Creator Harbor

Privacy Policy

Last updated: 19 October 2026

Who is responsible

Currentbits, based in the Netherlands, is the controller of the personal data described here. Contact us about privacy at hello@creatorharbor.app.

What we store

  • Account: your name, email address, whether you confirmed it, and a hash of your password (never the password itself).
  • Sessions and security: sign-in sessions with the IP address and browser user agent they came from, and per-IP request counts used for rate limits.
  • Videos you make (ads, Shorts and clips): what you submit (product names and page links, topics, your own scripts, product photos, and the videos you upload or link to for clipping), the options you chose, the scripts, transcripts and captions we make, status and any error, and the finished videos.
  • Actors you add: the name and voice you pick and the portrait: one we generate from your description, or the photo you upload. For a photo we also keep your confirmation that it shows you or someone who agreed, with its wording and time.
  • Brand: the logo and caption colour you save for your videos.
  • Credits and purchases: a ledger of credits granted, spent and refunded, and for each credit pack you buy, the pack, the price and Polar’s checkout reference. Your card details go to Polar, never to us.
  • Social accounts you connect: the TikTok, Instagram or YouTube account’s id, name and profile picture, and the access tokens that let us post for you (encrypted). For each post you ask for: the video, caption, settings, time and result.
  • Invites: your invite code, and who invited whom, so the invite bonus can reach you both.
  • Email preferences: whether “your videos are ready” emails are on, and when the last one was sent.
  • Feedback: messages you send with the Feedback button, and the page you sent them from.
  • Beta invites: while sign-ups are closed, the emails we invited to make an account.
  • Share links: a video you share can be watched by anyone with its link, until you stop sharing it.
  • API and app access: your API keys (stored hashed), the AI apps you connected over OAuth with their tokens, and your webhook URL and secret.

Product pages are fetched from the link you give us. We use their text and images to make your ad. They may contain personal data if you point us at a page that does.

We use cookies to keep you signed in, and one more if you open someone’s invite link: it remembers that invite for 30 days, so the bonus reaches you both if you sign up. We don’t use advertising or analytics cookies or trackers.

Why we use it

To run your account and make the ads you ask for (performance of our contract with you), to keep the service secure and stop abuse such as repeat free-ad sign-ups (legitimate interest), and to keep records we are required to keep (legal obligation). A photo you upload for an actor also relies on your confirmation that it shows you or someone who agreed. Account emails are part of running your account; “your videos are ready” emails can be turned off in Account.

Where it is stored

Our database and file storage run on servers we operate at Hetzner Online GmbH in the EU. Every generated video is tagged as AI-generated in its file metadata.

Who we send data to

  • Hetzner Online GmbH (Germany): hosts our servers, database and file storage.
  • OpenRouter (OpenRouter, Inc., United States): routes our AI requests to the model providers below. For each step it receives what that step needs: product names, page text and images, scripts and topics, actor portraits, frames from videos, and audio from the videos we make or you upload to clip.
    • Anthropic (Claude): writes scripts and narration, picks the best moments for clips, and translates.
    • Google (Gemini, Nano Banana, Lyria): makes the opening stills and scene pictures, checks actor portraits, finds the speaker in video frames, and makes background music.
    • Kuaishou (Kling), with Alibaba (Wan) as a fallback: turns stills into video, with speech for ads.
    • HeyGen: the Precise engine, which speaks the script in the actor’s voice.
    • ByteDance (Seedance): the Seedance engine, which makes the ad from the script and the product’s image (never an actor portrait).
    • OpenAI: reads Shorts’ narration aloud.
    • ElevenLabs (Scribe): transcribes speech for captions and clips.
  • Polar (Polar Software, Inc., United States): sells credit packs as merchant of record. It takes the payment and handles tax, and receives your email address, payment details and billing address. We receive the order, not your card.
  • TikTok, Instagram (Meta) and YouTube (Google): only when you connect an account and ask us to post. They receive the video, caption and settings you chose. We read only what posting needs: the account’s id, name and picture, and for TikTok the posting options it allows that account.
  • Resend (Plus Five Five, Inc., United States): sends account emails, such as email confirmation, password resets and “your videos are ready”. It receives your email address and the message.
  • Your own systems: if you set a webhook URL, render results are sent there.

Creator Harbor’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our staff can look at your account and watch your videos when you ask us for help, or to investigate abuse. We don’t sell your data or share it for advertising.

OpenRouter, Polar, Resend and several model providers are in the United States. Sending data there relies on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission’s standard contractual clauses. OpenRouter doesn’t use what we send it to train models. Each model provider handles a request under its own terms, which may let it keep the request for a limited time, for example to detect abuse.

How long we keep it

  • Account, ads, videos and the credit ledger: for as long as your account exists, unless you ask us to delete them sooner.
  • Sign-in sessions: until they expire or you sign out.
  • Social account tokens: until you disconnect the account or delete yours. Either way we also ask TikTok and YouTube to revoke them; Instagram has no such call, so remove the app in Instagram’s settings too.
  • Backups: nightly, kept for up to six months (daily ones for a week, weekly ones for a month, monthly ones for six months), then deleted. Something you delete stays in older backups until they expire; we only restore a backup to recover the service.
  • Payment records we must keep by law: seven years (Dutch tax law). Once you delete your account they no longer point to you.

Deleting your data and your other rights

You can delete your account and everything in it yourself: open Account in the app (click your email or credit balance) and confirm with your password. It happens at once. If you can’t sign in, email hello@creatorharbor.app from the address you signed up with and we’ll do it within one month.

You can also ask for a copy of your data, ask us to correct it, object to or restrict how we use it, or ask to move it elsewhere. We answer within one month. You can complain to your data protection authority; ours is the Dutch Autoriteit Persoonsgegevens.

You can revoke API keys and disconnect AI apps yourself on the Keys page, and disconnect social accounts in Account, at any time.

Children

Creator Harbor isn’t for children: you need to be at least 18 to use it. If you think a child has given us their data, write to hello@creatorharbor.app and we’ll delete it.

Changes

If we change this policy in a way that matters, we’ll tell you by email or in the app. See also our Terms of Service.