Privacy Policy
Last updated: July 21, 2026
This Privacy Policy explains how the CREOplatform (platform.creo.ua, ai.creo.ua and school subdomains on *.creo.ua — the "Platform", "we") collects, uses, stores and protects personal data. We process data in accordance with the Law of Ukraine "On Personal Data Protection" and, for users in the EEA, the General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is CREO, Ukraine. For any privacy matters contact support@creo.ua. If you study with a client school running on the Platform, that school is the controller of your learning data and CREO acts as its processor.
2. Data we collect
- Account data: name, email, phone (optional), hashed password, avatar, profile settings.
- Learning activity: course enrollments, lesson progress, homework submissions and conversations with curators, points (creoins), certificates, achievements.
- Payment data: we do not store card details — payments are processed by payment providers (WayForPay, monobank). We only receive the payment status, amount and order reference.
- Communications: messages in Platform chats, support requests; if you connect the Telegram notification bot — your Telegram chat ID and username.
- Technical data: IP address, browser type, cookies and similar technologies required for authentication and operation of the service.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing access to courses, saving progress, issuing certificates | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Service notifications (homework review, curator replies) — in-app, email, Telegram | Contract; consent for the Telegram channel (Art. 6(1)(a)) |
| Marketing emails | Consent — withdrawable at any time (Art. 6(1)(a)) |
| Security, abuse prevention, service improvement | Legitimate interest (Art. 6(1)(f)) |
4. Who we share data with
We do not sell personal data. Data is shared only with service providers under data processing agreements:
- Supabase — database and authentication (EU hosting);
- Vercel — application hosting;
- Resend — email delivery;
- WayForPay, monobank — payment processing;
- Telegram — notification delivery if you connect the bot;
- Google — Google sign-in (if you choose it);
- Meta Platforms — if your school connects Facebook/Instagram integrations.
Transfers outside Ukraine/EEA are protected by appropriate safeguards (EU Standard Contractual Clauses or equivalent mechanisms).
5. Retention
Account data is kept while your account is active. After account deletion we erase or irreversibly anonymise personal data within 30 days, except data we must keep by law (e.g. financial records — up to 3 years). Backups are purged within a rotation cycle of up to 90 days.
6. Your rights
- access your data and obtain a copy;
- rectify inaccurate data (in Settings or via support);
- delete your account and data (see Data Deletion);
- restrict or object to processing;
- data portability (receive data in a machine-readable format);
- withdraw consent at any time (e.g. unsubscribe from emails);
- lodge a complaint with a supervisory authority (in Ukraine — the Parliament Commissioner for Human Rights; in the EU — your local DPA).
To exercise your rights, email support@creo.ua — we respond within 30 days.
7. Cookies
We use strictly necessary cookies for authentication and service operation (Supabase Auth session, theme preference). No third-party analytics or advertising cookies are set without your consent. You can manage cookies in your browser settings.
8. Children
The Platform is not intended for unsupervised use by children under 16. If you are under 16, use the Platform with the consent of a parent or legal guardian.
9. Security
We apply technical and organisational measures: TLS encryption, password hashing, database-level tenant isolation (Row Level Security) and restricted staff access. No service can guarantee absolute security; in the event of a breach we will notify you and the regulator as required by law.
10. Changes
We may update this Policy; the new version is published on this page with an updated date. We will notify you of material changes in-app or by email.
11. Contact
CREO, Ukraine · support@creo.ua
See also: Terms of Service · Data Deletion