Legal · Privacy

Privacy Policy

01 Introduction

Qreators is an operations tool for creators, operators, and agencies working on third-party creator platforms. This Privacy Policy explains what personal information we collect, why we collect it, and what you can do about it.

Data controller
MXM SOLUTION LLC, a Wyoming LLC — WY Commercial Registered Agent LLC, 75 E 3rd St, Sheridan, WY 82801.
Contact
[email protected]

We do not engage in automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Article 22 GDPR.

02 Data we collect

Categories of personal data we process, as required under Article 13(1) GDPR:

Category
Description
Classification
Account
Account identifiers, authentication credentials, and role.
Identity
Workspace
Workspace configuration (name, members, permissions).
Config
Creator accounts
Connected creator account data and metrics.
Creator
Scripts & messages
User-generated operational content (templates, automations, message history).
Content
Fan data (third-party)
Personal data of third-party platform subscribers, accessed via the integrations you authorize.
Third-party
Usage & telemetry
Technical and usage data (device, browser, IP address, feature usage).
Log
Billing
Plan and invoice metadata only. All payment card data is handled exclusively by Bonzai as Merchant of Record; we do not receive or store any card details.
Finance
i
Source of fan data (Art. 14 GDPR) Fan data is collected by you, the agency, from third-party platforms via the API integrations you authorize. For this data category, MXM SOLUTION LLC acts as data processor on your behalf; you remain the controller. A Data Processing Addendum (DPA) is available on request and incorporated by reference into our Terms of Service §09.

03 How we use data

We use your data for the following purposes, and nothing else:

  • Operate the product — authenticate you, sync scripts and lists, power the Chat Center, Live Floor, and automations.
  • Reliability — error traces and anonymized telemetry to fix bugs and improve latency.
  • Support — minimum context needed to reproduce your issue when you open a ticket.
  • Billing & fraud prevention — Bonzai (Merchant of Record) processes payments; we see only plan and invoice metadata.
  • Legal compliance — tax records, lawful requests from competent authorities.

04 Legal basis

Under the GDPR, we process your data on the following bases:

  • Contract — account, workspace, scripts, billing, support.
  • Legitimate interest — telemetry, fraud prevention, product improvement.
  • Consent — optional analytics, product email updates (when introduced).
  • Legal obligation — tax records, law-enforcement requests.

05 Sharing & sub-processors

We share data only with sub-processors that are contractually bound to GDPR-equivalent protections. Categories of recipients are listed below, in accordance with Article 13(1)(e) GDPR. Specific vendor names and the Data Processing Addendum are available on request to [email protected].

Category
Purpose
Region
Cloud infrastructure provider
Application hosting, primary database, in-memory cache.
EU (Germany)
Edge security & CDN provider
DNS, content delivery, web application firewall, DDoS protection, edge authentication for the admin panel.
Global / US (SCCs)
Transactional email provider
Authentication emails, billing notifications, operational alerts.
US (SCCs)
Encrypted off-site backup provider
Encrypted backups of file storage and database dumps.
EU
Payment processor (Merchant of Record)
Subscription billing, tax handling, customer billing portal. Bonzai (operated by FROG-TECH OÜ) appears as merchant on your bank statement.
Estonia (EU)
Third-party API providers for connected creator platforms
Account linking, message synchronisation, fan data, transactions for the platforms you authorize.
[À VÉRIFIER]
Domain registrar & mailbox provider
Domain registration and the human mailboxes used by our team (legal@, support@, contact@, billing@, noreply@).
EU

We never sell, rent, or barter personal data. We do not run advertising inside Qreators and we do not embed third-party ad trackers.

06 Data retention

We keep your data only for as long as it serves a clear purpose.

Data
Retention
After
Active workspace data
For the life of the subscription.
live
Backups
Tiered rolling snapshots (up to ~2 years), encrypted AES-256, capped at 5 GB total.
purged
Deleted account
Immediate and irreversible deletion (no recovery window).
hard-del
Mail archives
7 days, then automatic purge.
purged
Telemetry / error logs
7 days rolling (Laravel Pulse).
purged
Fan data (after creator disconnect)
Retained until you disconnect the creator account or revoke processor instructions; then purged in accordance with your DPA.
processor
Billing records
Held by Bonzai as Merchant of Record, per their statutory retention. Qreators retains plan and invoice metadata only, up to 7 years where required by applicable tax law.
legal
Support tickets
24 months after last reply.
archive

07 International transfers

Primary application data and encrypted backups are hosted within the European Union. Certain sub-processor categories (edge security & CDN, transactional email, and payment processing infrastructure) may process data in the United States under Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 GDPR.

A Data Processing Addendum (DPA) is available on request to [email protected].

08 Your rights

Under the GDPR, you have the following rights:

  • Access — receive a copy of your data.
  • Rectification — correct inaccurate information.
  • Erasure — delete your account and associated data.
  • Restriction — limit processing while a dispute is pending.
  • Portability — receive your data in a machine-readable format.
  • Objection — opt out of legitimate-interest processing.
  • Withdraw consent — for anything based on consent.
  • Lodge a complaint — with your local Data Protection Authority (EDPB member list at edpb.europa.eu).
Request channel
[email protected]
Response time
Within 30 days; extendable by 60 days for complex requests (Art. 12(3) GDPR).
Data portability
On request to the channel above; we provide a reasonable export within the applicable statutory deadlines.

09 Security

We implement technical and organizational measures appropriate to the risks of the processing we carry out, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, two-factor authentication for user accounts, signature verification on inbound webhooks, and encrypted off-site backups. Further detail is available on request for procurement reviews.

We notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach as required by Article 33 GDPR, and we notify affected users without undue delay where Article 34 GDPR applies.

If you discover a vulnerability, write to [email protected] — we operate a responsible-disclosure program and aim to acknowledge within a reasonable delay.

10 Contact

Privacy requests
[email protected]
Security
[email protected]
Postal address
MXM SOLUTION LLC — WY Commercial Registered Agent LLC, 75 E 3rd St, Sheridan, WY 82801
Last updated July 20, 2026