Approximate location (country-level, derived from IP)
• Device type (mobile/desktop)
• Browser family (e.g., Chrome, Safari—not fingerprinting)

First-party analytics stay separate from Meta marketing. Allowing analytics does not allow us to share your visits or inquiries with Meta.

1.3 User Profile

If you create an account, we store:

• Email address (for authentication)
• Display name (optional)
• Avatar URL (if you set one)
• Account creation date
• Consent preferences (analytics opt-out status)

1.4 Optional Meta marketing

Meta marketing is off by default. If you allow it in Privacy choices, we share public page visits and saved inquiry events with Meta to measure Facebook and Instagram campaigns. Event information can include the public page path, event type and time, an event identifier, and IP address and browser information. Saved inquiries can also include a hashed email for matching to a Meta account. Hashing changes the email into a coded value; it does not make the information anonymous.

We exclude inquiry messages and private page identifiers. We use a first-party cookie and a server consent receipt to remember your separate marketing choice for up to 180 days. You can withdraw it through Privacy choices. Do Not Track and Global Privacy Control keep Meta marketing off.

2. Why We Collect It

2.1 Authentication

Session data allows you to stay logged in and access your account across our properties.

2.2 Personalization

Your profile data enables personalized experiences like progress tracking on createsomething.agency (Services).

2.3 Service Improvement

Aggregate page view data helps us understand which content resonates and where to focus our efforts. We do not sell this first-party analytics data. Optional Meta marketing measures campaign activity only when you separately allow it.

3. How Long We Keep It

After retention periods expire, data is permanently deleted—not archived, not anonymized for later use. Deleted means deleted.

Marketing consent and delivery records are separate from page-view analytics. Withdrawing consent stops future sharing and cancels pending delivery; it does not recall events already sent to Meta. Meta processes received events under its own privacy policy. Contact us below for help with a deletion request.

4. Third Parties

Cloudflare runs our website and measurement infrastructure. Meta receives marketing events only when you separately allow Meta marketing.

We do not use:

• Google Analytics or any Google services
• Data brokers or data enrichment services
• Social login providers (we use our own identity system)

5. Your Rights

You have full control over your data. These rights apply to all users, regardless of location:

5.1 Access

Request a complete copy of all data we hold about you. We'll provide it in a machine-readable format (JSON) within 30 days.

5.2 Export

Download your data at any time from your account settings. No request needed—it's self-service.

5.3 Deletion

Request permanent deletion of your account and all associated data. We process deletion requests within 30 days. Once deleted, data cannot be recovered.

5.4 Correction

Update your profile information at any time through your account settings.

5.5 Opt-Out

Opt out of analytics collection from the on-site privacy controls or your account settings. Your choice is stored and respected across CREATE SOMETHING properties.

On Agency, open Privacy choices to change Meta marketing independently of analytics. Choosing Necessary only turns both off. If the marketing service is unavailable, it stays off.

6. Contact for Privacy Requests

For any privacy-related requests or questions:

For automated requests (access, export, deletion), use the self-service options in your account settings—they're faster than email.

7. Legal Compliance

This policy is designed to comply with:

• GDPR (European Union)
• CCPA/CPRA (California, USA)
• PIPEDA (Canada)

We apply these protections to all users, regardless of jurisdiction. Privacy shouldn't depend on where you live.

8. Changes to This Policy

We'll notify you of significant changes via email (if you have an account) and update the "Last updated" date. Minor clarifications don't require notification but are reflected in the date.

Last updated: November 5, 2026