Privacy Policy
This policy explains what CreArt collects, why, and what you can do about it. It covers both the website at creartai.com and the CreArt mobile app for iOS and Android. Where the two differ — and they do, particularly around advertising — it says so.
1. Who is responsible for your data
YAWAI LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States — a limited liability company formed in Wyoming, United States, filing ID 2025-001813265 — is the controller of the personal data described here. You can reach us at yawaiapps@gmail.com.
Earlier versions of the app's terms named WAITOS AI SL as the provider. YAWAI LLC is the entity responsible for the service today.
2. What we collect
Information you give us
When you create an account: your email address, and your name and profile picture if you sign in with Google or Apple. Sign in with Apple lets you hide your address, and we work fine with the relay address it gives us.
When you use the tools: the prompts you write and any image you upload or photograph. In the app this needs access to your camera or photo library, which you grant per device and can revoke in system settings.
When you contact us: whatever you put in your message.
Information created by using the service
The images the tools generate for you, your generation history, your credit balance and plan, and — if you post to the community — the images you chose to publish and their public engagement.
Information collected automatically
Your IP address, which also tells us your approximate country; device and browser type and version; and records of what you did in the service and when. In the app we also collect crash diagnostics through Firebase Crashlytics, and a push notification token if you allow notifications.
The app additionally uses your device's advertising identifier (IDFA on iOS, Advertising ID on Android). Section 5 explains what for and how to stop it.
Payment information
We never see your card. Purchases in the app are processed by Apple or Google and recorded through RevenueCat; purchases on the website are processed by Paddle, who act as merchant of record. What reaches us is the outcome: which plan you are on, whether it renewed, and whether it was refunded.
3. Why we use it, and on what legal basis
To provide what you asked for — running generations, keeping your history, applying your plan's limits, and letting you sign in. This is necessary to perform our contract with you.
To keep the service working and safe — preventing automated abuse of the generators, investigating misuse, fixing crashes, and protecting against fraud. This is our legitimate interest in a service that stays available and is not exploited.
To comply with the law, including tax and accounting obligations attached to purchases.
For advertising and attribution in the mobile app, and for any future analytics on the website, we rely on your consent, which you can withdraw at any time.
4. What the website does
The website sets no advertising or cross-site tracking cookies. Traffic is measured with Vercel Analytics and Vercel Speed Insights, neither of which uses cookies or builds a profile of you.
Google reCAPTCHA Enterprise runs through Firebase App Check to stop the generators being driven by scripts. It sets its own cookies and is governed by Google's privacy policy. Loading a page also requests fonts from Google, which discloses your IP address to them.
Our Cookie Policy lists everything stored in your browser, by name.
5. Advertising in the mobile app
The free tier of the app is supported by advertising through Google AdMob, and we work with AppsFlyer and Meta to understand which campaigns bring people to the app.
On iOS, personalised advertising requires your permission through Apple's App Tracking Transparency prompt. If you decline, you still see ads, but they are not personalised using your device identifier. You can change this at any time under Settings › Privacy & Security › Tracking.
On Android you can reset or delete your Advertising ID under Settings › Google › Ads.
Buying a paid plan removes the ads.
The website carries no advertising at all.
6. Who else processes your data
We use other companies to run the service. They act on our instructions and may only use the data to provide their service to us:
Google (Firebase) — accounts, database, file storage, push notifications, crash reporting, abuse prevention, and analytics in the app. Vercel — website hosting and cookieless traffic measurement. Cloudflare — storage of generated images in R2. fal.ai and our own GPU servers — running the image and video models. Google (Gemini) — improving the prompts you write, and generating advertising copy in the ad tools. RevenueCat, Apple, Google Play and Paddle — purchases and subscriptions. AppsFlyer and Meta — attribution and campaign measurement, in the app only.
Your prompts and uploaded images are sent to the model provider that runs the generation, because there is no other way to produce the result. We do not sell your personal data, and we do not use your images to train AI models.
7. Where your data goes
We are established outside the European Economic Area, and several of the providers above process data in the United States and other countries. Where data leaves the EEA or the United Kingdom, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to each provider. You can ask us for details of the safeguards that apply.
8. How long we keep it
Account data, generation history and credit balance are kept while your account exists. When you delete your account we delete them, other than what we must keep for tax and accounting purposes.
If you use the generators without an account, the images are deleted 24 hours after they are created, and the rest of the guest record is deleted after 7 days without activity. These jobs run daily.
Generation history is also capped by plan: older items are removed once the stored history exceeds your plan's allowance.
Images you publish to the community stay visible until you remove them or delete your account.
9. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or send it to another provider. You can object to processing we base on legitimate interest, ask us to restrict processing, and withdraw any consent you gave — withdrawing consent does not undo what was done before.
Write to yawaiapps@gmail.com and we will respond within one month. We may need to confirm who you are before acting, so that nobody else can make requests about your account.
If you are in the EEA or the UK you can also complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es); in the UK, the Information Commissioner's Office (ico.org.uk).
If you are a California resident, you may request the categories and specific pieces of personal information we collected, ask for deletion, and not be discriminated against for asking. We do not sell or share personal information as those terms are defined by the CCPA.
10. Children
CreArt is not directed at children. You must be at least 16 to create an account, or 13 where local law permits with parental consent, and at least 18 to make a purchase. If you believe a child has given us personal data, write to yawaiapps@gmail.com and we will delete it.
11. Security
Traffic is encrypted in transit. Generated images are served through links that expire rather than public URLs. Access to production systems is restricted, and the API routes that can delete data are behind separate credentials. No service can promise perfect security, and we do not.
12. Changes
We update this page when what we do changes, and revise the date below. If a change materially affects your rights we will tell you in the app or by email rather than relying on you to notice.
Last updated: 29 July 2026.