Creativity Privacy Policy

1. Who we are

Creativity is the brand name under which the trader named below runs this streaming platform — the one that lets you browse, watch and react to films, series, games, music and backstage material we produce, and rent or buy titles from independent partner studios. This policy explains what personal data we collect, why, who we share it with, how long we keep it and what your rights are. It applies to creativityfilms.gr, our television and casting apps and the emails we send.

The controller of your personal data is the trader named below. You can reach us about anything in this policy at the contact address shown; we answer requests within one month.

Trader

Thomas Doykinitsas

Service address

Flat 3 Regal Court, Dawes Road, SW6 7DT, London

Contact

thomas@creativityfilms.gr

2. Information we collect

We collect information in two ways:

Information you provide to us:

When you log in via Google, we receive your Google ID, name, email address, and profile picture. If you grant YouTube access, we also receive your YouTube Channel ID and YouTube Membership status. This information is used solely to create and manage your account and to verify your eligibility for exclusive member content.

Your profile (all optional):

After your first sign-in we invite you to review a short profile: your display name, preferred language, and — entirely optionally — your age group, gender, a link to your YouTube channel, and a profile picture of your own instead of the one from Google. The optional items are collected on the basis of your consent, are never pre-filled with a guess, are never shown to other viewers, and are never sold or shared. You may skip the invitation entirely; we will not ask again. You can change or erase any of it at any time from the menu under your name, and clearing a field deletes the stored value. If you upload a picture, the 1:1 crop happens in your browser and only the cropped square is sent to us — the original photo, and any location data your camera saved inside it, never leaves your device. Removing an uploaded picture deletes it from our storage and restores your Google one. Your YouTube channel link is not read from Google: we only pre-fill a suggestion from the channel we already identify for membership checks, and nothing is stored unless you save it.

Information automatically collected:

• Page views and duration of visit.
• Referral sources (the URL that linked you to us).
• Video engagement data (watch time, pause timestamps, completion status).
• Device type, browser and the country or region your connection appears to come from. We derive the country from your IP address at the edge; we do not store the IP address itself with your analytics or account records.

Anonymous Demographic Data:

We may record age and gender data associated with page views for aggregate analysis, but this is stored separately from your personal user profile to maintain anonymity.

3. Google user data

This section specifically addresses how we handle data obtained through Google Sign-In and Google API Services.

How We Access Google User Data:

We use Google OAuth 2.0 to authenticate you. During sign-in, we request access to your basic profile information (name, email, profile picture) and, with your consent, read-only access to your YouTube account to determine your channel ID and membership status.

How We Use Google User Data:

Your Google profile data is used exclusively to create and maintain your user account on Creativity. Your YouTube channel ID and membership status are used only to verify whether you are an active Creativity+ YouTube channel member, which grants access to exclusive content.

How We Store Google User Data:

Your Google profile information and YouTube data are stored securely in our database. We retain this data only for as long as your account is active. When you delete your account, all associated Google user data is permanently removed.

How We Share Google User Data:

We do not sell, trade, rent, or share your Google user data with any third parties. Your data is used solely within Creativity for the purposes described in this policy.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Why we use your information, and on what legal basis

We use your data for the following purposes, each with the legal basis the GDPR and the UK GDPR require:

• Providing the service — creating and managing your account, signing you in, checking your Creativity+ membership, remembering where you stopped watching, and granting access to titles you have rented or bought. Basis: performance of our contract with you.
• Personalisation you control — the optional profile fields and the optional “For you” row (see the sections on recommendations below). Basis: your consent for the profile fields; our legitimate interest, with an opt-out, for “For you”.
• Analytics — understanding which pages and titles are watched, from which countries, and for how long, so that we can programme the site and report aggregated figures to partners. Basis: your consent, given through the cookie settings; without it we record nothing about your visit beyond what is technically necessary.
• Email — telling you about new releases and, if you opted in, campaigns. Basis: your consent, which you can withdraw from any email or from your account settings.
• Purchases — recording the order, the entitlement it grants, your confirmation about immediate access, the country you bought from, and any refund; making your invoice available. Basis: performance of the contract, and our and the seller’s legal obligations for tax and consumer law.
• Security and abuse prevention — rate limits, sign-in protection, Google’s account-security signals, and short-lived records of device pairing codes. Basis: our legitimate interest in keeping the platform and your account safe.
• Legal compliance — handling content reports, responding to lawful requests, and keeping the records tax law requires. Basis: our legal obligations, and our legitimate interest in establishing or defending a claim.

We never use your data for advertising, we never sell it, and we do not make automated decisions about you that have a legal or similarly significant effect.

