01 Introduction
Qreators is an operations tool for creators, operators, and agencies working on third-party creator platforms. This Privacy Policy explains what personal information we collect, why we collect it, and what you can do about it.
- Data controller
- MXM SOLUTION LLC, a Wyoming LLC — WY Commercial Registered Agent LLC, 75 E 3rd St, Sheridan, WY 82801.
- Contact
- [email protected]
We do not engage in automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Article 22 GDPR.
02 Data we collect
Categories of personal data we process, as required under Article 13(1) GDPR:
03 How we use data
We use your data for the following purposes, and nothing else:
- Operate the product — authenticate you, sync scripts and lists, power the Chat Center, Live Floor, and automations.
- Reliability — error traces and anonymized telemetry to fix bugs and improve latency.
- Support — minimum context needed to reproduce your issue when you open a ticket.
- Billing & fraud prevention — our payment processor, acting as Merchant of Record, processes payments; we see plan and invoice metadata.
- Legal compliance — tax records, lawful requests from competent authorities.
- Referral program — record which workspace referred which, calculate and pay commissions, issue self-billing invoices, and detect abuse such as self-referral by comparing sign-up and sign-in IP addresses and connected Telegram accounts. A referrer sees, for each workspace they referred, a shortened name, the sign-up date, whether it is subscribed, and the commissions earned.
- Service emails — send the workspace owner emails about their account, such as reminders to finish setting up the workspace or a creator, and occasional news about the service, based on our legitimate interest in helping you set up your account and keeping you informed about the service. Each of these emails contains an unsubscribe link. Emails needed to run your account (sign-in, security, billing) are always sent.
We measure traffic to the site and the application with Cloudflare Web Analytics. When you create an account, we record the channel through which you found us. Both rely on our legitimate interest in understanding where our customers come from.
04 Legal basis
Under the GDPR, we process your data on the following bases:
- Contract — account, workspace, scripts, billing, support, referral commissions and payouts.
- Legitimate interest — telemetry, fraud prevention (including referral abuse), product improvement, audience measurement, sign-up source, service emails about your account.
- Legal obligation — tax records, referral tax forms and payout records, law-enforcement requests.
05 Sharing & sub-processors
We share data only with sub-processors that are contractually bound to GDPR-equivalent protections. Categories of recipients are listed below, in accordance with Article 13(1)(e) GDPR. Specific vendor names and the Data Processing Addendum are available on request to [email protected].
We never sell, rent, or barter personal data. We do not run advertising inside Qreators and we do not embed third-party ad trackers.
06 Data retention
We keep your data only for as long as it serves a clear purpose.
07 International transfers
Primary application data and encrypted backups are hosted within the European Union. Certain sub-processor categories (edge security & CDN, transactional email, and payment processing infrastructure) may process data in the United States under Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 GDPR.
A Data Processing Addendum (DPA) is available on request to [email protected].
08 Your rights
Under the GDPR, you have the following rights:
- Access — receive a copy of your data.
- Rectification — correct inaccurate information.
- Erasure — delete your account and associated data.
- Restriction — limit processing while a dispute is pending.
- Portability — receive your data in a machine-readable format.
- Objection — opt out of legitimate-interest processing. To stop service emails about your account, use the unsubscribe link in any of them.
- Withdraw consent — for anything based on consent.
- Lodge a complaint — with your local Data Protection Authority (EDPB member list at edpb.europa.eu).
- Request channel
- [email protected]
- Response time
- Within 30 days; extendable by 60 days for complex requests (Art. 12(3) GDPR).
- Data portability
- On request to the channel above; we provide a reasonable export within the applicable statutory deadlines.
09 Security
We implement technical and organizational measures appropriate to the risks of the processing we carry out, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, two-factor authentication for user accounts, signature verification on inbound webhooks, and encrypted off-site backups. Further detail is available on request for procurement reviews.
We notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach as required by Article 33 GDPR, and we notify affected users without undue delay where Article 34 GDPR applies.
If you discover a vulnerability, write to [email protected] — we operate a responsible-disclosure program and aim to acknowledge within a reasonable delay.
10 Contact
- Privacy requests
- [email protected]
- Security
- [email protected]
- Postal address
- MXM SOLUTION LLC — WY Commercial Registered Agent LLC, 75 E 3rd St, Sheridan, WY 82801