Privacy Policy — CreateArt

Effective date: 18/07/2026
Last updated: 18/07/2026

1. Who we are

CreateArt is a mobile application operated by CREATE ART, a partnership, registered at 601, City Center, Opp. Shukan mall, Science City Road, Sola, Ahmedabad, Gujarat, INDIA. Under India's Digital Personal Data Protection Act, we act as a Data Fiduciary for the personal data described below.

This Privacy Policy explains what data CreateArt collects, why, how it's used, who it's shared with, and the rights you have over it. It applies to the CreateArt mobile app (Android and iOS) and any associated web pages we operate, including this policy's hosted web version.

2. Data we collect

2.1 Account and profile data

When you create an account (via email/password through Firebase Authentication), we collect:

• Name, email address, phone number
• Profile photo (if you choose to add one)
• User type (e.g. individual/business), business name and address (if provided)
• Interests/preferences you select during onboarding
• Social media handle (if provided)

2.2 Subscription and purchase data

• Subscription tier, status, and expiry
• Order and payment status for paid services you request
• Payments are processed by Razorpay, our third-party payment processor. Razorpay collects and handles your payment details (card, UPI, netbanking, etc.) directly; we receive and store confirmation of payment/subscription status (amounts, order/subscription IDs, payment status) but do not directly collect or store your full payment card details, which never pass through our servers. Razorpay's own privacy policy governs its handling of your payment data.

2.3 Content you create

• Designs, layouts, and images you create or edit using the in-app editor
• Custom frames or templates you save
• Photos you upload for use in designs

2.4 Usage and device data

• App interaction events (e.g. screens viewed, features used, downloads/shares) via Firebase Analytics
• Crash and performance diagnostics via Firebase Crashlytics
• Device type, operating system version, app version
• Push notification token (Firebase Cloud Messaging), if notifications are enabled

2.5 What we do *not* collect

We do not knowingly collect precise real-time location, contacts, or payment card numbers. We do not use advertising SDKs, and we do not link your in-app activity with your activity on other companies' apps or websites for advertising purposes.

3. How we use your data

We use your data to:

• Create and maintain your account
• Provide and personalize the content catalog (posters, templates, frames) shown to you
• Process and reflect your subscription/premium status
• Let you save, edit, and export your designs
• Send you service-related notifications (e.g. subscription status, new content) if you've enabled them
• Diagnose crashes and improve app stability and performance
• Understand aggregate feature usage to improve the app
• Respond to support requests and enforce our Terms & Conditions
• Comply with legal obligations

4. Legal basis for processing (DPDP Act)

We process your personal data on the basis of your consent, given at account creation and re-confirmed if this policy materially changes. Where processing is necessary to provide a service you've directly requested (e.g. storing a design you created), we may rely on the Act's "legitimate use" ground for that specific, limited purpose. You may withdraw consent at any time (see Section 8); withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may result in us no longer being able to provide parts of the service that depend on that data.

5. Who we share data with

We share data only with service providers who process it on our behalf, under contract, for the purposes described above:

Provider	Purpose	Data involved
Google Firebase / Google Cloud	Authentication, database (Firestore), file storage, analytics, crash reporting, push notifications	Account data, usage data, content you create
Apple / Google (App Store, Play Store)	Subscription billing and purchase processing	Purchase/subscription status (not full payment details)
[Hostinger / hosting provider]	Hosting of our backend servers and content catalog	Content catalog data, account data needed to serve the app

We do not sell your personal data. We do not share it with data brokers or advertisers.

5.1 Cross-border data storage

Some of the above providers (notably Google Firebase/Cloud) may store or process data on servers located outside India. We take reasonable steps to ensure such providers offer safeguards consistent with the DPDP Act. As of this policy's drafting, the Indian government has not published a list of restricted countries under Section 16 of the DPDP Act; we will update this policy if that changes and it affects our processing.

6. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where we're required to retain certain records for longer to comply with law (e.g. financial/tax records) or to resolve disputes.

7. Security

We use industry-standard safeguards, including encrypted connections (HTTPS/TLS) between the app and our servers, hashed/signed authentication tokens, and access controls restricting who can view account data. No system is 100% secure; if a data breach occurs that affects you, we will notify the Data Protection Board of India and affected users as required by law.

8. Your rights

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it's processed
• Correct or update inaccurate or incomplete data
• Withdraw consent at any time (note: this may limit what the app can do for you)
• Request erasure of your personal data — the primary way to do this is deleting your account directly in the app (Settings → Account → Delete Account); see also our Account Deletion page for a web-based fallback
• Nominate a representative to exercise these rights on your behalf in specified circumstances
• File a complaint with us first, and if unresolved, with the Data Protection Board of India

To exercise these rights, contact our Grievance Officer:

Grievance Officer: Krupal Patel
Email: support@createart.in

We will respond within 10 days.

9. Children's privacy

CreateArt is intended for users 18 years of age and older. We do not knowingly collect personal data from children under 18. If you believe a child has provided us personal data, contact us using the details in Section 8 and we will delete it.

10. Changes to this policy

We may update this policy from time to time. If changes are material, we'll ask you to re-confirm your consent the next time you open the app before you can continue using features that depend on the changed processing. The "Last updated" date at the top of this document reflects the most recent revision.

11. Governing law

This policy is governed by the laws of India. Any disputes arising from it are subject to the exclusive jurisdiction of the courts of Ahmedabad, Gujarat.

12. Contact us

CREATE ART
601, City Center, Opp. Shukan mall, Science City Road, Sola, Ahmedabad, Gujarat, INDIA
support@createart.in

Terms & Conditions · Delete Account · support@createart.in