5. Who we share your data with

We share personal data only with the service providers we need to run the platform, each bound by a data-processing contract, and with the parties named below:

• Hosting and delivery — our database (MongoDB Atlas, hosted in the European Union), file and image storage (Cloudflare R2), video storage, transcoding and delivery (Amazon Web Services), and our application host. They process data on our instructions only.
• Google — for sign-in and for the YouTube membership check, under the Google API Services User Data Policy.
• Stripe — when you rent or buy a partner title, Stripe processes the payment on the seller’s account. Stripe receives your name, email, billing address and card details; we never see your card. Stripe is an independent controller for payment processing.
• Resend — our email delivery provider, which receives your email address and the content of the messages we send you.
• Partner studios — aggregated statistics only, plus what Stripe provides on their own account for invoicing (see “What partner studios see”).
• Authorities and advisers — where the law requires it, to respond to a valid legal request, or to establish or defend a legal claim.

We do not sell, rent or trade personal data, and we do not share it with advertising networks or data brokers.

6. International transfers

Creativity is established in the United Kingdom, and our database is hosted in the European Union. The UK and the EU each recognise the other as providing adequate protection, so data flowing between them needs no further safeguard.

Some providers (Google, Stripe, Amazon Web Services, Cloudflare, Resend) may process data in the United States or elsewhere. Where they do, the transfer is covered by the EU–US and UK–US Data Privacy Framework where the provider is certified, or by the European Commission’s standard contractual clauses and the UK addendum. You can ask us for details of the safeguard that applies to a particular provider.

7. How long we keep your data

We keep personal data only for as long as the purpose it was collected for requires:

• Account, profile, watch progress and reactions — for as long as your account exists. Deleting your account (“Revoke access”) removes them immediately.
• Page and video analytics — deleted automatically two years after the visit.
• Orders, entitlements, invoices and refunds — six years after the transaction, because tax law requires the seller and the platform to keep them, even if you delete your account in the meantime; the order is then kept without the link to your deleted profile beyond your name and email on the invoice.
• Content reports — about three years after the matter is resolved.
• Email preferences — until you withdraw consent or delete your account; a record that you unsubscribed is kept so we do not email you again.
• Security and payment-event logs — 30 days; device pairing codes — minutes.

8. Cookies and similar technologies

Strictly necessary cookies keep you signed in, remember your language and your cookie choices, and protect the site; they cannot be switched off. Everything else — functional cookies, analytics and email preferences — is off until you accept it in the cookie banner, and you can change your choice at any time from “Cookie settings” in the footer. We do not use advertising or cross-site tracking cookies. Embedded YouTube players set Google’s own cookies when you play a YouTube video; Google’s privacy policy applies to those.

9. YouTube API Services

Our application uses YouTube API Services. By using our website, you agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy. We access your YouTube membership status solely to verify eligibility for content and do not share this data with external third parties.

10. Recommendations (“More like this”)

Our editors score every film, series and game against a list of descriptive tags — how funny it is, how scary, how fast-paced. The "More like this" row on a page is worked out by comparing those scores between titles.

This part does not use anything about you. It is calculated from the two titles alone, so every visitor sees exactly the same "More like this" suggestions on the same page, whether or not you are signed in.

The calculation happens on our own servers, from our own database. No recommendation service, advertising network or other third party is involved, and nothing about your visit is shared for this purpose.

11. “For you” and your reactions

If you are signed in, we may also show you a "For you" row on your home page, built from your own likes, dislikes and reaction emotions on titles across the site. This is different from "More like this" above: it looks at your account's reactions, not just the two titles on the page you happen to be viewing.

The only purpose is ordering that extra row on your own home page. It is never used for advertising, is never shown to anyone else, and is never sold or shared with a third party.

Our lawful basis for this is legitimate interest: a like or dislike is a deliberate action you took on your own account, and using it to order your own home page sits within what you would reasonably expect. What makes that balance hold is that it is easy to turn off — see below.

This is profiling under data protection law (it draws inferences about your taste from your activity), and we say so plainly here. It is not automated decision-making with a legal or similarly significant effect on you: at most, it changes the order of one optional row on a page you are already looking at.

You can turn this off at any time from your account settings (the "Personalised recommendations" toggle, on by default). When it is off, we do not compute anything from your reactions and the "For you" row does not appear.

We do not keep a separate profile of you anywhere. Your taste is worked out fresh each time it is needed, directly from your reaction history, and the result is kept in a short server cache for at most one hour before it expires. There is no long-lived "taste profile" database.

