Version 2026-09-22 · Last updated September 22, 2026
This Privacy Notice for Creo Proposals ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share your personal information when you use our services, including when you visit https://creoproposals.com or use the Creo Proposals platform.
Questions or concerns? Contact us at support@creoproposals.com.
We collect personal information that you voluntarily provide when you register on the Services or otherwise contact us. The personal information we collect may include:
Information about the people you share a proposal with. A shared proposal is opened through a link. Before it will show anything, the person opening it enters their email address, which we use to recognise them on that proposal and for nothing else. If they leave a comment we store the comment, the name they type, and the email address they entered to open the proposal. If the proposal offers a choice between options, we store which option they preferred, a name to show your advisor — the one on your record for them where you have entered one, otherwise the name they give us — and an irreversible code derived from their email address rather than the address itself — enough to count one person once and to show them their own choice, and not enough on its own to identify them from the record.
How long we keep it. Comments and the record of who opened a proposal live as long as the proposal does, and are deleted with it. A stored preference is deleted as soon as you settle the choice it was about, because the question it answered no longer exists. Deleting your account removes all of it.
Payment Data. Card details are entered on a page hosted by Stripe, our payment processor, and are never transmitted to or stored on our servers. This applies both when you buy credits and when you save a card for auto-reload. What we store is an identifier Stripe gives us for your customer record and, if you save one, for your card; the card's brand, last four digits and expiry are read back from Stripe when we display them and are not kept by us. You may find Stripe's privacy notice at https://stripe.com/privacy.
Social Media Login Data. We may provide you with the option to register using your existing Google account. If you choose to register in this way, we will collect certain profile information from Google.
Google API. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The following data is stored in Cloudflare R2 (our cloud storage provider):
We process your personal information for the following purposes:
If you are located in the EEA, UK, or Switzerland: The Services are intended for users in the United States and Canada (see Section 23 of our Terms of Use). If you nonetheless use them from the European Economic Area, the United Kingdom, or Switzerland, the legal bases we rely on are Consent, Performance of a Contract, and Legal Obligations.
If you are located in Canada: We may process your information if you have given us specific permission (express consent) or where your permission can be inferred (implied consent). You can withdraw your consent at any time.
We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf:
| Category | Provider |
|---|---|
| AI Service Providers | Anthropic |
| Third-Party Account Connection | Google account |
| File Storage (logos, photos, snapshots) | Cloudflare R2 |
| Invoice and Billing | Stripe |
| User Authentication | Google OAuth 2.0 |
| Email Delivery | Resend |
| Photo Search | Pexels |
| Typefaces (loaded by your browser) | Google Fonts |
| Infrastructure and Hosting | Railway |
| Edge Delivery and CDN | Cloudflare Workers |
| Error Monitoring | Sentry |
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, or acquisition of all or a portion of our business.
We use session cookies only for authentication and essential site functions. We do not use advertising cookies or analytics cookies, we do not run any third-party visitor-tracking or visitor-identification technology on any page, and we do not sell or share your information with advertisers.
One third party receives a request when you load a page, because your browser fetches files from it directly: Google Fonts serves some of our typefaces, and in doing so Google receives your IP address. It is not used to identify or profile you on our behalf. No payment provider's code runs on any page of ours — to buy credits or save a card, you are taken to a page hosted by Stripe and returned afterwards.
We offer AI-powered proposal generation through our third-party service provider, Anthropic. Your input and personal information will be shared with and processed by Anthropic to enable your use of our AI products.
Our AI products are designed for:
Uploaded document content is transmitted to Anthropic via encrypted HTTPS and processed in real-time. Anthropic does not use API inputs to train its models by default.
Anthropic's privacy policy: https://www.anthropic.com/privacy
Our Services offer you the ability to register and log in using your Google account. Where you choose to do this, we will receive certain profile information from Google, including your name and email address. We will use the information we receive only for the purposes described in this Privacy Notice.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law.
No purpose in this notice will require us to keep your personal information in our active systems for longer than three (3) months past the deletion of your account. You can delete your account yourself at any time from Settings. Your account remains usable for thirty (30) days so the request can be cancelled if it was made in error; after that your data is removed from our active systems. You can also download everything we hold about you from the same place.
Backups. Our database is backed up automatically on a daily, weekly and monthly rotation, and we may also take a backup by hand before maintenance. Data removed from active systems may persist in encrypted backups for up to one hundred and twenty (120) days, after which it is deleted in the normal course of that rotation. Backups are not used to restore deleted accounts.
When you delete your account, your credit history is deleted with it. Records of payments you actually made are held by Stripe, our payment processor, under their own retention policy — we do not keep a separate copy. Supplier invoices you uploaded to a proposal after it was generated are kept in private storage with that proposal, and are removed when you delete that invoice, the proposal, or your account.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect your personal information, including:
Despite our safeguards, no electronic transmission over the Internet can be guaranteed to be 100% secure. You should only access the Services within a secure environment.
We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18 years of age. If you become aware of any data we may have collected from children under age 18, please contact us at support@creoproposals.com.
In some regions (such as Canada), you have certain rights under applicable data protection laws, including the right to:
Account Information. You may review or change the information in your account by logging in to your account settings. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases.
Most web browsers include a Do-Not-Track ("DNT") feature or setting. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.
If you are a resident of California, Colorado, Connecticut, or other applicable states, you may have specific rights regarding your personal information.
| Category | Collected |
|---|---|
| A. Identifiers (name, email, address, phone) | YES |
| B. Personal information per California Customer Records statute | YES |
| C. Protected classification characteristics | NO |
| D. Commercial information (transaction history) | YES |
| E. Biometric information | NO |
| F. Internet or other similar network activity | YES |
| G. Geolocation data | NO |
| H. Audio, electronic, sensory information | NO |
| I. Professional or employment-related information | NO |
| J. Education information | NO |
| K. Inferences drawn from collected personal information | NO |
| L. Sensitive personal information | NO |
Category L is "NO" because we do not ask for sensitive personal information and our Terms prohibit uploading it. A supplier document you upload could nonetheless contain some; where it does, we hold it as part of that document and do not use or disclose it for any purpose beyond producing and storing your proposal.
We have not sold or shared any personal information to third parties for a business or commercial purpose.
Your rights include:
How to Exercise Your Rights: Contact us at support@creoproposals.com.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated version and date at the top. If we make material changes, we may notify you either by prominently posting a notice or by directly sending you a notification.
If you have questions or comments about this notice, you may email us at:
Creo Proposals
support@creoproposals.com
Based on the applicable laws of your country or state of residence, you may have the right to request access to, correct, or delete your personal information. To request to review, update, or delete your personal information, please email us at support@creoproposals.com. We will respond within forty-five (45) days, or sooner where the law that applies to your request requires it. You do not have to wait for us for the two most common requests: Settings lets you download everything we hold about you, and delete your account, yourself and at once.