Deleting your account ("Revoke Access" in your profile menu) removes your reactions along with everything else, and any cached result for you expires on its own shortly after.

As with "More like this", this is calculated on our own servers from our own database. No third-party recommendation service is involved, and your reactions are never shared outside Creativity for this purpose.

12. Content reports

If you report content to us using the report form, we process what you send: the type of report, the link and the description you give, and — where you provide them — your name and email address. A copyright notice needs a name and contact details; other reports can be made anonymously.

We use the information in this report to review and act on it. The substance of your notice (what you reported and why) may be shared with the content provider so they can respond; your identity is only shared where necessary to act on the report, and we will say so beforehand.

Our lawful basis is our legal obligation to run a notice-and-action mechanism under Article 16 of the EU Digital Services Act, together with our legitimate interest in keeping unlawful material off the platform and in being able to defend a claim about how we handled a notice.

We keep a report and its outcome for about three years after the matter is resolved — roughly how long a dispute about our handling of it could realistically run — and then delete it.

13. What partner studios see

Some titles here are distributed by independent partner studios. Partners receive aggregated statistics only: how many views or sales a title had, and over what period. They never receive your name, your email address, your viewing history, or anything else that identifies you. This is written into our agreement with them, not only into this policy.

When you rent or buy a partner title, the payment is taken by the partner through Stripe, and Stripe processes your card details — we never see them. The partner receives, through their own Stripe account, what they need in order to issue your invoice and meet their own tax obligations as the seller — your name, email address and billing country — and they are a separate data controller for that. They may use it only to fulfil and account for the sale, never for marketing. Everything else about your account stays with us.

14. Partner applications and partner accounts

If you apply to become a Creativity Partner, we process what you enter on the application form — who you are (individual, group or company), your name, country, contact email, whether you want paid distribution, your description and the links you give us — together with the Google account you sign in with and the messages exchanged about the application. We also keep a salted hash of your IP address for a short time, purely to limit abuse of the form; it is never shown to anyone.

Our lawful basis is the steps you ask us to take before entering into a partner agreement (Article 6(1)(b) GDPR / UK GDPR); for the abuse-control hash, our legitimate interest in keeping a public form usable.

Applications that are not accepted, or that you withdraw, are deleted automatically six months after the decision; approved applications twelve months after approval, by which point the partner account holds what is needed. You can delete a closed application yourself from your application page, and withdraw an open one at any time.

Once you are a partner, we hold the details needed to run your channel and, if you sell titles, to identify you as the seller — legal name, address, tax registration number and the status of your Stripe account — for as long as the partner agreement runs and for six years afterwards where invoices exist, as tax law requires. People you invite to help manage your channel see your partner's name and channel details, not your personal details; the owner of a partner can see the name and email of everyone who has joined it.

15. Our representative in the EU

Creativity is established in the United Kingdom and offers its service to people in the European Union. Where Article 27 of the GDPR requires a representative in the EU, their name and contact details are published here; until they are, you may contact us directly at the address above about anything in this policy, and you keep every right described in it.

16. Security

We use appropriate technical and organisational measures to protect your personal data: encrypted connections everywhere, encrypted session cookies, access-controlled databases, least-privilege access for staff, and short-lived signed links for paid video. No transmission over the internet is completely secure, so we cannot promise absolute security, but if a breach ever affects your data we will tell you and the regulator as the law requires.

17. Your rights

You have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to take it with you in a portable format, and to withdraw any consent you have given at any time. To delete your account and all associated data (including Google user data), use “Revoke access” in your profile menu: it permanently deletes your account, watch history, preferences, reactions and stored Google data. Your profile fields can be changed or cleared from the menu under your name. For anything else, contact us at privacy@creativityfilms.gr

When you make a request we may ask you to confirm your identity. Requests are free and answered within one month; if a request is complex we may extend that by up to two months and will tell you if so. Order records that tax law requires us to keep are the one thing we cannot erase early, and we explain that when it applies.

You may withdraw consent for analytics from the cookie settings, for emails from any message we send, and for personalised recommendations from your account settings. Withdrawing consent does not affect processing that happened before you withdrew it.

18. Complaints

If you are unhappy with how we handle your data, please tell us first so that we can put it right. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Greece, the Hellenic Data Protection Authority (dpa.gr); or the authority of the EU member state where you live or work.

19. Children

You must be at least 16 to create an account. The free catalogue can be watched without an account. We do not knowingly collect personal data from children under 16; if you believe a child has created an account, contact us and we will delete it.

20. Changes to this policy

We will update this policy when our processing changes — for example when a new feature or provider is added. The date at the top is the date of the current version; material changes are announced on the platform.